SEC Cybersecurity Guidance: Color & Context

By Randi Morrison posted 02-22-2018 08:00 AM

Recommend

Further to yesterday's report in the Society Alert, the new, fairly succinct SEC-issued cybersecurity guidance primarily reinforces the 2011 Corp Fin guidance relating to existing disclosure requirements that may give rise to cybersecurity risk or incident disclosure in periodic and current reports and registration statements - with additional emphasis on maintaining policies and procedures (including DC&P) that address cybersecurity risks and incidents, insider trading (including avoiding the appearance of improprieties), and selective disclosures (Reg FD).

The guidance does not effectively attempt to "regulate by guidance" to avoid the rulemaking process; rather, as indicated in Chair Clayton's Statement, the guidance reinforces and expands the Division's prior guidance within the confines of the existing law. The reminders are helpful and instructive in light of the changes in the cybersecurity environment and - relatedly - our perspective and experiences relating to cybersecurity risks and incidents, since 2011.

See also these articles from Reuters, Forbes, The Hill, Journal of Accountancy, Pensions & Investments, Corporate Counsel, and the WSJ reflecting various views. We will be posting the expected flood of law firm memos summarizing and analyzing this new guidance on our Cybersecurity page here, and have a bountiful and expanding portfolio of practical and board oversight guidance/resources here and here, respectively.

0 comments

210 views

Permalink

https://www.societycorpgov.org/blogs/randi-morrison/2018/02/22/sec-cybersecurity-guidance-color-context

Blogs