under Item 106(b)(2) of Regulation S-K to describe ``[w]hether any
risks from cybersecurity threats, including as a result of any
previous cybersecurity incidents, have materially affected or are
reasonably likely to materially affect the registrant'' (emphasis
added). See infra Section II.C.1.c.
---------------------------------------------------------------------------

    We are not adopting proposed Item 106(d)(2), in response to
concerns that the proposed aggregation requirement was vague or
difficult to apply. We are persuaded by commenters that the proposed
requirement might be difficult to differentiate from Item 1.05
disclosure, or by contrast, could result in the need for extensive
internal controls and procedures to monitor all immaterial events to
determine whether they have become collectively material. The intent of
the proposed requirement was to capture the material impacts of related
incidents, and prevent the avoidance of incident disclosure through
disaggregation of such related events. However, upon further
reflection, and after review of comments, we believe that the proposed
requirement is not necessary based on the scope of Item 1.05.
    To that end, we emphasize that the term ``cybersecurity incident''
as used in the final rules is to be construed broadly, as the
Commission stated in the Proposing Release.\188\ The definition of
``cybersecurity incident'' we are adopting extends to ``a series of
related unauthorized occurrences.'' \189\ This reflects that
cyberattacks sometimes compound over time, rather than present as a
discrete event. Accordingly, when a company finds that it has been
materially affected by what may appear as a series of related cyber
intrusions, Item 1.05 may be triggered even if the material impact or
reasonably likely material impact could be parceled among the multiple
intrusions to render each by itself immaterial. One example was
provided in the Proposing Release: the same malicious actor engages in
a number of smaller but continuous cyberattacks related in time and
form against the same company and collectively, they are either
quantitatively or qualitatively material.\190\ Another example is a
series of related attacks from multiple actors exploiting the same
vulnerability and collectively impeding the company's business
materially.
---------------------------------------------------------------------------

    \188\ Proposing Release at 16601.
    \189\ See infra Section II.C.3.
    \190\ Proposing Release at 16599.
---------------------------------------------------------------------------

C. Disclosure of a Registrant's Risk Management, Strategy and
Governance Regarding Cybersecurity Risks

1. Risk Management and Strategy
a. Proposed Amendments
    The Commission proposed to add 17 CFR 229.106(b) (Regulation S-K
``Item 106(b)'') to require registrants to provide more consistent and
informative disclosure regarding their cybersecurity risk management
and strategy in their annual reports. The Commission noted the Division
of Corporation Finance staff's experience that most registrants
disclosing a cybersecurity incident do not describe their cybersecurity
risk oversight or any related policies and procedures, even though
companies typically address significant risks by developing risk
management systems that often include written policies and
procedures.\191\
---------------------------------------------------------------------------

    \191\ Id.
---------------------------------------------------------------------------

    Proposed Item 106(b) would require a description of the
registrant's policies and procedures, if any, for the identification
and management of cybersecurity threats, including, but not limited to:
operational risk (i.e., disruption of business operations);
intellectual property theft; fraud; extortion; harm to employees or
customers; violation of privacy laws and other litigation and legal
risk; and reputational risk. As proposed, registrants would be required
to include a discussion, as applicable, of:
     Whether the registrant has a cybersecurity risk assessment
program and if so, a description of the program ((b)(1));
     Whether the registrant engages assessors, consultants,
auditors, or other third parties in connection with any cybersecurity
risk assessment program ((b)(2));
     Whether the registrant has policies and procedures to
oversee, identify, and mitigate the cybersecurity risks associated with
its use of any third-party service provider (including, but not limited
to, those providers that have access to the registrant's customer and
employee data), including whether and how cybersecurity considerations
affect the selection and oversight of these providers and contractual
and other mechanisms the company uses to mitigate cybersecurity risks
related to these providers ((b)(3));
     Whether the registrant undertakes activities to prevent,
detect, and minimize effects of cybersecurity incidents ((b)(4));
     Whether the registrant has business continuity,
contingency, and recovery

plans in the event of a cybersecurity incident ((b)(5));
     Whether previous cybersecurity incidents have informed
changes in the registrant's governance, policies and procedures, or
technologies ((b)(6));
     Whether cybersecurity related risk and incidents have
affected or are reasonably likely to affect the registrant's results of
operations or financial condition and if so, how ((b)(7)); and
     Whether cybersecurity risks are considered as part of the
registrant's business strategy, financial planning, and capital
allocation and if so, how ((b)(8)).\192\
---------------------------------------------------------------------------

    \192\ Id. at 16599-16600.
---------------------------------------------------------------------------

    The Commission anticipated that proposed Item 106(b) would benefit
investors by requiring more consistent disclosure of registrants'
strategies and actions to manage cybersecurity risks.\193\ Such risks,
the Commission observed, can affect registrants' business strategy,
financial outlook, and financial planning, as companies increasingly
rely on information technology, collection of data, and use of digital
payments as critical components of their businesses.\194\
---------------------------------------------------------------------------

    \193\ Id. at 16599.
    \194\ Id.
---------------------------------------------------------------------------

    The Commission noted that the significant number of cybersecurity
incidents pertaining to third-party service providers prompted the
proposal to require disclosure of registrants' selection and oversight
of third-party entities.\195\ The Commission also proposed requiring
discussion of how prior cybersecurity incidents have affected or are
reasonably likely to affect the registrant, because such disclosure
would equip investors to better comprehend the level of cybersecurity
risk the company faces and assess the company's preparedness regarding
such risk.\196\
---------------------------------------------------------------------------

    \195\ Id.
    \196\ Id.
---------------------------------------------------------------------------

b. Comments
    Many commenters supported proposed Item 106(b) for requiring
information that is vital to investors as they assess companies' risk
profiles and make investment decisions.\197\ One said cybersecurity
disclosures now are ``scattered and unpredictable'' rather than
``uniform,'' which ``diminishes their effectiveness.'' \198\ Similarly,
another found that current disclosures ``do not provide investors with
the information necessary to evaluate whether companies have adequate
governance structures and measures in place to deal with cybersecurity
challenges.'' \199\ The IAC recommended extending the proposed Item
106(b) disclosure requirements (as well as the proposed Item 106(c)
disclosure requirements) to registration statements, stating that
``pre-IPO companies may face heightened [cybersecurity] risks.'' \200\
---------------------------------------------------------------------------

    \197\ See letters of AICPA; BuildingCyberSecurity.org (``BCS'');
Better Markets; Bitsight; Blue Lava, Inc. (``Blue Lava''); CalPERS;
ITIF; National Association of Corporate Directors (``NACD''); NASAA;
PWC; PRI; R Street; SecurityScorecard; Tenable Holdings Inc.
(``Tenable''). See also IAC Recommendation.
    \198\ See letter from Better Markets.
    \199\ See letter from PRI.
    \200\ See IAC Recommendation.
---------------------------------------------------------------------------

    By contrast, a number of commenters opposed proposed Item 106(b).
In particular, they commented that much of the proposed Item 106(b)
disclosure could increase a company's vulnerability to cyberattacks;
they expressed particular concern regarding the potential harms from
disclosures about whether cybersecurity policies are in place, incident
response processes and techniques, previous incidents and what changes
they spurred, and third-party service providers.\201\ Another criticism
was that proposed Item 106(b) would effectively force companies to
model their cybersecurity policies on the rule's disclosure elements,
rather than the practices best suited to each company's context.\202\
One commenter saw proposed Item 106(b) as counteracting the
streamlining accomplished in the Commission's 2020 release modernizing
Regulation S-K.\203\
---------------------------------------------------------------------------

    \201\ See letters from ABA; ACLI; APCIA; BIO; BPI et al.;
Business Roundtable; Chamber; CSA; CTIA; EIC; Enbridge; FAH;
Federated Hermes; GPA; ITI; ISA; Nareit; NAM; NMHC; NRA; National
Retail Federation (``NRF''); SIFMA; Sen. Portman; TechNet;
TransUnion; USTelecom; Virtu.
    \202\ See letters from BPI et al.; Chamber; EIC; Nareit; NRF;
NYSE; SCG; SIFMA; Virtu.
    \203\ See letter from Nasdaq (citing Modernization of Regulation
S-K Items 101, 103, and 105, Release No. 33-10825 (Aug. 26, 2020)
[85 FR 63726 (Oct. 8, 2020)]).
---------------------------------------------------------------------------

    Some commenters offered suggestions to narrow proposed Item 106(b)
to address their concerns. On proposed paragraph (b)(1), one commenter
recommended allowing a registrant to forgo describing its risk
assessment program if it confirms that it ``uses best practices and
standards'' to identify and protect against cybersecurity risks and
detect and respond to such events.\204\ On proposed paragraph (b)(3), a
few commenters said that registrants should be required to disclose
only high-level information relating to third parties, such as
confirmation that policies and procedures are appropriately applied to
third-party selection and oversight, and should not have to identify
the third parties or discuss the underlying mechanisms, controls, and
contractual requirements.\205\
---------------------------------------------------------------------------

    \204\ See letter from Cybersecurity Coalition.
    \205\ See letters from BPI et al.; Chamber; SIFMA. Other
commenters supported the level of detail required in (b)(3). See
letters from AICPA; PRI.
---------------------------------------------------------------------------

    Some commenters opposed proposed paragraph (b)(6)'s requirement to
discuss whether ``previous cybersecurity incidents informed changes in
the registrant's governance, policies and procedures, or technologies''
entirely, stating it would undermine a registrant's cybersecurity.\206\
One commenter recommended the proposed (b)(6) disclosure be required
only at a high level, without specific details,\207\ while two
commenters appeared to propose only requiring disclosure as it pertains
to previous material incidents.\208\ Commenters suggested a materiality
filter for proposed paragraph (b)(7)'s requirement to discuss whether
``cybersecurity-related risks and previous cybersecurity-related
incidents have affected or are reasonably likely to affect the
registrant's strategy, business model, results of operations, or
financial condition and if so, how,'' so that the requirement would
apply only where a registrant has been materially affected or is
reasonably likely to be materially affected.\209\
---------------------------------------------------------------------------

    \206\ See letters from ITI; SCG; Tenable.
    \207\ See letter from Cybersecurity Coalition.
    \208\ See letters from AGA/INGA; American Public Gas Association
(``APGA'').
    \209\ See letter from PWC.
---------------------------------------------------------------------------

    More broadly, one commenter recommended replacing the rule's
references to ``policies and procedures'' with ``strategy and
programs,'' because in the commenter's experience companies may not
codify their cybersecurity strategy in the same way they codify other
compliance policies and procedures.\210\ One commenter also suggested
offering companies the choice to place the proposed Item 106(b)
disclosures in either the Form 10-K or the proxy statement.\211\
---------------------------------------------------------------------------

    \210\ See letter from Prof. Perullo.
    \211\ See letter from Nasdaq.
---------------------------------------------------------------------------

    Several commenters supported requiring registrants that lack
cybersecurity policies and procedures to explicitly say so, commenting,
for example, that ``investors should not be left to intuit the meaning
of a company's silence in its disclosures.'' \212\ One

commenter further stated that registrants should be required to explain
why they have not adopted cybersecurity policies and procedures.\213\
By contrast, two commenters opposed requiring registrants that lack
cybersecurity policies and procedures to explicitly say so,\214\ with
one commenter saying that ``a threat actor may target registrants they
perceive to have unsophisticated cybersecurity programs,'' \215\ and
the other commenter saying ``it is highly unlikely that any SEC
registrants would not have `established any cybersecurity policies and
procedures.'' \216\
---------------------------------------------------------------------------

    \212\ See letters from Blue Lava; CSA; Cybersecurity Coalition;
ITI; NASAA; Prof. Perullo; Tenable. The quoted language is from
NASAA's letter. See also IAC Recommendation (recommending ``that
issuers that have not developed any cybersecurity policies or
procedures be required to make a statement to that effect'' because
``the vast majority of investors . . . would view the complete
absence of cybersecurity risk governance as overwhelmingly material
to investment decision-making'').
    \213\ See letter from NASAA.
    \214\ See letters from EIC; IIA.
    \215\ See letter from EIC.
    \216\ See letter from IIA.
---------------------------------------------------------------------------

    In response to the Commission's request for comment about whether
to require a registrant to specify whether any cybersecurity assessor,
consultant, auditor, or other service provider that it relies on is
through an internal function or through an external third-party service
provider, several commenters opposed the idea as not useful, with one
saying that ``a significant majority--possibly the entirety--of SEC
registrants'' rely on third-party service providers for some portion of
their cybersecurity.\217\ Conversely, another commenter supported the
third-party specification, and suggested requiring registrants to name
the third parties, as over time, this would create more transparency in
whether breaches correlate with specific third parties.\218\
---------------------------------------------------------------------------

