New SEC Guidance Addresses Disclosure Requirements For Breach Events

As the SEC has made clear on numerous occasions over the past year, cybersecurity will continue to be a major enforcement priority under the Commission's new leadership. As we have previously covered, one new area of potential enforcement activity that the SEC has warned about concerns the failure of public companies to make disclosures regarding material cyber events. While the SEC had previously provided some guidance to publicly traded companies about when to disclose such events, that 2011 guidance still left many questions unanswered.

Just last week, the Commission attempted to provide some additional clarity regarding when disclosure of both cyber threats and events is required, addressed controls that issuers should put in place to address the need to disclose a cyber event, and also warned publicly traded companies and their executives against trading on inside information regarding a cyber-incident.