New cybersecurity disclosure requirements mandated by the U.S. Securities and Exchange will go into force in coming days, requiring companies to disclose cybersecurity incidents, with some exceptions, within four days of their occurrence.There are two components to the disclosure rules. The first is mandatory cybersecurity incident reporting of “material” incidents. The disclosure of incidents would be via an 8-K form and must be reported within four business days of the incident. The second component requires companies to disclose their policies to manage cybersecurity risk, including providing updates on previously reported material cybersecurity incidents

The U.S. Securities and Exchange Commission recently updated its rules on cyber risk management, governance and incident disclosure. The new rules will take effect in December 2023.Given that the guidelines have only been out for a month, how are companies responding to its stipulations so far, and what major challenges are they facing on that path?“When we talk to the chief information security officers out there, they’re like, ‘We’ve got it, we’re used to this stuff,'” said Sean Joyce (pictured), global cybersecurity and privacy leader and U.S. cyber, risk and regulatory leader at PricewaterhouseCoopers LLP