SEC Issues New Cybersecurity Disclosure Guidance

On February 21, 2018, in response to the increasing significance of cybersecurity incidents, the Securities and Exchange Commission ("SEC") announced much-anticipated interpretive guidance on cybersecurity disclosure. The guidance affirms and expands upon the 2011 cybersecurity disclosure guidance issued by the staff of the Division of Corporation Finance¹ The new guidance also notably addresses the importance of the board's role in overseeing the management of cybersecurity risks, the need for corporate cybersecurity policies and procedures, considerations concerning potential insider trading prohibitions by companies investigating potential breaches, and Regulation FD and selective disclosure prohibitions in the cybersecurity context. Overall, the new guidance is consistent with pressure being exerted on companies in all industries by regulators, counterparties and industry bodies to treat cybersecurity as an enterprise-level risk, and to ensure that companies'