The US Securities and Exchange Commission (SEC) recently introduced new rules requiring covered organizations to disclose cybersecurity incidents within four business days of their discovery. The disclosures must describe “the material aspects of the incident's nature, scope, and timing, as well as its material impact.”