In July 2023, the Securities and Exchange Commission adopted new rules requiring public companies to disclose material cybersecurity incidents within four business days of determining they are material. The rules also require annual disclosures describing a company’s cybersecurity risk management program, governance, and the board’s oversight of cyber risk.

The four-day clock is aggressive. Many organizations spend weeks or months investigating a breach before they fully understand its scope. The SEC’s position is that public investors deserve timely information even when the full picture is not yet known. Companies must disclose what they know, when they know it is material — not when the investigation is complete.

The rules create a new challenge for security teams and legal counsel: how do you determine materiality in real time, while an incident is still unfolding? Boards are now asking questions they were not asking before. Audit committees are reviewing incident response plans. General counsels are rewriting disclosure policies.

The practical effect is that cybersecurity is no longer just an IT issue or even a risk management issue. For public companies, it is a disclosure obligation with legal consequences for getting it wrong.