Publicly traded companies that suffer a significant hack will need to disclose the incident within four business days, according to new rules from the Securities and Exchange Commission.
The SEC today voted 3-2 to adopt the new rules, which are designed to bolster investor transparency at a time when cyberattacks have become commonplace.
“Currently, many public companies provide cybersecurity disclosure to investors," SEC Chair Gary Gensler said in the announcement. “I think companies and investors alike, however, would benefit if this disclosure were made in a more consistent, comparable, and decision-useful way.”
Specifically, companies will need to disclose “material cybersecurity incidents they experience," which means hacks that cover a significant amount of money or business. In addition, they will need to report the hack “four business days” after the incident is deemed to be material.
Four days is a short amount of time, but the SEC says the deadline is “workable” since companies will only need to supply an “incident’s basic identifying details and its material impact or reasonably likely material impact.”
The only exception is for computer hacks that affect national security. “The disclosure may be delayed if the United States Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the Commission of such determination in writing,” the SEC says.
If this occurs, a company could delay the breach up to 30 or 60 days. Hence, if a company still needs time to patch a software vulnerability that facilitated the hack, they theoretically could file for an extension.
The other major rule enacted involves a publicly traded company's overall cybersecurity stance. The SEC is requiring firms to describe their efforts to fend off cyberthreats and what kind of material impacts the dangers could have on their businesses.
Although companies do often report cybersecurity incidents voluntarily, the SEC rule promises to prevent firms across the industry from potentially burying information about lesser-known hacks. The rules are expected to take effect by year's end.
Amit Yoran, CEO of the cybersecurity company Tenable, says the new rules should push companies to treat IT security as a “must have,” instead of merely as a luxury. “This is a dramatic step toward greater transparency and accountability and will greatly improve our cybersecurity preparedness as a nation,” he says. “In many ways, the SEC’s rule will regulate what companies should have been implementing in the first place: good cyber hygiene.”