Recent enforcement actions, proposed rule-making and increased staffing reflect the SEC Enforcement Division's expanding focus on cybersecurity incidents and corresponding disclosures. While the Enforcement Division has historically focused its resources in this area on highlighting failures to disclose internal control deficiencies, the Division is beginning to cast a wider net in its investigations and enforcement actions.

In this article we discuss likely areas for continued expansion of cyber-related enforcement activity and practical implications for public companies. The SEC has also proposed new cybersecurity rules for investment advisers registered under the Investment Advisers Act of 1940 and investment companies registered under the Investment Company Act of 1940. See 17 CFR Parts 230, 232, 239, 270, 274, 275, and 279.

Similar to the proposed rules for public companies that we describe in more detail below, the proposed rules for financial advisers and funds would require subject entities to (1) adopt and implement written cybersecurity policies and procedures, (2) confidentially report significant cybersecurity incidents to the SEC, and (3) disclose certain cybersecurity incidents to investors.