Yesterday, the SEC’s Division of Corporation Finance issued a guidance document regarding public companies’ disclosure obligations relating to cybersecurity risks and breaches. The guidance responds to a request by Sen. Jay Rockefeller that the SEC clarify its position on this increasingly important issue.
The Division noted that as companies have turned to digital technologies to conduct their operations, cybersecurity risks–and incidents–have increased. Although there is no disclosure requirement under the federal securities laws that specifically addresses cybersecurity, the Division explained that existing regulations may require disclosure of cyber risk assessments and the costs stemming from incidents. It is important to note, as the Division does, that this is guidance, not a rule, regulation, or order (as some headlines have suggested).
We provide an overview of the guidance after the jump. For additional information please see this E-Alert prepared by members of our Global Privacy & Data Security and Securities & Corporate Finance practice groups.