US companies pushed to disclose cyber attacks

Public companies may need to look more closely at their exposure to cyberattacks after new guidelines were released last week by the Securities and Exchange Commission.

The guidelines, from the SEC's division of corporation finance, aim to help companies determine when they need to disclose cyberattacks or the amount of risk they pose to a business. In general, public companies in the U.S. are required to disclose incidents that could have a material impact on their business. While the current regulations don't specifically mention cyberattacks, the new guidelines say they need to be reported in some cases. Companies should disclose the risk of cyber incidents "if these issues are among the most significant factors that make an investment in the company speculative or risky," say the guidelines.

Senate Commerce Chairman Jay Rockefeller (D-WV) said the guidance will fundamentally change the way firms handle cybersecurity.