U.S. Securities And Exchange Commission Issues Guidance On Cybersecurity Risks And Incidents

On February 21, 2018, the U.S. Securities and Exchange Commission (the "Commission") issued guidance in a report titled "Commission Statement and Guidance on Public Company Cybersecurity Disclosures"¹ to assist public companies in preparing disclosures on cybersecurity risks and incidents. The Commission notes that its 2011 guidance led to increased general disclosures, typically in the form of risk factors. Considering the increasing significance of cybersecurity incidents however, the Commission believes it is important to provide further guidance to public companies. In addition to reinforcing and expanding upon the Commission's 2011 guidance on cybersecurity disclosures, the Commission addressed new topics, including the importance of cybersecurity policies and procedures and the application of insider trading prohibitions in the context of cybersecurity. A close analysis of the new guidance shows that the Commission is becoming increasingly aggressive