The Securities and Exchange Commission recently updated guidance to public companies regarding cybersecurity disclosures and disclosure policies. The Commission also suggested that it may base future insider trading cases on trading ahead of the announcement of material cybersecurity events. To reduce the risk of enforcement actions, public companies should revisit existing cybersecurity disclosures and policies. Consistent with other trends in regulation, the SEC guidance likely will accelerate public reporting of cybersecurity breaches.
Recent SEC Guidance
The guidance issued recently focuses on public company disclosures and related policies and procedures.
- The Commission wants public companies to move beyond boilerplate cybersecurity disclosures to a more individualized, thoughtful review of risks. Those disclosure enhancements are meant to foster more rigorous self-examination of risks and mitigation plans. Boards should be involved in this review.
- The SEC urges near-immediate reporting of cybersecurity events. The guidelines encourage public companies to disclose events on Form 8-K, rather than waiting for quarterly and annual reports.
- The enhancements to disclosure policies and certifications suggest an invitation to audit firms to increase testing in this area.
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
LexisNexis® and Bloomberg Law are third party online distributors of the broad collection of current and archived versions of ALM's legal news publications. LexisNexis® and Bloomberg Law customers are able to access and use ALM's content, including content from the National Law Journal, The American Lawyer, Legaltech News, The New York Law Journal, and Corporate Counsel, as well as other sources of legal information.
For questions call 1-877-256-2472 or contact us at [email protected]