    \217\ See letters from BCS; Chevron; EIC; IIA; Prof. Perullo.
The quoted language is from the letter of IIA.
    \218\ See letter from Blue Lava.
---------------------------------------------------------------------------

    Commenters also offered a range of recommended additions to the
rule. One commenter recommended modifying proposed paragraph (b)(1) to
require registrants to specify whether their cybersecurity programs
assess risks continuously or periodically, arguing the latter approach
leaves companies more exposed.\219\ The same commenter suggested
paragraph (b)(2) require ``a description of the class of services and
solutions'' provided by third parties.\220\
---------------------------------------------------------------------------

    \219\ See letter from Tenable.
    \220\ Id.
---------------------------------------------------------------------------

    A few commenters recommended that we direct registrants to quantify
their cybersecurity risk exposure through independent risk
assessments.\221\ Similarly, one commenter urged us to require
registrants to explain how they quantify their cybersecurity risk,\222\
while another said we should set out quantifiable metrics against which
companies measure their cybersecurity systems, though it did not
specify what these metrics should be.\223\ Two commenters suggested
that we require companies to disclose whether their cybersecurity
programs have been audited by a third party.\224\ And one commenter
recommended that we require registrants to disclose whether they use
the cybersecurity framework of the National Institute of Standards and
Technology (``NIST''), to ease comparison of registrant risk
profiles.\225\
---------------------------------------------------------------------------

    \221\ See letters from BitSight; Kovrr Risk Modeling Ltd.;
SecurityScorecard.
    \222\ See letter from Safe Security.
    \223\ See letter from FDD.
    \224\ See letters from BCS; Better Markets.
    \225\ See letter from SandboxAQ. This commenter also recommended
registrants be required to disclose whether they use post-quantum
cryptography as part of their risk mitigation efforts.
---------------------------------------------------------------------------

c. Final Amendments
    We continue to believe that investors need information on
registrants' cybersecurity risk management and strategy, and that
uniform, comparable, easy to locate disclosure will not emerge absent
new rules. Commenters raised concerns with proposed Item 106(b)'s
security implications and what they saw as its prescriptiveness. We
agree that extensive public disclosure on how a company plans for,
defends against, and responds to cyberattacks has the potential to
advantage threat actors. Similarly, we acknowledge commenters' concerns
that the final rule could unintentionally affect a registrant's risk
management and strategy decision-making. In response to those comments,
we confirm that the purpose of the rules is, and was at proposal, to
inform investors, not to influence whether and how companies manage
their cybersecurity risk. Additionally, to respond to commenters'
concerns about security, the final rules eliminate or narrow certain
elements from proposed Item 106(b). We believe the resulting rule
requires disclosure of information material to the investment decisions
of investors, in a way that is comparable and easy to locate, while
steering clear of security sensitive details.
    As adopted, 17 CFR 229.106(b)(1) (Regulation S-K ``Item
106(b)(1)'') requires a description of ``the registrant's processes, if
any, for assessing, identifying, and managing material risks from
cybersecurity threats in sufficient detail for a reasonable investor to
understand those processes.'' We believe this revised formulation of
the rule should help avoid levels of detail that may go beyond
information that is material to investors and address commenters'
concerns that those details could increase a company's vulnerability to
cyberattack. We have also substituted the term ``processes'' for the
proposed ``policies and procedures'' to avoid requiring disclosure of
the kinds of operational details that could be weaponized by threat
actors, and because the term ``processes'' more fully compasses
registrants' cybersecurity practices than ``policies and procedures,''
which suggest formal codification.\226\ We still expect the disclosure
to allow investors to ascertain a registrant's cybersecurity practices,
such as whether they have a risk assessment program in place, with
sufficient detail for investors to understand the registrant's
cybersecurity risk profile. The shift to ``processes'' also obviates
the question of whether to require companies that do not have written
policies and procedures to disclose that fact. We believe that, to the
extent a company discloses that it faces a material cybersecurity risk
in connection with its overall disclosures of material risks,\227\ an
investor can ascertain whether such risks have resulted in the adoption
of processes to assess, identify, and manage material cybersecurity
risks based on whether the company also makes such disclosures under
the final rules.
---------------------------------------------------------------------------

    \226\ See letter from Prof. Perullo (distinguishing the
formality of ``policies and procedures'' from the informality of
``strategy or program''). We have adopted ``processes'' in place of
the commenter's suggestion of ``strategy or program'' because
``processes'' is broader and commonly understood. We decline the
suggestion from another commenter to allow registrants to avoid this
disclosure altogether by confirming they adhere to ``best practices
and standards,'' because there is no single set of widely accepted
best practices and standards, and industry practices may evolve. See
letter from Cybersecurity Coalition.
    \227\ See Item 105 of Regulation S-K.
---------------------------------------------------------------------------

    We have also added a materiality qualifier to the proposed
requirement to disclose ``risks from cybersecurity threats,'' and have
removed the proposed list of risk types (i.e., ``intellectual property
theft; fraud; extortion; harm to employees or customers; violation of
privacy laws and other litigation and legal risk; and reputational
risk''), to foreclose any perception that the rule prescribes
cybersecurity policy. We continue to believe these are the types of
risks that registrants may face in this context, and enumerate them
here as guidance. We note that registrants will continue to tailor
their cybersecurity processes to threats as they perceive them. The
rule requires registrants to describe those processes insofar as they
relate to material cybersecurity risks.
    We have also revised Item 106(b)'s enumerated disclosure elements
in

response to commenters that raised concerns regarding the level of
detail required by some elements of the proposal. Specifically, we are
not adopting proposed paragraphs (4) (prevention and detection
activities), (5) (continuity and recovery plans), and (6) (previous
incidents). We have similarly revised proposed paragraph (3) to
eliminate some of the detail it required, consistent with commenter
suggestions to require only high-level disclosure regarding third-party
service providers. The enumerated elements that a registrant should
address in its Item 106(b) disclosure, as applicable, are:
     Whether and how the described cybersecurity processes in
Item 106(b) have been integrated into the registrant's overall risk
management system or processes;
     Whether the registrant engages assessors, consultants,
auditors, or other third parties in connection with any such processes;
and
     Whether the registrant has processes to oversee and
identify material risks from cybersecurity threats associated with its
use of any third-party service provider.
    We have also revised the rule text to clarify that the above
elements compose a non-exclusive list of disclosures; registrants
should additionally disclose whatever information is necessary, based
on their facts and circumstances, for a reasonable investor to
understand their cybersecurity processes.
    We have moved proposed paragraph (7) into a separate paragraph, at
17 CFR 229.106(b)(2) (Regulation S-K ``Item 106(b)(2)''), instead of
including it in the enumerated list in Item 106(b)(1), and have added a
materiality qualifier in response to a comment.\228\ Item 106(b)(2)
requires a description of ``[w]hether any risks from cybersecurity
threats, including as a result of any previous cybersecurity incidents,
have materially affected or are reasonably likely to materially affect
the registrant, including its business strategy, results of operations,
or financial condition and if so, how.'' \229\
---------------------------------------------------------------------------

    \228\ See letter from PWC.
    \229\ With respect to the Item 106(b)(2)'s requirement to
describe any risks as a result of any previous cybersecurity
incidents, see supra Section II.B.3 for a discussion of the duties
to correct or update prior disclosure that registrants may have in
certain circumstances. As we note in that section, registrants
should consider whether they need to revisit or refresh previous
disclosure, including during the process of investigating a
cybersecurity incident.
---------------------------------------------------------------------------

    The final rules will require disclosure of whether a registrant
engages assessors, consultants, auditors, or other third parties in
connection with their cybersecurity because we believe it is important
for investors to know a registrant's level of in-house versus
outsourced cybersecurity capacity. We understand that many registrants
rely on third-party service providers for some portion of their
cybersecurity, and we believe this information is accordingly necessary
for investors to assess a company's cybersecurity risk profile in
making investment decisions. However, we are not persuaded, as one
commenter contended, that registrants should be required to name the
third parties (though they may choose to do so), because we believe
this may magnify concerns about increasing a company's cybersecurity
vulnerabilities. For the same reason, we decline the commenter
suggestion to require a description of the services provided by third
parties.
    We are also not persuaded that risk quantification or other
quantifiable metrics are appropriate as mandatory elements of a
cybersecurity disclosure framework. While such metrics may be used by
registrants and investors in the future, commenters did not identify
any such metrics that would be appropriate to mandate at this time.
Additionally, to the extent that a registrant uses any quantitative
metrics in assessing or managing cybersecurity risks, it may disclose
such information voluntarily. For similar reasons, we decline
commenters' recommendations to require disclosure of independent
assessments and audits, as well as commenters' recommendations on
disclosure of use of the NIST framework, and on distinguishing between
continuous and periodic risk assessment.
    We decline the commenter suggestion to allow Item 106(b) disclosure
to be provided in the proxy statement, as the proxy statement is
generally confined to information pertaining to the election of
directors. We are also not requiring Item 106 disclosures in
registration statements as recommended by the IAC, consistent with our
efforts to reduce the burdens associated with the final rule. However,
as discussed further below,\230\ we reiterate the Commission's guidance
from the 2018 Interpretive Release that ``[c]ompanies should consider
the materiality of cybersecurity risks and incidents when preparing the
disclosure that is required in registration statements.'' \231\
Finally, we note that registrants may satisfy the Item 106 disclosure
requirements through incorporation by reference pursuant to 17 CFR
240.12b-23 (``Rule 12b-23'').\232\
---------------------------------------------------------------------------

    \230\ See infra text accompanying notes 355 and 356.
    \231\ 2018 Interpretive Release at 8168.
    \232\ As required by Rule 12b-23, in order to incorporate
information by reference in answer, or partial answer, to Item 106,
a registrant must, among other things, include an active hyperlink
if the information is publicly available on EDGAR.
---------------------------------------------------------------------------

2. Governance
a. Proposed Amendments
    The Commission proposed to add 17 CFR 229.106(c) (Regulation S-K
``Item 106(c)'') to require a description of management and the board's
oversight of a registrant's cybersecurity risk. This information would
complement the proposed risk management and strategy disclosure by
clarifying for investors how a registrant's leadership oversees and
implements its cybersecurity processes.\233\ Proposed 17 CFR
229.106(c)(1) (Regulation S-K ``Item 106(c)(1)'') would focus on the
board's role, requiring discussion, as applicable, of:
---------------------------------------------------------------------------

    \233\ Proposing Release at 16600.
---------------------------------------------------------------------------

     Whether the entire board, specific board members, or a
board committee is responsible for the oversight of cybersecurity
risks;
     The processes by which the board is informed about
cybersecurity risks, and the frequency of its discussions on this
topic; and
     Whether and how the board or board committee considers
cybersecurity risks as part of its business strategy, risk management,
and financial oversight.
    Proposed 17 CFR 229.106(c)(2) (Regulation S-K ``Item 106(c)(2)'')
meanwhile would require a description of management's role in assessing
and managing cybersecurity-related risks, as well as its role in
implementing the registrant's cybersecurity policies, procedures, and
strategies, including at a minimum discussion of:
     Whether certain management positions or committees are
responsible for measuring and managing cybersecurity risk, specifically
the prevention, mitigation, detection, and remediation of cybersecurity
incidents, and the relevant expertise of such persons or members;
     Whether the registrant has a designated chief information
security officer, or someone in a comparable position, and if so, to
whom that individual reports within the registrant's organizational
chart, and the relevant expertise of any such persons;
     The processes by which such persons or committees are
informed about and monitor the prevention, mitigation, detection, and
remediation of cybersecurity incidents; and

     Whether and how frequently such persons or committees
report to the board of directors or a committee of the board of
directors on cybersecurity risk.
    The Proposing Release explained that proposed Item 106(c)(1) would
reinforce the Commission's 2018 Interpretive Release,\234\ which said
that disclosure on how a board engages management on cybersecurity
helps investors assess the board's exercise of its oversight
responsibility.\235\ The Proposing Release noted that proposed Item
106(c)(2) would be of importance to investors in that it would help
investors understand how registrants are planning for cybersecurity
risks and inform their decisions on how best to allocate their
capital.\236\
---------------------------------------------------------------------------

    \234\ Id. (citing 2018 Interpretive Release at 8170).
    \235\ 2018 Interpretive Release at 8170.
    \236\ Proposing Release at 16600.
---------------------------------------------------------------------------

b. Comments
    A few commenters supported proposed Item 106(c) as providing
investors with more uniform and informed understanding of registrants'
governance of cybersecurity risks.\237\ A number of commenters opposed
proposed Item 106(c). They contended that the proposed Item 106(c)
disclosures would be too granular to be decision-useful; instead, some
of these commenters recommended that we limit the rule to a high-level
explanation of management and the board's role in cybersecurity risk
oversight.\238\
---------------------------------------------------------------------------

