SEC Guidance On Cybersecurity For Public Companies

On February 21, 2018, the United States Securities and Exchange Commission (“SEC”) issued guidance regarding cybersecurity-related procedures and disclosures for public companies (the “2018 Release”).  The 2018 Release reinforces and expands guidance that the SEC provided in 2011.  Additionally, the 2018 Release addresses two topics that were not developed in the 2011 guidance, specifically the importance of cybersecurity policies and procedures and the application of insider trading prohibition in the cybersecurity context.

The 2018 Release emphasizes that officers and directors must implement comprehensive controls and procedures for the purposes of guarding against cybersecurity risks and incidents.  Officers and directors must then oversee and regularly assess the adequacy of the procedures and the company’s compliance with such procedures. Companies must also prepare adequate financial statement disclosures regarding cybersecurity risks and incidents.  As part of the disclosure requirements, a company’s principal executive officer and principal financial officer are required to sign certifications regarding the design and effectiveness of controls and procedures.  These certifications must incorporate controls and procedures related to cybersecurity risks and incidents.  The 2018 Release also instructs directors, officers and other corporate insiders to not trade a public company’s securities while in possession of material cybersecurity related information.  The SEC Release can be found here.  A statement from SEC Chairman Jay Clayton can be found here.