2022-05480: Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure

Summary

The Securities and Exchange Commission ("Commission") is proposing rules to enhance and standardize disclosures regarding cybersecurity risk management, strategy, governance, and cybersecurity incident reporting by public companies that are subject to the reporting requirements of the Securities Exchange Act of 1934. Specifically, we are proposing amendments to require current reporting about material cybersecurity incidents. We are also proposing to require periodic disclosures about a registrant's policies and procedures to identify and manage cybersecurity risks, management's role in implementing cybersecurity policies and procedures, and the board of directors' cybersecurity expertise, if any, and its oversight of cybersecurity risk. Additionally, the proposed rules would require registrants to provide updates about previously reported cybersecurity incidents in their periodic reports. Further, the proposed rules would require the cybersecurity disclosures to be presented in Inline eXtensible Business Reporting Language ("Inline XBRL"). The proposed amendments are intended to better inform investors about a registrant's risk management, strategy, and governance and to provide timely notification of material cybersecurity incidents.

The agency’s own summary, as published.

What this changes

Amends 5 parts of the Code of Federal Regulations — the standing rules this notice rewrites.

• 17 CFR 229 Standard Instructions for Filing Forms Under Securities Act of 1933, Securities Exchange Act of 1934 and Energy Policy and Conservation Act of 1975—Regulation S-K
• 17 CFR 232 Regulation S-T—General Rules and Regulations for Electronic Filings
• 17 CFR 239 Forms Prescribed Under the Securities Act of 1933
• 17 CFR 240 General Rules and Regulations, Securities Exchange Act of 1934
• 17 CFR 249 Forms, Securities Exchange Act of 1934