Recent enforcement actions, proposed rule-making and increased staffing reflect the SEC Enforcement Division’s expanding focus on cybersecurity incidents and corresponding disclosures. While the Enforcement Division has historically focused its resources in this area on highlighting failures to disclose internal control deficiencies, the Division is beginning to cast a wider net in its investigations and enforcement actions.
In this article we discuss likely areas for continued expansion of cyber-related enforcement activity and practical implications for public companies. The SEC has also proposed new cybersecurity rules for investment advisers registered under the Investment Advisers Act of 1940 and investment companies registered under the Investment Company Act of 1940. See 17 CFR Parts 230, 232, 239, 270, 274, 275, and 279.
