The State of Cyber-Risk Disclosures of Public Companies

The U.S. Securities and Exchange Commission has in recent years demanded more transparency from public companies in how they identify, measure, and manage cyber-risk. This paper, produced by SecurityScorecard, National Association of Corporate Directors (NACD), Cyber Threat Alliance, IHS Markit, and Diligent, offers companies, their management teams, and boards specific examples of both ineffective and effective disclosures of cyber-risks. Corporate directors can use the guidance in this report to assess whether their organizations are appropriately presenting to investors the exposure to cyber-risks and the actions taken to minimize these risks.