On December 17, 2015, Senators Reed (D-RI) and Collins (R-ME) introduced the Cybersecurity Disclosure Act of 2015 (S. 2410), which has been referred to the Committee on Banking, Housing, and Urban Affairs.  According to the press release accompanying the bill, it “seeks to strengthen and prioritize cybersecurity at publicly traded companies by encouraging the disclosure of cybersecurity expertise, or lack thereof, on corporate boards at these companies.”

The bill applies to “reporting companies,” defined as companies that issue registered securities under 15 U.S.C. § 78l or companies that are required to file reports with the Securities and Exchange Commission (“SEC”) under 15 U.S.C. § 78o(d).  It requires the SEC to issue rules within one year of enactment that require reporting companies to include disclosures relating to the cybersecurity expertise of their corporate boards in their annual reports.

Specifically, reporting companies must disclose whether any member of their board “has expertise or experience in cybersecurity,” with sufficient detail to “fully describe the nature” of that experience.  If no member of the board has such experience, reporting companies must “describe what other cybersecurity steps” were taken into account by those responsible for identifying and evaluating nominees to the board.

Finally, the SEC must coordinate with the National Institute of Standards and Technology to “define what constitutes expertise or experience in cybersecurity, such as professional qualifications to administer information security program functions or experience detecting, preventing, mitigating, or addressing cybersecurity threats.” Cybersecurity threats are defined identically to the Cybersecurity Act of 2015, which was enacted into law on December 18, 2015, as actions “through an information system that may result in an unauthorized effort to adversely impact the security, availability, confidentiality, or integrity of an information system or information that is stored on, processed by, or transiting an information system.”