SEC's New Data Breach Disclosure Rules: What You Need to Know in 2024

A new rule from the Securities and Exchange Commission (SEC) requires public companies to report data breaches within four business days of determining them to be "material." Currently, companies take around 80 days to report incidents, but the new rule aims to expedite the process and provide more transparency. The ambiguity of what constitutes a "material" cybersecurity incident poses a challenge, as determining severity may require internal review. The rule also mandates that companies provide more details about the nature, scope, and timing of incidents. The goal is to increase awareness and prompt quicker responses to data breaches, which have become increasingly common and impactful.