The Securities and Exchange Commission is set to vote on a rule that would require companies to report major cybersecurity incidents within four days.
Photo:
Al Drago/Bloomberg News
WASHINGTON—Federal regulators are considering a requirement that publicly traded companies disclose data breaches and other significant cybersecurity incidents within four days, as they seek to strengthen financial markets’ resilience to online attacks.
The Securities and Exchange Commission is set to propose a rule that would impose mandatory reporting for companies around cybersecurity. The agency’s four commissioners—three Democrats and one Republican—will vote on the proposal in a public meeting Wednesday. If the proposal is approved, it could be finalized after the agency receives and analyzes feedback from the public.
“Cybersecurity incidents, unfortunately, happen a lot,” SEC Chair
Gary Gensler
said in prepared remarks, noting that successful attacks affect companies’ finances, operations and reputations. “Thus, investors increasingly seek information about cybersecurity risks, which can affect their investment decisions and returns.”
SHARE YOUR THOUGHTS
Do you support tougher rules to regulate crypto? Join the conversation below.
Companies have long been required to tell the market about risks and incidents they deem to be material to investors, and the SEC has reminded them in recent years to do so in a timely fashion with regards to cybersecurity. But agency officials say companies’ disclosure of such information has been inconsistent.
Wednesday’s proposed rules would be more prescriptive, officials said.
In addition to reporting major cybersecurity events within four days after uncovering them, companies would be required to provide periodic updates about previous incidents. They would also have to report when “a series of previously undisclosed, individually immaterial cybersecurity events has become material in the aggregate.”
Annual reports would also have to outline a firm’s policies for identifying and managing cybersecurity risks, and say whether any member of its board of directors has expertise in cybersecurity.
The SEC will solicit comments on the proposal for at least 60 days before deciding whether to issue a final rule.
Copyright ©2022 Dow Jones & Company, Inc. All Rights Reserved. 87990cbe856818d5eddac44c7b1cdeb8
For all the latest Technology News Click Here
For the latest news and updates, follow us on Google News.