    \237\ See, e.g., letters from Better Markets; CalPERS.
    \238\ See letters from ABA; AGA/INGAA; EEI; Nareit; NYSE.
---------------------------------------------------------------------------

    One commenter said proposed Item 106(c)(1) should be dropped
because it duplicates existing 17 CFR 229.407(h) (Regulation S-K ``Item
407(h)''), which requires reporting of material information regarding a
board's leadership structure and role in risk oversight, including how
it administers its oversight function.\239\ Others saw similarities
with Item 407(h) as well and suggested instead that proposed Item
106(c) be subsumed into Item 407, thus co-locating governance
disclosures.\240\
---------------------------------------------------------------------------

    \239\ See letter from Davis Polk. The commenter went on to say
that, to the extent Item 106(c) requires disclosure of immaterial
information regarding the board, it should be dropped.
    \240\ See letters from ABA; BDO; PWC.
---------------------------------------------------------------------------

    In response to a request for comment in the Proposing Release on
whether the Commission should expressly provide for the use of
hyperlinks or cross-references in Item 106, one commenter supported the
use of hyperlinks and cross-references, but sought clarification of
whether the practice is already permitted under Commission rules.\241\
Another commenter opposed, saying Item 407(h)'s more general discussion
of board governance is distinct from Item 106(c)(1)'s specific focus on
cybersecurity.\242\ The commenter cautioned that allowing registrants
to employ hyperlinks and cross-references in Item 106 would lead to
``less detail,'' resulting in disclosure insufficient to investor
needs.\243\
---------------------------------------------------------------------------

    \241\ See letter from E&Y.
    \242\ See letter from Tenable.
    \243\ Id.
---------------------------------------------------------------------------

    One commenter recommended that we move proposed Item 106(c)(2) to
the enumerated list of topics called for in proposed Item 106(b).\244\
Another commenter suggested expanding the rule to include disclosure of
management and staff training on cybersecurity, asserting that the
information is useful to investors because policies depend on staff for
successful implementation.\245\ Two commenters suggested allowing the
Item 106(c) disclosures to be made in the proxy statement.\246\
---------------------------------------------------------------------------

    \244\ See letter from Davis Polk.
    \245\ See letter from PRI.
    \246\ See letters from Business Roundtable; Nasdaq.
---------------------------------------------------------------------------

c. Final Amendments
    In response to comments, and aligned with our changes to Item
106(b), we have streamlined Item 106(c) to require disclosure that is
less granular than proposed. Under Item 106(c)(1) as adopted,
registrants must ``[d]escribe the board's oversight of risks from
cybersecurity threats,'' and, if applicable, ``identify any board
committee or subcommittee responsible'' for such oversight ``and
describe the processes by which the board or such committee is informed
about such risks.'' We have removed proposed Item 106(c)(1)(iii), which
had covered whether and how the board integrates cybersecurity into its
business strategy, risk management, and financial oversight. While we
have also removed the proposed Item 106(c)(1)(ii) requirement to
disclose ``the frequency of [the board or committee's] discussions'' on
cybersecurity, we note that, depending on context, some registrants'
descriptions of the processes by which their board or relevant
committee is informed about cybersecurity risks may include discussion
of frequency.\247\
---------------------------------------------------------------------------

    \247\ For example, if the board or committee relies on periodic
(e.g., quarterly) presentations by the registrant's chief
information security officer to inform its consideration of risks
from cybersecurity threats, the registrant may, in the course of
describing those presentations, also note their frequency.
---------------------------------------------------------------------------

    Given these changes, we find that Item 407(h) and Item 106(c)(1) as
adopted serve distinct purposes and should not be combined, as
suggested by some commenters--the former requires description of the
board's leadership structure and administration of risk oversight
generally, while the latter requires detail of the board's oversight of
specific cybersecurity risk. As noted by one commenter,\248\ to the
extent these disclosures are duplicative, a registrant would be able to
incorporate such information by reference.\249\
---------------------------------------------------------------------------

    \248\ See letter from E&Y.
    \249\ Rule 12b-23.
---------------------------------------------------------------------------

    We have also modified Item 106(c)(2) to add a materiality
qualifier, to make clear that registrants must ``[d]escribe
management's role in assessing and managing the registrant's material
risks from cybersecurity threats'' (emphasis added).\250\ The
enumerated disclosure elements now constitute a ``non-exclusive list''
registrants should consider including. We have revised the first
element to require the disclosure of management positions or committees
``responsible for assessing and managing such risks, and the relevant
expertise of such persons or members in such detail as necessary to
fully describe the nature of the expertise.'' Because this requirement
would typically encompass identification of whether a registrant has a
chief information security officer, or someone in a comparable
position, we are not adopting the proposed second element that would
have specifically called for disclosure of whether the registrant has a
designated chief information security officer. Given our purpose of
streamlining the disclosure requirements, we also are not adopting the
proposed requirement to disclose the frequency of management-board
discussions on cybersecurity, though, as noted above, discussion of
frequency may in some cases be included as part of describing the
processes by which the board or relevant committee is informed about
cybersecurity risks in compliance with Item 106(c)(1), to the extent it
is relevant to an understanding of the board's oversight of risks from
cybersecurity threats.
---------------------------------------------------------------------------

    \250\ We have not added a materiality qualifier to Item
106(c)(1) because, if a board of directors determines to oversee a
particular risk, the fact of such oversight being exercised by the
board is material to investors. By contrast, management oversees
many more matters and management's oversight of non-material matters
is likely not material to investors, so a materiality qualifier is
appropriate for Item 106(c)(2).
---------------------------------------------------------------------------

    Thus, as adopted, Item 106(c)(2) directs registrants to consider
disclosing the following as part of a description of management's role
in assessing and managing the registrant's material risks from
cybersecurity threats:
     Whether and which management positions or committees are
responsible

for assessing and managing such risks, and the relevant expertise of
such persons or members in such detail as necessary to fully describe
the nature of the expertise;
     The processes by which such persons or committees are
informed about and monitor the prevention, detection, mitigation, and
remediation of cybersecurity incidents; and
     Whether such persons or committees report information
about such risks to the board of directors or a committee or
subcommittee of the board of directors.
    As many commenters recommended, these elements are limited to
disclosure that we believe balances investors' needs to understand a
registrant's governance of risks from cybersecurity threats in
sufficient detail to inform an investment or voting decision with
concerns that the proposal could inadvertently pressure registrants to
adopt specific or inflexible cybersecurity-risk governance practices or
organizational structures. We do not believe these disclosures should
be subsumed into Item 106(b), as one commenter recommended, because
identifying the management committees and positions responsible for
risks from cybersecurity threats is distinct from describing the
cybersecurity practices management has deployed. We also decline the
commenter suggestion to require disclosure of management and staff
training on cybersecurity; registrants may choose to make such
disclosure voluntarily. Finally, we decline the commenter suggestion to
allow Item 106(c) disclosure to be provided in the proxy statement;
governance information in the proxy statement is generally meant to
inform shareholders' voting decisions, whereas Item 106(c) disclosure
informs investors' assessment of investment risk.
3. Definitions
a. Proposed Definitions
    The Commission proposed to define three terms to delineate the
scope of the amendments: ``cybersecurity incident,'' ``cybersecurity
threat,'' and ``information systems.'' \251\ Proposed 229 CFR
229.106(a) (Regulation S-K ``Item 106(a)'') would define them as
follows:
---------------------------------------------------------------------------

    \251\ Proposing Release at 16600-16601.
---------------------------------------------------------------------------

     Cybersecurity incident means an unauthorized occurrence on
or conducted through a registrant's information systems that
jeopardizes the confidentiality, integrity, or availability of a
registrant's information systems or any information residing therein.
     Cybersecurity threat means any potential occurrence that
may result in an unauthorized effort to adversely affect the
confidentiality, integrity or availability of a registrant's
information systems or any information residing therein.
     Information systems means information resources, owned, or
used by the registrant, including physical or virtual infrastructure
controlled by such information resources, or components thereof,
organized for the collection, processing, maintenance, use, sharing,
dissemination, or disposition of the registrant's information to
maintain or support the registrant's operations.
    As noted above, the Commission explained that what constitutes a
``cybersecurity incident'' should be construed broadly, encompassing a
range of event types.\252\
---------------------------------------------------------------------------

    \252\ Id. at 16601.
---------------------------------------------------------------------------

b. Comments
    Most commenters that offered feedback on the proposed definitions
suggested narrowing them in some fashion. On ``cybersecurity
incident,'' many commenters urged limiting the definition to cases of
actual harm, thereby excluding incidents that had only the potential to
cause harm.\253\ They suggested accomplishing this by replacing
``jeopardizes'' with phrases such as ``adversely affects'' or ``results
in substantial loss of.'' \254\ One of these commenters noted that such
a change would more closely align the definition with that in
CIRCIA.\255\ Other commenters objected to the definition's use of ``any
information'' as overbroad, saying it would lead to inconsistent
application.\256\ One commenter sought clarification of whether the
definition encompasses accidental incidents, such as chance technology
outages, that do not involve a malicious actor,\257\ while another
commenter advocated broadening the definition to any incident
materially disrupting operations, regardless of what precipitated
it.\258\
---------------------------------------------------------------------------

    \253\ See letters from ABA; BPI et al.; Chamber et al.; Davis
Polk; Enbridge; FDD; FEI; Hunton; PWC; SCG; SIFMA.
    \254\ See letters from BPI et al.; Hunton.
    \255\ See letter from BPI et al. (``The word `jeopardizes'
should be replaced with `results in substantial loss of' to capture
incidents that are causing some actual harm, and to better harmonize
the definition with the reporting standard set forth by Congress in
CIRCIA.'').
    \256\ See letters from Deloitte; SIFMA.
    \257\ See letter from CSA.
    \258\ See letter from Crindata.
---------------------------------------------------------------------------

    On ``cybersecurity threat,'' commenters urged narrowing the rule by
replacing the language ``may result in'' with ``could reasonably be
expected to result in'' or some other probability threshold.\259\ One
stated that ``the use of a `may' standard establishes an unhelpfully
low standard that would require registrants to establish policies and
procedures to identify threats that are potentially overbroad and not
appropriately tailored to those threats that are reasonably
foreseeable.'' \260\ In a similar vein, two commenters objected to the
language ``any potential occurrence'' as over-inclusive and lacking
``instructive boundaries.'' \261\
---------------------------------------------------------------------------

    \259\ See letters from Chevron; Debevoise; NYC Bar.
    \260\ See letter from Debevoise.
    \261\ See letters from Chevron; Deloitte.
---------------------------------------------------------------------------

    On ``information systems,'' many commenters favored replacing
``owned or used by'' with ``owned or operated by,'' ``owned or
controlled by,'' or like terms, so that registrants' reporting
obligations stop short of incidents on third-party information
systems.\262\ A few commenters said the definition could be construed
to cover hard-copy information and should be revised to foreclose such
a reading.\263\
---------------------------------------------------------------------------

    \262\ See letters from ABA; APCIA; Business Roundtable; Chamber;
Cybersecurity Coalition; ISA; ITI; NAM; NDIA; Paylocity. Other
commenters made similar arguments about third party systems without
speaking specifically to the definition, saying, for example, that
registrants may not have sufficient visibility into third-party
systems and may be bound by confidentiality agreements. See letters
from AIA; EIC; FAH; NMHC; SIFMA.
    \263\ See letters from ABA; BPI et al.; Enbridge.
---------------------------------------------------------------------------

    More broadly, many commenters advised the Commission to align these
definitions with comparable definitions in other Federal laws and
regulations, such as CIRCIA and NIST.\264\ One commenter explained that
``[a]ligning definitions with those in existing federal laws and
regulations would help ensure that the defined terms are consistently
understood, interpreted and applied in the relevant disclosure.'' \265\
However, another commenter cautioned against aligning with definitions,
such as those of NIST, that were developed with a view toward internal
risk management and response rather than external reporting; the
commenter identified CIRCIA and the Federal banking regulators'
definitions as more apposite.\266\ One commenter noted that additional
proposed defined terms were included in the Commission's rulemaking
release Cybersecurity Risk Management for Investment Advisers,
Registered Investment Companies, and Business Development Companies
\267\ that were not included in the Proposing Release and recommended
that we

``consider whether the defined terms should be consistent.'' \268\
---------------------------------------------------------------------------

    \264\ See letters from ABA; CAQ; Chevron; FEI; IC; IIA;
Microsoft; PWC; SandboxAQ; SIFMA.
    \265\ See letter from ABA.
    \266\ See letter from SCG.
    \267\ Release No. 33-11028 (Feb. 9, 2022) [87 FR 13524 (Mar. 9,
2022)].
    \268\ See letter from Deloitte.
---------------------------------------------------------------------------

