Describe your board’s cyber oversight in a filing, and you have made a promise

The week

Most rules about cybersecurity tell companies what to do. The proposal the Securities and Exchange Commission published in March 2022 did something subtler. It asked public companies to say, in writing and under securities law, what they already do. That turns out to be a much bigger ask than it sounds.

On March 9, 2022, the SEC, the federal agency that oversees public companies and the information they give investors, proposed rules on cybersecurity risk management, strategy, governance and incident disclosure for public companies. The commission approved the proposal by a vote of three to one, with Commissioner Hester Peirce dissenting. Her dissent argued that parts of the proposal, especially the director expertise item, edged from disclosure toward telling companies how to organize themselves.

The proposal did not come from nowhere. In 2011, the SEC’s Division of Corporation Finance had issued staff guidance on how existing disclosure rules applied to cyber risks and incidents. In 2018, the commission itself issued interpretive guidance that reinforced and expanded it, including on cybersecurity policies and on insider trading around incidents. The SEC’s own assessment was that disclosure had improved since then but remained inconsistent from company to company. A month earlier, on February 9, the commission had proposed separate cybersecurity rules for registered investment advisers and funds.

The headline element was speed. Companies would disclose material cybersecurity incidents on Form 8-K within four business days of determining that an incident was material, and update that disclosure in their periodic reports. Form 8-K is the short filing a public company uses to tell investors about significant events between its regular quarterly and annual reports. “Material” is a legal term with a practical meaning: information a reasonable investor would consider important when deciding whether to buy, sell or hold the stock. The clock would start not when an attack happened, but when the company decided it was material. The proposal also asked companies to disclose when a series of individually immaterial incidents had become material in the aggregate.

The proposed 8-K item set out what a filing would contain. A company would say when the incident was discovered and whether it was ongoing, and describe its nature and scope. It would say whether data had been stolen, altered, accessed or misused, what effect the incident had on operations, and whether it had been remediated. The proposal offered no delay for an ongoing law enforcement investigation, a point that drew sharp objections from companies and some security specialists.

The second element got less attention but reached further. Every year, companies would describe their policies and procedures, if any, for identifying and managing cybersecurity risk. They would say whether they considered cybersecurity as part of business strategy, financial planning and capital allocation. They would describe management’s role and expertise, and the board’s oversight. Foreign private issuers would make comparable disclosures in their own annual and current reports.

The third element was the most provocative. As proposed, companies would disclose whether any director had cybersecurity expertise, naming the director and describing the expertise. For boards that had treated cyber as a technical matter for management, that was a pointed question to have to answer in public.

A less noticed detail mattered too. The disclosures would be tagged in Inline XBRL, the machine-readable format the SEC uses for financial data. Tagged text can be pulled, compared and analyzed across thousands of companies at once.

The comment period, the window during which anyone can send the agency views on a proposed rule, opened that month. On the same day, President Biden signed an executive order on digital assets. Days later, on March 15, a separate federal law gave CISA authority to require critical infrastructure operators to report significant cyber incidents. Incident reporting was arriving from several directions at once.

The SEC proposal raised a question that was easy to state and harder to answer honestly. If you had to describe your company’s cyber governance in a legal filing, could you stand behind every sentence?

The four-business-day incident deadline drew most of the debate. The governance disclosures drew less, but they reached every public company every year, whether or not it ever had a material incident. Publicly traded banks, health care companies and the technology firms that serve banks, health systems and agencies would all have to put their cyber governance in writing, in a document governed by securities law.

A description of practice in an annual report is a statement the company is answerable for. If practice falls short, the description is the evidence.

The argument runs through six parts. The first separates the governance layer from the technical one. The second sets out what the proposal asked companies to describe. The third explains why a description becomes evidence, and the fourth how governance connects to the incident clock. The fifth covers what a board needs to see to oversee cyber risk, including the dispute over director expertise. The sixth follows the effects beyond public companies. A short test of readiness closes the piece.

Two layers: the server room and the boardroom

Cybersecurity has two layers that are easy to confuse. The first is the technical layer: firewalls, passwords, software updates, monitoring tools, the things a security team installs and runs. The second is the governance layer: who is responsible, how decisions get made, how much risk the organization is willing to accept, and how leaders find out whether the technical layer is actually working.

