Statement in Support of a Multi-Pronged Approach to Cybersecurity

As I noted a few weeks ago, cybersecurity is one of the biggest challenges facing market participants today [1]. Chief executive officers have identified cybersecurity as the number one threat to business growth in the coming years. [2] Experts have provided Congressional testimony that cyber threats are among the most significant strategic risks to our national security, economic prosperity, and public health and safety. [3] President Biden signed a National Security Memorandum acknowledging that the recent cyberattacks on Colonial Pipeline and JBS Foods demonstrate “significant cyber vulnerabilities” across our critical infrastructure. [4]

Further, the sophistication and frequency of cyberattacks have increased. And that increase has imposed corresponding economic harms and increased expenses on companies, and their investors. In the most high-profile examples, we have seen outright halts in production and multi-million dollar ransom payments. [5] Costs also include, among other things, loss of intellectual property, reputational damage, remediation expenses, and harms to individual privacy. [6]

The Commission has taken steps to address cybersecurity concerns in the past. In 2018, the Commission issued guidance regarding cybersecurity related disclosure obligations, and also noted that cybersecurity risks and incidents may be material nonpublic information that issuers should contemplate in their codes of ethics and insider trading policies. [7] Despite this prior action, disclosures relating to cyber-security incidents are inconsistent in level of detail, time of disclosure, and placement. [8] In other words, the “who, what, when, and where” is often inconsistent and unreliable.

Today’s proposal is an important step forward in addressing this growing and ever-present risk. The proposal includes an 8-K filing requirement for any material cyber-intrusion, continuing periodic reporting on previously disclosed incidents, and disclosure of related policies and procedures. I look forward to the comment file and working with the public and the staff to finalize this important rule.

Thank you to the staff in the Division of Corporation Finance, the Office of the General Counsel, the Division of Economic and Risk Analysis, and the Chair’s office for their diligent and effective work on this proposal.