Ride the Lightning

SEC: New Guidance on Cybersecurity Disclosure

February 26, 2018

On February 21^st, the Securities and Exchange Commission released new guidelines calling for public companies to be more transparent about their cybersecurity risks both before and after security incidents.

"[T]he Commission believes that it is critical that public companies take all required actions to inform investors about material cybersecurity risks and incidents in a timely fashion," the report says, "including those companies that are subject to material cybersecurity risks but may not yet have been the target of a cyber-attack."

Guidelines are a format used to clarify the SEC's views on security laws and regulations – these guidelines were built on a 2011 report on the same topic.

"I believe that providing the Commission's views on these matters will promote clearer and more robust disclosure by companies about cybersecurity risks and incidents, resulting in more complete information being available to investors," SEC Chairman Jay Clayton said a statement. "In particular, I urge public companies to examine their controls and procedures, with not only their securities law disclosure obligations in mind, but also reputational considerations around sales of securities by executives."

Not much of the guidelines are new – except for that last part. Though no specific breaches were named, this new focus comes five months after the Department of Justice, with assistance from the FBI and SEC, opened an investigation into insider trading by executives at Equifax, which experienced a hack exposing over 140 million records.

Personally, I think the guidance is a little weak. Where are the rules? Where are the penalties? "Guidance" has no teeth.

E-mail: Phone: 703-359-0700
Digital Forensics/Information Security/Information Technology
https://www.senseient.com
https://twitter.com/sharonnelsonesq
https://www.linkedin.com/in/sharondnelson
https://amazon.com/author/sharonnelson