A useful comparison is financial controls. Nobody expects a board to reconcile the bank accounts. They do expect it to make sure there is a finance function, a chief financial officer, an audit committee, an independent auditor and regular reports that would reveal a problem. Cyber governance applies the same logic. The board does not configure servers. It makes sure someone senior owns the risk, that the risk is assessed, that outside checks happen, and that it hears enough to judge whether the company is exposed.

Reporting lines

The person who typically runs the security function is the chief information security officer, or CISO. In some companies the CISO reports to the chief information officer, in others to the general counsel, the chief risk officer or the chief executive. Those reporting lines matter, because they shape what the board hears and how candidly it hears it.

A CISO who reports to the CIO may find security priorities weighed against delivery deadlines before they reach anyone senior. One who reports to the general counsel may have a clearer path to the board but less influence over technology spending. Neither arrangement is wrong. Each needs a deliberate channel, such as a standing slot at a committee meeting or a direct line to the committee chair, so that unwelcome news is not filtered on the way up. A disclosure that describes the reporting line invites readers to ask about that channel.

What already applied before 2022

Public companies were not free of cyber disclosure duties before the proposal. The general rules on material risks and events already applied, and the SEC had explained how in staff guidance in 2011 and commission guidance in 2018. The 2018 guidance also reminded companies that insiders should not trade on knowledge of an undisclosed incident.

Enforcement had begun to test statements against practice. In 2018, the company formerly known as Yahoo agreed to pay a $35 million penalty to settle SEC charges that it had misled investors by failing to disclose a large data breach. In 2021, the SEC settled with the education company Pearson over disclosures that described a data privacy incident as a hypothetical risk after one had occurred. Also in 2021, it settled with First American Financial over disclosure controls that failed to bring a known vulnerability to senior executives. The proposal built on that pattern. It moved governance from something inferred from general rules to something each company had to describe in a fixed place, every year.

Eight things to put in writing

The proposal asked companies to describe a specific set of things:

• whether the company runs a cybersecurity risk assessment program;
• whether it engages assessors, consultants or auditors;
• whether it has policies for overseeing third-party service providers;
• whether it has business continuity and recovery plans;
• whether cyber risk has affected, or is likely to affect, strategy, results or finances;
• which management positions are responsible, and their expertise;
• how management reports to the board, and how often;
• which board committee, if any, oversees cyber risk.

A risk assessment program is a structured, repeated process for identifying what could go wrong, how likely it is and how much it would hurt. Third-party service providers are the outside companies a business relies on, from cloud hosting to payroll processing, whose security failures can become the business’s own. Business continuity and recovery plans set out how the company keeps critical operations running, and gets them back, after a disruption.

What an incident filing would contain

The proposed 8-K item asked for facts rather than reassurance: when the incident was discovered, its nature and scope, what data was affected, the effect on operations and the state of remediation.

Every one of those answers depends on governance working. Knowing when an incident was discovered requires a log that records it. Describing scope requires forensic capability, in-house or on retainer, that can produce reliable facts quickly. Describing the effect on operations requires the business owners of affected services to be part of the response. A company that could not answer those questions within days of a material determination had a governance problem the filing would expose.

A diagnostic as much as a disclosure

For mature companies, the answers existed but were scattered across policies, committee charters, internal audit reports and the CISO’s slides. For others, the questions were a diagnostic. A company that could not say which executive owned cyber risk, or how often the board discussed it, had a governance gap whatever the final rule said.

The phrase “if any” deserves attention. The proposal did not require a company to have a risk assessment program or a board committee. It required the company to say whether it did. That design relies on disclosure to create pressure. Few companies want to tell investors that they have no program, so the act of describing pushes practice toward the described norm.

Strategy, budgets and the CFO

One item reached into finance. Companies would say whether they considered cybersecurity as part of business strategy, financial planning and capital allocation. That is a question for the chief financial officer as much as the CISO. A company that described cyber as a strategic risk but could not point to any budget or planning decision shaped by it would have a description its own numbers did not support.

