Cybersecurity Risk Disclosures

By Cydney Posner

This article from BNA  quotes former Corp Fin Director Meredith Cross as saying that she expects to see future disclosure requirements, including corporate spending levels, regarding the steps taken by companies to prevent cybersecurity risk. That type of disclosure is just one of several that she expects will continue to be introduced to guide corporate behavior to effect social and political goals: "'Requiring companies to post [on EDGAR] potentially embarrassing information… even if the information is not qualitatively or quantitatively material to investors, can be a very powerful motivator to change corporate behavior….Congress has figured this out, and the dam' has broken, she said. ‘And I think there is a significant risk that people will keep pushing for it.'" The challenge for the SEC (a "nearly impossible position," according to Cross) is trying to determine, when rules are proposed, "how these regulations would impact competition, capital formation and efficiency...." (Note that regulation by humiliation is really nothing new, but what seems to be different here is the extent of the Congressional mandate. )

With regard to cybersecurity risk disclosure, while Senator Jay Rockefeller has previously urged the SEC to enhance its formal guidance on disclosure of cybersecurity risks, his last draft of a cybersecurity bill made public dropped the reporting requirement.

This content is provided for general informational purposes only, and your access or use of the content does not create an attorney-client relationship between you or your organization and Cooley LLP, Cooley (UK) LLP, or any other affiliated practice or entity (collectively referred to as “Cooley”). By accessing this content, you agree that the information provided does not constitute legal or other professional advice. This content is not a substitute for obtaining legal advice from a qualified attorney licensed in your jurisdiction and you should not act or refrain from acting based on this content. This content may be changed without notice. It is not guaranteed to be complete, correct or up to date, and it may not reflect the most current legal developments. Prior results do not guarantee a similar outcome. Do not send any confidential information to Cooley, as we do not have any duty to keep any information you provide to us confidential. This content may be considered Attorney Advertising and is subject to our legal notices.