Large public companies felt largely prepared to comply with the disclosure requirements of the Securities and Exchange Commission’s (SEC) new cybersecurity incident rule in the weeks before it took effect in December, though many felt only somewhat prepared.
Many companies also felt such disclosures and other reporting requirements of the rule could enhance the threat of them being targeted for future cyberattacks.