Answering well meant tracing a few concrete links. A decision to fund a recovery capability, to delay an acquisition until a target’s security had been assessed, or to buy cyber insurance with defined limits each shows cyber risk shaping a financial decision. Those links also give the board a better basis for oversight than general statements of priority.

Who has to be in the room

The questions also crossed functions. Third-party oversight usually belongs to procurement and vendor management. Continuity plans belong to operations. Strategy and financial impact belong to finance. Gathering accurate answers required a working group that most companies had never convened on this subject, led jointly by the general counsel’s office and the security function.

Machine-readable governance

The Inline XBRL requirement changed the audience. Tagged disclosures can be extracted and compared across every filer by data vendors, investors, insurers, plaintiffs’ firms and the SEC’s own staff. A company whose description is noticeably thinner than its peers’, or that changes from one year to the next without explanation, becomes easier to spot. Governance language that once sat unread in a long annual report would be compared at scale.

When the annual report becomes evidence

Securities law treats material misstatements and omissions seriously, and statements about risk management are no exception. If a company says its board receives quarterly cybersecurity briefings and it emerges after an incident that briefings were annual and brief, the disclosure itself becomes an issue. Plaintiffs’ lawyers, short sellers, journalists and regulators can read the annual description and test it against what an incident reveals. A short seller is an investor who profits when a stock falls, and who therefore has a strong incentive to find gaps between what a company says and what it does.

The drift toward aspiration

That changes who has to sign off and what they need. Disclosure is usually drafted by legal, finance and investor relations staff with a strong instinct toward reassuring language. The security function knows where practice falls short. Unless those groups work together, the description drifts toward aspiration: what the company intends, or would like to be true, rather than what is.

Risk factors show the same hazard in a different form. The Pearson case turned on describing as hypothetical a risk that had already materialized. A risk factor that says a breach “could” happen, written by a company that has had one, is a misleading statement waiting to be discovered. Each annual cycle needs someone to check the risk factors against the incident log.

A three-step discipline

A workable discipline has three steps. Write an honest internal description of how cyber risk is actually governed, including known gaps. Close the gaps that matter, or record why they remain. Only then reduce the description to disclosure language, with each sentence traceable to evidence such as minutes, policies or reports.

The internal description should be blunt. It names the executive who owns cyber risk, the committee that oversees it, how often each met on the subject last year and what they decided. It lists the outside assessments performed and their main findings. It records which business units and acquired companies are covered by the risk program and which are not. Its value lies in its candor, and it should be prepared with counsel so that its handling is considered from the start.

Disclosure controls for cyber statements

The disclosure controls that already govern financial reporting offer a model. Disclosure controls are the internal checks a public company uses to make sure what it tells investors is accurate and complete. Chief executives and chief financial officers already certify their effectiveness in each periodic report. A sub-certification from the CISO, meaning a signed internal statement that the security-related content is accurate, brings cyber statements into the same process. So do a defined evidence file for each statement and a pre-filing review by the disclosure committee.

The cost is time and some loss of flattering language. The benefit is that the filing survives scrutiny when it is most likely to receive it, after an incident. The evidence file also serves other purposes: it answers auditors, regulators, insurers and enterprise customers who ask the same questions in different forms.

Three adjectives a critic would quote

Consider a listed payments company whose legal team prepares a first draft of the new disclosure from an older investor presentation. It reads well. It says the company maintains a “comprehensive” risk assessment program, that the board receives “regular” cybersecurity updates, and that all critical vendors undergo “rigorous” security reviews.

The CISO is asked to review the draft. She points out three problems. The risk assessment covers the core payments platform but not two smaller businesses acquired last year. The board’s audit committee heard from her twice in the past year, once for twenty minutes. And vendor reviews are rigorous for the largest suppliers but consist of an emailed questionnaire for everyone else, including a small firm that hosts part of the customer support system.

The gaps are typical rather than scandalous. But if the company suffered an incident through that support vendor, the words “comprehensive,” “regular” and “rigorous” would be quoted back at it by every critic. The fix is partly language and partly practice. The company extends the risk assessment to the acquired businesses, sets a quarterly committee briefing, and tiers its vendor reviews with a clear statement of which tier gets what. The final disclosure is plainer and less flattering. It is also true, and each sentence points to a document in the evidence file.

