Proposed SEC Cybersecurity Risk Governance Rules for Public Companies

Cybersecurity Incident Reporting

Must disclose:

·      “material” cybersecurity incidents;

·      current information on previously disclosed incidents; and

·      instances where a series of previously undisclosed immaterial cybersecurity incidents is considered “material” in the aggregate.

Table 2 below provides further information on the proposed SEC cybersecurity incident reporting requirements.

Cybersecurity Policies and Procedures

Must disclose:

·      the company’s policies and procedures to identify and manage cybersecurity risk; and

·      whether the company considers cybersecurity risks as part of its business strategy, financial planning, and capital allocation.

Board Requirements

Must describe the board’s:

·      oversight of the company’s cybersecurity risk; and

·      cybersecurity expertise and the nature of such expertise.

Senior Management Requirements

Must describe senior management’s:

·      cybersecurity expertise;

·      role in assessing and managing cyber risks; and

·      role in implementing its cyber policies, procedures, and strategies.

Materiality Trigger

“Material” means a substantial likelihood that a reasonable shareholder would consider it important in making an investment decision, or if it would have significantly altered the `total mix’ of information made available. The company would need to consider, from the viewpoint of an investor, all relevant facts and circumstances surrounding the cybersecurity incident.

Notification Period

The company must disclose the cybersecurity event in a current report on Form 8-K within four business days of becoming aware that the incident is “material.” 

The materiality determination must be made “as soon as reasonably practicable after discovery of the incident” and should not be delayed due to ongoing internal or external investigations into the incident. Delayed notifications under state data breach laws due to an ongoing law enforcement investigation may not be used to delay SEC disclosures.

Required Information to Disclose

Companies will need to disclose:

(i)        when the company discovered the incident and whether it is ongoing;

(ii)       a brief description of the nature and scope of the incident;

(iii)      whether any data was stolen, altered, accessed, by an unauthorized party or used by for any other unauthorized purpose;

(iv)      the effect of the incident on the company’s operations; and

(v)       whether the company has remediated or is currently remediating the incident.

It is not necessary to disclose specific technical information about the company’s security systems, system vulnerabilities, or response to the incident to the extent it would hinder the company’s response and/or remediation of the incident.