Cybersecurity Risk Governance on SEC Agenda

On June 11, 2021, the Office of Information and Regulatory Affairs (“OIRA”), a part of the Office of Management and Budget and the U.S. Government’s central authority for reviewing Executive Branch regulations, released the Spring 2021 Unified Agenda of Regulatory and Deregulatory Actions.  The purpose of the OIRA Agenda is to report on short and long-term actions which administrative agencies anticipate issuing, while providing transparency on proposed regulatory and deregulatory actions in the Executive Branch.  The Securities and Exchange Commission (“SEC”) contributed to the OIRA Agenda.   

As concerns the SEC, one of the areas addressed in the Agenda was cybersecurity risk governance.  Specifically, the Division of Corporation Finance of the SEC considered recommending that the SEC propose rule amendments aimed at enhancing issuer disclosures as they relate to cybersecurity risk governance.  This proposed recommendation comes amidst an increase in the frequency, scope, sophistication, and harmful effects of cyberattacks generally over the last several years, as well as approximately one month after President Biden issued an Executive Order aimed at enhancing the nation’s cybersecurity.  As has been made readily apparent, cyberattacks can lead to myriad of problems, including the shutdown of private and public services (including those essential to the public) and both the compromising and disclosing of confidential information.  

The Spring 2021 OIRA Unified Agenda of Regulatory and Deregulatory Actions can be found here.  The particular rule under consideration concerning cybersecurity risk governance can be found here.