The SEC’s 2023 cybersecurity rules mandate that public companies disclose material cyber incidents within four business days. They must also detail their cyber risk management strategies annually. These rules aim to standardize disclosures that were previously inconsistent, helping investors assess cyber risks across their portfolios.

For investors, this means better visibility into companies’ digital vulnerabilities. Frequent disclosures could initially increase stock volatility but should lead to improved corporate cybersecurity over time. The rules also cover funds and advisors, requiring them to implement cyber policies and disclose breaches.

Companies are responding by boosting cybersecurity budgets and board oversight. This regulatory push reflects growing recognition that cyber risks are financial risks, with the average data breach now costing $4.45 million. Investors should factor cyber resilience into their analysis alongside traditional financial metrics.