Addressing the new SEC cyber incident disclosure rules

**Executive summary:** The SEC now requires publicly traded companies to disclose material cyber incidents within four days of determining materiality and to provide detailed information on incident nature, scope, impact, remediation, and board-level cyber risk governance; this tight timeline and expanded disclosure expectations will increase burdens on incident response, investor relations, and legal teams. The report summarizes the new rules, highlights ambiguity around materiality and the operational challenges of rapid, accurate reporting, and describes how Expel's incident findings, severity assessments, and investigation capabilities can help organizations comply with the requirements.