    In the Proposing Release, the Commission asked whether to define
other terms used in the proposed amendments, and specifically sought
comment on whether a definition of ``cybersecurity'' would be
useful.\269\ Several commenters supported defining ``cybersecurity,''
\270\ reasoning, for example, that any rulemaking on cybersecurity
should define that baseline term; \271\ that, left undefined, the term
would be open to varying interpretations; \272\ and that details such
as whether hardware is covered should be resolved.\273\ Separately, two
commenters recommended the Commission define ``operational
technology,'' \274\ with one explaining that the ``proposed definitions
understandably focus on data breaches, which are a major cybersecurity
threat, but we believe an operational technology breach could have even
more detrimental effects in certain cases (such as for ransomware
attacks that have impacted critical infrastructure) and warrants
disclosure guidance from the Commission.'' \275\
---------------------------------------------------------------------------

    \269\ Proposing Release at 16601.
    \270\ See letters from BCS; Blue Lava; EIC; R. Hackman; R
Street.
    \271\ See letter from R Street.
    \272\ See letter from Blue Lava.
    \273\ See letter from BCS.
    \274\ See letters from Chevron; EIC.
    \275\ See letter from Chevron.
---------------------------------------------------------------------------

    Several commenters also sought either a formal definition or more
guidance on the term ``material'' specific to the cybersecurity
space.\276\ Some read the proposal, particularly the incident examples
provided in the Proposing Release, as lowering the bar for materiality
and being overly subjective, which they indicated may result in over-
reporting of cybersecurity incidents or introduce uncertainty, and they
urged the Commission to affirm the standard materiality
definition.\277\ Another commenter sought cybersecurity-specific
guidance on materiality, including ``concrete thresholds to assist
registrants in determining materiality.'' \278\ A few commenters
recommended conditioning the materiality determination on the
underlying information being verified to ``a high degree of
confidence'' and ``unlikely to materially change,'' \279\ while one
commenter looked to replace materiality altogether with a significance
standard like that in CIRCIA.\280\
---------------------------------------------------------------------------

    \276\ See letters from ACLI; AIC; AICPA; APCIA; Bitsight; Harry
Broadman, Eric Matrejek, and Brad Wilson (``Broadman et al.'');
Debevoise; EIC; International Information System Security
Certification Consortium (``ISC2''); M. Barragan; NYC Bar; Prof.
Perullo; R Street; SIFMA; TransUnion; Virtu.
    \277\ See letters from APCIA; ACLI; EIC; Virtu.
    \278\ See letter from SIFMA.
    \279\ See letters from Debevoise; NYC Bar. See also letter from
AIC (suggesting ``unlikely to change,'' without ``materially'').
    \280\ See letter from National Electrical Manufacturers
Association (``NEMA'').
---------------------------------------------------------------------------

c. Final Definitions
    We are adopting definitions for ``cybersecurity incident,''
``cybersecurity threat,'' and ``information systems'' largely as
proposed, with three modifications.
    First, on ``cybersecurity incident,'' we are adding the phrase ``or
a series of related unauthorized occurrences'' to the ``cybersecurity
incident'' definition. This reflects our guidance in Section II.B.3
above that a series of related occurrences may collectively have a
material impact or reasonably likely material impact and therefore
trigger Form 8-K Item 1.05, even if each individual occurrence on its
own would not rise to the level of materiality. Second, we are making a
clarifying edit to ``information systems.'' Some commenters said the
definition could be construed to cover hard-copy resources.\281\ We
recognize that reading is possible, if unlikely and unintended, and we
are therefore inserting ``electronic'' before ``information
resources,'' to ensure the rules pertain only to electronic resources.
Third, we are making minor revisions to the ``cybersecurity threat''
definition for clarity and to better align it with the ``cybersecurity
incident'' definition.
---------------------------------------------------------------------------

    \281\ See letters from ABA; BPI et al.; Enbridge.
---------------------------------------------------------------------------

    Accordingly, the definitions are as follows:
     Cybersecurity incident means an unauthorized occurrence,
or a series of related unauthorized occurrences, on or conducted
through a registrant's information systems that jeopardizes the
confidentiality, integrity, or availability of a registrant's
information systems or any information residing therein.
     Cybersecurity threat means any potential unauthorized
occurrence on or conducted through a registrant's information systems
that may result in adverse effects on the confidentiality, integrity or
availability of a registrant's information systems or any information
residing therein.
     Information systems means electronic information
resources, owned or used by the registrant, including physical or
virtual infrastructure controlled by such information resources, or
components thereof, organized for the collection, processing,
maintenance, use, sharing, dissemination, or disposition of the
registrant's information to maintain or support the registrant's
operations.
    We recognize commenters' concern regarding the term ``jeopardizes''
in the proposed ``cybersecurity incident'' definition and the resulting
scope of the definition. Nonetheless, we note that the definition is
not self-executing; rather it is operationalized by Item 1.05, which is
conditioned on the incident having been material to the registrant.
Typically that would entail actual harm, though the harm may sometimes
be delayed, and a material cybersecurity incident may not result in
actual harm in all instances. For example, a company whose intellectual
property is stolen may not suffer harm immediately, but it may foresee
that harm will likely occur over time as that information is sold to
other parties, such that it can determine materiality before the harm
occurs. The reputational harm from a breach may similarly increase over
time in a foreseeable manner. There may also be cases, even if
uncommon, where the jeopardy caused by a cybersecurity incident
materially affects the company, even if the incident has not yet caused
actual harm. In such circumstances, we believe investors should be
apprised of the material effects of the incident. We are therefore
retaining the word ``jeopardizes'' in the definition.
    We are not persuaded that the proposed ``cybersecurity incident''
definition's use of ``any information'' would lead to inconsistent
application of the definition among issuers or cause a risk of over-
reporting, as suggested by some commenters. As noted above, the
``cybersecurity incident'' definition is operationalized by Item 1.05.
Item 1.05 does not require disclosure whenever ``any information'' is
affected by an intruder. Disclosure is triggered only when the
resulting effect of an incident on the registrant is material.
    We are also retaining ``unauthorized'' in the incident definition
as proposed. In general, we believe that an accidental occurrence is an
unauthorized occurrence. Therefore, we note that an accidental
occurrence may be a cybersecurity incident under our definition, even
if there is no confirmed malicious activity. For example, if a
company's customer data are accidentally exposed, allowing unauthorized
access to such data, the data breach would constitute a ``cybersecurity
incident'' that would necessitate a materiality analysis to determine
whether disclosure under Item 1.05 of Form 8-K is required.
    On ``cybersecurity threat,'' we appreciate commenters' concerns
with

the proposed definition's use of ``may result in'' and ``any potential
occurrence.'' Unlike with ``cybersecurity incident,'' where the
interplay of the proposed definition with proposed Item 1.05 ensured
only material incidents would become reportable, proposed Item 106(b)'s
reference to ``the identification and management of risks from
cybersecurity threats'' was not qualified by materiality. We are
therefore adding a materiality condition to Item 106(b). As adopted,
Item 106(b) will require disclosure of registrants' processes to
address the material risks of potential occurrences that could
reasonably result in an unauthorized effort to adversely affect the
confidentiality, integrity, or availability of a registrant's
information systems. Given the addition of a materiality condition to
Item 106(b), we do not believe that further revision to the
``cybersecurity threat'' definition is warranted.
    On ``information systems,'' we decline to change ``owned or used
by'' to ``owned or operated by,'' ``owned or controlled by,'' or
similar terms advanced by commenters. Commenters recognized that ``used
by'' covers information resources owned by third parties. That is by
design: covering third party systems is essential to the working of
Item 106 of Regulation S-K and Item 1.05 of Form 8-K. As we explain
above, in Section II.A.3, the materiality of a cybersecurity incident
is contingent neither on where the relevant electronic systems reside
nor on who owns them, but rather on the impact to the registrant. We do
not believe that a reasonable investor would view a significant data
breach as immaterial merely because the data are housed on a cloud
service. If we were to remove ``used by,'' a registrant could evade the
disclosure requirements of the final rules by contracting out all of
its information technology needs to third parties. Accordingly, the
definition of ``information systems'' contemplates those resources
owned by third parties and used by the registrant, as proposed.
    In considering commenters' suggestion to align our definitions with
CIRCIA, NIST, and other Federal regulations, we observe that there is
no one standard definition for these terms, and that regulators have
adopted definitions based on the specific contexts applicable to their
regulations. Nonetheless, we also observe that the final
``cybersecurity incident'' definition is already similar to the CIRCIA
and NIST incident definitions, in that all three focus on the
confidentiality, integrity, and availability of information
systems.\282\ Our definition of ``information systems'' also tracks
CIRCIA and NIST, as all three cover ``information resources'' that are
``organized for the collection, processing, maintenance, use, sharing,
dissemination, or disposition'' of information.\283\ Of course, the
definitions do not match precisely, but some variation is inevitable
where various Federal laws and regulations have different purposes,
contexts, and goals. We therefore find that further alignment is not
needed.
---------------------------------------------------------------------------

    \282\ For CIRCIA, see supra note 19, at sec. 103, 136 Stat.
1039; and 6 U.S.C. 681b(c)(2)(A)(i). For NIST, see Incident,
Glossary, NIST Computer Security Resource Center, available at
https://csrc.nist.gov/glossary/term/incident.
    \283\ For CIRCIA, see supra note 19, at sec. 103, 136 Stat.
1039; and 44 U.S.C. 3502(8). For NIST, see Information System,
Glossary, NIST Computer Security Resource Center, available at
https://csrc.nist.gov/glossary/term/information_system.
---------------------------------------------------------------------------

    We decline to define any other terms. We acknowledge commenters who
asked for additional guidance regarding the application of a
materiality determination to cybersecurity or sought to replace
materiality with a significance standard. As noted in the Proposing
Release, however, we expect that registrants will apply materiality
considerations as would be applied regarding any other risk or event
that a registrant faces. Carving out a cybersecurity-specific
materiality definition would mark a significant departure from current
practice, and would not be consistent with the intent of the final
rules.\284\ Accordingly, we reiterate, consistent with the standard set
out in the cases addressing materiality in the securities laws, that
information is material if ``there is a substantial likelihood that a
reasonable shareholder would consider it important'' \285\ in making an
investment decision, or if it would have ``significantly altered the
`total mix' of information made available.'' \286\ Because
materiality's focus on the total mix of information is from the
perspective of a reasonable investor, companies assessing the
materiality of cybersecurity incidents, risks, and related issues
should do so through the lens of the reasonable investor. Their
evaluation should take into consideration all relevant facts and
circumstances, which may involve consideration of both quantitative and
qualitative factors. Thus, for example, when a registrant experiences a
data breach, it should consider both the immediate fallout and any
longer term effects on its operations, finances, brand perception,
customer relationships, and so on, as part of its materiality analysis.
We also note that, given the fact-specific nature of the materiality
determination, the same incident that affects multiple registrants may
not become reportable at the same time, and it may be reportable for
some registrants but not others.
---------------------------------------------------------------------------

    \284\ See, e.g., Basic Inc. v. Levinson, 485 U.S. 224, 236
(1988) (``[a]ny approach that designates a single fact or occurrence
as always determinative of an inherently fact-specific finding such
as materiality, must necessarily be overinclusive or
underinclusive'').
    \285\ TSC Indus. v. Northway, 426 U.S. 438, 449 (1976); Matrixx
Initiatives v. Siracusano, 563 U.S. 27, 38-40 (2011); Basic, 485
U.S. at 240.
    \286\ Id. See also the definition of ``material'' in 17 CFR
230.405 [Securities Act Rule 405]; 17 CFR 240.12b-2 [Exchange Act
Rule 12b-2].
---------------------------------------------------------------------------

    We also decline to separately define ``cybersecurity,'' as
suggested by some commenters. We do not believe such further definition
is necessary, given the broad understanding of this term. To that end,
we note that the cybersecurity industry itself appears not to have
settled on an exact definition, and because the field is quickly
evolving and is expected to continue to evolve over time, any
definition codified in regulation could soon become stale as technology
develops. Likewise, the final rules provide flexibility by not defining
``cybersecurity,'' allowing a registrant to determine meaning based on
how it considers and views such matters in practice, and on how the
field itself evolves over time.
    We decline to define ``operational technology'' as suggested by
some commenters because the term does not appear in the rules we are
adopting.

