The Securities and Exchange Commission (SEC) has, by a 3-2 vote, implemented new rules demanding companies to be more transparent about their cybersecurity situations. This change requires companies to provide up to date disclosure on Form 8-K within four business days of identifying a material cybersecurity incident.
These new rules could have profound effects on how companies manage cybersecurity risks. The SEC’s decision highlights the increasing significance of cybersecurity in the field of corporate governance. It illuminates the aspect that cybersecurity is no longer just an IT issue but a vital component of corporate risk management.
Moreover, the rules now necessitate disclosure regarding cybersecurity risk management, strategy, and governance in annual reports on Form 10-K and Form 20-F. Such disclosures could compel companies to invest more seriously and think more strategically about their cybersecurity postures.
The implication for companies is clear; in case of a substantial cybersecurity incident, it is mandatory for the it to be reported within a stipulated time. It obliges companies not only to react expeditiously to such issues, but also to have a clear and focused strategy for these incidents in place.
While this progression is likely to increase transparency and instill more trust in the investors regarding a company’s cybersecurity efforts, it also poses challenges for the companies to be swift and strategic in managing cybersecurity risks.
For more in-depth insights, the details of this update can be accessed at JDSupra by Latham & Watkins.