3 2 1… Impact! Early Results under the SEC’s Cybersecurity Governance Rule

This article reviews early impacts of the SEC’s 2023 cybersecurity disclosure rule, highlighting emerging themes of preparedness and processes among public companies, including use of the NIST framework, continuous monitoring, quantified risk reporting to leadership, and practiced materiality analyses. It also cautions private suppliers to expect tighter contractual controls, deeper risk assessments, and greater scrutiny as public companies extend third‑party risk management across their supply chains.