New SEC Rule Sets 4-Day Clock on Cyber Disclosures

Miriam Wugmeister and Dave Lynn spoke to Agenda about the Securities and Exchange Commission’s (SEC) new cybersecurity rule, which puts a hard timeline on when companies must publicly disclose material cybersecurity incidents, one of the more complex aspects of the final rule that companies had been eyeing.

According to Dave, companies are being attacked by cyber criminals “all the time.”

“It takes a while, once you even identify the breach, to figure out what’s happening,” Dave said. “It could take days, it could take weeks, it could take months. …And then once you at least have some knowledge about the incident, you can apply the materiality thresholds and tests to try to decide if it’s material.”

Miriam added that the four-day window to disclose a cybersecurity event once it is deemed material is daunting because, when a company is in crisis, “the facts are literally changing every couple hours.”

“So you’re trying to make a materiality determination while the facts are changing,” she said. “And it’s always hard to make decisions when the facts are changing or when they’re uncertain.”

Read the full article (subscription required).