Disclosure

On March 9, the Securities and Exchange Commission (SEC) proposed a new rule intended to enhance and standardize disclosure requirements for cybersecurity ...

But the proposal is dangerous to the extent that it jeopardizes important safety, security, and geopolitical interests in the name of disclosure. The SEC should not force public companies to choose between SEC liability and effective collaboration with the government’s cybersecurity-focused agencies. For example, if a company discovers it has been impacted by a zero-day vulnerability in widely used software, the company may be required by the SEC to report it publicly before the company has had sufficient time to put in place a patch or other remedial measures. The explicit lack of a law enforcement (and national security and cybersecurity agency) exemption in the SEC’s proposal will undermine critical national, corporate, economic, and personal security interests. [the government obtained court orders](https://www.justice.gov/opa/pr/justice-department-announces-court-authorized-disruption-botnet-controlled-russian-federation) dictating confidentiality until official authorization was granted—and the takedown of Russia’s malicious botnet could be effectuated. There is a time and a place for everything, including disclosure to shareholders, but the current proposed rule threatens to put the nation’s cyber defense at risk. In other words, the new, mandatory four-day reporting trigger, with no deference to the “captains” of Team Cyber, as Gensler put it, is neither necessary nor wise. In addition to the Cyclops Blink example, the U.S. [The company] enthusiastically cooperated with the FBI to figure out the source of the infection and to counter it,” Wray stated. Wray repeatedly and directly attributed the success of the disruption to close coordination between the government and a company that had been infected by the malware: “Our partnership with the private sector was key here. [stated](https://www.justice.gov/opa/speech/deputy-attorney-general-lisa-o-monaco-delivers-keynote-address-international-conference) in a major address to a cybersecurity conference that, “[b]y working closely with … Finalizing the proposal in its current form would seriously disrupt the government’s essential partnership with the private sector—involving close coordination and confidentiality—to combat significant cyberattacks.