Key Takeaways
Background
In March 2022, the SEC issued a proposed rule (the “Proposed Rule”) to expand and standardize disclosure and reporting requirements for public companies regarding cybersecurity risks, incidents and management.2 The SEC issued the Proposed Rule in response to a perceived rise in cybersecurity risks, the severity in cost and impact to companies experiencing cybersecurity attacks and the lack of standardization regarding disclosure. Currently, registrants disclose cybersecurity risks and incidents across Form 8-K, Form 10-K and Form 20-F, although the breadth and depth of disclosure has been varied making it difficult for investors to track. The Proposed Rule amended certain disclosure forms to require reporting on material cybersecurity incidents and a registrant’s policies and procedures for risk management. If the amended disclosure and reporting framework in the form set forth in the Proposed Rule were to apply to ABS issuers, it would represent a significant departure and expansion from the existing disclosure and reporting standards required under Regulation AB.
Market Participant and SFA Response to the Proposed Rule
The prevailing view among ABS market participants was that the Proposed Rule was not adequately tailored for ABS issuers, would not yield useful information for investors and would be a significant cost and compliance burden to ABS issuers. The Structured Finance Association (“SFA”) put forth these arguments in a May 9, 2022 comment letter (“Comment Letter”).3
The Comment Letter highlig ..
Support the originator by clicking the read the rest link below.
