SEC's New Cybersecurity Disclosure Rules

## Executive Summary The SEC has introduced updated cybersecurity disclosure rules requiring public companies to report material cyber incidents within four business days, expand disclosure of cyber risk factors and governance, and describe management and board roles in managing cyber risk; the document outlines challenges for smaller firms and trade-secret concerns but argues the rules will increase transparency, investor comparability, and overall cybersecurity preparedness.