In this editorial, a cybersecurity professional denounces a coalition of banking lobbyists who have petitioned the U.S. Securities and Exchange Commission (SEC) to eliminate the 4‑day material cybersecurity incident disclosure requirement for public companies. The speaker systematically dismantles the six reasons the lobbyists present for the change—claims that the rule conflicts with confidential reporting, hampers incident response and law‑enforcement investigations, creates market confusion, enables ransomware extortion, harms insurance and liability positions, and chills internal communications. For each point, the speaker argues that the rule does not jeopardize critical infrastructure, is independent of investigations, is clear and mandatory, lacks evidence of ransomware weaponization, does not increase insurance risk, and actually promotes open communication. The speaker highlights the rule’s role in preventing insider‑trading abuses by ensuring investors receive timely material information, and stresses the importance of rapid notification for downstream victims to protect their data. Citing the year‑and‑a‑half track record since the rule’s December 2023 implementation, the speaker notes no major adverse effects and argues the rule has enhanced market fairness and victim awareness. The lobbying effort is framed as a “shameful” attempt to conceal breaches, protect corporate image, and avoid accountability, ultimately undermining transparency, security, and public trust.
Chapters
As a cybersecurity professional, I am disappointed and aggravated. A coalition of banking lobbyists have made a shameful request to the Security and Exchange Commission to remove the disclosure requirements that mandate reporting of material cybersecurity incidents within 4 days of detection. This rule was created to inform shareholders and notify victims so that they may make informed decisions, timely decisions, to protect themselves and their assets, both of which were not being done consistently prior to the rule taking effect in December 2023. The banking association lobbyists have scraped together 6 reasons for this request. All of which are bogus. So let's break them down. First, they say the rule conflicts with confidential reporting requirements intended to protect critical infrastructure and warn potential victims, thereby compromising coordinated regulatory efforts to enhance national security. Absolutely not. Submitting a concise summary without any sensitive data via an 8K form does not put critical infrastructure at risk for an attack that's already happened. Neither does notifying potential victims. Number 2, they say it interferes with incident response and law enforcement investigations. No. SEC reporting is independent of investigations, which can take quite a bit of time. In fact, the attacker and the financial institution, they both know a breach occurred. The only relevant people left out of the loop are the investors and the potential end-user victims. Number 3, it has created market confusion and uncertainty as companies struggle to distinguish between mandatory and voluntary, or voluntary disclosure. No, that's not true either. It is actually very clear. If you're a public company and have determined a material breach has occurred, right? And this is something that companies, public companies have to disclose in any way. So those rules have been around for a while. You must report it to the SEC within 4 days. It's that simple. Number 4, they say the incident disclosure requirement has been weaponized as an extortion method by ransomware criminals to further malicious objectives and may subject disclosing companies to additional cybersecurity threats. No. They cited a case where an attacker sent a note to the SEC saying the breached company, the company they breached, did not follow the regulations and disclose their breach to the SEC within the 4-day window. First, the ruling hadn't even taken effect yet. This was in November of 2023. So the ruling was on the books, but it hadn't started yet. So that tells me that they could not find an example anytime since the ruling actually took effect. Second, their argument is that if banks don't comply with the SEC rules, that attackers might tattle on them, and that's so unfair! Except they're supposed to follow the rules. Number 5. Insurance and liability implement— excuse me— implications of premature disclosures can exacerbate financial and operational harm to registrants. No, this hasn't happened either. The reality is the notification is a preliminary step. Other details will come out. And that's what the insurance is concerned with, not what may have happened, but what actually did happen, which is often revealed in the weeks or months after as the investigation concludes. Number 6, the public disclosure requirement risks chilling candid internal communications and routine information sharing. So this is a joke. The whole point is to make sure communication is occurring. Often when such incidents occur, companies actually try and keep it very quiet with the minimum number of people to be informed. That is what greatly limits the communication. Once it becomes public, then everyone knows and communication then flows. A lot more freely. All 6 of these reasons represent a complete farce. The only reason you would not do a preliminary report is so that you can either delay or outright hide the incident from the market, shareholders, and victims. The short window forces companies to apply the necessary resources to investigate incidents and proactively invest in cybersecurity to prevent future incidents. Issues. Withholding information also creates an interesting insider trading situation where again, that small group of people that know, they know a material event has happened before the investors know. That enables them to sell their shares before the negative news pushes the stock price down. And this has actually happened. Executives, including CISOs, have been charged with this type of insider trading. Again, it's another reason why the ruling was created in the first place. Investors have a right to know of material events in a timely manner. Otherwise, they are at a disadvantage to the insiders. Then there are the potential downstream victims. Knowing that their data has been breached in a timely manner is important. It allows victims to be more mindful, establish defenses, and reevaluate their loyalty to the offending organization. Overall, I find this attempt to undermine the SEC 4-day reporting rule to be absolutely shameful. In the year and a half since its implementation, we have not seen any major issues resulting from these disclosures. It has provided fairness in markets with investors and given timely notice to potential victims. These lobbying organizations are blatantly putting forth weak arguments because that's all they have in hopes that their industry can better conceal material cybersecurity incidents, manage negative public narratives, and ultimately minimize accountability and proper cybersecurity investments. Business leaders and cybersecurity professionals should see this for what it is: a shady move to protect image and profits at the expense of transparency, fairness, security, and public trust.
