BY: Joshua Stein, RBFL Student Editor<\/p>\n
Since the internet boom in the early 2000\u2019s, cybersecurity risks have developed into significant threats to investors, markets, and the economy in general. This article explores the possible changes to regulations regarding cybersecurity and their effects on the public sector. The article largely focuses on SEC guidance surrounding cybersecurity and anticipates the upcoming SEC guidance by analyzing recent government actions dealing with the topic.<\/span><\/p>\n In the past decade, the SEC has continuously monitored these \u201cnew age\u201d threats of security related to technology, proposing rules for corporations to follow to avoid potential attacks and limit the consequences of these attacks. The goal of the SEC in implementing these new rules is to create transparency for investors and other interested parties by eliminating elective disclosures and deterring corporations from refraining from disclosing material information.<\/span><\/p>\n In October 2011, the SEC\u2019s Division of Corporation Finance issued its first guidance on the topic, stating that \u201c[a]lthough no existing disclosure requirement explicitly refers to cybersecurity risks and cyber incidents,\u201d companies nonetheless may be obligated to disclose such risks and incidents. In 2018, the SEC offered two additional recommendations to address developments in the cyber space following 2011. The guidance stressed the \u201cimportance of maintaining comprehensive policies and procedures related to cybersecurity risks and incidents\u201d and reminded companies and their \u201cdirectors, officers, and other corporate insiders of the applicable insider trading prohibitions under the general antifraud provisions of the federal securities laws.\u201d In particular, the SEC pointed to the \u201cobligation to refrain from making selective disclosures of material nonpublic information about cybersecurity risks or incidents.\u201d<\/span><\/p>\n The updated SEC guidance is expected to be released in 2022 after being pushed back from Fall 2021, and although there is not much available information about the new rules yet, we can speculate on certain policy points based on recent actions by the government. Recently, Congress enacted <\/span>The Cybersecurity Information Sharing Act of 2015 and the Internet of Things Cybersecurity Improvement Act of 2020. While the 2020 Act is focused on government agencies and employees, it is based on the 2015 Act which established certain protections to \u201cencourage companies voluntarily to share information\u2014specifically, information about \u2018cyber threat indicators\u2019 and \u2018defensive measures\u2019\u2014with the federal government, state and local governments, and other companies and private entities.\u201d <\/span>President\u2019s Biden\u2019s Executive Order on Improving the Nation\u2019s Cybersecurity (Cyber EO) from May of 2021 also offered insight into the upcoming SEC rules, though it did not focus on security of consumer products.<\/span><\/p>\n Beyond direct guidance offered by the SEC, early enforcement trends from SEC Chairman Gary Gensler provide a picture of how his administration will act towards cybersecurity concerns. Gensler has already shifted the SEC\u2019s focus further towards disclosure violations since he was sworn into the Chairman position in April 2021. In June 2021, the SEC settled charges with First American Financial Corporation in \u201cone of the first instances in which the SEC had brought charges in the absence of an actual data breach or intrusion by a third party.\u201d Gensler has made it clear that cybersecurity will be a priority for the SEC, and strict enforcement of disclosure rules will become routine as technology continues to develop.<\/span><\/p>\n As blockchains, cryptocurrencies, and other advances in business and technology move the operations of corporations to digital mediums, cyberattacks become a greater threat to investors and the corporations they invest in. While the atmosphere of cybersecurity within the financial sector is continuously changing, the upcoming SEC proposal should provide increased insight into the path that the government is taking to educate corporations and investors to prevent the threat.<\/span><\/p>\n <\/p>\n \u00a0Citations<\/b><\/p>\n Commission Statement and Guidance on Public Company Cybersecurity Disclosures<\/span>, 17 C.F.R. \u00a7\u00a7 229, 249 (Sec. Exch. Comm\u2019n, Feb. 26, 2018).<\/span><\/p>\n Vivek Mohan, David Simon & Richard Rosenfeld, <\/span>SEC Increasingly Turns Focus Toward Strength of Cyber Risk Disclosures<\/span><\/i>, <\/span>Harv. L.F. on Corp. Governance<\/span> (July 25, 2021). <\/span>https:\/\/corpgov.law.harvard.edu\/2021\/07\/25\/sec-increasingly-turns-focus-toward-strength-of-cyber-risk-disclosures\/<\/span><\/a> [https:\/\/perma.cc\/4YBA-JGNF].<\/span><\/p>\n Our goals<\/span><\/i>, U.S. <\/span>Sec. Exch. Comm\u2019n<\/span>,<\/span> https:\/\/www.sec.gov\/our-goals (Oct. 16, 2018)) [https:\/\/perma.cc\/ZH9C-MTGL]<\/span><\/p>\n CF Disclosure Guidance: Topic No. 2 \u2013 Cybersecurity, U.S. <\/span>Sec. Exch. Comm\u2019n<\/span> (Oct. 13, 2011),\u00a0 <\/span>https:\/\/www.sec.gov\/divisions\/corpfin\/guidance\/cfguidance-topic2.htm<\/span><\/a> [https:\/\/perma.cc\/KWX5-5BQH].<\/span><\/p>\n Rajesh De Et Al., <\/span>President Biden Issues Executive Order to Improve Nation\u2019s Cybersecurity<\/span><\/i>, <\/span>Mayer Brown<\/span>, (May 17, 2021), <\/span>https:\/\/www.mayerbrown.com\/en\/perspectives-events\/publications\/2021\/05\/president-biden-issues-executive-order-to-improve-nations-cybersecurity<\/span><\/a> [https:\/\/perma.cc\/ZJ27-9MMT]<\/span><\/p>\n