SEC Provides Disclosure Guidance On Cybersecurity

On October 13, 2011, the Division of Corporation Finance (the "Division") of the Securities and Exchange Commission (SEC) issued informal guidance regarding the disclosure by public companies of cybersecurity risks and cyber incidents.¹

While the use of computer networks has increased the efficiency of business operations, it also exposes companies to cyber attacks that may result in the theft of company assets or sensitive information about the company, its customers and other business partners. Cyber attacks may cause a company to not only incur substantial costs (e.g., remediation costs, litigation costs and costs to increase security) but also to suffer loss of revenue and reputational damage. In issuing its guidance, the Division recognized that with the "increasing dependence on digital technologies," there has been an increased focus on "how [cybersecurity] risks and their related impact on the operations of a registrant should be described within the