SEC Statement and Interpretive Guidance on Public Company Cybersecurity Disclosures- Disclosure of cyber-related matters may be required in a company’s business description where they affect a company’s products, services, relationships with customers and suppliers or competitive conditions. Likewise, material litigation would need to be included in the “legal proceedings” section of a periodic report or registration statement. The litigation disclosure should include any proceedings that relate to cybersecurity issues. Cyber-matters may need to be included in a company’s financial statements prior to, during and/or after an incident. Costs to prevent cyber-incidents are generally capitalized and included on the balance sheet as an asset. GAAP provides for specific recognition, measurement and classification treatment for the payment of incentives to customers or business relations, including after a cyber-attack. Cyber-incidents can also result in direct losses or the necessity to account for loss contingencies, including those related to warranties, direct loss of revenue, providing customers with incentives, breach of contract, product recall and replacement, indemnification or remediation. Incidents can result in loss of, and therefore accounting impairment to, goodwill, intangible assets, trademarks, patents, capitalized software and even inventory. Financial statement disclosure may also include expenses related to investigation, breach notification, remediation and litigation, including the costs of legal and other professional service providers. A company must disclose the extent of its board of directors’ role in the risk oversight of the company, such as how the board administers its oversight function and the effect this has on the board’s leadership structure. To the extent cybersecurity risks are material to a company’s business, this discussion should include the nature of the board’s role in overseeing the management of that risk. Information should also be included on how the board engages with management on cybersecurity risk management. The new guidance clearly provides that companies should adopt comprehensive policies and procedures related to cybersecurity and to assess their compliance regularly, including policy/procedure compliance related to the sufficiency of disclosure controls and procedures. Procedures must address a company’s ability to record, process, summarize and report financial and other information in SEC filings. Additionally, any deficiency in these controls and procedures should be reported. The SEC reminds companies that their principal executive officer and principal financial officer must make individual certifications regarding the design and effectiveness of disclosure controls and procedures. These certifications should take into account cybersecurity-related controls and procedures. Furthermore, as discussed in this Lawcast series, a company should have proper policies and procedures preventing officers, directors and other insiders from trading on material nonpublic information related to cybersecurity risks and incidents. Companies may have disclosure obligations under Regulation FD related to cybersecurity matters. Under Regulation FD, “when an issuer, or person acting on its behalf, discloses material nonpublic information to certain enumerated persons it must make public disclosure of that information.” The SEC reminds companies that these requirements also relate to cybersecurity matters and that, along with all the other disclosure requirements, policies and procedures should specifically address any disclosures of material non-public information related to cybersecurity. #LegalAndComplianceLLC

SEC Statement and Interpretive Guidance on Public Company Cybersecurity Disclosures

Cybersecurity, IT & SOFTWARE, System Security

tutorial

212 - How to Make a Wood-Geared Clock

9 min

CRAFTS

tutorial

Database Security Concepts

English 5 min

Global Hub for Vocational Education Training!

Your search is running...

SEC Statement and Interpretive Guidance on Public Company Cybersecurity Disclosures

Your notes

Comments

Related videos

The Deep Web Explained

Cybersecurity, IT & SOFTWARE, System Security

212 - How to Make a Wood-Geared Clock

CRAFTS

Database Security Concepts

Cybersecurity, System Security, IT & SOFTWARE

Your search is running...

Tutorial infos

SEC Statement and Interpretive Guidance on Public Company Cybersecurity Disclosures

Your notes

Comments

Related videos

The Deep Web Explained

Cybersecurity, IT & SOFTWARE, System Security

212 - How to Make a Wood-Geared Clock

CRAFTS

Database Security Concepts

Cybersecurity, System Security, IT & SOFTWARE