policy · 1690329600000

SEC Adopts New Cybersecurity Disclosure Rules

The US SEC adopted rules requiring public companies to disclose material cybersecurity incidents within four days.

What happened

The SEC finalized rules for cybersecurity risk management, strategy, governance, and incident disclosure.

Technical mechanism

Regulatory requirement.

Why it matters

Fundamentally changed how and when public companies must report cyber incidents.

Impact

Increased transparency but also pressure on incident response teams.

Response

Companies updated incident response plans to meet the 4-day deadline.

Defensive lessons

  • Integrate legal and IR teams
  • Define materiality early

Evidence register

  1. US SEC — SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies (verified)