Cybersecurity Disclosure Guidance For Public Companies

On February 21, 2018, the United States Securities and Exchange Commission ("SEC") issued interpretive guidance on cybersecurity disclosure obligations for public companies subject to U.S. securities laws (the "Guidance"). The Guidance underscores that public companies should inform investors about material cybersecurity risks and incidents in a timely fashion, including where companies have not yet been the target of a cyber-attack. This requires that those persons responsible for developing and overseeing disclosure controls and procedures are informed about the related material cyber risks and incidents their company faces. The guidance further draws attention to insider trading prohibitions equally applying to knowledge about a material cybersecurity incident being experienced by a company before it is publicly disclosed.