Business Commons^™

Cybersecurity Disclosure Effectiveness On Public Companies, Jingjing Jin

Senior Honors Projects, 2010-2019

On October 13, 2011, the U.S. Securities and Exchange Commission issued a guidance on corporate disclosure of cyber-risks and information security breaches (SEC, 2011). To determine if a company disclosed information on the breach, I reviewed the company’s risk factors, management’s discussion and analysis of financial conditions and results of operations, description of the business, legal proceedings, financial statement disclosures, and disclosure controls and procedures. However, the disclosure regulations from this guidance are vague and thus do little to force disclosure of valuable information. The guidance has led to companies disclosing ambiguous, generic risk factors that can be applied to …