SEC Proposes Amendments Regarding Cybersecurity Risk Management, Strategy, Governance, And Incident Disclosure

In Short

The Situation:  On March 9, 2022, the U.S. Securities and Exchange Commission (the "SEC") proposed amendments to enhance and standardize disclosures regarding cybersecurity risk management, strategy, governance, and incident reporting by public companies. 

The Potential Result: If adopted as proposed, the amendments would, among other things, require current disclosure of material cybersecurity incidents within four business days of the determination that a cybersecurity incident is material, and periodic updates regarding previously reported cybersecurity incidents. The proposed amendments also would require periodic reporting about a registrant's policies and procedures to identify and manage cybersecurity risks; a registrant's board of directors' oversight of cybersecurity risk; management's role and expertise in assessing and managing cybersecurity risk and implementing cybersecurity policies and procedures; and a registrant's board of