The SEC recently adopted new guidelines requiring publicly-traded companies (as well as foreign private companies) to disclose cybersecurity incidents that could have a “material” impact on the company. The disclosures will require companies to provide a description of the material aspects of the incident, such as its nature, scope, and timing, within four business days of determining the incident as “material.” 

Additionally, companies will have to describe their processes, if any, for assessing, identifying, and managing material risks from threats. Disclosures may be delayed if the United States Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety, but the SEC must still be notified of the incident in writing.

The SEC says that these guidelines are designed to improve transparency about cybersecurity risks by creating a more adaptable, principle-based approach to articulate risk management while providing companies the freedom to implement diverse strategies for the ever-changing nature of adversarial cyber threats. The SEC seeks to ensure that companies are better equipped to handle cybersecurity challenges effectively by providing public companies with adaptive programs that can swiftly pivot in response to emerging risks. The SEC plans to accomplish this by requiring disclosures on an annual basis, highlighting the company’s cybersecurity risk management, strategy, and governance.

The impact of the new disclosure rules may also be felt under D&O policies. The new guidelines adopted by the SEC rules could increase D&O claims, as directors and officers may be held liable for failing to disclose material cybersecurity incidents in a timely manner. Given the increasing complexity of cyber risks, this impact could, in turn, make it more difficult for insurers to assess and price D&O coverage. The resulting impact could be higher premiums, or even the withdrawal of coverage altogether.