SEC Issues Interpretive Guidance On Cybersecurity Disclosures

In response to the increasing frequency and severity of cybersecurity incidents, the staff of the Securities and Exchange Commission ("SEC") has issued interpretive guidance for registrants to assist them in assessing what, if any, disclosures should be provided in periodic reports and registration statements about cybersecurity matters in light of each registrant's specific facts and circumstances.

Background

As registrants have migrated toward increasing dependence on digital technologies to conduct their operations, the risks to registrants associated with the security of such technologies, known as cybersecurity, have also increased. Registrants have been subject to both intentional and inadvertent cyber incidents, such as unauthorized release of proprietary or sensitive information, misappropriation of assets, corruption of data and loss of service, resulting in costs and liability, lost revenues, litigation and reputational damage.