What the New SEC Cybersecurity Rules Mean for Tech Companies

On July 26, the US Securities & Exchange Commission (SEC) released a new rule aimed to increase consistency of how and when material cybersecurity information is disclosed to investors and the public. The rule became effective Sept 5, 2023.

With this new rule, publicly traded companies may be required to disclose cybersecurity incidents within as little as four business days. The rule also sets out new requirements for annual reporting to the SEC on cybersecurity preparedness, including:

  • Companies will be asked to describe their processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats, as well as the material effects or reasonably likely material effects of risks from cybersecurity threats and previous cybersecurity incidents.
  • Companies will also need to describe the board of directors’ oversight of risks from cybersecurity threats and management’s role and expertise in assessing and managing material risks from cybersecurity threats.

While these rules apply directly to public companies in the United States, we can expect to see a trickle-down effect in the level of preparedness and urgency that is expected from companies responding to cybersecurity incidents.

Lisa Hartman is Associate General Counsel (Privacy) at SurveyMonkey, and has seven years of experience in public and private high-growth tech companies and international law firms. She has deep experience in GDPR, CCPA, PIPEDA and other privacy regulations.

The first thing Lisa suggests for companies who want to better understand how evolving cybersecurity requirements impact them: plan ahead. “The best-case scenario is being able to create and document a basic plan for what you’ll do in a breach before you ever have one. The National Institute of Standards and Technology (NIST) provides a quick start guide for their cybersecurity framework that’s great for companies getting started in this area. There’s really no need to reinvent the wheel. If you at least have a plan on paper, then you have a starting point for your first incident.” The NIST guide breaks the lifecycle of a security incident into five stages: Identify, Protect, Detect, Respond and Recover. It also provides an overview of activities that should take place within each stage.

Once you’ve defined what needs to take place when a security incident is discovered, you should consider who within your organization will be performing what actions. This can also help you understand any gaps you may have that could require third-party service providers. As Lisa puts it,

“You should not handle something like this on your own. If you’re in this situation, there are a lot of moving pieces. Hopefully you have somebody who knows your product extremely well to help understand the specific impact of the incident, somebody that can keep track of all the organizational tasks, somebody to own communications, etc.” You can also use incident management software for this, as SurveyMonkey and many other large companies do.

With that in mind, be realistic about what you can handle as a company. Security incidents warrant thorough investigation and remediation efforts, highly sensitive customer communications, and more. It’s also not just the SEC you need to worry about when it comes to disclosure—there are many laws and regulations that govern privacy matters and your obligations when responding to them. These regulations vary significantly depending on geography and the nature of the incident. Unless you have in-house experts, Lisa suggests you consider bringing in external help.

“There are plenty of third-party breach forensics providers, external counsel, and even breach coaches that have deep expertise in these situations,” she says. “This is a complex area where missteps can result in litigation and media scrutiny. Even if the SEC rule doesn’t apply to you, you may be subject to requirements to directly notify your customers or data subjects. If you're part of a supply chain, you may need to notify companies you work with as a vendor. You may also have to notify your data protection supervisory authority. All while being careful not to give conflicting information, even as situations develop.”

The increasing expectations around speed of response and transparency for public companies dealing with security breaches will almost certainly set the tone for what the public expects from smaller companies in similar situations. One of the most difficult aspects of this is navigating the pressure to disclose as quickly as possible, often while the investigation is still underway, before having all the details on the incident. When it comes to communicating with limited information, Lisa says, “I don't think there's a bottom-line rule or a silver bullet answer to this. But we’re seeing a shift towards informed regulators, data subjects, and investors expecting more fulsome reporting. People want more details about a breach earlier and more consistently. With regards to the SEC rule specifically, they provide a list of points that need to be included in the report. So, if this applies to you, by knowing what the SEC requires, you can prioritize these pieces in your investigation.”

This required information includes:

  • When the incident was discovered and whether it is ongoing;
  • A brief description of the nature and scope of the incident;
  • Whether any data was stolen, altered, accessed, or used for any other unauthorized purpose;
  • The effect of the incident on the company's operations; and
  • Whether the company has remediated or is currently remediating the incident.

There’s also significance in what is not on this list—companies are not required to publicly disclose technical details around how the incident is being resolved, or exactly how the system was accessed. Especially if the incident is ongoing, you don’t want to share information that bad actors could use to further exploit a vulnerability.

Data breaches are more costly now than ever, and research shows that cyberattacks are increasing in complexity and frequency. Check Point’s 2023 Cyber Security Report revealed that weekly cyberattacks have increased worldwide by 7% in Q1 2023 compared to the same period last year—and that’s on top of a significant 28% increase from Q3 of 2022 compared to Q3 of 2021. With those breaches increasingly becoming material for public companies, regulations were warranted. Follow these best practices to ensure your company doesn’t run afoul of the new rules.


  • ASIS International and SIA Release “Complexities in the Global Security Market: 2024 Through 2026”

    ASIS International and the Security Industry Association (SIA) – the leading security associations for the security industry – have released ”Complexities in the Global Security Market: 2024 Through 2026”, a new research report that provides insights into the equipment, technologies, and employment of the global security industry, including regional market breakouts. SIA and ASIS partnered with global analytics and advisory firm Omdia to complete the research. Read Now

  • President Biden Issues Executive Order to Bolster U.S Port Cybersecurity

    On Wednesday, President Biden issued an Executive Order to bolster the security of the nation’s ports, alongside a series of additional actions that will strengthen maritime cybersecurity and more Read Now

  • Report: 15 Percent of All Emails Sent in 2023 Were Malicious

    VIPRE Security Group recently released its report titled “Email Security in 2024: An Expert Look at Email-Based Threats”. The 2024 predictions for email security in this report are based on an analysis of over 7 billion emails processed by VIPRE worldwide during 2023. This equates to almost one email for everyone on the planet. Of those, roughly 1 billion (or 15%) were malicious. Read Now

  • ASIS Announces ANSI-Approved Cannabis Security Standard

    ASIS International, a leading authority in security standards and guidelines, proudly announces the release of a pioneering American National Standards Institute (ANSI)-approved standard dedicated to cannabis security. This best-in-class standard, meticulously developed by industry experts, sets a new benchmark by providing comprehensive requirements and guidance for the design, implementation, monitoring, evaluation, and maintenance of a cannabis security program. Read Now

Featured Cybersecurity


New Products

  • ResponderLink


    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols. 3

  • Hanwha QNO-7012R

    Hanwha QNO-7012R

    The Q Series cameras are equipped with an Open Platform chipset for easy and seamless integration with third-party systems and solutions, and analog video output (CVBS) support for easy camera positioning during installation. A suite of on-board intelligent video analytics covers tampering, directional/virtual line detection, defocus detection, enter/exit, and motion detection. 3

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction. 3