SEC Approves Cyber Incident-Reporting Rules for Public Companies

The U.S. Securities and Exchange Commission voted Wednesday to adopt rules requiring publicly traded companies to report cyberattacks, but softened elements of its initial proposals after pushback from the private sector.

“Whether a company loses a factory in a fire, or millions of files in a cybersecurity incident, it may be material to investors,” said Gary Gensler, the SEC’s chair, in a virtual meeting of the agency’s commissioners.

Under…