The counter-argument: say less

A reasonable response to this risk is to disclose as little as possible: describe processes in general terms, avoid specifics, and give critics nothing to quote. Some general counsels will find that approach attractive.

Minimal disclosure has limits. The rule still required specific topics, and generic language that could describe any company tells investors little and may draw questions from SEC staff. More importantly, vagueness does not protect a company whose practice is weak; it only delays the moment that weakness becomes visible. The safer course is accurate, moderately specific language backed by evidence. Specific statements that are true are easier to defend than vague ones that imply more than the company does.

How governance connects to the four-day clock

The incident deadline and the governance disclosures look like separate topics. They depend on each other. The four business days would run from the moment a company determined that an incident was material. Someone has to make that determination, on the basis of information that is often incomplete, under pressure, and possibly late at night.

Who decides materiality

That is a governance question before it is a legal one. Someone has to gather the facts and decide what “material” means for this company, in this situation. Someone in finance has to estimate the likely cost. Someone in operations has to say how long a disrupted service will stay down. Someone has to call the general counsel, the chief executive and the chair of the relevant committee. A company that has never assigned those roles in a calm moment will answer them badly in a crisis, and may find the clock has effectively started before anyone noticed.

Materiality is broader than cost. An incident that exposes sensitive customer data, disrupts a core service for a day or invites regulatory action may be material even if the immediate cost is modest. The assessment weighs qualitative factors, such as harm to reputation, customer relationships and regulatory standing, alongside quantitative ones. A procedure that looks only at dollar thresholds will miss incidents that investors would consider important.

A materiality procedure and its rehearsal

Companies that prepared well treated the two parts of the proposal as one system. They wrote a short materiality procedure naming who would be convened, what information they would need and how the decision would be recorded. They ran tabletop exercises, structured rehearsals in which leaders talk through a simulated incident step by step, to test whether the procedure held up. And they made sure the annual governance description matched how that procedure actually worked. A disclosure that says incidents are escalated promptly to the board is only safe if the escalation path has been tested.

The record of the decision matters as much as the decision. If the company concludes an incident is not material, it should be able to show later what it knew, who considered it and why. If facts change, the procedure should require a fresh assessment. The aggregation item in the proposal, covering immaterial incidents that become material together, made a central incident log necessary. Without one, nobody can see a pattern across business units.

No pause for investigations

The proposal did not allow companies to delay disclosure because law enforcement was investigating. That drew strong objections. Companies argued that early public disclosure could tip off attackers, complicate ransom negotiations and undermine investigations. Some law enforcement and security voices shared the concern, since attackers watch public filings too.

The final rule added only a narrow exception, triggered by the Attorney General rather than the company. For governance, the lesson was practical. A company could not plan on withholding a material incident from investors while it investigated. Its communications, legal and security teams needed a plan for disclosing accurately while the facts were still developing, and for updating the disclosure as they changed. Drafting holding language in advance, describing the kinds of facts the company would and would not share, saved hours when they mattered.

Insider trading and the trading window

The period between discovering an incident and disclosing it creates insider trading risk. Executives and employees who know about a serious incident should not trade until it is public or judged immaterial. The 2018 guidance had made that point. Practical controls include adding incident response team members to the restricted trading list as soon as an incident is escalated, and having counsel confirm when the restriction lifts.

One incident, several clocks

The SEC clock was one of several, and they differ by type of organization. Banking organizations faced a federal rule, with compliance required from May 1, 2022, to notify their primary regulator within 36 hours of determining that a qualifying incident had occurred. Banks and insurers licensed in New York had a 72-hour notice requirement under the state’s cybersecurity regulation. Health care organizations covered by HIPAA had breach notification duties on their own timeline, and most companies faced state breach notification laws.

A publicly traded bank holding company could therefore face a 36-hour regulator notice, a state notice and, if the incident was material, an 8-K within four business days. The triggers differ: the bank rule turns on operational disruption, breach laws on personal data, and the SEC rule on materiality to investors. Each needs its own determination, and the determinations should be consistent. A company that tells its regulator an incident is severe while telling investors it is immaterial needs a clear and documented reason.

