Morrison Foerster is an international law firm with lawyers practicing throughout the United States, Asia, and Europe. Click to discover more.

mofo_share_image.jpg

Morrison Foerster

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Terms / Notices

Cookies

Privacy Policy

Attorney Advertising

Secure Login

Alumni

  Facebook

MoFo Facebook

  Linkedin

MoFo LinkedIN

Twitter

MoFo Twitter

YouTube

MoFo Youtube

Morrison Foerster - Footer

You have not solved the recaptcha challenge yet or session expired, try again.

Disclaimer

Unsolicited e-mails and information sent to Morrison Foerster will not be considered confidential, may be disclosed to others pursuant to our <a href="https://www.mofo.com/about/privacy-policy.html">Privacy Policy</a>, may not receive a response, and do not create an attorney-client relationship with Morrison Foerster. If you are not already a client of Morrison Foerster, do not include any confidential information in this message. Also, please note that our attorneys do not seek to practice law in any jurisdiction in which they are not properly authorized to do so.

Feedback

mofo-logo-2022.svg

People

Capabilities

Resources

About

Culture

Offices

Careers

Stay Connected

In an unusual step that appears to indicate renewed, if not intensified, scrutiny of public companies’ cybersecurity practices by the Securities and Exchange Commission (SEC), the SEC’s five commissioners unanimously issued guidance (the “Guidance”) on February 21, 2018 covering a range of cybersecurity topics including disclosure obligations, board oversight and risk management controls.

SEC Publishes New Guidance on Cybersecurity Disclosures and Compliance Practices

About Morrison Forester

people-default-header-desktop.jpg

people-default-header-mobile.jpg

Default Meta Data

In an unusual step that appears to indicate renewed, if not intensified, scrutiny of public companies’ cybersecurity practices by the Securities and Exchange Commission (SEC), the SEC’s five commissioners unanimously issued <a href="https://www.sec.gov/rules/interp/2018/33-10459.pdf" target="_blank">guidance</a> (the “Guidance”) on February 21, 2018 covering a range of cybersecurity topics including disclosure obligations, board oversight and risk management controls. The SEC staff had issued guidance regarding cybersecurity disclosure in <a href="https://www.sec.gov/divisions/corpfin/guidance/cfguidance-topic2.htm" target="_blank">October 2011</a>. While the Commission issued the Guidance unanimously, it is important to note that <a href="https://www.sec.gov/news/public-statement/statement-stein-2018-02-21" target="_blank">two</a> of <a href="https://www.sec.gov/news/public-statement/statement-jackson-2018-02-21" target="_blank">the</a> commissioners have released public statements expressing reserved support for the Guidance, but noting that it in large part recapitulates information already presented in 2011 by the SEC’s Division of Corporation Finance.Public companies should closely review the Guidance for the additional details it provides regarding key disclosure obligations:<ul><li>Disclosures regarding cybersecurity threats and practices should be integrated throughout a company’s periodic reports, including the Risk Factors, Management’s Discussion & Analysis, Description of Business, Legal Proceedings, and Financial Statements Disclosures sections. “Companies should avoid generic cybersecurity-related disclosures and provide specific information that is useful to investors.”<a id="_ftnref1" name="_ftnref1" href="#_ftn1" class="anchor">[1]</a> The Guidance also advised public companies to consider their disclosure regarding Board oversight of the management risks relating to cybersecurity matters.</li><li>While companies are not required to make specific technical disclosures that would compromise their security efforts and while the SEC recognizes that additional details may come to light in the course of ongoing security investigations, companies should make every effort to provide timely disclosures with the information at their disposal so that the public can make informed investment decisions.</li></ul>The Guidance also touches upon two areas not previously discussed by the SEC:<ul><li>Companies are encouraged to adopt, implement and regularly update comprehensive cybersecurity risk management policies. Importantly, these policies should specify disclosure controls and procedures that ensure that relevant information regarding cybersecurity threats and developments are channeled to the right personnel, both for purposes of assessing risk and determining disclosures obligations. There should, in particular, be a free flow of information up the corporate ladder to senior management.</li><li>Information about cybersecurity risks and practices may be material nonpublic information and, therefore, companies should be mindful of applicable insider trading laws when drafting codes of conduct, designing trading black-out periods and otherwise implementing executive trading policies.</li></ul>In July 2017, SEC Chairman Jay Clayton gave a speech at the Economic Club of New York that many interpreted as signaling a more cooperative enforcement posture by the SEC (“Being a victim of a cyber penetration is not, in itself, an excuse. But, I think we need to be cautious about punishing responsible companies who nevertheless are victims of sophisticated cyber penetrations”<a id="_ftnref2" name="_ftnref2" href="#_ftn2" class="anchor">[2]</a>).TakeawaysThe extent to which this newly published Guidance will have a direct impact on enforcement is still not clear, but companies are advised to:<ul><li>make cybersecurity training and compliance a priority company-wide; </li><li>review their existing periodic filing disclosures for completeness and timeliness; </li><li>confirm that existing policies and practices include appropriate and timely notification to senior leaders; and </li><li>update their insider trading policies as necessary to expressly contemplate cybersecurity risks as potentially material nonpublic information.</li></ul> <div data-type='hr' style='border-top: 3px solid #bbb'></div> <a id="_ftn1" name="_ftn1" href="#_ftnref1" class="offset">[1]</a> <a href="https://www.sec.gov/rules/interp/2018/33-10459.pdf" target="_blank">https://www.sec.gov/rules/interp/2018/33-10459.pdf</a><a id="_ftn2" name="_ftn2" href="#_ftnref2" class="offset">[2]</a> <a href="https://www.sec.gov/news/speech/remarks-economic-club-new-york" target="_blank">https://www.sec.gov/news/speech/remarks-economic-club-new-york</a>

SEC Publishes New Guidance on Cybersecurity Disclosures and Compliance Practices