Sep 282023

SEC’s Cybersecurity Disclosure Rules Are Here. Is Your Company Ready to Comply?

Sonia Gupta Barros, Colleen Theresa Brown and Samir A. Gandhi
, , , , , , ,

Companies are facing more attacks on their information systems. And, as their cyber risk skyrockets, the SEC has stepped in with new regulations, telling businesses what to disclose about these incidents — and requiring detailed disclosures on cyber risk management more broadly. With the deadline for compliance fast approaching, businesses are scrambling to mitigate their legal risk and comply with regulations that some say may be an overreach.

In this episode of The Sidley Podcast, host and Sidley partner Sam Gandhi speaks with two of the firm’s thought leaders on these issues — Sonia Barros and Colleen Brown. Sonia is a partner in Sidley’s Capital Markets group and co-leader of the firm’s Public Companies practice. Colleen is a partner in the firm’s practices in Privacy and Cybersecurity, Commercial Litigation and Disputes, Crisis Management and Strategic Response, and Insurance. Together, they discuss the SEC’s newly adopted regulations for disclosing information on cyber risk and how companies and their boards can best comply.

Executive Producer: John Metaxas, WallStreetNorth Communications, Inc.

View the transcript here.

This post is as of the posting date stated above. Sidley Austin LLP assumes no duty to update this post or post about any subsequent developments having a bearing on this post.

Sonia Gupta Barros

Washington, D.C.

sbarros@sidley.com

Colleen Theresa Brown

Washington, D.C.

cbrown@sidley.com

Samir A. Gandhi

New York

sgandhi@sidley.com

You might also like
Advisor to the CJEU Confirms GDPR Fines For Subsidiary Infringements Should Reflect Group Turnover

On 12 September 2024, Advocate General Medina issued their Opinion in Case C-383/23 (Opinion) in which they confirmed that supervisory data protection authorities (SAs) must, when calculating the fine for a GDPR infringement committed by a subsidiary, take into account the total annual turnover of the entire group—a concept known as parental liability.

U.S. Department of Commerce Issues Proposed Rule on ICTS Supply Chain for Connected Vehicles

On September 26, 2024, the U.S. Department of Commerce Bureau of Industry and Security (BIS) Office of Information and Communications Technology and Services (OICTS) published a long-awaited rule proposing to ban certain connected vehicles transactions involving hardware and software linked to the People’s Republic of China (China) and Russia. BIS also proposed extensive compliance obligations for importers and manufacturers of connected vehicles and related components, which come as the automotive industry continues to grapple with how to protect critical safety-related data as vehicle interconnectivity increases.

DOL Confirms Cybersecurity Guidance Applies to All Employee Benefit Plans

The U.S. Department of Labor (DOL) published Compliance Assistance Release No. 2024-01 on September 6, 2024. The release, titled “Cybersecurity Guidance Update,” clarifies that the cybersecurity guidance the DOL issued in April 2021 applies to all employee benefit plans, including health and welfare plans. The DOL states that since the guidance was published, service providers have told plan fiduciaries and Employee Benefits Security Administration (EBSA) investigators that the guidance applies only to retirement plans.