Ed McNicholas Comments on the Changing SEC Cyber Disclosure Rules in the Wall Street Journal

In a Wall Street Journal article deliberating the challenges of the new SEC cyber disclosure rules, data, privacy & cybersecurity co-chair Ed McNicholas explains how data breach information can change over the course of a cyber attack investigation.

“You have to dig layer by layer to understand what [the hackers] did over time,” said Ed McNicholas, co-leader of the data, privacy and cybersecurity practice at law firm Ropes & Gray. “The SEC doesn’t appreciate the fog of war that takes place when you have threat actors that are sophisticated and working intensely to remain undetected and stealthy,” he said. 

Companies might quickly disclose information they believe to be correct, but later face allegations of misleading investors if it turns out to be wrong, Ed said. 

New SEC cyber disclosure rules, scheduled to go live this month, require publicly traded companies to report cyberattacks through regulatory filings, no later than four business days after they determine the attack will. The SEC said the rules are intended to give investors the ability to make investment decisions with as much information as possible.