Cybersecurity Disclosure Act of 2018

To promote transparency in the oversight of cybersecurity risks at publicly traded companies. 1. Short title This Act may be cited as the Cybersecurity Disclosure Act of 2018 2. Cybersecurity transparency (a) Definitions In this section— (1) the term Commission (2) the term cybersecurity threat (A) means an action, not protected by the First Amendment to the Constitution of the United States, on or through an information system that may result in an unauthorized effort to adversely impact the security, availability, confidentiality, or integrity of an information system or information that is stored on, processed by, or transiting an information system; and (B) does not include any action that solely involves a violation of a consumer term of service or a consumer licensing agreement; (3) the term information system (A) has the meaning given the term in section 3502 of title 44, United States Code; and (B) includes industrial control systems, such as supervisory control and data acquisition systems, distributed control systems, and programmable logic controllers; (4) the term issuer 15 U.S.C. 78c (5) the term NIST (6) the term reporting company (A) the securities of which are registered under section 12 of the Securities Exchange Act of 1934 ( 15 U.S.C. 78l (B) that is required to file reports under section 15(d) of such Act ( 15 U.S.C. 78o(d) (b) Requirement To issue rules Not later than 360 days after the date of enactment of this Act, the Commission shall issue final rules to require each reporting company, in the annual report submitted under section 13 or section 15(d) of the Securities Exchange Act of 1934 ( 15 U.S.C. 78m 15 U.S.C. 78n(a) (1) to disclose whether any member of the governing body, such as the board of directors or general partner, of the reporting company has expertise or experience in cybersecurity and in such detail as necessary to fully describe the nature of the expertise or experience; and (2) if no member of the governing body of the reporting company has expertise or experience in cybersecurity, to describe what other cybersecurity steps taken by the reporting company were taken into account by such persons responsible for identifying and evaluating nominees for any member of the governing body, such as a nominating committee. (c) Cybersecurity expertise or experience For purposes of subsection (b), the Commission, in consultation with NIST, shall define what constitutes expertise or experience in cybersecurity, such as professional qualifications to administer information security program functions or experience detecting, preventing, mitigating, or addressing cybersecurity threats, using commonly defined roles, specialities, knowledge, skills, and abilities, such as those provided in NIST Special Publication 800–181 entitled NICE Cybersecurity Workforce Framework

Summary: Cybersecurity Disclosure Act of 2018 This bill directs the Securities and Exchange Commission (SEC) to issue final rules requiring a registered issuer to: disclose in its mandatory annual report or annual proxy statement whether any member of its governing body has expertise or experience in cybersecurity, including details necessary to describe fully the nature of that expertise or experience; and if no member has such expertise or experience, describe what other company cybersecurity steps were taken into account by the persons responsible for identifying and evaluating nominees for the governing body. The SEC shall, in coordination with the National Institute of Standards and Technology, define what constitutes expertise or experience in cybersecurity.