Summary Bullets:

• The SEC released new rules on the expediency and response detail required of public companies in reporting cybersecurity incidents after a comment period.

• The rules were met with a mix of concern and criticism, including from two SEC commissioners who expressed dissenting opinions, raising red flags around the reporting requirements potentially revealing key elements of the breached organization’s defenses that could put them at risk of another attack and going beyond the agency’s authority.

In an intensifying threat environment, the US SEC posted new rules requiring how and when public companies will report security incidents that have a material impact on their operations. The new SEC rules oblige organizations to disclose a cybersecurity incident within four days of determining that the event had a material impact on the business. The guidelines state breached organizations are also compelled to outline their practices for detecting, assessing, and managing material risks from cybersecurity threats. The breached organization will need to also reveal prior incidents. The SEC is holding foreign companies conducting business in the US to the same standard. The rules do allow disclosure to be postponed if the US attorney general decides that immediate posting of the incident would put national security or public safety at risk.

Initial reaction to the new procedures was swift and largely negative, with companies pushing back on the public nature of the disclosures. Critics also said the way material impact is defined will differ by company and industry. Some also questioned whether the disclosures may be overly punitive and lead to even greater damage to the breached companies’ reputations while not actually providing mechanisms to improve corporate cyber defense against threats.

Two SEC commissioners opposed the new rules around several factors. Describing the disclosure requirements as overly prescriptive, Commissioner Hester Peirce said the details provided might actually serve as guideposts for threat actors while redirecting resources away from preventing future attacks. She also noted a law enforcement exception which would allow organizations to delay disclosure may be too difficult to obtain in the short four day window.

Commissioner Mark Uyeda suggested that rules seem to prioritize cybersecurity risks over other threats that may have an even bigger material impact to specific companies. He also observed that introducing a forward-looking disclosure demand in 8-Ks and amendments might be beyond the SEC’s governing scope.

Enforcement of the rules could begin as soon as December 15, 2023. Organizations will need to include the disclosures in their 10-K filings for fiscal year 2023.

With the new rules in place, corporate boards and chief information security officers need to be brought up to speed on the disclosure requirements. It is also essential that they understand all of the processes they have in place to guard against incidents that could harm the business significantly from operational, reputational, and financial perspectives.

What are your thoughts on the new SEC security incident disclosure requirements? Do you think the new requirements may cause more harm than good? Is your business prepared to outline the steps it takes to protect its assets and operations?