SEC Cybersecurity Reporting Requirements for Public Companies: Applying Old Standards to New Risks

Back to All Thought Leadership

On July 26, 2023, the Securities and Exchange Commission (“SEC”) issued a final rule that requires registrants to provide enhanced and standardized disclosures regarding “cybersecurity risk management, strategy, governance and incidents.” This rule, the culmination of discussion following the March 9, 2022 proposed rule, applies to public companies that are subject to the Securities Exchange Act of 1934 and takes effect September 5, 2023.