SEC’s cyber disclosure rules: Key considerations for the board, C-suite and risk managers

Cybersecurity Dive November 27, 2023
Chris Tarbell, Dave Franzel and Greg Van Houten

Each business stakeholder has a different cyber risk management responsibility. Given the SEC’s coming disclosure rules, it’s even more important to outline who owns what.

The Securities and Exchange Commission’s new cybersecurity disclosure rules take effect on Dec. 18 and starting then, public companies must disclose material cyber incidents within four business days of determining that an incident is “material.”

Companies will also have to disclose, via their annual Form 10-K, information regarding their cybersecurity strategy, risk management and governance practices.

Given the public nature of those disclosures, the SEC’s heightened focus on cyber enforcement actions, and the active shareholder litigation landscape with respect to cyber incidents, it is critical that company leadership takes steps now to decrease risk and...

Today's Sponsors

Today's Sponsor