Cybersecurity & Corporate Governance: SEC Releases First-Ever Guidance On Cybersecurity Risks Disclosure

In the fast changing landscape of corporate governance, one of the newest issues to emerge for chief officers and directors to consider is cybersecurity preparedness and monitoring, as well as cyber incident response and (in some cases) reporting. Such cybersecurity governance obligations are two-fold. First, for internal IT systems, that oversight can be conducted as a matter of internal management practice. However, where part of a company's IT infrastructure is provided by third parties (including outsourcing, shared services, intercompany management services, SaaS, or cloud computing) the effective execution of those services must be governed through the related service contract. Indeed, the outsourcing or relegation of the day-to-day operational duties of any IT operation or business process does not discharge the executive officers or the board from their continuing governance duties of oversight and supervision. Since corporate governance duties do not evaporate