In the wake of a number of high-profile cybersecurity incidents,
the SEC's Division of Corporation Finance recently released disclosure guidance on the
topic of cybersecurity. While the guidance creates no new legal
obligations, it is intended to provide clarity regarding the forms
of disclosure that registrants may have to make. In the release,
the Division of Corporation Finance recognized that while no
current disclosure requirements explicitly refer to cybersecurity,
there are a number of existing disclosure obligations that may
require registrants to disclose cybersecurity risks or
incidents.
Such cyber incidents may be deliberate or unintentional, and
include gaining unauthorized access to digital systems for the
purpose of misappropriating assets or sensitive information,
causing operational disruption or corrupting data. Meanwhile, the
concept of a cyber attack also includes actions that don't
require unauthorized access to a computer system, such
