Access your Pro+ Content below.
SEC guidance clarifies cybersecurity disclosure requirements
This article is part of the Information Security magazine issue of December 2011
Recent guidance from the U.S. Securities and Exchange Commission on disclosure of cybersecurity risks and incidents puts the spotlight squarely on enterprise cybersecurity and could help security professionals at publicly traded companies win funding for projects, experts say. Released in October, the guidance from the SEC’s Division of Corporate Finance makes it clear that companies must factor cybersecurity risks and incidents into their SEC disclosures. Companies should disclose “the risk of cyber incidents if these issues are among the most significant factors that make an investment in the company speculative or risky,” according to the guidelines. In order to determine whether disclosure is required, the SEC says companies should take into account a number of factors, including prior incidents, the potential costs and consequences of data theft or operational disruption resulting from a breach, and the adequacy of preventative actions to reduce risk. The SEC advises companies to avoid generic “boilerplate” disclosure, but ...
Access this PRO+ Content for Free!
Features in this issue
Companies need to factor security risks and incidents in their financial disclosures, agency says.
As the relative security of passwords falters, are they destined for obscurity?
EDRM brings users into security more than any other tool. Are you ready?
Researcher tells a firsthand account of her experience as a member of the final security review team for Windows Vista.
Columns in this issue
Lawmakers continue to wrangle over creation of a national data breach notification standard.
If you’re going to lure topnotch talent, refine your skills.
Cloud computing needs security standards and widely adopted security practices in order to become a viable choice for the enterprise.