What the New SEC Cybersecurity Rules Mean for Tech Companies

On July 26, the US Securities & Exchange Commission (SEC) released a new rule aimed to increase consistency of how and when material cybersecurity information is disclosed to investors and the public. The rule became effective Sept 5, 2023.

With this new rule, publicly traded companies may be required to disclose cybersecurity incidents within as little as four business days. The rule also sets out new requirements for annual reporting to the SEC on cybersecurity preparedness, including:

  • Companies will be asked to describe their processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats, as well as the material effects or reasonably likely material effects of risks from cybersecurity threats and previous cybersecurity incidents.
  • Companies will also need to describe the board of directors’ oversight of risks from cybersecurity threats and management’s role and expertise in assessing and managing material risks from cybersecurity threats.

While these rules apply directly to public companies in the United States, we can expect to see a trickle-down effect in the level of preparedness and urgency that is expected from companies responding to cybersecurity incidents.

Lisa Hartman is Associate General Counsel (Privacy) at SurveyMonkey, and has seven years of experience in public and private high-growth tech companies and international law firms. She has deep experience in GDPR, CCPA, PIPEDA and other privacy regulations.

The first thing Lisa suggests for companies who want to better understand how evolving cybersecurity requirements impact them: plan ahead. “The best-case scenario is being able to create and document a basic plan for what you’ll do in a breach before you ever have one. The National Institute of Standards and Technology (NIST) provides a quick start guide for their cybersecurity framework that’s great for companies getting started in this area. There’s really no need to reinvent the wheel. If you at least have a plan on paper, then you have a starting point for your first incident.” The NIST guide breaks the lifecycle of a security incident into five stages: Identify, Protect, Detect, Respond and Recover. It also provides an overview of activities that should take place within each stage.

Once you’ve defined what needs to take place when a security incident is discovered, you should consider who within your organization will be performing what actions. This can also help you understand any gaps you may have that could require third-party service providers. As Lisa puts it,

“You should not handle something like this on your own. If you’re in this situation, there are a lot of moving pieces. Hopefully you have somebody who knows your product extremely well to help understand the specific impact of the incident, somebody that can keep track of all the organizational tasks, somebody to own communications, etc.” You can also use incident management software for this, as SurveyMonkey and many other large companies do.

With that in mind, be realistic about what you can handle as a company. Security incidents warrant thorough investigation and remediation efforts, highly sensitive customer communications, and more. It’s also not just the SEC you need to worry about when it comes to disclosure—there are many laws and regulations that govern privacy matters and your obligations when responding to them. These regulations vary significantly depending on geography and the nature of the incident. Unless you have in-house experts, Lisa suggests you consider bringing in external help.

“There are plenty of third-party breach forensics providers, external counsel, and even breach coaches that have deep expertise in these situations,” she says. “This is a complex area where missteps can result in litigation and media scrutiny. Even if the SEC rule doesn’t apply to you, you may be subject to requirements to directly notify your customers or data subjects. If you're part of a supply chain, you may need to notify companies you work with as a vendor. You may also have to notify your data protection supervisory authority. All while being careful not to give conflicting information, even as situations develop.”

The increasing expectations around speed of response and transparency for public companies dealing with security breaches will almost certainly set the tone for what the public expects from smaller companies in similar situations. One of the most difficult aspects of this is navigating the pressure to disclose as quickly as possible, often while the investigation is still underway, before having all the details on the incident. When it comes to communicating with limited information, Lisa says, “I don't think there's a bottom-line rule or a silver bullet answer to this. But we’re seeing a shift towards informed regulators, data subjects, and investors expecting more fulsome reporting. People want more details about a breach earlier and more consistently. With regards to the SEC rule specifically, they provide a list of points that need to be included in the report. So, if this applies to you, by knowing what the SEC requires, you can prioritize these pieces in your investigation.”

This required information includes:

  • When the incident was discovered and whether it is ongoing;
  • A brief description of the nature and scope of the incident;
  • Whether any data was stolen, altered, accessed, or used for any other unauthorized purpose;
  • The effect of the incident on the company's operations; and
  • Whether the company has remediated or is currently remediating the incident.

There’s also significance in what is not on this list—companies are not required to publicly disclose technical details around how the incident is being resolved, or exactly how the system was accessed. Especially if the incident is ongoing, you don’t want to share information that bad actors could use to further exploit a vulnerability.

Data breaches are more costly now than ever, and research shows that cyberattacks are increasing in complexity and frequency. Check Point’s 2023 Cyber Security Report revealed that weekly cyberattacks have increased worldwide by 7% in Q1 2023 compared to the same period last year—and that’s on top of a significant 28% increase from Q3 of 2022 compared to Q3 of 2021. With those breaches increasingly becoming material for public companies, regulations were warranted. Follow these best practices to ensure your company doesn’t run afoul of the new rules.

Featured

  • Survey: 60 Percent of Organizations Using AI in IT Infrastructure

    Netwrix, a cybersecurity provider focused on data and identity threats, today announced the release of its annual global 2025 Cybersecurity Trends Report based on a global survey of 2,150 IT and security professionals from 121 countries. It reveals that 60% of organizations are already using artificial intelligence (AI) in their IT infrastructure and 30% are considering implementing AI. Read Now

  • New Research Reveals Global Video Surveillance Industry Perspectives on AI

    Axis Communications, the global industry leader in video surveillance, has released its latest research report, ‘The State of AI in Video Surveillance,’ which explores global industry perspectives on the use of AI in the security industry and beyond. The report reveals current attitudes on AI technologies thanks to in-depth interviews with AI experts from Axis’ global network and a comprehensive survey of more than 5,800 respondents, including distributors, channel partners, and end customers across 68 countries. The resulting insights cover AI integration and the opportunities and challenges that exist with regard to security, safety, business intelligence, and operational efficiency. Read Now

  • SIA Urges Tariff Relief for Security Industry Products

    Today, the Security Industry Association has sent a letter to U.S. Trade Representative Jamieson Greer and U.S. Secretary of Commerce Howard Lutnick requesting relief from tariffs for security industry products and asking that the Trump administration formulate a process that allows companies to apply for product-specific exemptions. The security industry is an important segment of the U.S. economy, contributing over $430 billion in total economic impact and supporting over 2.1 million jobs. Read Now

  • Report Shows Cybercriminals Continue Pivot to Stealthier Tactics

    IBM recently released the 2025 X-Force Threat Intelligence Index highlighting that cybercriminals continued to pivot to stealthier tactics, with lower-profile credential theft spiking, while ransomware attacks on enterprises declined. IBM X-Force observed an 84% increase in emails delivering infostealers in 2024 compared to the prior year, a method threat actors relied heavily on to scale identity attacks. Read Now

  • 2025 Security LeadHER Conference Program Announced

    ASIS International and the Security Industry Association (SIA) – the leading membership associations for the security industry – have announced details for the 2025 Security LeadHER conference, a special event dedicated to advancing, connecting and empowering women in the security profession. The third annual Security LeadHER conference will be held Monday, June 9 – Tuesday, June 10, 2025, at the Detroit Marriott Renaissance Center in Detroit, Michigan. This carefully crafted program represents a comprehensive professional development opportunity for women in security this year. To view the full lineup at this year’s event, please visit securityleadher.org. Read Now

    • Industry Events

New Products

  • 4K Video Decoder

    3xLOGIC’s VH-DECODER-4K is perfect for use in organizations of all sizes in diverse vertical sectors such as retail, leisure and hospitality, education and commercial premises.

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file.

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation.