SEC updates guidance for disclosures of cybersecurity risks and hacking incidents, warns against employees in the know selling shares before public disclosure
Zaid Shoorbajee / Cyberscoop :
Context & Ripple Effects
This 2018 guidance landed months after the SEC disclosed that hackers had breached its own corporate-filing database and may have traded on the stolen information — an episode that made insider trading around cyber incidents a live enforcement concern rather than a hypothetical. The agency's answer was interpretive: companies should treat hacking knowledge as material nonpublic information, and employees in the know should not sell shares before the public learns of the incident.
What makes the guidance worth revisiting is that it was the soft opening act of a much harder regime. The SEC later moved from warning to rulemaking — proposing 48-hour cyberattack reporting for investment funds and advisers in 2022, then approving [[a:842543|rules requiring public companies to file details of a material cyberattack within four days]] in 2023.
First-order effects
- Public companies must now police their own insider lists around security incidents: anyone who learns of a hack before disclosure falls under standard insider-trading exposure, putting general counsel and CISOs in the same briefing loop.
- Disclosure committees gain a new trigger — a confirmed intrusion can be material even before financial impact is quantified, changing when companies choose to go public with an incident.
Second-order effects
- Incident-response playbooks at issuers get rebuilt around securities law: legal review moves into the first hours of a breach response because the trading window closes as soon as insiders know.
- Companies that disclose late or trade-then-disclose face a two-front problem — securities enforcement on top of the breach itself — raising the cost of the quiet-patching approach.
Third-order effects
- The guidance-to-rule arc shows the SEC converting interpretive pressure into binding deadlines: the four-day filing requirement and fund/adviser reporting turn what was advice in 2018 into auditable obligations, making cyber disclosure a standing part of issuer compliance rather than a crisis decision.
The trend: Cybersecurity disclosure is shifting from voluntary, judgment-call guidance toward mandatory, deadline-bound reporting enforced through securities law.