The SEC's Interpretive Guidance On Cybersecurity—What It Does, Doesn't Do And Key Takeaways

On February 21, the SEC adopted new interpretive guidance (the Guidance) to assist public companies in preparing disclosures about cybersecurity risks and incidents. Response to the Guidance has been mixed, with some partisan bickering and calls that it does not do enough to meaningfully address cybersecurity risks. Nevertheless, the Guidance makes plain that the SEC is focused on cybersecurity and expects public companies to address and inform investors about material risks and incidents in a timely fashion. While it is not yet apparent how the SEC intends to enforce the Guidance, public companies should take heed. To that end, the following is a brief summary of what the Guidance does, doesn't do and key takeaways.