SEC disclosure rule for ‘material’ cybersecurity incidents goes into effect

The report analyzes the SEC’s new rule mandating publicly traded companies to disclose material cybersecurity incidents within four business days and to annually describe their cybersecurity risk management, addressing concerns about overlap with CISA’s CIRCIA reporting, potential national security risks, and increased CISO liability. It notes DOJ guidance that disclosures generally benefit investors and public safety while allowing limited delays for sensitive scenarios. Expert commentary highlights the need for defensible materiality assessments, the heightened impact on critical infrastructure operators, and the imperative to strengthen OT/IoT security and incident response readiness.