SEC Chair Gensler Wants Public Companies to Upgrade “Cyber Hygiene”

By Cynthia J. Larose

Data Privacy Week kicked off with a major message for US publicly-traded companies:  the Securities and Exchange Commission will be looking at cybersecurity.  SEC Chairman Gary Gensler said in a speech to a virtual securities conference at Northwestern Pritzker School of Law that he has asked SEC staff to make recommendations regarding companies’ cybersecurity practices and risk disclosures.  Gensler also indicated that he will also be considering whether companies should update disclosures to investors when cyber events occur. 

“Cybersecurity is an emerging risk with which public issuers increasingly must contend,” Gensler said.  “A lot of issuers already provide cyber risk disclosure to investors.  I think companies and investors alike would benefit if this information were presented in a consistent, comparable, and decision-useful manner.”  

Public (or soon-to-be-public) companies should pay close attention to data privacy and cybersecurity issues and boards should be prepared to discuss company policies and procedures and engage with management on these enterprise risk issues.

We discuss cybersecurity disclosures in preparation for 2021 Fiscal Year-End SEC filings and 2022 annual shareholder meetings in our annual memorandum available here.

Contact a member of the Mintz Privacy Team if you have questions regarding privacy and cybersecurity disclosures or any other related issue. 

Subscribe To Viewpoints

Published

    • Viewpoint Topics

  • Privacy & Cybersecurity

    • Professionals

  • Cynthia J. Larose

    • Related Practices

  • Privacy & Cybersecurity
    • Securities & Capital Markets Viewpoints Thumbnail

    Preparation for 2021 Fiscal Year-End SEC Filings and 2022 Annual Shareholder Meetings

    January 18, 2022| Advisory|

    Author

    Cynthia J. Larose

    Member / Co-Chair, Privacy & Cybersecurity Practice

    Cynthia J. Larose is Chair of the firm's Privacy & Cybersecurity Practice, a Certified Information Privacy Professional-US (CIPP-US), and a Certified Information Privacy Professional-Europe (CIPP-E). She works with clients in various industries to develop comprehensive information security programs on the front end, and provides timely counsel when it becomes necessary to respond to a data breach.