It is well known that secrets don't make friends, and if
you're a public operating company, this is especially true for
disclosures related to material cybersecurity issues. Last week,
the Securities and Exchange Commission issued a guidance that serves as a reminder for public
companies of their cybersecurity disclosure requirements under
federal securities laws. The publication reinforces and expands on
a similar guidance issued in 2011 by the Division of Corporation
Finance, but also focuses on two topics that were not previously
addressed: the importance of cybersecurity policies and procedures,
and applicable insider trading prohibitions in the cybersecurity
context.
The 24-page publication provides direction in essentially three
areas. It provides an overview of the rules requiring disclosure of
cybersecurity issues, it discusses the need for adequate controls
and procedures that would enable a company to make timely
disclosures, and it briefly reminds companies
