New SEC Cybersecurity Disclosure Protocols: Enhanced Transparency, Short Deadlines

The Securities and Exchange Commission (SEC) issued its final rule on Cybersecurity Risk Management, Strategy, Governance, and Incident Response on July 26, 2023. This mandates that SEC‐regulated companies disclose both significant cybersecurity incidents and their cyber risk management processes. These public disclosures will be made via existing SEC reporting channels. They are intended to provide investors with enhanced transparency into the cyber risks and mitigation strategies employed by SEC‐regulated corporations. This landmark decision marks the culmination of an 18‐month intensive rulemaking process that commenced in March 2022. The process was anything but smooth. The interval from the SEC's original announcement to the finalization of the rules was marked by fervent debate, heated public discourse, and diverging viewpoints. Adapting to the new regulations will vary among companies. Established firms with robust practices will find the transition smoother, primarily focusing on initial disclosures for the year's 10‐k report. In contrast, companies with less structured cyber risk approaches and reliant on reactive measures, will grapple with substantial challenges. Central to this transition is the collaboration between boards and executives in defining “material” cyber incidents. While no fixed formula exists to gauge impact, it is crucial for leadership to holistically understand and swiftly assess potential repercussions—spanning operational costs, legal ramifications, brand implications, and revenue loss—during emergent cyber situations.