Hester M. Peirce is a Commissioner at the U.S. Securities and Exchange Commission. This post is based on her recent public statement. The views expressed in this post are those of Commissioner Peirce and do not necessarily reflect those of the Securities and Exchange Commission or its staff.
Thank you, Chair Gensler. Although better than the proposal, this final cybersecurity disclosure rule continues to ignore both the limits to the SEC’s disclosure authority and the best interests of investors. Moreover, the Commission has failed to explain why we need this rule. Accordingly, I dissent.
Cyber risk and the attendant disclosure obligations have been front-and-center for public companies for a long time, and the SEC has underscored the importance of cyber disclosures. In 2011, “the Division of Corporation Finance issued interpretive guidance providing [its] views concerning operating companies’ disclosure obligations relating to cybersecurity.” [1] In 2018, the Commission issued interpretive guidance to assist public companies in fulfilling their obligation to “take all required actions to inform investors about material cybersecurity risks and incidents in a timely fashion, including those companies that are subject to material cybersecurity risks but may not yet have been the target of a cyber-attack.” [2] When companies fail to make the required disclosures about cyber risks or inform investors of a cyber incident in a timely manner, the Commission can bring an enforcement action based on existing disclosure obligations. [3] We do not need additional regulations. However, I could have supported a cyber rule designed to guide public companies in their obligation to disclose material cyber risks and material cyber incidents in a way that would be net-beneficial to investors. Today’s rule, by contrast, reads like a test run for future overly prescriptive, overly costly disclosure rules covering a never-ending list of hot topics.
