Pro+ Content/Information Security magazine

Thank you for joining!
Access your Pro+ Content below.
December 2011

SEC guidance clarifies cybersecurity disclosure requirements

Recent guidance from the U.S. Securities and Exchange Commission on disclosure of cybersecurity risks and incidents puts the spotlight squarely on enterprise cybersecurity and could help security professionals at publicly traded companies win funding for projects, experts say. Released in October, the guidance from the SEC’s Division of Corporate Finance makes it clear that companies must factor cybersecurity risks and incidents into their SEC disclosures. Companies should disclose “the risk of cyber incidents if these issues are among the most significant factors that make an investment in the company speculative or risky,” according to the guidelines. In order to determine whether disclosure is required, the SEC says companies should take into account a number of factors, including prior incidents, the potential costs and consequences of data theft or operational disruption resulting from a breach, and the adequacy of preventative actions to reduce risk. The SEC advises companies to avoid generic “boilerplate” disclosure, but ...

Access this Pro+ Content for Free!

By submitting you agree to recieve email from TechTarget and its partners. If you reside outside of the United States you consent to having your personal data transferred and processed in the United States. Privacy Policy

Features in this issue

Columns in this issue

SearchCloudSecurity

SearchNetworking

SearchCIO

SearchConsumerization

SearchEnterpriseDesktop

SearchCloudComputing

ComputerWeekly

-ADS BY GOOGLE

Close