A new Securities and Exchange Commission (SEC) rule that requires companies to report a breach within four days of determining a material incident goes into effect today, and the industry has responded positively to a last-minute change that does not require companies to file the technical details of a breach. In a blog post published December 14, Erik Gerding, director of the SEC’s Division of Corporation Finance, clarified that in the final version of the rules, companies do not need to “disclose any specific or technical information about their incident response, systems or potential vulnerabilities if that could impede their incident response and remediation process.” Gerding said the SEC sought to balance the need for disclosure with the risk that disclosing specific technical information could offer a roadmap that threat actors could exploit in future attacks.

Source: SC Magazine