[This post revises and updates my earlier post primarily to
reflect the contents of the proposing release.]
At an open meeting last week, the SEC voted, three to one, to
propose regulations "to enhance and standardize disclosures
regarding cybersecurity risk management, strategy, governance, and
incident reporting by public companies." At the meeting,
SEC Corp Fin Director Renee Jones said that, in today's
digitally connected world, cyber threats and incidents pose an
ongoing and escalating threat to public companies and their
shareholders. In light of the pandemic-driven trend to work from
home and, even more seriously, the potential impact of horrific
global events, cybersecurity risk is affecting just about all
reporting companies, she continued. While threats have
increased in number and complexity, Jones said, currently, company
disclosure about cybersecurity is not always decision-useful and is
often inconsistent, not timely and sometimes hard for investors
