On July 26, 2023, the Securities Exchange Commission (SEC) adopted its final rule formulated with the goal of fortifying and standardizing disclosures with regards to cybersecurity risk management, governance, and incident reporting. According to a report by Venable LLP, this new rule brings about additional disclosure responsibilities for U.S. reporting issuers and foreign private issuers, which includes all public companies with stocks being traded on U.S. exchanges.
The SEC’s adoption of this rule signals a marked movement from the commission to further ensure that companies are complying with stringent cybersecurity norms, and that investors are kept comprehensively informed about the companies’ cyber risk governance and risk management policies. Besides, it also intends to align the cybersecurity risk disclosure guidelines across the board, creating a standardized format which companies should adhere to while reporting their cybersecurity strategies and risk management protocols.
This step implies that companies could foreseeably face sanctions by the SEC if they fail to comply adequately with the new regulations. Thus, it is critically important for companies to comprehend the precise nature and extent of these new disclosure responsibilities and align their cybersecurity governance and incident reporting protocols accordingly.
With these new rules in effect, public companies are ushered towards a more transparent and proactive approach towards managing cyber risks. The SEC’s expectations for companies to take preemptive action against cyber threats has never been more explicit and these regulations can significantly impact how companies interpret and respond to cyber threats moving forward. Hence, understanding and taking necessary actions under the new cybersecurity rule can be pivotal to the reputation, trust and, eventually, the success of these companies.