Fitbit IPO Cyber Risk Disclosures

Earlier this month, fitness-tracking company Fitbit, Inc. filed a Form S-1 Registration Statement for an IPO of up to $100 million that exhaustively disclosed potential cybersecurity risks with respect to the personal data the company collects. As businesses collect and process voluminous amounts of consumer data, and as data breaches become more widespread, registration statement disclosures discussing cyber risk have garnered much attention. It is critical for companies to both analyze their cyber risks before going public and to provide relevant, concise and timely disclosures on an ongoing basis for investors to consider.

According to SEC guidance, public companies must disclose cybersecurity risks and incidents that could have a material impact on profitability. Regulation S-K Item 503(c) requires that disclosures be concise and tailored.  Clear and relevant cyber risk disclosures may be critical in preventing or mitigating future scrutiny from regulators