United States of America: Implemented SEC Rules on Cybersecurity Disclosure by Public Companies requiring registrants to disclose incidents and information regarding risk management

On 5 September 2023, the Securities and Exchange Commission (SEC) implemented Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies. Registrants would have to disclose cybersecurity incidents they determine to be material and provide a description of the incident. Furthermore, an annual report with a description of processes for assessing, identifying, and managing material risks from cybersecurity threats, as well as the effects of risks from cybersecurity threats and previous cybersecurity incidents, must be provided to the SEC. Comparable disclosures must be made by foreign private issuers.