SEC Proposes Cybersecurity Disclosure And Reporting Requirements For Public Companies

On March 9, the U.S. Securities and Exchange Commission (SEC) proposed rule amendments¹ that, if adopted, would impose significant new cybersecurity-related disclosure obligations on U.S. reporting companies², including requirements to both file current reports with the SEC about material cybersecurity incidents as well as provide disclosure regarding cybersecurity incidents, risk management, strategy and governance in periodic reports. However, most of the proposed amendments would not apply to Canadian companies that report under the multijurisdictional disclosure system (MJDS).

The SEC previously issued guidance in 2011 and 2018³ regarding U.S. reporting companies' cybersecurity-related disclosure obligations. In the proposing release, the SEC noted that although disclosures in these areas generally have improved since this guidance was issued, disclosure practices have been inconsistent.