The SEC posted today an interpretive release regarding its latest guidance public companies’ disclosure obligations under existing law with respect to matters involving cybersecurity risk and incidents. It also addresses the importance of cybersecurity policies and procedures and the application of disclosure controls and procedures, insider trading prohibitions, and Regulation FD and selective disclosure prohibitions in the cybersecurity context.

The timing of the release was a bit unusual. Initially, the SEC was scheduled to consider the guidance at an open meeting on February 21^st. It abruptly cancelled the meeting and instead put out a press release saying the interpretive guidance had been approved on February 20^th. Sounds like the SEC may be having its own issues with disclosure controls and procedures!

The SEC has approved a NYSE rule that will prohibit listed companies from issuing material news after the official closing time of trading until at least 5 minutes after closing (unless the company’s official closing price is published sooner).