In the wake of hacks such as the 2017 Equifax breach, which exposed personal information of roughly 145.5 million people, the Securities and Exchange Commission (SEC) has announced plans to update its interpretive guidance for disclosing cybersecurity issues. The SEC wants to remind public companies of their responsibility to keep investors informed when data is breached or severe hacks are attempted.
Need for change
At a recent American Bar Association meeting, David Fredrickson, chief counsel of the SEC’s Division of Corporation Finance, said that the SEC doesn’t expect to overhaul its Disclosure Guidance: Topic No. 2, Cybersecurity. But he said that the SEC needs to “refresh” it. Specifically, it plans to consider whether important information about cybersecurity should be disclosed to stakeholders within the context of the existing rules. For example, companies may need to beef up their management’s discussion and analysis (MD&A) and footnote disclosures to reflect potential cyber risks and material financial implications of data breaches.
The current guidance on cybersecurity, which was published in 2011, doesn’t include a specific requirement for companies to disclose computer system intrusions. The SEC’s effort to update the guidance comes amid concerns that more public companies have been experiencing attacks to their computer systems, but their disclosures haven’t been timely or informative enough.
Investors in the past few years have been especially vocal about pushing companies to provide more information about cybersecurity. And SEC Chairman Jay Clayton has told lawmakers during congressional hearings that he believes companies can do a better job of disclosing the risks they face and the hacks into their computers.
Substance over form
Regulators in the SEC haven’t decided whether the update will be issued in the form of staff-level guidance or a regulatory release approved by the SEC’s commissioners. But Fredrickson has identified two new areas the SEC needs to address in the update:
February 23, 2018