SEC’s New Mandatory Cybersecurity Disclosure Rules: Maintaining Compliance and Avoiding Enforcement Risks

Description

On July 26, 2023, the SEC adopted final rules that generally require public companies to disclose material cybersecurity incidents within four business days after determining the incident was material. Also, companies must now provide information regarding their cybersecurity risk management, strategy, and governance on an annual basis. The final rules are effective Sept. 5, 2023.

Since 2011, the SEC has encouraged public companies to file a Form 8-K upon the occurrence of a material cybersecurity incident. The final rules turn the guidance into a mandate for Form 8-K. Foreign private issuers (FPIs) already have an obligation to disclose material information on Form 6-K that they disclose offshore, on a stock exchange, or to their security holders, and the new rules simply add material cybersecurity incidents to the list of material information included in the form.

Under the new rules, public companies and FPIs will be required to include additional cybersecurity risk management disclosures in Forms 10-K and 20-F. As part of these disclosures, companies must describe: their processes for assessing, identifying, and managing material risks from cybersecurity threats; the board of directors' oversight of risks from cybersecurity threats; management's cybersecurity expertise and its role in assessing and managing material risks from cybersecurity threats; and whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the registrant, including its business strategy, results of operations, or financial condition.

Listen as our authoritative panel provides an overview of the new rules and practical guidance for implementing policies and procedures to comply with the new requirements. The panel will also address the potential compliance and enforcement implications of the new rules.