SEC issues guidelines for cybersecurity risk disclosure

The US SEC has issued a new set of guidelines to public companies on how and when they should disclose cyber security vulnerabilities and breaches. The updated guidance follows hot on the heels of the Meltdown and Spectre CPU vulnerabilities, which primarily impacted the Intel platform.

Public companies are encouraged to deliver clearer and more robust disclosure. It also stipulates new rules for insider trading while a hack is being investigated before it's publicly disclosed;

The guidance also said company executives must not trade in a firm’s securities while possessing nonpublic information on cyber security attacks. The SEC encouraged companies to consider adopting specific policies restricting executive trading in shares while a hack is being investigated and before it is disclosed.

It discourages companies from withholding disclosure simply because of an ongoing investigation into a cyber security matter.

More at Reuters.