New SEC cybersecurity guidelines: Next steps for public companies

• Fast reporting: Businesses must disclose cybersecurity incidents within four days of determining materiality. (The definition of materiality is built around a “reasonable investor” construct and remains open to interpretation.)
• Annual disclosure: Form 10-K disclosures must encompass comprehensive insights into cybersecurity risk management, strategies, posture, and processes for assessing incident materiality.
• Governance under scrutiny: Cybersecurity governance will face rigorous scrutiny, mandating an intricate outline of board and management oversight, discussion frequency, and the formality of this process.

Access full details at SEC.gov.

Under these new regulations, companies must elevate their cybersecurity practices by crafting effective strategies for incident reporting, regulatory disclosures, risk management, and board-level governance. To adapt to these changes and help ensure regulatory compliance, businesses should consider the following action steps.

• Fortify incident response. Perfect your plans for swift identification of threats and incidents, thorough materiality evaluation, and timely reporting. Conduct regular tabletop exercises to strengthen real-world crisis preparedness.
• Establish a cybersecurity committee at the board level. While not explicitly required by these new guidelines, forming a cybersecurity committee or naming a cyber-capable member to the risk committee demonstrates your recognition that cybersecurity is a uniquely pervasive risk that obligates board supervision, and helps instill confidence among investors and other stakeholders. (Read more about the importance of adding cyber expertise to your board.)
• Exercise diligence in drafting. Publicly traded companies should approach their security strategy holistically and collaborate with their reporting group and lawyers skilled in cyber and securities practices. Cybersecurity disclosures will need to be crafted meticulously, as they will be exposed as public information. Engage securities lawyers to comprehend the legal implications and requirements from a securities law perspective, as cybersecurity disclosures now intersect with the purview of securities filings.
• Seek objective validation. In addition to engaging independent cyber contractors or consultants, boards of publicly traded companies should obtain an independent annual assessment of their company’s cybersecurity posture. Such an assessment will furnish factual evidence supporting Form 10-K disclosures, reinforcing the organization's cybersecurity preparedness and resilience. Once again, independence is key; using the same consultants that management might is not recommended.
• Mind the clock. Time is of the essence: The rules are expected to go into effect in December.  Most publicly traded companies will have to comply with Form 10-K and Form 20-F disclosures beginning with annual reports for fiscal years ending on or after Dec. 15, 2023, and the Form 8-K and Form 6-K disclosures will be due beginning the later of 90 days after the date of publication in the Federal Register or Dec. 18, 2023, the SEC states. Smaller reporting companies will have an additional 180 days to start providing the Form 8-K disclosure (anticipated June 2024).

Contact our cybersecurity team for support in identifying your company’s needs and navigating these protocols confidently.

Bhavesh N. Vadhani, CISA, CRISC, CGEIT, PMP, CDPSE, Principal, Global Leader, Cybersecurity, Technology Risk, and Privacy

703.847.4418

Scott Corzine, Managing Director, Cybersecurity, Technology Risk, and Privacy

703.744.8541