SEC Focuses on Cybersecurity for Public Companies, Proposes Rules to Enhance Cybersecurity for Advisers and Funds

The effort to keep up in the cybersecurity race seems to be a constant challenge for everyone these days.  

In a speech this past January to the Northwestern Pritzker School of Law’s Annual Securities Regulation Institute, U.S. Securities and Exchange Commission Chair Gary Gensler focused on the importance of cybersecurity, including the prevalence of cyber incidents and how the SEC was “working to improve the overall cybersecurity posture and resiliency of the financial sector.” Part of Chair Gensler’s focus was on public companies, specifically their disclosure of cyber attacks and cyber risk. To this end, Chair Gensler stated that he had “asked staff to make recommendations for the Commission’s consideration around companies’ cybersecurity practices and cyber risk disclosures”, which “may include their practices with respect to cybersecurity governance, strategy, and risk management.” Critically, Chair Gensler had asked his staff for recommendations concerning “whether and how to update companies’ disclosures to investors when cyber events have occurred”, noting recent cases (including a case covered in this blog) where a failure to accurately disclose cyberattacks and risks led to enforcement actions. 

A transcript of the SEC Chair’s speech can be found here.

A rule seeking to enhance a public company’s disclosure requirements as they relate to cyberattacks and a company’s cybersecurity preparedness could have significant consequences, including for those companies who fail to comply. Certainly, it should come as no surprise that the SEC may demand more transparency and more robust cybersecurity preparedness in order to better ensure that peoples’ personal private information is protected and that cybersecurity attacks are either successfully defended against or are significantly mitigated. Indeed, cybersecurity continues to be on the forefront of the SEC’s agenda, as evident not only by the recent enforcement actions by the SEC’s Cyber Unit and by Chair Gensler’s recent speech, but also by the recent proposal of rules aimed at enhancing cybersecurity which would require advisers and funds to, amongst other things, “publicly disclose cybersecurity risks and significant cybersecurity incidents that occurred in the last two fiscal years in their brochures and registration statements” (the recent rule proposals can be found here).