Remarks Of SEC Enforcement Director On Cyber Resilience

On June 22, 2023, Gurbir S. Grewal, Director of the SEC's Division of Enforcement, spoke on the topic of cyber resilience at the Financial Times Cyber Resilience Summit. Director Grewal defined cyber resilience as a guiding concept: because cybersecurity incidents are likely to occur, companies must be prepared to respond and react appropriately when they do.

While not weighing in on the SEC's pending rulemaking activity for new cybersecurity disclosure requirements, Director Grewal shared five principles that guide the Enforcement Division's approach to a company's cybersecurity and disclosure obligations.

1. The Division views the investing public, not just the public company being attacked, as potential victims due to the impact on customers whose information has been compromised and the potential materiality of that information to investors. The Division's goal is to ensure that investors receive timely and accurate disclosure in order to prevent additional