Cybersecurity & Data Privacy Leader • Founder & Executive Director of Former Gov • Speaker • Former DOJ Cybercrime Prosecutor • NYAG Regulator • Civil Litigator • Posts reflect my own views.
14,738 followers
BIG NEWS! At today's open meeting of the SEC, the SEC Commissioners voted to adopt the SEC's proposed cybersecurity rules on a split three to two vote. While we have yet to see the written rules, here are my initial takeaways from today's meeting: 1. DISCLOSURE TIMING: The SEC emphasized that the disclosure requirement would be four business days from the time that a breach is determined to be "material"--not four days from learning of the breach. The SEC recognized that the determination that an incident is "material" may take some time, in part, because the Company may lack sufficient information to make the materiality determination at the outset. 2. DISCLOSURE CONTENT: The new rule apparently "streamlines" specifically what registrants must disclose about an incident. Now registrants would be required to disclose the material aspects of the nature, scope, and timing of the incident, as well as the incident's material impact or reasonably likely material impact. 3. DELAYED DISCLOSURE: The SEC has implemented a new process for registrants to delay disclosure of material incidents. If the U.S. Attorney General (the AG) determines that disclosure poses a substantial risk to national security or public safety and notifies the SEC of such a determination, the AG would be able to trigger a disclosure delay for an initial period of up to 30 days, followed by a 30-day extension, and a final extension of up to 60 days. The SEC would also consider additional disclosure delays, as requested by the AG. The SEC has apparently worked with AG to set up an interagency communication channel to support rapid extensions. While the SEC didn't mention it, this provision would give registrants an additional incentive to contact the FBI or DOJ soon after learning of an incident. 4. MATERIALITY: The SEC seems to have softened its requirement that registrants disclose immaterial incidents that are nonetheless material in the aggregate. Now the otherwise immaterial incidents must be "related" to each other to require reporting, such as attacks by the same cyber actor, or by exploiting the same vulnerability. 5. BOARD EXPERTISE: While the original proposal would have required registrants to identify any member of the board of directors who has cybersecurity experience and describe such expertise, the updated rules do not contain any such board expertise and disclosure requirements. Instead, the rules require disclosure of the relevant expertise of any members of management or committees that are responsible for assessing and managing registrants' material cyber risks. 6. EFFECTIVE DATE: It sounded like most registrants would be required to file annual reports in compliance with the new rule beginning Dec 15, 2023, with certain smaller organizations filing reports beginning June 15, 2024. The new incident disclosure requirements would go into effect for material incidents occurring after December 18, 2023.