What the board needs to see

So much rests on what reaches the board that its contents deserve to be concrete. A board report that supports real oversight usually fits on a few pages and answers a handful of questions in language a non-specialist can follow.

A board report built around risk

• What matters most. The few services or data sets whose disruption or loss would hurt customers, revenue or regulatory standing most.
• How exposed they are. For each, the main threats, the state of the key protections, and how long the company could cope if the service failed.
• What has changed. Trends since the last report, new risks, and progress against the improvement plan, with dates that slipped called out rather than buried.
• What outside checks found. Findings from internal audit, independent assessors or exercises, and what is being done about them.
• What risk is being accepted. The gaps management has chosen not to close, for now, and why.

That last item is the one most often missing, and the one that matters most for a board. Accepting some risk is normal and sensible; no company can fix everything. But the board should know which risks it is accepting, rather than discover them after an incident. Residual risk is what remains after all the controls are in place: the exposure the company is, knowingly or not, choosing to live with. A report built this way also gives the disclosure team something solid to describe.

Activity counts versus risk

Many board packs were long on activity, such as attacks blocked, training completion and tool deployments, and short on risk. Activity numbers show effort. They do not tell a director whether the company could survive a bad week. Board reports rarely said which critical services could be disrupted, for how long, and at what cost.

Moving from activity to risk takes work from management. It requires an inventory of critical services, an estimate of recovery times tested against reality, and a view of financial impact developed with finance. Those are the same inputs a materiality procedure needs, which is another reason to build them once and use them twice.

The dispute over board expertise

The most contested governance item was director expertise. Supporters argued that investors were entitled to know whether a board could oversee a significant risk. Critics said boards oversee rather than manage, and that cyber is one of many specialized risks. They added that expertise is hard to define and that the rule would push companies to appoint directors for a single skill.

The more useful question underneath was whether the board could ask good questions and judge the answers. That depends less on one specialist director than on the quality of what management brings to the board. A board that receives a risk-focused report, with trends and a clear statement of residual risk, can exercise oversight with or without a specialist.

A single named expert also creates its own risks. Other directors may defer to that person rather than engage. The expert may be expected to carry a load that belongs to management. And a director’s expertise can date quickly in a field that changes as fast as this one. Practical responses included assigning cyber oversight to a named committee, setting a reporting calendar, giving all directors periodic education, and bringing in outside advisers for an annual deep review.

Minutes as evidence

Board and committee minutes are where oversight leaves a record. A disclosure that says a committee reviews cyber risk quarterly will be tested against minutes that show what it reviewed and what it decided. Minutes that record only “the CISO gave an update” support the claim that briefings occurred, but say little about oversight.

Better minutes note the topics covered, the questions directors asked, the decisions taken and the follow-up assigned. They do not need to record every exchange, and their drafting is a matter for counsel, since minutes can become evidence in litigation. The aim is a record that shows a board engaging with risk rather than receiving a presentation. Companies preparing for the first disclosure cycle often found their minutes thinner than their practice, and adjusted both.

Which committee

Many companies placed cyber oversight with the audit committee, which already handled financial controls and internal audit. Others used a risk committee, common at banks, or a technology committee. The audit committee option has logic, since disclosure controls and internal audit are already there, but audit committees also carry heavy agendas. Wherever oversight lands, the committee charter should say so, the calendar should allot real time, and the full board should hear a summary at least annually. The disclosure then describes an arrangement that exists on paper and in practice.

Better decisions, and bad news sooner

The most obvious stake for a public company is legal exposure: inaccurate disclosure can draw regulatory action and lawsuits. But the governance work behind good disclosure pays off in other ways. A company that knows who owns cyber risk, how it reports to the board and which services matter most makes faster, better decisions when something goes wrong. Customers, lenders, insurers and acquirers increasingly ask the same questions the proposal did, so a clear, evidenced account serves many audiences at once.

There is also a cultural effect. When the security leader knows that public statements will be checked against practice, and has a formal role in signing them off, the incentive to raise uncomfortable facts early gets stronger. That beats a system in which bad news travels upward only after an incident. Boards that want early warning have to make it safe, and routine, for people to give it.

