SEC Adopts Cybersecurity Risk Management, Strategy, Governance And Incident Disclosure Rules

On March 9, 2022, the U.S. Securities and Exchange Commission (SEC) released proposed rules regarding public companies' reporting of (i) cybersecurity incidents, (ii) policies and procedures for identifying and managing cybersecurity risks and (iii) management and board roles in implementing cybersecurity policies and procedures. On July 26, 2023, the final rules were adopted.

In 2011, and then again in 2018, the SEC provided interpretive guidance for cybersecurity disclosure. However, even as the SEC has observed cybersecurity threats becoming more prevalent and costly for the economy and companies, companies have employed varied disclosure practices regarding cybersecurity, with registrants providing different levels of specificity regarding the nature and significance of cybersecurity risks, as well as the cause, scope, impact and materiality of cybersecurity incidents.