SEC issues Guidance On Public Company Cybersecurity Risk Disclosures

On Wednesday, February 21, 2018, the United States Securities and Exchange Commission (SEC) published cybersecurity risk disclosure guidance (the SEC Guidance) for public companies to assist them in preparing disclosure related to these types of risk and incidents. The SEC Guidance does not propose new rules or rule amendments that would impose new requirements, but rather expresses the SEC's views within the existing disclosure framework. It is nonetheless important because, as with previous cybersecurity guidance in 2011 (see below), SEC staff can be expected to turn to it when evaluating the adequacy of disclosures.

The SEC Guidance is also important because it places new emphasis on: