SEC issues guidance on cybersecurity disclosures

On Oct 13, 2011, the staff of the Securities and Exchange Commission (SEC) released disclosure guidance regarding public company disclosure obligations relating to cyber-security risks and cyber incidents (Disclosure Guidance). The Disclosure Guidance reviews specific SEC disclosure rules that may require public companies to describe cybersecurity matters and provides SEC staff guidance on what type of disclosure, if any, may be necessary in light of a company's particular facts and circumstances. As part of the company's disclosure controls and procedures, they should review the existing process for assessing the materiality of cybersecurity matters to the company and determine what (if any) disclosures should be included in their SEC filings. The process should include discussions among the company's securities law counsel, information technology and security personnel and members of the company's disclosure committee. Companies should assess their current disclosures and compare them to disclosures by others in the company's industry.