SAN FRANCISCO — The Securities and Exchange Commission in new guidance Wednesday urged public companies to guard against insider trading before cybersecurity breaches are disclosed and to ensure there are clear internal procedures in place to determine when a hack might be “material” to investors.

The 24-page guidance, formally adopted Tuesday, is the first to be issued on cybersecurity by the SEC commissioners. The SEC staff issued a shorter guidance document in 2011 focusing primarily on how companies should disclose cyber risks and incidents, and how threats might affect their financials. The new guidance underscores how critical cyber infrastructure has become to modern business, comparing it to “the importance of electricity and other forms of power in the past century.”

“There is no doubt that the cybersecurity landscape and the risks associated with it continue to evolve,” SEC chairman Jay Clayton said in a statement announcing the guidance's release. He added that he has tasked the agency's Division of Corporate Finance “to carefully monitor cybersecurity disclosures as part of their selective filing reviews.”

“We will continue to evaluate developments in this area and consider feedback about whether any further guidance or rules are needed,” Clayton added, hinting at the possibility of new cyber breach disclosure regulations further down the road.

Keir Gumbs, a partner at Covington & Burling and a former SEC lawyer, said he was disappointed the guidance does not give more clarity about how to determine when a cyber breach is material — or provide any kind of safe harbor for companies that make good-faith determinations about the scope of a breach that later turn out to be incorrect.

“In every case that I've ever worked on, the initial assessment is wrong. You always think the cyber breach is smaller than it is,” Gumbs said in an interview. “From a practical perspective, I don't think the landscape has changed very much by this guidance.”

The guidance comes roughly a half-year after the credit reporting agency Equifax disclosed last September it had suffered a massive data breach, reportedly resulting in the leak of personal data on some 145 million people.

In the wake of that debacle, it emerged that a number of Equifax executives had sold stock before the hack became public. The company's board later cleared those executives of insider trading suspicions, concluding they were not aware of the data breach when they made the trades.

The SEC's new guidance prods companies to consider “prophylactic measures” to guard against trading by company officers on the basis of non-public information about a data breach, such as restricting trading while a hack is being investigated.

“We believe that companies would be well served by considering how to avoid the appearance of improper trading during the period following an incident and prior to the dissemination of disclosure,” the document adds.

The SEC doesn't indicate that it expects more frequent disclosures by public companies. But it does make clear that it wants registrants to spell out internal procedures for determining when a cyber incident is serious enough that investors must be informed, and involve their boards in providing oversight on cybersecurity issues.

“Companies should assess whether they have sufficient disclosure controls and procedures in place to ensure that relevant information about cybersecurity risks and incidents is processed and reported to the appropriate personnel, including up the corporate ladder, to enable senior management to make disclosure decisions,” the guidance says.

Determining exactly what kinds of cyber information should be disclosed, however, is still a highly subjective process, according to the document.

The guidance says the SEC would consider cybersecurity information to have been omitted “if there is a substantial likelihood that a reasonable investor would consider the information important,” or if it would have “significantly altered the total mix of information available.” The agency, at the same time, said it does not want companies to disclose technical information that could offer hackers a “roadmap” for how to breach their systems.