Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles (As of 7.1.24)

New York

Washington, D.C.

During 2021, the SEC began to emphasize its interest in environmental, social and governance (“ESG”) issues; among other things, it indicated its intent to issue rules on an array of ESG matters, including climate-based disclosures. It kicked off its ESG rulemaking in December 2021 by issuing proposed rules regarding stock repurchases and Rule 10b5‑1 plans and insider trading, which we reviewed <a href="https://www.thompsonhine.com/publications/sec-issues-proposed-rules-on-stock-repurchases-and-rule-10b5-1-plans-and-insider-trading">here</a>.

contentpilot/introduction

One major ESG area, cybersecurity, has been on the SEC’s radar for a number of years; it initially issued guidance in <a href="https://www.sec.gov/divisions/corpfin/guidance/cfguidance-topic2.htm">2011</a>, which it expanded upon in <a href="https://www.sec.gov/rules/interp/2018/33-10459.pdf">2018</a>. The SEC made it clear that cybersecurity remained an area of focus in recent years; most recently, SEC Chair Gary Gensler gave a speech in <a href="https://www.sec.gov/news/speech/gensler-cybersecurity-and-securities-laws-20220124">January 2022 </a>in which he announced that he asked staff to recommend rule disclosures regarding cybersecurity practices and risk disclosures and public disclosure of cyber events, aiming for information “presented in a consistent, comparable, and decision-useful manner”. &nbsp;

core/paragraph

On March 9, 2022, the proposal arrived. The SEC released a <a href="https://www.sec.gov/rules/proposed/2022/33-11038.pdf">proposed rule</a> intended to enhance and standardize disclosures relating to cybersecurity risk management, strategy, governance, and incident reporting. Companies would be required to tag the new disclosures described below using iXBRL.

core/list

In addition, under Item 407(j), companies would need to disclose certain information relating to directors’ cybersecurity expertise, including naming any such directors and describing the nature of any such expertise (for example, prior work experience, possession of a cybersecurity certification or degree, or other knowledge, skills, or background in cybersecurity, such as risk management or security operations).

Importantly, as noted above, the proposed rules would require a company to disclose its selection and oversight of third-party entities. This is critical to understand a company’s information security programs and risk posture, as evidenced by several recent high-profile ransomware and cyber operations that have targeted data processing service providers and indirectly caused severe damage and loss to their customers. In turn, it will be important that the information security policies described above include a vendor management process wherein companies are analyzing and verifying the technical, physical, and administrative security controls within a service provider and ensuring any data processing contracts memorialize such information security requirements and properly allocate the liability and risks between the parties.

Many companies already disclose some or all of the matters described above in their SEC filings, particularly in annual meeting proxy statements with respect to board risk oversight and directors’ cybersecurity expertise; those that do not should consider including such disclosures in their proxy statements for upcoming annual meetings. Companies should undertake an assessment of their cybersecurity measures and compliance programs. In addition, companies should be expanding their director and officer questionnaires to solicit information regarding cybersecurity and information technology knowledge and expertise.

Comments are due on the proposal by the later of 30 days after publication in the Federal Register or May 9, 2022.

core/heading

<a href="https://www.thompsonhine.com/professionals/ashley-jurgita">Jurgita Ashley</a> 216.566.8928 <a href="mailto:Jurgita.Ashley@ThompsonHine.com">Jurgita.Ashley@ThompsonHine.com</a>

<a href="https://www.thompsonhine.com/professionals/stransky-steven">Steven G. Stransky</a> 216.566.5646 Steven.Stransky@ThompsonHine.com

<a href="https://www.thompsonhine.com/professionals/miller-julia">Julia Miller</a> 216.566.5831 <a href="mailto:Julia.Miller@ThompsonHine.com">Julia.Miller@ThompsonHine.com</a>

or another member of our <a href="https://www.thompsonhine.com/services/securities">Securities, Capital Markets &amp; Corporate Governance</a> or <a href="https://www.thompsonhine.com/services/privacy-and-cybersecurity" target="_self" rel="noopener">Privacy &amp; Cybersecurity</a>&nbsp;teams. For ESG matters, please contact a member of our <a href="https://www.thompsonhine.com/services/esg-collaborative">ESG Collaborative</a>.

This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel. This document may be considered attorney advertising in some jurisdictions.

https://admin.thompsonhinestaging.contentpilot.net/wp-content/uploads/2022/08/ESG_Collaborative_Update_-_SEC_Issues_Proposed_Rules_on_Mandatory_Cybersecurity_Disclosure_-_March_2022.pdf

SEC Issues Proposed Rules on Mandatory Cybersecurity Disclosure

Services