Effects beyond public companies

Private companies, nonprofit health systems and public agencies were outside the rule. They were not outside its effects.

Vendors’ filings as a due diligence source

Public vendors would describe governance in filings that procurement and third-party risk teams could read and compare with questionnaire answers. A vendor whose filing describes quarterly board briefings and an independent assessment program, but whose questionnaire claims more, has given its customers a useful discrepancy to raise. Incident filings add another source: a vendor’s 8-K may be the first formal notice a customer receives that a supplier has had a material incident.

Third-party risk teams can build that into their routine. For each critical public vendor, someone reads the annual cyber disclosure, notes the governance claims and checks them against contract terms and questionnaire answers. A vendor 8-K triggers a review of the customer’s own exposure, even before the vendor makes contact.

How it reached different kinds of organization

Credit unions are not public companies, and most community banks are privately held, so the SEC rule did not apply to them directly. They still felt it through their technology providers, many of which are public, and through examiners’ growing interest in board oversight. Broker-dealers and investment advisers faced separate SEC proposals aimed at them as regulated firms. A publicly traded broker-dealer parent could face both.

Nonprofit health systems that issue bonds already tell investors about their finances under continuing disclosure agreements. Describing their cyber oversight with the same structure helps their own boards as much as their bondholders. Investor-owned hospital companies, by contrast, were squarely covered, and their disclosures gave nonprofit peers a template to compare against.

Public agencies answer to elected boards, legislatures and auditors rather than investors. The SEC’s list of governance topics still offers a useful structure for a report to a county board or a legislative committee. An agency that can describe who owns cyber risk, how it is assessed and how leadership is informed is in a stronger position when it asks for budget or answers questions after an incident.

Insurers and lenders reading the same words

Cyber insurers had already been tightening their underwriting, asking applicants detailed questions about controls such as multifactor authentication, backups and incident response. Public governance disclosures gave underwriters another document to read alongside the application. A company whose filing and insurance application described different practices invited questions at renewal, and possibly disputes after a claim.

Lenders and rating agencies also took a growing interest in cyber risk as a business risk. A clear, consistent account of governance, used across filings, insurance applications, customer questionnaires and lender diligence, reduces the chance that one audience hears a different story from another. Keeping one master description, maintained by the disclosure working group, makes that consistency achievable.

Small public companies

The rule applied to small public companies as well as large ones, and the final version gave smaller reporting companies extra time for incident filings but not for the annual description. A listed community bank holding company or a small medical device maker might have a security function of two or three people, or none. The work may fall to a managed service provider or a part-time outside CISO.

For these companies, honest disclosure means describing that arrangement as it is. A statement that an outside firm provides security leadership under contract, reporting to a named executive and briefing the audit committee twice a year, is accurate and defensible. Describing the outside firm’s staff as if they were an internal team, or implying round-the-clock monitoring the contract does not include, creates exactly the gap this article describes. The contract itself becomes part of the evidence file, and its terms should match the words in the filing.

Small companies also have less room to absorb the work of preparing the disclosure. A short, accurate description, reviewed by counsel and the outside security provider, is better than a long one borrowed from a larger peer’s filing. Borrowed language is easy to spot in tagged data, and it describes someone else’s practice.

Companies preparing to go public

Private companies planning an initial public offering, or seeking to be acquired by a public company, would meet the requirements as soon as they entered the public market. Buyers in acquisitions increasingly examined a target’s cyber governance during due diligence, partly because the acquirer would have to describe the combined company afterward. Building governance that could be described accurately became part of preparing a company for sale or listing.

Sentences we would struggle to prove

Companies that handle this well share five habits:

• Honesty first. An internal, candid account of cyber governance, gaps included, comes before any public language.
• Evidence behind every sentence. Each disclosed statement maps to minutes, policies, reports or audit findings kept in a defined file.
• Shared ownership. Legal, finance, investor relations and security draft together, and the CISO signs a sub-certification.
• Risk-focused board reporting. Reports say which critical services could fail, for how long and at what cost, with trends over time.
• A named committee and a calendar. The board knows who owns cyber oversight and when it will hear about it.

