The Securities and Exchange Commission (SEC) has officially adopted new rules on cybersecurity disclosures, following a 3-2 vote on July 26th, 2023. The rules, which will go into effect on December 1, 2023, aim to provide investors with more information about the cybersecurity risks facing public companies and encourage companies to improve their cybersecurity posture.
Under the new rules, public companies will be required to disclose any material cybersecurity incidents within four business days of determining their significance. A material cybersecurity incident is defined as one that is likely to have a significant impact on the company’s business, financial condition, or operations. This disclosure deadline is intended to ensure that investors have timely information to make informed investment decisions and protect them from potential financial risks.
In addition to disclosing cybersecurity incidents, public companies will also need to provide information about the nature and impact of the incident, the steps taken to address it, and the company’s policies and procedures for managing cybersecurity risks. The rules also require companies to disclose information about the board of directors’ oversight of cybersecurity risk, including their role in assessing and managing risk and their expertise in cybersecurity.
The new cybersecurity disclosure rules will have a significant impact on public companies, who will need to carefully consider the information they disclose about cybersecurity risks and incidents. Failure to comply with these rules could result in SEC enforcement actions, investor lawsuits, and damage to the company’s reputation.
There are mixed opinions among companies regarding the new rules. Some view them as a positive step towards increased transparency, while others believe they are too complex or could discourage companies from reporting cybersecurity incidents. The Securities Industry and Financial Markets Association (SIFMA), NYSE Group, and Nasdaq have expressed concerns about the disclosure of sensitive information and potential harm to companies.
To prepare for the new rules, board of directors should focus on board education to ensure everyone has a good understanding of cybersecurity issues. They may also consider assigning a specific committee to oversee cybersecurity and enhancing their qualifications in this area. Directors should ask management relevant questions to gain a comprehensive view of the company’s cybersecurity posture.
While compliance with the new rules is important, boards must not lose sight of their primary focus, which is to be good stewards for the health and growth of the companies they serve. Cyber-related risks continue to be a top concern for businesses, and boards will need to absorb and implement regulatory oversight in the coming months.