Cybersecurity: SEC Enforcement, Disclosure Controls And Risk Factor Disclosure

With the new leadership at the Securities and Exchange Commission, industry commentators expect the Division of Enforcement to be more aggressive in several arenas, including public company disclosure of cybersecurity incidents. While this has been a stated focus of the SEC for more than 10 years, enforcement cases relating to disclosure of cybersecurity incidents have historically been uncommon. Just in the past few months, however, the SEC filed two enforcement actions against public companies related to the timing and content of cybersecurity incident disclosures. These recent enforcement cases further signal the SEC's continued focus into how public companies respond to and issue public disclosures for material cybersecurity incidents.