Weak disclosure is the reverse. It shows adjectives without evidence, drafts written without the security team, board packs full of activity counts, and a single “cyber director” treated as a substitute for good information flowing to the whole board.

• Which executive owns cyber risk, and could we describe their role and expertise accurately in one paragraph?
• How many times did the board or a committee discuss cyber risk last year, and what did it actually decide?
• If we wrote down our cyber governance today, which sentences would we struggle to prove?
• Do our board reports tell us which services could be disrupted, for how long and at what cost?
• Does the security leader review and sign off on everything we say publicly about security?

With hindsight

The SEC adopted final rules on July 26, 2023, by a vote of three to two. The four-business-day incident disclosure survived, in a new Item 1.05 of Form 8-K. Disclosure could be delayed if the US Attorney General determined that immediate disclosure would pose a substantial risk to national security or public safety and told the SEC in writing. Companies had to determine materiality without unreasonable delay after discovering an incident. The Justice Department and FBI published guidance late in 2023 on how companies could request such a delay.

The annual governance and risk management disclosures were adopted in streamlined form, as a new Item 106 of Regulation S-K. Companies would describe their processes for assessing, identifying and managing material cyber risks, whether past incidents or risks had materially affected them, the board’s oversight and management’s role and expertise. The board expertise requirement was dropped. So was the proposed requirement to aggregate individually immaterial incidents, and updates to earlier incidents moved to amended 8-K filings instead of periodic reports. Companies began including the governance disclosures in annual reports for fiscal years ending on or after December 15, 2023. Incident reporting on Form 8-K began on December 18, 2023, with an extra 180 days for smaller reporting companies.

The first months of incident reporting showed how hard materiality judgments were. Some companies filed under the new item for incidents they had not yet judged material, to be safe. In May 2024, the director of the SEC’s Division of Corporation Finance said that Item 1.05 should be reserved for incidents a company had determined to be material. Others could be disclosed voluntarily under a different item, followed by an Item 1.05 filing within four business days if the company later found the incident material. The distinction rewarded companies that had a clear, recorded materiality procedure.

Dropping the expertise requirement did not make the underlying question go away. Boards still have to show how they oversee cyber risk, and the most convincing way to do that is with good information from management, not a single specialist name in the proxy statement. In that sense, the final rule pointed toward the same answer the debate had reached: oversight quality matters more than a résumé line. State regulators moved in a similar direction. New York’s amended cybersecurity regulation, finalized in November 2023, required the boards of regulated firms to exercise oversight of cyber risk and to have sufficient understanding of cyber matters to do so.

In October 2023 the SEC sued a software company and its CISO over allegedly misleading security statements. Whatever its eventual outcome, the case made clear that descriptions of security practice carry legal weight. For CISOs in particular, it sharpened attention to what they sign, what they say internally and how closely public statements match reality. Boards have reason to make sure the security leader has clear support from the legal team, and a direct line to the relevant committee, before putting their name to public descriptions of practice. A CISO who feels unable to flag a gap is a disclosure risk as well as a security one.

A year later, in October 2024, the SEC settled charges against four technology companies, Unisys, Avaya, Check Point and Mimecast, over disclosures about intrusions linked to the SolarWinds compromise. The SEC found that each had downplayed what it knew. One had described cyber risks as hypothetical after intrusions had occurred. Others had described incidents in generic terms or left out important details. The penalties ranged from just under $1 million to $4 million, and the companies settled without admitting or denying the findings. The cases turned on the gap between what companies knew and what they wrote, the same gap this article describes.

The SEC’s enforcement priorities shifted under new leadership in 2025. In February 2025 it replaced its crypto and cyber enforcement unit with a Cyber and Emerging Technologies Unit. That unit’s published priorities still included fraudulent cybersecurity disclosures by public companies.

By this point in 2026, cyber governance disclosures are a routine part of annual reports. The better ones read as accurate accounts of practice, traceable to evidence. Weaker ones read as reassurance and carry the risk that implies. What March 2022 showed is that writing something down in public changes its status. A description becomes a commitment, and the safest commitments are the ones that simply describe what the company already does well.