The Securities and Exchange Commission (SEC) has recently adopted new cybersecurity disclosure rules, which are set to go into effect on December 1, 2023. The rules aim to provide investors with more information about the cybersecurity risks facing public companies and encourage companies to enhance their cybersecurity measures.
Under the new rules, public companies will be required to disclose any material cybersecurity incidents within four business days of determining their significance. A material incident is defined as one that is likely to have a significant impact on the company’s business, financial condition, or operations. This disclosure deadline is designed to ensure that investors have timely information to make informed investment decisions and protect them from potential financial risks.
In addition to disclosing incidents, public companies will also need to provide information about the nature and impact of the incident, the steps taken to address it, and the company’s policies and procedures for managing cybersecurity risks. Furthermore, the rules require companies to disclose information about the board of directors’ oversight of cybersecurity risk, including their role in assessing and managing such risks and their expertise in cybersecurity.
While the new rules have been welcomed by some as a positive step towards transparency, others have expressed concerns about their complexity and potential negative consequences. The Securities Industry and Financial Markets Association (SIFMA) has criticized the disclosure of sensitive information at premature stages, while the NYSE Group and Nasdaq have raised concerns about the potential harm caused by disclosing information to unauthorized intruders. The SEC has addressed some of these concerns by clarifying certain aspects of the rules, but some concerns still remain.
To comply with the new rules, board of directors should start preparing now. This includes board education to ensure everyone has a sufficient understanding of cybersecurity, potentially bringing in outside experts for orientation and briefing. Boards may also consider assigning a specific committee for cybersecurity oversight and enhancing their qualifications in this area. Directors should focus on providing oversight rather than taking on operational roles and should ask management relevant questions to gain a comprehensive view of the company’s cybersecurity posture.
While compliance with the new rules may seem daunting, it is important for boards to remember their primary responsibility of being good stewards for the companies they serve. Cyber-related risks continue to be a major concern for businesses, and boards must strike a balance between regulatory compliance and the health and growth of their companies.