D. Disclosure Regarding the Board of Directors' Cybersecurity Expertise

1. Proposed Amendments
    Congruent with proposed Item 106(c)(2) on the board's oversight of
cybersecurity risk, the Commission proposed adding 17 CFR 229.407(j)
(Regulation S-K ``Item 407(j)'') to require disclosure about the
cybersecurity expertise, if any, of a registrant's board members.\287\
The proposed rule did not define what constitutes expertise, given the
wide-ranging nature of cybersecurity skills, but included a non-
exclusive list of criteria to consider, such as prior work experience,
certifications, and the like. As proposed, paragraph (j) would build on
existing 17 CFR 229.401(e) (Regulation S-K ``Item 401(e)'') (business
experience of directors) and Item 407(h) (board risk oversight), and
would be required in the annual report on Form 10-K and in the proxy or
information statement when action is to be taken on the election of
directors. Thus, the Proposing Release said,

proposed Item 407(j) would help investors in making both investment and
voting decisions.\288\
---------------------------------------------------------------------------

    \287\ Proposing Release at 16601.
    \288\ Id.
---------------------------------------------------------------------------

    The Commission also proposed to include a safe harbor in 17 CFR
229.407(j)(2) (Regulation S-K ``Item 407(j)(2)'') providing that any
directors identified as cybersecurity experts would not be deemed
experts for liability purposes, including under Section 11 of the
Securities Act.\289\ This was intended to clarify that identified
directors do not assume any duties, obligations, or liabilities greater
than those assumed by non-expert directors.\290\ Nor would such
identification decrease the duties, obligations, and liabilities of
non-expert directors relative to identified directors.\291\
---------------------------------------------------------------------------

    \289\ Id. at 16602.
    \290\ Id.
    \291\ Id.
---------------------------------------------------------------------------

2. Comments
    Proposed Item 407(j) garnered significant comment. Supporters wrote
that understanding a board's level of cybersecurity expertise is
important to assessing a company's ability to manage cybersecurity
risk.\292\ For example, one commenter said ``[b]oard cybersecurity
expertise serves as a useful starting point for investors to assess a
company's approach to cybersecurity;'' \293\ while another commenter
said investors need the Item 407(j) disclosure ``[t]o cast informed
votes on directors.'' \294\ One comment letter submitted an academic
study by the authors of the letter and noted that its findings
``underscore the importance of understanding the role of boards in
cybersecurity oversight.'' \295\
---------------------------------------------------------------------------

    \292\ See letters from O. Borges; CalPERS; Prof. Choudhary; CII;
Digital Directors Network (``DDN''); ISC2; Prof. Lowry et al.; NACD;
PRI; SANS Institute; SM4RT Secure.
    \293\ See letter from PRI.
    \294\ See letter from CII.
    \295\ See letter from Prof. Lowry et al.
---------------------------------------------------------------------------

    By contrast, many commenters argued cybersecurity risk is not
intrinsically different from other risks that directors assess with or
without specific technical expertise.\296\ For example, one reasoned
that, given the ``ever-changing range of risks confronting a company,''
directors require ``broad-based skills in risk and management
oversight, rather than subject matter expertise in one particular type
of risk.'' \297\ Commenters also predicted the disclosure requirement
would pressure companies to retain cybersecurity experts on their
board, and submitted there is not enough cybersecurity talent in the
marketplace at this time for all or most companies to do so.\298\ One
of these commenters further contended that finding such expertise will
be harder for smaller reporting companies.\299\ Another commenter
warned that, given the current cybersecurity talent pool, the end
result may be lower diversity on boards; \300\ and one said hiring
cybersecurity experts to the board may come at the expense of spending
on a company's cybersecurity defenses.\301\ Commenters also expressed
concern that the identified expert directors would face elevated risks,
such as being targeted by nation states for surveillance or hackers
attempting to embarrass them, thus creating a disincentive to board
service.\302\
---------------------------------------------------------------------------

    \296\ See letters from ABA; ACC; AGA/INGAA; AICPA; Auto
Innovators; BDO; BPI et al.; Business Roundtable; CAQ; CBA; Chamber;
CTA; CTIA; Davis Polk; Deloitte; EEI; EIC; Hunton; ITI; IC; LTSE;
Microsoft; Nareit; NAM; NDIA; NRA; NYSE; PPG; Safe Security; SCG;
SIFMA; TechNet; USTelecom; Virtu; Wilson Sonsini. See also IAC
Recommendation.
    \297\ See letter from ABA.
    \298\ See letters from ACC; APCIA; BIO; Blue Lava; Chamber; FDD;
ITI (May 9, 2022); NDIA; NYSE; SCG (May 9, 2022). In this vein, a
commenter requested the Commission affirm Item 407(j) is only a
disclosure provision and is not intended to mandate cybersecurity
expertise on the board. See letter from Federated Hermes.
    \299\ See letter from BIO.
    \300\ See letter from Chamber (``An unintended consequence of
the SEC proposal is likely to create new barriers for
underrepresented groups to move into cybersecurity leadership roles
largely due to the expense of obtaining credentials and other formal
certifications. The costs associated with obtaining cybersecurity-
related degrees and other credentials could hinder the advancement
of individuals who could otherwise rise through the ranks within the
field of cybersecurity.'').
    \301\ See letter from Wilson Sonsini.
    \302\ See letters from BIO; Chevron; EEI; EIC; Hunton; Profs.
Rajgopal & Sharp.
---------------------------------------------------------------------------

    More generally, sentiment among those opposed to Item 407(j) was
that the rule is overly prescriptive and in effect would direct how
companies operate their cybersecurity programs.\303\ As an alternative,
some commenters pushed for other ways to show competency, such as
identifying outside experts the board relies on for cybersecurity
expertise, disclosing how frequently the board meets with the chief
information security officer, listing relevant director training, and
relying on adjacent technology skills.\304\
---------------------------------------------------------------------------

    \303\ See, e.g., letter from ACC.
    \304\ See letters from AGA/INGAA; BPI et al.; Business
Roundtable; DDN; LTSE; PRI; Wilson Sonsini.
---------------------------------------------------------------------------

    Whether they supported or opposed the proposed disclosure
requirement, commenters largely endorsed the proposed Item 407(j)(2)
safe harbor; its absence, they said, could make candidates with
cybersecurity expertise reluctant to serve on boards.\305\ Two
commenters requested the Commission define ``cybersecurity expertise;''
\306\ one of them said being ``duly accredited and certified as a
cybersecurity professional'' should be a prerequisite, and posited
specific industry certifications to establish expertise.\307\ Another
commenter suggested adding participation in continuing education to the
17 CFR 229.407(j)(1)(i) factors considered in assessing expertise.\308\
---------------------------------------------------------------------------

    \305\ See letters from ABA; BIO; CII; CSA; A. Heighington; NACD;
Paylocity; Prof. Perullo.
    \306\ See letters from Federated Hermes; ISC2.
    \307\ See letter from ISC2.
    \308\ See letter from SandboxAQ.
---------------------------------------------------------------------------

3. Final Amendments
    After considering the comments, we are not adopting proposed Item
407(j). We are persuaded that effective cybersecurity processes are
designed and administered largely at the management level, and that
directors with broad-based skills in risk management and strategy often
effectively oversee management's efforts without specific subject
matter expertise, as they do with other sophisticated technical
matters. While we acknowledge that some commenters indicated that the
proposed Item 407(j) information would be helpful to investors, we
nonetheless agree that it may not be material information for all
registrants. We believe investors can form sound investment decisions
based on the information required by Items 106(b) and (c) without the
need for specific information regarding board-level expertise. And to
that end, a registrant that has determined that board-level expertise
is a necessary component to the registrant's cyber-risk management
would likely provide that disclosure pursuant to Items 106(b) and (c).

E. Disclosure by Foreign Private Issuers

1. Proposed Amendments
    The Commission proposed to establish disclosure requirements for
FPIs parallel to those proposed for domestic issuers in Regulation S-K
Items 106 and 407(j) and Form 8-K Item 1.05.\309\ Specifically, the
Commission proposed to amend Form 20-F to incorporate the requirements
of proposed Item 106 and 407(j) to disclose information regarding an
FPI's cybersecurity risk management, strategy, and governance.\310\
With respect to

incident disclosure, the Commission proposed to: (1) amend General
Instruction B of Form 6-K to reference material cybersecurity incidents
among the items that may trigger a current report on Form 6-K,\311\ and
(2) amend Form 20-F to require updated disclosure regarding incidents
previously disclosed on Form 6-K.
---------------------------------------------------------------------------

    \309\ Proposing Release at 16602. The Commission did not propose
to amend Form 40-F, choosing rather to maintain the
multijurisdictional disclosure system (``MJDS'') whereby eligible
Canadian FPIs use Canadian disclosure standards and documents to
satisfy SEC registration and disclosure requirements.
    \310\ As noted in the Proposing Release, FPIs would include the
expertise disclosure only in their annual reports, as they are not
subject to Commission rules for proxies and information statements.
    \311\ A registrant is required under Form 6-K to furnish copies
of all information that it: (i) makes or is required to make public
under the laws of its jurisdiction of incorporation, (ii) files, or
is required to file under the rules of any stock exchange, or (iii)
otherwise distributes to its security holders.
---------------------------------------------------------------------------

2. Comments
    A few commenters agreed that the Commission should not exempt FPIs
from the proposed disclosure requirements, given they face the same
threats as domestic issuers.\312\ Another commenter said the Commission
should not delay compliance for FPIs, for similar reasons.\313\ On the
other hand, one commenter said the proposal would disproportionately
burden FPIs because, under its reading of the proposed amendment to
General Instruction B, Form 6-K would require disclosure of all
cybersecurity incidents, not just those that are material.\314\ The
commenter went on to say that the interplay of the European Union's
Market Abuse Regulation (``MAR'') would render the proposed Form 6-K
amendment particularly taxing, because MAR requires immediate
announcement of non-public price sensitive information.\315\
---------------------------------------------------------------------------

    \312\ See letters from CSA; Cybersecurity Coalition; Prof.
Perullo; Tenable.
    \313\ See letter from Crindata.
    \314\ See letter from SIFMA.
    \315\ Id.
---------------------------------------------------------------------------

    On MJDS filers, commenters endorsed the Commission's determination
not to propose to amend Form 40-F, maintaining that Canadian issuers
eligible to use MJDS should be permitted to follow their domestic
disclosure standards, consistent with other disclosure requirements for
those registrants.\316\
---------------------------------------------------------------------------

    \316\ See letters from ACLI; BCE; Cameco Corporation; CBA; Sun
Life Financial Inc.
---------------------------------------------------------------------------

3. Final Amendments
    We are adopting the Form 20-F and Form 6-K amendments as proposed,
with modifications that are consistent with those being applied to Item
106 of Regulation S-K and Item 1.05 of Form 8-K. We continue to believe
that FPIs' cybersecurity incidents and risks are not any less important
to investors' capital allocation than those of domestic registrants. We
also do not find that the Form 6-K amendments unduly burden FPIs.
Importantly, the language the Commission proposed to add to General
Instruction B (``cybersecurity incident'') of Form 6-K would be
modified by the existing language ``that which is material with respect
to the issuer and its subsidiaries concerning.'' Nonetheless, for added
clarity, we are including the word ``material'' before ``cybersecurity
incident.'' Thus, for a cybersecurity incident to trigger a disclosure
obligation on Form 6-K, the registrant must determine that the incident
is material, in addition to meeting the other criteria for required
submission of the Form.\317\ Even registrants subject to the European
Union's MAR will first have developed the relevant information for
foreign disclosure or publication under MAR, so any added burden for
preparing and furnishing the Form 6-K should be minor. As the
Commission stated in the Proposing Release, we do not find reason to
adopt prescriptive cybersecurity disclosure requirements for Form 40-F
filers, given that the MJDS generally permits eligible Canadian FPIs to
use Canadian disclosure standards and documents to satisfy the
Commission's registration and disclosure requirements.\318\ We note
that such filers are already subject to the Canadian Securities
Administrators' 2017 guidance on the disclosure of cybersecurity risks
and incidents.\319\
---------------------------------------------------------------------------

    \317\ See supra note 311 for the other criteria.
    \318\ Proposing Release at 16603.
    \319\ Canadian Securities Administrators, CSA Multilateral Staff
Notice 51-347--Disclosure of cyber security risks and incidents
(Jan. 19, 2017).
---------------------------------------------------------------------------

F. Structured Data Requirements

1. Proposed Amendments
    The Commission proposed to mandate that registrants tag the new
disclosures in Inline XBRL, including by block text tagging narrative
disclosures and detail tagging quantitative amounts.\320\ The Proposing
Release explained that the structured data requirements would make the
disclosures more accessible to investors and other market participants
and facilitate more efficient analysis.\321\ The proposed requirements
would not be unduly burdensome to registrants, the release posited,
because they are similar to the Inline XBRL requirements for other
disclosures.\322\
---------------------------------------------------------------------------

    \320\ Proposing Release at 16603.
    \321\ Id.
    \322\ Id.
---------------------------------------------------------------------------

2. Comments
    Commenters largely supported the proposal to require Inline XBRL
tagging of the new disclosures, as structured data would enable
automated extraction and analysis.\323\ Opposition to the requirement
centered on filer burden, including an argument that, given the time-
sensitive nature of the Item 1.05 Form 8-K disclosure, mandating
structured data tagging would unduly add to companies' burden in
completing timely reporting.\324\
---------------------------------------------------------------------------

