U.S. SEC Incident Reporting and Management Oversight

In December 2023, the U.S. Securities and Exchange Commission (SEC) made final rules requiring publicly traded companies to standardize disclosures regarding cybersecurity risk management, strategy, governance, and incident reporting. These rules are designed to improve transparency for investors and ensure that organizations treat cybersecurity as a critical component of corporate governance and enterprise risk management. The goal is also to encourage organizations to strengthen internal risk management and oversight mechanisms and promote timely reporting of material cybersecurity incidents that could impact financial or operational performance.

These requirements include:

• Cyber Incident Reporting: Public companies must disclose any material cybersecurity incident via Form 8-K, Item 1.05, within four business days of determining materiality, including the material impact on the company’s financial operations or reputation in protecting shareholder value.
• Annual Risk and Governance Disclosures: Companies must include in their annual reporting (Form 10-K or Form 20-F for FPIs) the processes for identifying and managing cyber risks and threats. This includes how cybersecurity affects business strategy and operations, as well as the organization’s overall financial condition, to ensure shareholders are informed about the company’s cyber hygiene.
• Board and Leadership Oversight: The board of directors and executive management must demonstrate oversight of cybersecurity risks. This includes clearly defined reporting lines and accountability mechanisms for the CIO, CISO, and security teams.

Navigating new and evolving cybersecurity regulations can be daunting, making compliance a complex challenge. In this high-stakes environment, seeking guidance from industry leaders is essential. SANS stands at the forefront of cybersecurity preparedness, offering deep expertise and immersive training to help organizations meet and exceed regulatory requirements. From breach disclosure protocols to enhancing organizational cyber resilience, SANS provides the strategic knowledge and tools needed to achieve compliance while strengthening defenses against current and future cybersecurity threats.