SEC: Companies Must Disclose More Info on Cybersecurity Attacks & Risks

The Securities and Exchange Commission (SEC) has issued updated guidance for public companies that calls for providing investors more information on their cybersecurity incidents - as well as risks - in a more timely fashion.

In the so called interpretive guidance statement released yesterday, the commission also said corporate officers, directors, and "other corporate insiders" cannot trade shares if they have unpublicized knowledge of a security incident at the company.

"Public companies should have policies and procedures in place to (1) guard against directors, officers, and other corporate insiders taking advantage of the period between the company's discovery of a cybersecurity incident and public disclosure of the incident to trade on material nonpublic information about the incident, and (2) help ensure that the company makes timely disclosure of any related material nonpublic information," the SEC said.

The SEC didn't specify what it meant by "timely fashion," but it did reiterate the need to disclose breaches and security risks sooner and with more information. "Given the frequency, magnitude and cost of cybersecurity incidents, the Commission believes that it is critical that public companies take all required actions to inform investors about material cybersecurity risks and incidents in a timely fashion, including those companies that are subject to material cybersecurity risks but may not yet have been the target of a cyber-attack," the SEC said in its statement. 

Chris Pierson, CEO of Binary Sun Cyber Risk Advisors, says the SEC's new guidance forces companies to more proactively address risks of security incidents.

"This Guidance serves as a loud wake-up call for all Boards of Directors to determine who among them is a cybersecurity and risk expert, what role the Board is playing in governing cybersecurity risks, and how exactly the Board is managing these risks and responding to incidents," Pierson says. "Just like with Sarbanes Oxley, the SEC is telling the Board to figure out how they will govern and oversee all risks, but most especially cybersecurity risks and incidents."

The SEC doesn't go into specifics on disclosure guidance. Chris Roberts, chief security architect at Acalvio, says the SEC actually goes "round and round in circles" on that.

"Basically it's saying we'd like to know if you have a risk, but we are not really asking because we don't want you to disclose because that'll be bad and give the criminals ways to break into you," he says. "But, really we want to know if it's going to break Wall Street. However, we don't want to know because it'll break you. But we kind of want to know if you really think we need to know," he says the SEC's statement said.

Read the full SEC guidance here.

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.