Public Companies Get Prepared: SEC Adopts New Cybersecurity Disclosure Rules

The SEC adopted new rules for public companies regarding disclosure of information relating to cybersecurity risk management, strategy, governance, and material incidents. Companies will now be required to disclose cybersecurity incidents deemed material through Current Reports on Form 8-K. Companies will also be required to include information in Annual Reports on Form 10-K relating to (i) procedures for assessing, identifying and managing material risks from cybersecurity threats as well as the material outcomes that have resulted, or may result, from such cybersecurity threats, (ii) board oversight of risks posed by cybersecurity threats, any board committee (or subcommittee) responsible for such oversight and the process by which the board (or such committee) is informed of such risks, and (iii) management's role in assessing and managing material cybersecurity risks.