What the New SEC Cybersecurity Rules Mean for Tech Companies

On July 26, the US Securities & Exchange Commission (SEC) released a new rule aimed to increase consistency of how and when material cybersecurity information is disclosed to investors and the public. The rule became effective Sept 5, 2023.

With this new rule, publicly traded companies may be required to disclose cybersecurity incidents within as little as four business days. The rule also sets out new requirements for annual reporting to the SEC on cybersecurity preparedness, including:

  • Companies will be asked to describe their processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats, as well as the material effects or reasonably likely material effects of risks from cybersecurity threats and previous cybersecurity incidents.
  • Companies will also need to describe the board of directors’ oversight of risks from cybersecurity threats and management’s role and expertise in assessing and managing material risks from cybersecurity threats.

While these rules apply directly to public companies in the United States, we can expect to see a trickle-down effect in the level of preparedness and urgency that is expected from companies responding to cybersecurity incidents.

Lisa Hartman is Associate General Counsel (Privacy) at SurveyMonkey, and has seven years of experience in public and private high-growth tech companies and international law firms. She has deep experience in GDPR, CCPA, PIPEDA and other privacy regulations.

The first thing Lisa suggests for companies who want to better understand how evolving cybersecurity requirements impact them: plan ahead. “The best-case scenario is being able to create and document a basic plan for what you’ll do in a breach before you ever have one. The National Institute of Standards and Technology (NIST) provides a quick start guide for their cybersecurity framework that’s great for companies getting started in this area. There’s really no need to reinvent the wheel. If you at least have a plan on paper, then you have a starting point for your first incident.” The NIST guide breaks the lifecycle of a security incident into five stages: Identify, Protect, Detect, Respond and Recover. It also provides an overview of activities that should take place within each stage.

Once you’ve defined what needs to take place when a security incident is discovered, you should consider who within your organization will be performing what actions. This can also help you understand any gaps you may have that could require third-party service providers. As Lisa puts it,

“You should not handle something like this on your own. If you’re in this situation, there are a lot of moving pieces. Hopefully you have somebody who knows your product extremely well to help understand the specific impact of the incident, somebody that can keep track of all the organizational tasks, somebody to own communications, etc.” You can also use incident management software for this, as SurveyMonkey and many other large companies do.

With that in mind, be realistic about what you can handle as a company. Security incidents warrant thorough investigation and remediation efforts, highly sensitive customer communications, and more. It’s also not just the SEC you need to worry about when it comes to disclosure—there are many laws and regulations that govern privacy matters and your obligations when responding to them. These regulations vary significantly depending on geography and the nature of the incident. Unless you have in-house experts, Lisa suggests you consider bringing in external help.

“There are plenty of third-party breach forensics providers, external counsel, and even breach coaches that have deep expertise in these situations,” she says. “This is a complex area where missteps can result in litigation and media scrutiny. Even if the SEC rule doesn’t apply to you, you may be subject to requirements to directly notify your customers or data subjects. If you're part of a supply chain, you may need to notify companies you work with as a vendor. You may also have to notify your data protection supervisory authority. All while being careful not to give conflicting information, even as situations develop.”

The increasing expectations around speed of response and transparency for public companies dealing with security breaches will almost certainly set the tone for what the public expects from smaller companies in similar situations. One of the most difficult aspects of this is navigating the pressure to disclose as quickly as possible, often while the investigation is still underway, before having all the details on the incident. When it comes to communicating with limited information, Lisa says, “I don't think there's a bottom-line rule or a silver bullet answer to this. But we’re seeing a shift towards informed regulators, data subjects, and investors expecting more fulsome reporting. People want more details about a breach earlier and more consistently. With regards to the SEC rule specifically, they provide a list of points that need to be included in the report. So, if this applies to you, by knowing what the SEC requires, you can prioritize these pieces in your investigation.”

This required information includes:

  • When the incident was discovered and whether it is ongoing;
  • A brief description of the nature and scope of the incident;
  • Whether any data was stolen, altered, accessed, or used for any other unauthorized purpose;
  • The effect of the incident on the company's operations; and
  • Whether the company has remediated or is currently remediating the incident.

There’s also significance in what is not on this list—companies are not required to publicly disclose technical details around how the incident is being resolved, or exactly how the system was accessed. Especially if the incident is ongoing, you don’t want to share information that bad actors could use to further exploit a vulnerability.

Data breaches are more costly now than ever, and research shows that cyberattacks are increasing in complexity and frequency. Check Point’s 2023 Cyber Security Report revealed that weekly cyberattacks have increased worldwide by 7% in Q1 2023 compared to the same period last year—and that’s on top of a significant 28% increase from Q3 of 2022 compared to Q3 of 2021. With those breaches increasingly becoming material for public companies, regulations were warranted. Follow these best practices to ensure your company doesn’t run afoul of the new rules.


  • Cloud Adoption Gives Way to Hybrid Deployments

    Cloud adoption is growing at an astonishing rate, with Gartner forecasting that worldwide public cloud end-user spending will approach $600 billion by the end of this year—an increase of more than 21% over 2022. McKinsey believes that number could eclipse $1 trillion by the end of the decade, further underscoring the industry’s exponential growth. Read Now

  • AI on the Edge

    Discussions about the merits (or misgivings) around AI (artificial intelligence) are everywhere. In fact, you’d be hard-pressed to find an article or product literature without mention of it in our industry. If you’re not using AI by now in some capacity, congratulations may be in order since most people are using it in some form daily even without realizing it. Read Now

  • Securing the Future

    In an increasingly turbulent world, chief security officers (CSOs) are facing a multitude of challenges that threaten the stability of businesses worldwide. Read Now

    • Guard Services
  • Security Entrances Move to Center Stage

    Most organizations want to show a friendly face to the public. In today’s world, however, the need to keep people safe and secure has become a prime directive when designing and building facilities of all kinds. Fortunately, there is no need to construct a fortress-like entry that provides that high level of security. Today’s secured entry solutions make it possible to create a welcoming, attractive look and feel at the entry without compromising security. It is for this reason that security entrances have moved to the mainstream. Read Now

Featured Cybersecurity


New Products

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation. 3

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles. 3

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions. 3