Yesterday, the SEC’s Division of Corporation Finance issued a guidance document regarding public companies’ disclosure obligations relating to cybersecurity risks and breaches.  The guidance responds to a request by Sen. Jay Rockefeller that the SEC clarify its position on this increasingly important issue.

The Division noted that as companies have turned to digital technologies to conduct their operations, cybersecurity risks–and incidents–have increased.  Although there is no disclosure requirement under the federal securities laws that specifically addresses cybersecurity, the Division explained that existing regulations may require disclosure of cyber risk assessments and the costs stemming from incidents.  It is important to note, as the Division does, that this is guidance, not a rule, regulation, or order (as some headlines have suggested).

We provide an overview of the guidance after the jump.  For additional information please see this E-Alert prepared by members of our Global Privacy & Data Security and Securities & Corporate Finance practice groups.

The Division referenced the following sections of Regulation S-K as potentially requiring disclosures related to cybersecurity:

• Item 503(c) (“Risk Factors”), which requires companies to disclose risks facing the business that might make an investment in the company’s stock speculative or risky.  If cybersecurity presents a material risk, the Division suggests that, depending on the company’s particular situation, disclosures concerning cybersecurity might include, among other things:  (1) discussion of the aspects of the company’s operations that give rise to material cybersecurity risks and the potential costs and consequences; (2) description of any cyber incidents that the company has experienced, and the costs associate with those incidents, if material; and (3) description of relevant insurance coverage.
• Item 303 (“Management’s Discussion and Analysis of Financial Condition and Results of Operations” or “MD&A”), which requires a discussion and analysis of the company’s financial condition and results of operation.  This should address cybersecurity risks and incidents if costs or other consequences associated with known incidents or the risk of potential incidents represent a “material event, trend, or uncertainty that is reasonably likely to have a material effect on the [company’s] results of operations, liquidity, or financial condition or would cause reported financial information not to be necessarily indicative of future operating results or financial condition.”  The Division notes that an example of an event might trigger such disclosures would be the theft of material intellectual property in a cyber attack.
• Item 101 (“Description of the Business”), which requires a description of the company’s business.  Where a cyber incident has materially affected a company’s products, services or relationships with customers or suppliers, the Division suggests that the impact should be discussed.
• Item 103 (“Legal Proceedings”), which requires a brief description of “material pending legal proceedings, other than routine litigation incidental to the business.”  This might include, for example, a suit against the company involving a loss of customer information as the result of a cyber incident, if the liability that could be incurred by the company is material.
• Item 307 (“Disclosure Controls and Procedures”), which requires disclosure of the company’s conclusions regarding the effectiveness of the company’s disclosure controls and procedures.  To the extent a cyber incident affects a company’s ability to comply with its SEC disclosure obligations, the company must consider whether this has impaired the effectiveness of its disclosure controls.