Lawmakers Push Companies to Bring Cyber Experts on Boards

Legislation introduced recently in the U.S. Senate would require publicly traded companies to disclose to regulators whether any members of their boards of directors have cybersecurity expertise.

The Cybersecurity Disclosure Act of 2017 would require companies to explain in their filings with the Securities and Exchange Commission whether cybersecurity expertise exists on their boards and, if not, why such expertise is not necessary.

“It is in the best interest of consumers and shareholders for companies to fully disclose the plans they’ve set in place to defend against (data breaches), said Sen. Warner (D-Va.), one of the bill’s sponsors. According to a 2015 report published by the Georgia Institute of Technology, fewer than one-quarter of boards of directors had a member with cybersecurity expertise.

The sponsors, citing research from the National Association of Corporate Directors, suggest boards need help in addressing cybersecurity challenges. The association’s 2016-2017 public company governance survey reveals that 59 percent of respondents see overseeing cyber risk as a challenge, with only 19 percent of respondents saying their boards possess a high level of knowledge about cybersecurity.

Source: govinfosecurity.com