In the SEC’s Cyber Disclosure Rules, Timing Is a Sticking Point

Assessment and reporting of cybersecurity incidents, long ingrained as risk-management and business-continuity imperatives, have gotten even closer scrutiny at companies subject to Securities and Exchange Commission cyber disclosure requirements. A rule that took effect in December, mandating release of information on a material breach within four business days, magnified complaints about its complexity, costs and consequences.

In addition to the four-day rule, which applies when there may be significant impact on a listed company’s operations or financial condition, annual disclosures are now required regarding cyber risk management, strategy and governance.

The financial services industry, which is widely regarded as among the most experienced and best prepared in cybersecurity and has supported public- and private-sector strategic and policy cooperation, is less on board with the four-day deadline. Heather Hogsett of the Bank Policy Institute’s BITS technology division summarized the objections in a blog article that argued for reconsideration:

 Heather Hogsett of Bank Policy Institute

“In some cases, disclosure [of an...