Jay Clayton is Chairman of the U.S. Securities and Exchange Commission. This post is based on Chairman Clayton’s recent remarks concerning the SEC Cybersecurity Interpretive Guidance, available here. The views expressed in this post are those of Mr. Clayton and do not necessarily reflect those of the Securities and Exchange Commission or its staff.
Yesterday [Feb. 20, 2018], the Commission approved the issuance of an interpretive release to provide guidance to public companies when preparing disclosures about cybersecurity risks and incidents. The release also communicates the Commission’s views on the importance of maintaining comprehensive policies and procedures related to cybersecurity risks and incidents.
In today’s environment, cybersecurity is critical to the operations of companies and our markets. Companies increasingly rely on and are exposed to digital technology as they conduct their business operations and engage with their customers, business partners, and other constituencies. This reliance on and exposure to our digitally-connected world presents ongoing risks and threats of cybersecurity incidents for all companies, including public companies regulated by the Commission. Public companies must stay focused on these issues and take all required action to inform investors about material cybersecurity risks and incidents in a timely fashion.