Share on LinkedInShare on LinkedIn

ARTICLE · 01 JULY 2026

What Boards Get Wrong About Cybersecurity

As cybersecurity claims the top spot among digital investment priorities globally, boards of directors face a critical question: are they building strategic capability or merely scrambling to meet the SEC's four-day disclosure requirement?

United StatesCorporate/Commercial Law

Boards that treat cybersecurity as a compliance issue will stay stuck in reactive mode. But the starting point for strategic capability is simpler than most directors assume.

Four business days. That’s the floor regulators have set: how long a public company has to disclose a material cyber incident under current SEC rules. The question is whether boards of directors are building above it or still scrambling to meet it. It’s not much time for a board of directors that hasn’t pre-defined what “material” means, assigned who owns the response or ever run a serious tabletop exercise.

The SEC didn’t invent board accountability for cybersecurity. It just made ignoring it more expensive. The EU’s DORA (Digital Operations Resilience Act) and CSRD (Corporate Sustainability Reporting Directive) have added equivalent obligations for firms operating across Europe, and regulators across much of the world are following a similar pattern. In all cases, ignorance will not be tolerated as a

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

See more popular content from