On February 28 and March 13, 2019, members of the U.S. Senate and U.S. House of Representatives introduced legislation designed to enhance the transparency of cybersecurity risk oversight at certain SEC reporting companies. Although the text of the House bill, H.R. 1731 is not yet publicly available, the bipartisan Senate bill, S. 592, would require the U.S. Securities and Exchange Commission to issue final rules in less than one year that would require SEC-registered issuers to make certain disclosures in its annual reports, or annual proxy statement as appropriate, regarding cybersecurity risk oversight capabilities. The text of S. 592 is identical to the versions introduced in the Senate during previous sessions of Congress in 2015 and 2017 and to the House version that was introduced in 2018.
Specifically, the Senate bill would require a company to disclose whether any member of the board, other governing body, or general partner “has expertise or experience in cybersecurity” and to describe in detail the nature of that expertise or experience in the annual public disclosure. If no member of the governing body has that cybersecurity expertise or experience, the disclosure would need to describe “what other aspects of the reporting company’s cybersecurity were taken into account” by the governing officers who are otherwise responsible for identifying and evaluating nominees for membership in the governing body.
This measure appears intended to bolster the accountability of boards or governing members for cybersecurity oversight, and to promote the inclusion of cybersecurity expertise or experience when addressing board or governance composition. As written, the bill may create some tension with current practices of boards and governing bodies without cybersecurity expertise that rely on additional resources to provide that expertise. Although such practices are not directly addressed in the legislation, requiring disclosure of the cybersecurity expertise of a board, or how the issue is addressed if there are no board members with such expertise may increase attention to boards and governing bodies that rely on other resources for that expertise.
Finally, the Senate bill is noteworthy for its requirement that the SEC consult with NIST to define the meaning of cybersecurity “expertise or experience” for purposes of the SEC’s rulemaking.
