Recent enforcement actions, proposed rule-making, and increased staffing reflect the Securities and Exchange Commission (SEC) Enforcement Division's expanding focus on cybersecurity incidents and corresponding disclosures. While the Enforcement Division has historically focused its resources in this area on highlighting failures to disclose internal controls deficiencies, the division is now beginning to cast a wider net in its investigations and enforcement actions.

In this article, we discuss likely areas for continued expansion of cyber-related enforcement activity and practical implications for public companies. The SEC has also proposed new cybersecurity rules for investment advisers registered under the Investment Advisers Act of 1940 and investment companies registered under the Investment Company Act of 1940. See 17 CFR Parts 230, 232, 239, 270, 274, 275, and 279.

Similar to the proposed rules for public companies (which we describe in more detail below), the proposed rules for financial advisers and funds would require subject entities to (1) adopt and implement written cybersecurity policies and procedures, (2) confidentially report significant cybersecurity incidents to the SEC, and (3) disclose certain cybersecurity incidents to investors.