SEC Issues New Guidance On Disclosing Cybersecurity Risks And Incidents

On October 13, 2011, the Securities and Exchange Commission's (SEC) Division of Corporation Finance issued guidance on disclosure obligations relating to cybersecurity risks and cyber incidents.¹ The guidance, which is effective immediately, applies to domestic and non-US SEC registrants. It is intended to assist registrants in preparing disclosures under both the Securities Act of 1933 and the Securities Exchange Act of 1934.²

At the outset, the guidance explains that cyber incidents can occur when a company experiences an unintentional loss of data or a deliberate attack on its computer networks, and cautions that incidents can result in the loss of sensitive data, the corruption of important files, or even the disruption of company operations. The guidance notes several types of negative consequences public companies may confront in the wake of a cyber incident, including remediation costs, costs of increased cybersecurity protection measures, lost revenues,