New cybersecurity reporting requirements for publicly traded companies are expected to be enacted in the spring of 2023, with proposed rules from the US Securities and Exchange Commission (SEC) looking for more information and transparency from those hit with security incidents.
Under the proposal, the SEC would implement three new rules that public companies will need to follow:
A requirement that companies report any cybersecurity event within four business days of determining that it was a material incident.
Mandatory disclosures regarding the board of directors’ oversight of cybersecurity risk as well as details about the cybersecurity expertise and experience of individual board members.
Mandatory disclosures about management’s role in addressing cybersecurity risk.
The SEC action has — or should have — security leaders, their C-suite colleagues, and board directors prepping for the new steps they’ll have to follow. And it should have executives at private companies and other entities taking note, as the SEC action could have a trickle-down impact.
To read this article in full, please click here