    \323\ See letters from AICPA; CAQ; Crowe LLP; E&Y FDD; K.
Fuller; NACD; PWC; Professors Lawrence Trautman & Neal Newman; XBRL
US.
    \324\ See letters from NYC Bar; SFA.
---------------------------------------------------------------------------

3. Final Amendments
    After considering comments, we are adopting the structured data
requirements as proposed, with a staggered compliance date of one
year.\325\ We are not persuaded that Inline XBRL tagging will unduly
add to companies' burden in preparing and filing Item 1.05 Form 8-K in
a timely fashion, and we believe such incremental costs are appropriate
given the significant benefits to investors. Compared to the Inline
XBRL tagging companies will already be performing for their financial
statements, the tagging requirements here are less extensive and
complex. Inline XBRL tagging will enable automated extraction and
analysis of the information required by the final rules, allowing
investors and other market participants to more efficiently identify
responsive disclosure, as well as perform large-scale analysis and
comparison of this information across registrants.\326\ The Inline XBRL
requirement will also enable automatic comparison of tagged disclosures
against prior periods. If we were not to adopt the Inline XBRL
requirement as suggested by some commenters, some of the benefit of the
new rules would be diminished. However, we are delaying compliance with
the structured data requirements for one year beyond initial compliance
with the disclosure requirements. This

approach should both help lessen any compliance burden and improve
data.
---------------------------------------------------------------------------

    \325\ We have incorporated modifications of a technical nature
to the regulatory text.
    \326\ These considerations are generally consistent with
objectives of the recently enacted Financial Data Transparency Act
of 2022, which directs the establishment by the Commission and other
financial regulators of data standards for collections of
information, including with respect to periodic and current reports
required to be filed or furnished under Exchange Act Sections 13 and
15(d). Such data standards must meet specified criteria relating to
openness and machine-readability and promote interoperability of
financial regulatory data across members of the Financial Stability
Oversight Council. See James M. Inhofe National Defense
Authorization Act for Fiscal Year 2023, Public Law 117-263, tit.
LVIII, 136 Stat. 2395, 3421-39 (2022).
---------------------------------------------------------------------------

G. Applicability to Certain Issuers

1. Asset-Backed Issuers
    The Commission proposed to amend Form 10-K to clarify that an
asset-backed issuer, as defined in 17 CFR 229.1101 (Regulation AB
``Item 1101''), that does not have any executive officers or directors
may omit the information required by proposed Item 106(c).\327\ The
Commission noted that asset-backed issuers would likewise be exempt
from proposed Item 407(j) pursuant to existing Instruction J to Form
10-K.\328\ The Commission further requested comment on whether to
generally exempt asset-backed issuers from the proposed rules.
---------------------------------------------------------------------------

    \327\ Proposing Release at 16600.
    \328\ Id. at 16601.
---------------------------------------------------------------------------

    One commenter stated that the proposed rules should not apply to
issuers of asset-backed securities, given that they are limited purpose
or passive special purpose vehicles with limited activities, no
operations or businesses, and no information systems.\329\ The
commenter also opposed applying the proposed rules to other transaction
parties (such as the sponsor, servicer, originator, and trustee),
because such parties are neither issuers of nor obligors on an asset-
backed security, and ``it is extraordinarily unlikely that a
transaction party's financial performance or position would be impacted
by a cybersecurity incident to such an extent as to impede its ability
to perform its duties and responsibilities to the securitization
transaction.'' \330\ The commenter acknowledged that cybersecurity
disclosure rules may make sense for servicers of asset-backed
securities, but counseled that any new rules should be tailored to such
entities, rather than applying the proposed rules.\331\
---------------------------------------------------------------------------

    \329\ See letter from SFA.
    \330\ Id.
    \331\ Id.
---------------------------------------------------------------------------

    We are exempting asset-backed securities issuers from the final
rules.\332\ We agree with the commenter that the final rules would not
result in meaningful disclosure by asset-backed issuers. In particular,
we are persuaded by the fact that asset-backed issuers are typically
special purpose vehicles whose activities are limited to receiving or
purchasing, and transferring or selling, assets to an issuing entity
\333\ and, accordingly, do not own or use information systems, whereas
the final rules are premised on an issuer's ownership or use of
information systems.\334\ To the extent that a servicer or other party
to an asset-backed security transaction is a public company, it will be
required to comply with the final rules with respect to information
systems it owns or uses. Therefore, an investor in an asset-backed
security who wants to assess the cybersecurity of transaction parties
will be able to do so for those that are public companies. The
Commission may consider cybersecurity disclosure rules specific to
asset-backed securities at a later date.
---------------------------------------------------------------------------

    \332\ See General Instruction G to Form 8-K, and General
Instruction J to Form 10-K.
    \333\ See letter from SFA (citing the definitions contained in
17 CFR 229.1101(b), 17 CFR 230.191, and 17 CFR 240.3b-19).
    \334\ The definition of ``cybersecurity incident'' focuses on
``a registrant's information systems.'' Likewise, the definition of
``cybersecurity threat'' concerns ``a registrant's information
systems or any information residing therein.''
---------------------------------------------------------------------------

2. Smaller Reporting Companies
    In the Proposing Release, the Commission did not include an
exemption or alternative compliance dates or transition accommodations
for smaller reporting companies, but it did request comment on whether
to do so.\335\ The Commission noted that smaller companies may face
equal or greater cybersecurity risk than larger companies, such that
cybersecurity disclosures may be particularly important for their
investors.\336\
---------------------------------------------------------------------------

    \335\ Proposing Release at 16601.
    \336\ Id. at 16613.
---------------------------------------------------------------------------

    A few commenters advocated an exemption for smaller reporting
companies, asserting that they face outsized costs from the proposal
and lower cybersecurity risk.\337\ And some commenters called for a
longer compliance phase-in period for smaller reporting companies, to
help them mitigate their cost burdens and benefit from the compliance
and disclosure experience of larger companies.\338\ Other commenters
opposed an exemption for smaller reporting companies,\339\ in part
because they may face equal \340\ or greater \341\ cybersecurity risk
than larger companies, or because investors' relative share in a
smaller company may be higher, such that small companies' cybersecurity
risk ``may actually embody the most pressing cybersecurity risk to an
investor.'' \342\
---------------------------------------------------------------------------

    \337\ See letters from BIO; NDIA.
    \338\ See letters from BIO; BDO; NACD; Nasdaq. In addition, the
Commission's Small Business Capital Formation Advisory Committee
highlights generally in its parting perspectives letter that
``exemptions, scaling, and phase-ins for new requirements where
appropriate, allows smaller companies to build their businesses and
balance the needs of companies and investors while promoting strong
and effective U.S. public markets.'' See Parting Perspectives
Letter, U.S. Securities and Exchange Commission Small Business
Capital Formation Advisory Committee (Feb. 28, 2023), available at
https://www.sec.gov/files/committee-perspectives-letter-022823.pdf.
See also U.S. Securities and Exchange Commission Office of the
Advocate for Small Business Capital Formation, Annual Report Fiscal
Year 2022 (``2022 OASB Annual Report''), available at https://www.sec.gov/files/2022-oasb-annual-report.pdf, at 83 (recommending
generally that in engaging in rulemaking that affects small
businesses, the Commission tailor the disclosure and reporting
framework to the complexity and size of operations of companies,
either by scaling obligations or delaying compliance for the
smallest of the public companies).
    \339\ See letters from CSA; Cybersecurity Coalition; NASAA;
Prof. Perullo; Tenable.
    \340\ See letter from Cybersecurity Coalition.
    \341\ See letters from NASAA and Tenable.
    \342\ See letter from Prof. Perullo.
---------------------------------------------------------------------------

    Consistent with the proposal, we decline to exempt smaller
reporting companies. We believe the streamlined requirements of the
final rules will help reduce some of the costs associated with the
proposal for all registrants, including smaller reporting companies.
Also, we do not believe that an additional compliance period is needed
for smaller reporting companies with respect to Item 106, as this
information is factual in nature regarding a registrant's existing
cybersecurity strategy, risk management, and governance, and so should
be readily available to those companies to assess for purposes of
preparing disclosure. Finally, given the significant cybersecurity
risks smaller reporting companies face and the outsized impacts that
cybersecurity incidents may have on their businesses, their investors
need access to timely disclosure on material cybersecurity incidents
and the material aspects of their cybersecurity risk management and
governance. However, we agree with commenters that stated smaller
reporting companies would likely benefit from additional time to comply
with the incident disclosure requirements. Accordingly, as discussed
below, we are providing smaller reporting companies an additional 180
days from the non-smaller reporting company compliance date before they
must begin complying with Item 1.05 of Form 8-K.

H. Need for New Rules and Commission Authority

    Some commenters argued that the 2011 Staff Guidance and 2018
Interpretive Release are sufficient to compel adequate cybersecurity
disclosure, obviating the need for new rules.\343\ In this regard, two
commenters highlighted the Proposing Release's statement that
cybersecurity disclosures ``have improved since the issuance of

the 2011 Staff Guidance and the 2018 Interpretive Release.'' \344\
Another commenter said that Commission staff's findings that certain
cybersecurity incidents were reported in the media but not disclosed in
a registrant's filings and that registrants' disclosures provide
different levels of specificity suggested that ``existing guidance is
working, because each registrant should always be conducting an
individualized, case-by-case analysis'' and therefore disclosures
``should expectedly vary significantly.'' \345\ One commenter
questioned whether the materials cited in the Proposing Release support
the Commission's conclusion there that current cybersecurity reporting
may be inconsistent, not timely, difficult to locate, and contain
insufficient detail.\346\ Two commenters recommended that the
Commission ``reemphasize'' the prior guidance and ``utilize its
enforcement powers to ensure public companies continue to report
material cyber incidents.'' \347\ One commenter provided the results
from a survey it conducted of its members, finding that ``only 10-20%
of the 192 respondents reported that their shareholders have requested
information or asked a question on'' various cybersecurity topics,
while ``64.3% of the respondents indicated that their investors had not
engaged with them'' on those topics.\348\ Another commenter pointed to
a 2022 study finding that less than 1% of cybersecurity breaches are
``material,'' and asserted that current disclosures adequately reflect
such a level of material breaches.\349\ Some commenters also stated
that the Commission should forgo regulation of cybersecurity disclosure
because other agencies' regulations are sufficient.\350\
---------------------------------------------------------------------------

    \343\ See letters from BPI et al.; CTIA; ISA; ITI; SCG; SIFMA;
Virtu.
    \344\ See letters from Virtu (citing Proposing Release at
16594); BPI et al. (pointing to the Proposing Release's citation of
Stephen Klemash and Jamie Smith, What companies are disclosing about
cybersecurity risk and oversight, EY (Aug. 10, 2020), available at
https://www.ey.com/en_us/board-matters/whatcompanies-are-disclosing-about-cybersecurity-riskand-oversight).
    \345\ See letter from ITI.
    \346\ See letter from BPI et al. (discussing Moody's Investors
Service, Research Announcement, Cybersecurity disclosures vary
greatly in high-risk industries (Oct. 3, 2019); NACD et al., The
State of Cyber-Risk Disclosures of Public Companies (Mar. 2021), at
3).
    \347\ See letters from Virtu; SIFMA.
    \348\ See letter from SCG.
    \349\ See letter from ISA.
    \350\ See, e.g., letters from CTIA (``The wireless industry is
also regulated by the FCC, in several relevant respects . . . In
addition to FCC requirements, wireless carriers comply with
disclosure obligations under state law, which may require notices to
individual consumers and state regulators. Providers are also
subject to FCC reporting requirements regarding network outages.'');
Sen. Portman (``Congress intended that the Cyber Incident Reporting
for Critical Infrastructure Act be the primary means for reporting
of cyber incidents to the Federal Government, that such reporting be
through CISA, and that the required rule occupy the space regarding
cyber incident reporting''); SIFMA (stating the proposal ``is
unwarranted in light of other, existing regulations and the
Commission's lack of statutory responsibility for cybersecurity
regulation of public companies'').
---------------------------------------------------------------------------

    Other commenters, by contrast, stated that the 2011 Staff Guidance
and the 2018 Interpretive Release, while helpful, have not been
sufficient to provide investors with the material information they
need. One such commenter explained that ``[t]he Commission's past
guidance, while in line with our views, does not go far enough. The
Proposed Rule is needed to provide clarity regarding what, when, and
how to disclose material cybersecurity incident information . . . The
improved standardization of disclosures included in the Proposed Rule
adds clarity to the reporting process.'' \351\ Another commenter stated
that ``[t]he lack of timely, comprehensive disclosure of material cyber
events exposes investors and the community at large to potential
harm.'' \352\
---------------------------------------------------------------------------

