SEC Adopts Controversial New Cybersecurity Disclosure Rules For Public Companies

Public companies will soon face new cybersecurity disclosure requirements from the Securities and Exchange Commission (SEC), which voted last week to approve a controversial new cybersecurity rule. The final rule—which is part of an increasing number of reporting and disclosure requirements the federal government is issuing to mandate disclosure of cybersecurity incidents—will impose a variety of new public disclosure requirements on publicly traded companies. The agency says the rule is designed to keep investors informed about a company's material cybersecurity incidents and its cybersecurity risk management, strategy, and governance mechanisms.

The new SEC requirements—which have different roll-out dates—will create additional compliance burdens on public companies, many of whom are already subject to various other cyber incident reporting and regulatory obligations. With the growing patchwork of cybersecurity and incident reporting requirements at both the