The Securities and Exchange Commission (SEC) has recently assigned a series of new rules, mandating the disclosure of cybersecurity risk management, strategy, governance, and significant incidents. These new regulations are effective from September 5, 2023, and will apply to companies under U.S. jurisdiction, both domestic and foreign private issuers (FPIs).
The rules’ implications are not confined to these entities alone but extend to Canadian issuers as well. Specifically, those reporting under the U.S.-Canada Multijurisdictional Disclosure System (MJDS) will need to disclose any significant cybersecurity-related incidents, in alignment with these new SEC rules.
The reinforcement of such requirements arises from the increased global attention to cybersecurity risks considering the exponential rise in cybercrime. The SEC’s newly adopted rules primarily aim at ensuring complete transparency on how corporations manage their cybersecurity risks, which could potentially help mitigate adverse consequences of cyber attacks and data breaches for investors, customers, and the markets.
Furthermore, the rules oblige companies to report any significant cybersecurity incidents promptly, underscoring the need for ongoing risk assessment and cyber risk governance.
Bottom line: Corporations must understand these new rules’ implications and ready a robust response. They should consider assessing their current cybersecurity disclosures’ adequacy, scrutinizing their cyber risk management policies, and ensuring their incident response plans comply with the new requirements.