    \351\ See letter from CalPERS. Accord letter from Better Markets
(``Even in instances where a company discloses relevant
cybersecurity incidents, board and management oversights and
abilities, and policies and procedures in a comprehensive manner,
the information is scattered throughout various sections of the Form
10-K. While the 2018 guidance adopted by the Commission successfully
identified potential disclosure requirements for companies to think
about when disclosing cybersecurity risks, governance, and
incidents, it did not solve the problem confronting investors who
must search various sections of the Form 10-K for the
disclosures.'').
    \352\ See letter from CII.
---------------------------------------------------------------------------

    As the Commission explained in the Proposing Release, Commission
staff has observed insufficient and inconsistent cybersecurity
disclosure notwithstanding the prior guidance.\353\ Here, in response
to commenters, we emphasize that the final rules supplement the prior
guidance but do not replace it. The final rules are aimed at remedying
the lack of material cybersecurity incident disclosure, and the
scattered, varying nature of cybersecurity strategy, risk management,
and governance disclosure, the need for which some commenters
confirmed.\354\ The final rules therefore add an affirmative
cybersecurity incident disclosure obligation, and they centralize
cybersecurity risk management, strategy, and governance disclosure.
While we acknowledge commenters who noted the improvements to certain
cybersecurity-related disclosures in response to the 2018 Interpretive
Release, and we agree there have been improvements in the areas that
the guidance touched upon, we note that the guidance does not mandate
consistent or comparable public disclosure of material incidents or
otherwise address the topics that are the subject of the final rules.
And in response to commenters who suggested that other agencies' rules
on cybersecurity reporting are sufficient, we note that, unlike the
final rules, such rules are not tailored to the informational needs of
investors; instead, they focus on the needs of regulators, customers,
and individuals whose data have been breached. Accordingly, we believe
the final rules are necessary and appropriate in the public interest
and for the protection of investors, consistent with the Commission's
authority.
---------------------------------------------------------------------------

    \353\ Proposing Release at 16594, 16599, 16603.
    \354\ See supra notes 351 and 352.
---------------------------------------------------------------------------

    We also note that the 2018 Interpretive Release remains in place,
as it treats a number of topics not covered by the new rules. Those
topics include, for instance, incorporating cybersecurity-related
information into risk factor disclosure under Regulation S-K Item 105,
into management's discussion and analysis under Regulation S-K Item
303, into the description of business disclosure under Regulation S-K
Item 101, and, if there is a relevant legal proceeding, into the
Regulation S-K Item 103 disclosure.\355\ The 2018 Interpretive Release
also notes the Commission's expectation that, consistent with
Regulation S-X, a company's financial reporting and control systems
should be designed to provide reasonable assurance that information
about the range and magnitude of the financial impacts of a
cybersecurity incident would be incorporated into its financial
statements on a timely basis as that information becomes
available.\356\
---------------------------------------------------------------------------

    \355\ See 2018 Interpretive Release.
    \356\ Id.
---------------------------------------------------------------------------

    With respect to the Commission's authority to adopt the final
rules, some commenters asserted that the Commission does not have the
authority to regulate cybersecurity disclosure.\357\ These commenters
argued that the Proposing Release did not adequately explain which
statutory provisions the Commission was relying on to propose the
disclosure requirements, that the statutory provisions the Commission
did identify do not provide a legal basis to require the proposed
disclosures, that the release did not show the requirements were
necessary or appropriate to achieve statutory goals,

and that the requirements implicate the major questions doctrine and
non-delegation principles. Additionally, one commenter stated that
``Congress intended that [CIRCIA] be the primary means for reporting of
cyber incidents to the federal government.'' \358\
---------------------------------------------------------------------------

    \357\ See letters from International Association of Drilling
Contractors; NRF; Virtu.
    \358\ See letter from Sen. Portman. We address this comment in
Section II.A.3, supra.
---------------------------------------------------------------------------

    We disagree. Disclosure to investors is a central pillar of the
Federal securities laws. The Securities Act of 1933 ``was designed to
provide investors with full disclosure of material information
concerning public offerings of securities.'' \359\ In addition, the
Securities Exchange Act of 1934 imposes ``regular reporting
requirements on companies whose stock is listed on national securities
exchanges.'' \360\ Together, the provisions of the Federal securities
laws mandating release of information to the market--and authorizing
the Commission to require additional disclosures--have prompted the
Supreme Court to ``repeatedly'' describe ``the fundamental purpose'' of
the securities laws as substituting ``a philosophy of full disclosure
for the philosophy of caveat emptor.'' \361\ This bedrock principle of
``[d]isclosure, and not paternalistic withholding of accurate
information, is the policy chosen and expressed by Congress.'' \362\
Moreover, ``[u]nderlying the adoption of extensive disclosure
requirements was a legislative philosophy: `There cannot be honest
markets without honest publicity. Manipulation and dishonest practices
of the market place thrive upon mystery and secrecy.''' \363\
---------------------------------------------------------------------------

    \359\ Ernst & Ernst v. Hochfelder, 425 U.S. 185, 195 (1976);
accord Pinter v. Dahl, 486 U.S. 622 (1988) (``[t]he primary purpose
of the Securities Act is to protect investors by requiring
publication of material information thought necessary to allow them
to make informed investment decisions concerning public offerings of
securities in interstate commerce'').
    \360\ Ernst & Ernst, 425 U.S. at 195 (1976); see also Lawson v.
FMR LLC, 571 U.S. 429, 451 (2014) (referring to the Sarbanes-Oxley
Act's ``endeavor to `protect investors by improving the accuracy and
reliability of corporate disclosures made pursuant to the securities
laws''' (quoting Sarbanes-Oxley Act of 2002, Pub. L. 107-204, 116
Stat. 745, 745 (2002))).
    \361\ Lorenzo v. SEC, 139 S. Ct. 1094, 1103 (2019); accord Santa
Fe Indus. v. Green, 430 U.S. 462, 477-778 (1977); Affiliated Ute
Citizens of Utah v. United States, 406 U.S. 128, 151 (1972); SEC v.
Capital Gains Research Bureau, Inc., 375 U.S. 180, 186 (1963).
    \362\ Basic, 485 U.S. at 234. Congress also legislated on the
core premise that ``public information generally affects stock
prices,'' Halliburton Co. v. Erica P. John Fund, Inc., 573 U.S. 258,
272 (2014), and those prices can significantly affect the economy,
15 U.S.C. 78b(2) and (3).
    \363\ Basic, 485 U.S. at 230 (quoting H.R. Rep. No. 73-1383, at
11 (1934)); accord SEC v. Zandford, 535 U.S. 813, 819 (2002)
(``Among Congress' objectives in passing the [Exchange] Act was `to
insure honest securities markets and thereby promote investor
confidence' after the market crash of 1929'' (quoting United States
v. O'Hagan, 521 U.S. 642, 658 (1997))); Nat'l Res. Def. Council,
Inc. v. SEC, 606 F.2d 1031, 1050 (D.C. Cir. 1979) (the Securities
Act and Exchange Act ``were passed during an unprecedented economic
crisis in which regulation of the securities markets was seen as an
urgent national concern,'' and the Commission ``was necessarily
given very broad discretion to promulgate rules governing corporate
disclosure,'' which is ``evident from the language in the various
statutory grants of rulemaking authority'').
---------------------------------------------------------------------------

    Several provisions of the Federal securities laws empower the
Commission to carry out these fundamental Congressional objectives.
Under the Securities Act, the Commission has authority to require, in a
publicly filed registration statement, that issuers offering and
selling securities in the U.S. public capital markets include
information specified in Schedule A of the Act, including the general
character of the issuer's business, the remuneration paid to its
officers and directors, details of its material contracts and certain
financial information, as well as ``such other information . . . as the
Commission may by rules or regulations require as being necessary or
appropriate in the public interest or for the protection of
investors.'' \364\ In addition, under the Exchange Act, issuers of
securities traded on a national securities exchange or that otherwise
have total assets and shareholders of record that exceed certain
thresholds must register those securities with the Commission by filing
a registration statement containing ``[s]uch information, in such
detail, as to the issuer'' in respect of, among other things, ``the
organization, financial structure and nature of the [issuer's]
business'' as the Commission by rule or regulation determines to be in
the public interest or for the protection of investors.\365\ These same
issuers must also provide ``such information and documents . . . as the
Commission shall require to keep reasonably current the information and
documents required to be included in or filed with [a] . . .
registration statement'' as the Commission may prescribe as necessary
or appropriate for the proper protection of investors and to insure
fair dealing in the security.\366\ Separately, these issuers also must
disclose ``on a rapid and current basis such additional information
concerning material changes in the financial condition or operations of
the issuer . . . as the Commission determines, by rule, is necessary or
useful for the protection of investors and in the public interest.''
\367\
---------------------------------------------------------------------------

    \364\ Securities Act Section 7(a)(1) and Schedule A.
    \365\ Exchange Act Sections 12(b) and 12(g).
    \366\ Exchange Act Section 13(a). Other issuers that are
required to comply with the reporting requirements of Section 13(a)
include those that voluntarily register a class of equity securities
under Exchange Act Section 12(g)(1) and, pursuant to Exchange Act
15(d), issuers that file a registration statement under the
Securities Act that becomes effective.
    \367\ Exchange Act Section 13(l).
---------------------------------------------------------------------------

    These grants of authority are intentionally broad.\368\ Congress
designed them to give the Commission, which regulates dynamic aspects
of a market economy, the power and ``flexibility'' to address problems
of inadequate disclosure as they arose.\369\ As the United States Court
of Appeals for the District of Columbia Circuit explained, ``[r]ather
than casting disclosure rules in stone, Congress opted to rely on the
discretion and expertise of the SEC for a determination of what types
of additional disclosure would be desirable.'' \370\
---------------------------------------------------------------------------

    \368\ See Natural Resources Defense Council, Inc. v. SEC, 606
F.2d 1031, 1045 (1979); see also H.R. Rep. No. 73-1383, at 6-7
(1934).
    \369\ Courts have routinely applied and interpreted the
Commission's disclosure regulations without suggesting that the
Commission lacked the authority to promulgate them. See, e.g., SEC
v. Life Partners Holdings, Inc., 854 F.3d 765 (5th Cir. 2017)
(applying regulations regarding disclosure of risks and revenue
recognition); SEC v. Das, 723 F.3d 943 (8th Cir. 2013) (applying
Regulation S-K provisions regarding related-party transactions and
executive compensation); Panther Partners Inc. v. Ikanos Commc'ns,
Inc., 681 F.3d 114 (2d Cir. 2012) (applying Item 303 of Regulation
S-K, which requires disclosure of management's discussion and
analysis of financial condition); SEC v. Goldfield Deep Mines Co.,
758 F.2d 459 (9th Cir. 1985) (applying disclosure requirements for
certain legal proceedings).
    \370\ Natural Resources Defense Council, Inc., 606 F.2d at 1045.
---------------------------------------------------------------------------

    The Commission has long relied on the broad authority in these and
other statutory provisions \371\ to prescribe rules to ensure that the
public company disclosure regime provides investors with the
information they need to make informed investment and voting decisions,
in each case as necessary or appropriate in the public interest or for
the protection of investors.\372\ Indeed, the Commission's predecessor
agency,\373\ immediately upon enactment of the Securities Act, relied
upon such authority to adopt Form A-1, precursor

to today's Form S-1 registration statement, to require disclosure of
information including, for example, a list of states where the issuer
owned property and was qualified to do business and the length of time
the registrant had been engaged in its business--topics that are not
specifically enumerated in Schedule A of the Securities Act.\374\ Form
A-1 also required disclosures related to legal proceedings, though
there is no direct corollary in Schedule A.\375\
---------------------------------------------------------------------------

    \371\ Securities Act Section 19(a); Exchange Act Section 3(b);
and Exchange Act Section 23(a).
    \372\ In considering whether a particular item of disclosure is
necessary or appropriate in the public interest or for the
protection of investors, the Commission considers both the
importance of the information to investors as well as the costs to
provide the disclosure. In addition, when engaged in rulemaking that
requires it to consider or determine whether an action is necessary
or appropriate in the public interest, the Commission also must
consider, in addition to the protection of investors, whether the
action will promote efficiency, competition, and capital formation.
See Section 2(b) of the Securities Act and Section 3(f) of the
Exchange Act.
    \373\ Prior to enactment of the Exchange Act, the Federal Trade
Commission was empowered with administration of the Securities Act.
    \374\ Items 3 through 5 of Form A-1; see Release No. 33-5 (July
6, 1933) [not published in the Federal Register]. The Commission's
disclosure requirements no longer explicitly call for this
information.
    \375\ This early requirement called for a statement of all
litigation that may materially affect the value of the security to
be offered, including a description of the origin, nature, and names
of parties to the litigation. Item 17 of Form A-1. The Commission
has retained a disclosure requirement related to legal proceedings
in both Securities Act registration statements and in Exchange Act
registration statements and periodic reports. 17 CFR 229.103.
---------------------------------------------------------------------------

