FILE - The seal of the U.S. Securities and Exchange Commission at SEC headquarters, June 19, 2015, in Washington. The SEC adopted rules Wednesday, July 26, 2023, to require public companies to disclose within four days all cybersecurity breaches that could affect their bottom lines. Delays will be permitted if immediate disclosure poses serious national security or public safety risks.
“Whether a company loses a factory in a fire — or millions of files in a cybersecurity incident — it may be material to investors,” SEC Chair Gary Gensler said in a statement, noting the current inconsistency in disclosures. Technically, the clock doesn't start ticking on the four-day window for reporting until companies have determined a breach is material.the new requirements overstep the SEC's authority and “seem designed to better meet the needs of would-be hackers” - who could benefit from detailed info on how companies manage cyberrisk.
The rules were first proposed in March 2022, when the SEC determined that breaches of corporate networks posed an escalating risk as their digitization of operations and remote work increased — and the cost to investors from cybersecurity incidents rose.