New US Securities and Exchange Commission (SEC) cybersecurity disclosure guidelines are coming under fire as potentially causing more harm than good.

The agency posted new rules requiring how and when public companies will report security incidents that have a material impact on their operations. The new SEC rules oblige organisations to disclose a cybersecurity incident within four days of determining that the event had a material impact on the business. The guidelines state breached organisations are also compelled to outline their practices for detecting, assessing, and managing material risks from cybersecurity threats. The breached organisation will need to also reveal prior incidents.

The SEC is holding foreign companies conducting business in the US to the same standard. The rules do allow disclosure to be postponed if the United States Attorney General decides that immediate posting of the incident would put national security or public safety at risk.

SEC opposition

Initial reaction to the new procedures was swift and largely negative, with companies pushing back on the public nature of the disclosures. Critics also said the way material impact is defined will differ by company and industry. Some also questioned whether the disclosures may be overly punitive and lead to even greater damage to the breached companies’ reputations while not actually providing mechanisms to improve corporate cyberdefence against threats.

Two SEC commissioners opposed the new rules around several factors. Describing the disclosure requirements as overly prescriptive, Commissioner Hester Peirce said the details provided might serve as guideposts for threat actors while redirecting resources away from preventing future attacks. She also noted a law enforcement exception which would allow organisations to delay disclosure may be too difficult to obtain in the short four-day window.

SEC Commissioner Mark Uyeda suggested that rules seem to prioritise cybersecurity risks over other threats that may have an even bigger material impact to specific companies. He also observed that introducing a forward-looking disclosure demand in 8-Ks and amendments might be beyond the SEC’s governing scope.

How well do you really know your competitors?

Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.

Company Profile – free sample

Thank you!

Your download email will arrive shortly

Not ready to buy yet? Download a free sample

We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form

By GlobalData
Visit our Privacy Policy for more information about our services, how we may use, process and share your personal data, including information of your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.

Enforcement of the rules could begin as soon as 15 December, 2023. Organisations will need to include the disclosures in their 10-K filings for fiscal year 2023. With the new rules in place, corporate board of directors and Chief Information Security Officers need to be brought up to speed on the disclosure requirements. It is also essential that they understand all the processes they have in place to guard against incidents that could harm the business significantly from operations, reputation, and financial perspectives.