    Consistent with the statutory scheme that Congress enacted, the
Commission has continued to amend its disclosure requirements over time
in order to respond to marketplace developments and investor needs.
Accordingly, over the last 90 years, the Commission has eliminated
certain disclosure items and adopted others pursuant to the authority
in Sections 7 and 19(a) of the Securities Act and Sections 3(b), 12,
13, 15, and 23(a) of the Exchange Act. Those amendments include the
adoption of an integrated disclosure system in 1982, which reconciled
the various disclosure items under the Securities Act and the Exchange
Act and was intended to ensure that ``investors and the marketplace
have been provided with meaningful, nonduplicative information upon
which to base investment decisions.'' \376\
---------------------------------------------------------------------------

    \376\ See Adoption of Integrated Disclosure System, Release No.
33-6383 (Mar. 3, 1982) [47 FR 11380 (Mar. 16, 1982)]. Even prior to
the adoption of the integrated disclosure system in 1982, the
Commission addressed anticipated disclosure issues in particular
areas through the use of Guides for the Preparation and Filing of
Registration Statements. See Proposed Revision of Regulation S-K and
Guides for the Preparation and Filing of Registration Statements and
Reports, Release No. 33-6276 (Dec. 23, 1980) [46 FR 78 (Jan. 2,
1981)] (discussing the use of Guides); see also Notice of Adoption
of Guide 59 and of Amendments to Guides 5 and 16 of the Guides for
Preparation and Filing of Registration Statements Under the
Securities Act of 1933, Release No. 33-5396 (Jun. 1, 1973)
(discussing, in response to fuel shortages in 1974, the obligation
to disclose any material impact that potential fuel shortages might
have and adding a new paragraph relating to disclosure by companies
engaged in the gathering, transmission, or distribution of natural
gas).
---------------------------------------------------------------------------

    In keeping with Congressional intent, the Commission's use of its
authority has frequently focused on requiring disclosures that will
give investors enhanced information about risks facing registrants. For
example, in 1980, the Commission adopted Item 303 of Regulation S-K to
require registrants to include in registration statements and annual
reports a management's discussion and analysis of financial condition
(``MD&A''). This discussion is intended to allow investors to
understand the registrant's ``financial condition, changes in its
financial condition and results of operation'' through the eyes of
management.\377\ Item 303 includes a number of specific disclosure
items, such as requiring the identification of any known trends or
uncertainties that will result in, or that are reasonably likely to
result in, a material change to the registrant's liquidity,\378\ a
material change in the mix and relative cost of the registrant's
capital resources,\379\ or a material impact on net sales, revenues, or
income from continuing operations.\380\ Item 303 also requires
registrants to ``provide such other information that the registrant
believes to be necessary to an understanding of its financial
condition, changes in financial condition, and results of operation.''
\381\ The Commission developed the MD&A disclosure requirements to
supplement and provide context to the financial statement disclosures
previously required by the Commission.
---------------------------------------------------------------------------

    \377\ See Management's Discussion and Analysis of Financial
Condition and Results of Operations; Certain Investment Company
Disclosures, Release No. 33-6231 (Sept. 2, 1980) [45 FR 63630 (Sept.
25, 1980)]; see also 17 CFR 229.303(a).
    \378\ See 17 CFR 229.303(b)(1)(i).
    \379\ See 17 CFR 229.303(b)(1)(ii)(B).
    \380\ See 17 CFR 229.303(b)(2)(ii).
    \381\ 17 CFR 229.303(b).
---------------------------------------------------------------------------

    A few years later, in 1982, the Commission codified a requirement
that dated back to the 1940s for registrants to include a ``discussion
of the material factors that make an investment in the registrant or
offering speculative or risky,'' commonly referred to as ``risk
factors.'' \382\ By definition, these disclosures encompass a
discussion of risks, or prospective future events or losses, that might
affect a registrant or investment. The initial risk factor disclosure
item provided examples of possible risk factors, such as the absence of
an operating history of the registrant, an absence of profitable
operations in recent periods, the nature of the business in which the
registrant is engaged or proposes to engage, or the absence of a
previous market for the registrant's common equity.\383\
---------------------------------------------------------------------------

    \382\ See Adoption of Integrated Disclosure System, Release No.
33-6383 (Mar. 3, 1982) [47 FR 11380 (Mar. 16, 1982)] (``Release No.
33-6383'') (codifying the risk factor disclosure requirement as Item
503(c) of Regulation S-K); see also 17 CFR 229.105(a). Prior to
1982, the Commission stated in guidance that, if the securities to
be offered are of a highly speculative nature, the registrant should
provide ``a carefully organized series of short, concise paragraphs
summarizing the principal factors that make the offering
speculative.'' See Release No. 33-4666 (Feb. 7, 1964) [29 FR 2490
(Feb. 15, 1964)]. A guideline to disclose a summary of risk factors
relating to an offering was first set forth by the Commission in
1968 and included consideration of five factors that may make an
offering speculative or risky, including with respect to risks
involving ``a registrant's business or proposed business.'' See
Guide 6, in Guides for the Preparation and Filing of Registration
Statements, Release No. 33-4936 (Dec. 9, 1968) [33 FR 18617 (Dec.
16, 1968)] (``Release No. 33-4936'').
    \383\ See Release No. 33-6383.
---------------------------------------------------------------------------

    In subsequent years, the Commission expanded both the scope of
risks about which registrants must provide disclosures and the
granularity of those disclosures. For example, in 1997, the Commission
first required registrants to disclose quantitative information about
market risk.\384\ That market risk disclosure included requirements to
present ``separate quantitative information . . . to the extent
material'' for different categories of market risk, such as ``interest
rate risk, foreign currency exchange rate risk, commodity price risk,
and other relevant market risks, such as equity price risk.'' \385\
Under these market risk requirements, registrants must also disclose
various metrics such as ``value at risk'' and ``sensitivity analysis
disclosures.'' In addition, registrants must provide certain
qualitative disclosures about market risk, to the extent material.\386\
---------------------------------------------------------------------------

    \384\ See Disclosure of Accounting Policies for Derivative
Financial Instruments and Derivative Commodity Instruments and
Disclosure of Quantitative and Qualitative Information About Market
Risk Inherent in Derivative Financial Instruments, Other Financial
Instruments, and Derivative Commodity Instruments, Release No. 33-
7386 (Jan. 31, 1997) [62 FR 6044 (Feb. 10, 1997)] (``Release No. 33-
7386'') (``In light of those losses and the substantial growth in
the use of market risk sensitive instruments, the adequacy of
existing disclosures about market risk emerged as an important
financial reporting issue.''); see also 17 CFR 229.305.
    \385\ 17 CFR 229.305(a)(1).
    \386\ See 17 CFR 229.305(b).
---------------------------------------------------------------------------

    Each of these disclosure items reflects the Commission's long-
standing view that understanding the material risks faced by a
registrant and how the registrant manages those risks can be just as
important to assessing its business operations and financial condition
as knowledge about its physical assets or material contracts. Indeed,
investors may be unable to assess the value of those assets or
contracts adequately without appreciating the material risks to which
they are subject.\387\
---------------------------------------------------------------------------

    \387\ As early as the 1940s, the Commission issued stop order
proceedings under Section 8(d) of the Securities Act in which the
Commission suspended the effectiveness of previously filed
registration statements due, in part, to inadequate disclosure about
speculative aspects of the registrant's business. See In the Matter
of Doman Helicopters, Inc., 41 S.E.C. 431 (Mar. 27, 1963); In the
Matter of Universal Camera Corp., 19 S.E.C. 648 (June 28, 1945); see
also Release No. 33-4936.

---------------------------------------------------------------------------

    In addition to risk-focused disclosures, over the decades, the
Commission has also required registrants to provide information on a
diverse range of topics that emerged as significant to investment or
voting decisions, such as the extent of the board's role in the risk
oversight of the registrant,\388\ the effectiveness of a registrant's
disclosure controls and procedures,\389\ related-party
transactions,\390\ corporate governance,\391\ and compensation
discussion and analysis,\392\ among many other topics, including on
topics related to particular industries,\393\ offering structures,\394\
and types of transactions.\395\ In all these instances, the
Commission's exercise of its authority was guided by the baseline of
the specific disclosures articulated by Congress. But, as Congress
expressly authorized,\396\ the Commission's exercise of its disclosure
authority has not been narrowly limited to those statutorily prescribed
disclosures--instead, it has been informed by both those disclosures
and the need to protect investors.\397\ Many of these disclosures have
since become essential elements of the public company reporting regime
that Congress established.
---------------------------------------------------------------------------

    \388\ See 17 CFR 229.407.
    \389\ See 17 CFR 229.307.
    \390\ 17 CFR 229.404.
    \391\ 17 CFR 229.407.
    \392\ 17 CFR 229.402.
    \393\ See 17 CFR 229.1200-1208 (Disclosure by Registrants
Engaged in Oil and Gas Activities); 17 CFR 1300-1305 (Disclosure by
Registrants Engaged in Mining Operations); 17 CFR 1400-1406
(Disclosure by Bank and Savings and Loan Registrants).
    \394\ See 17 CFR Subpart 1100 (Asset-Backed Securities).
    \395\ See 17 CFR subpart 900 (Roll-Up Transactions); 17 CFR
229.1000-1016 (Mergers and Acquisitions).
    \396\ See supra notes 364 to 366 and accompanying text.
    \397\ For example, Item 303(b)(2) of Regulation S-K calls for
information well beyond the basic profit and loss statement
specified in Schedule A by requiring issuers to disclose any unusual
or infrequent events or transactions or any significant economic
changes that materially affected the amount of reported income--and
the extent to which income was so affected--so that investors can
better understand the reported results of operations.
---------------------------------------------------------------------------

    To ensure the transparency that Congress intended when it
authorized the Commission to promulgate disclosure regulations in the
public interest or to protect investors,\398\ the Commission's
regulations must--as they have over time--be updated to account for
changing market conditions, new technologies, new transaction
structures, and emergent risks. In this regard, we disagree with one
commenter's assertion that the Commission's disclosure authority is
``limited to specific types of information closely related to the
disclosing company's value and financial condition.'' \399\ The
commenter misstates the scope and nature of the Commission's authority.
There is a wealth of information about a company apart from that which
appears in the financial statements that is related to a company's
value and financial condition, including the material risks
(cybersecurity and otherwise) a company faces. Nor did Congress dictate
that the Commission limit disclosures only to information that is
``closely related'' to a company's ``value and financial condition.''
By also empowering the Commission to require ``such other information .
. . as the Commission may by rules or regulations require as being
necessary or appropriate in the public interest or for the protection
of investors,'' \400\ Congress recognized that there is information
that is vital for investors to understand in making informed investment
decisions but does not directly relate to a company's value and
financial condition.\401\
---------------------------------------------------------------------------

    \398\ See supra notes 368 to 370 and accompanying text.
    \399\ See letter from NRF.
    \400\ Securities Act Section 7(a).
    \401\ For example, Schedule A calls for information regarding,
among other things: the names of the directors or persons performing
similar functions, the disclosure of owners of record of more than
10% of any class of stock of an issuer; commissions paid to
underwriters; the renumeration paid to directors and certain
officers; and information about certain material contracts.
---------------------------------------------------------------------------

    The narrow reading of the Commission's authority advocated by the
commenter would foreclose many of these longstanding elements of
disclosure that market participants have come to rely upon for investor
protection and fair dealing of securities.\402\ Moreover, Congress
itself has amended, or required the Commission to amend, the Federal
securities laws many times. But Congress has not restricted the
Commission's disclosure authority; rather, Congress has typically
sought to further expand and supplement that authority with additional
mandated disclosures.
---------------------------------------------------------------------------

    \402\ See letter from NRF.
---------------------------------------------------------------------------

    We also reject the commenter's suggestion that the final rules are
an attempt to ``usurp the undelegated role of maintaining cyber safety
in America.'' \403\ The final rules are indifferent as to whether and
to what degree a registrant may have identified and chosen to manage a
cybersecurity risk. Rather, the final rules reflect the reality, as
acknowledged by the same commenter, that ``[c]ybersecurity is . . . an
area of growing importance to companies across the world.'' \404\ When
those companies seek to raise capital from investors in U.S. public
markets, we believe it is appropriate that they share information about
whether and, if so, how they are managing material cybersecurity risks
so that investors can make informed investment and voting decisions
consistent with their risk tolerance and investment objectives.
---------------------------------------------------------------------------

    \403\ Id.
    \404\ Id.
---------------------------------------------------------------------------

    Finally, with respect to the commenter's contention that a broad
reading of the Commission's disclosure authority could raise separation
of powers concerns,\405\ we note that a statutory delegation is
constitutional as long as Congress lays down by legislative act an