Describe your board’s cyber oversight in a filing, and you have made a promise
The SEC’s March 2022 proposal is remembered for its four-day incident clock. Its governance disclosures reached further: every public company would describe how management and the board handle cyber risk, and that text would become a standard others could test.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On March 9, 2022, the Securities and Exchange Commission proposed rules on cybersecurity risk management, strategy, governance and incident disclosure for public companies. Companies would disclose material cybersecurity incidents on Form 8-K within four business days of determining that an incident was material, and update that disclosure in periodic reports. They would also describe each year their policies and procedures for identifying and managing cybersecurity risk, management’s role and expertise, and the board’s oversight. As proposed, companies would disclose whether any director had cybersecurity expertise and describe it. The comment period opened that month. The same day, President Biden signed an executive order on digital assets.
The four-business-day incident deadline drew most of the debate. The governance disclosures drew less, but they reached every public company every year, whether or not it ever had a material incident. Publicly traded banks, health care companies and the technology firms that serve banks, health systems and agencies would all have to put their cyber governance in writing, in a document governed by securities law. A description of practice in an annual report is a statement the company is answerable for. If practice falls short, the description is the evidence. We look at three parts of the proposal: what companies would describe, why the description itself carried risk, and the dispute over board expertise.
What companies would describe
The proposal asked a specific set of questions. Does the company run a cybersecurity risk assessment program? Does it engage assessors, consultants or auditors? Does it have policies for overseeing third-party service providers? Does it have business continuity and recovery plans? Has cyber risk affected, or is it likely to affect, strategy, results or finances? Which management positions are responsible, and what is their expertise? How does management report to the board, and how often? Which board committee, if any, oversees cyber risk?
For mature companies, the answers existed but were scattered across policies, committee charters, internal audit reports and the chief information security officer’s slides. For others, the questions were a diagnostic. A company that could not say which executive owned cyber risk, or how often the board discussed it, had a governance gap whatever the final rule said.
The questions also crossed functions. Third-party oversight sits with procurement and vendor management. Continuity plans sit with operations. Strategy and financial impact sit with finance. Gathering accurate answers required a working group that most companies had never convened on this subject, led jointly by the general counsel’s office and the security function.
Why the description carried risk
Securities law treats material misstatements and omissions seriously, and statements about risk management are no exception. If a company says its board receives quarterly cybersecurity briefings and it emerges after an incident that briefings were annual and brief, the disclosure itself becomes an issue. Plaintiffs’ lawyers, short sellers, journalists and regulators can read the annual description and test it against what an incident reveals.
That changes who has to sign off and what they need. Disclosure is usually drafted by legal, finance and investor relations staff with a strong instinct toward reassuring language. The security function knows where practice falls short. Unless those groups work together, the description drifts toward aspiration. A workable discipline has three steps. Write an honest internal description of how cyber risk is actually governed, including known gaps. Close the gaps that matter, or record why they remain. Only then reduce the description to disclosure language, with each sentence traceable to evidence such as minutes, policies or reports.
The disclosure controls that already govern financial reporting offer a model. A sub-certification from the chief information security officer, a defined evidence file for each statement and a pre-filing review by the disclosure committee bring cyber statements into the same process. The cost is time and some loss of flattering language. The benefit is that the filing survives scrutiny when it is most likely to receive it, after an incident.
The dispute over board expertise
The most contested governance item was director expertise. Supporters argued that investors were entitled to know whether a board could oversee a significant risk. Critics said boards oversee rather than manage, that cyber is one of many specialized risks, that expertise is hard to define, and that the rule would push companies to appoint directors for a single skill.
The more useful question underneath was whether the board could ask good questions and judge the answers. That depends less on one specialist director than on the quality of what management brings to the board. Many board packs were long on activity, such as attacks blocked, training completion and tool deployments, and short on risk. They rarely said which critical services could be disrupted, for how long, and at what cost. A board that receives the second kind of report, with trends and a clear statement of residual risk, can exercise oversight with or without a specialist. Practical responses included assigning cyber oversight to a named committee, setting a reporting calendar, and bringing in outside advisers for an annual deep review.
Private companies, nonprofit health systems and public agencies were outside the rule. They were not outside its effects. Their public vendors would describe governance in filings that procurement and third-party risk teams could read and compare with questionnaire answers. A vendor whose filing describes quarterly board briefings and an independent assessment program, but whose questionnaire claims more, has given its customers a useful discrepancy to raise. Nonprofit health systems with bond disclosures, and agencies reporting to elected boards, could also borrow the format to describe their own governance in a consistent way.
With hindsight
The SEC adopted final rules in July 2023. The four-business-day incident disclosure survived, with a limited delay available on national security or public safety grounds. The annual governance and risk management disclosures were adopted in streamlined form, and the board expertise requirement was dropped. Companies began including the governance disclosures in annual reports for fiscal years ending on or after December 15, 2023. In October 2023 the SEC sued a software company and its chief information security officer over allegedly misleading security statements. A court dismissed most of the claims in 2024, and the SEC abandoned the rest in 2025, but the case made clear that descriptions of security practice carry legal weight. By this point in 2026, cyber governance disclosures are a routine part of annual reports. The better ones read as accurate accounts of practice, traceable to evidence. Weaker ones read as reassurance and carry the risk that implies.