The SEC adopted new Item 106 of Regulation S-K to require disclosure related to company cybersecurity risk management, strategy, and governance. Item 106 disclosures will be required in the ...

However, the rules only require disclosures “in sufficient detail for a reasonable investor to understand those processes.” (See 17 C.F.R. 229.106(b)(1)).They do not require intimate details ...

On Dec. 14, 2023, Erik Gerding, director of the U.S. Securities Exchange Commission's (SEC) Division of Corporation Finance, made a statement on cybersecurity disclosure in connection with SEC ...

The "Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure" from the Securities and Exchange Commission (SEC) is now in effect, and organizations need to start thinking ...

On December 18, 2023, the US Securities and Exchange Commission’s (SEC) new rules enhancing and standardizing disclosures regarding cybersecurity risk management, strategy, governance, and ...

Smaller reporting companies will have an additional 180 days before providing the Form 8-K disclosure. In March 2022, the SEC issued proposed rules, rule amendments, and form amendments regarding ...

On July 26, 2023, the SEC issued its final rules for companies disclosing key information regarding cyber risk. The final rules address concerns over investor access to timely and consistent ...

Cybersecurity is also poised to remain a key priority for the SEC in 2024; indeed, the SEC is engaged in rulemaking activity regarding new cybersecurity risk management requirements for broker ...

Implications of the Cybersecurity Governance Disclosure Requirements. The proposed amendments to Form 10-K also suggest that the SEC is seeking to encourage companies to ensure that their boards ...

New cybersecurity disclosure requirements mandated by the U.S. Securities and Exchange will go into force in coming days, requiring companies to disclose cybersecurity incidents, with some exceptions, ...

The SEC’s Cybersecurity Risk Management rule, published in July 2023, requires companies to rapidly disclose cybersecurity incidents such as data breaches or hacks.