TheCorporateCounsel.net

August 22, 2023

Reading the Tea Leaves: What Could Cybersecurity Rules Tell Us About Final Climate Change Rules?

One of the occupational hazards of being a securities lawyer is that you are often asked to predict what the SEC or the SEC Staff will do in a particular situation, and at times making such predictions can be difficult. The challenge can be particularly acute when it comes to SEC rulemaking, because so many variables are at play in any given rulemaking action. Sometimes I feel like Zoltar, the vending machine fortune teller from the movie Big.

The process of notice and comment rulemaking is very much a “give and take” process. Having been involved in this process at the SEC, I would say that rulemaking involves quite a bit of what we would always refer to as “horse trading,” particularly when the rulemaking is being considered at the Commission level. As a member of the Staff, sometimes the horse trading can be frustrating, because things can end up in proposed rules that do not necessarily make a lot of sense or are not consistent with what you were hoping to achieve. The process becomes even more complex once you have proposed the rules and are considering the input of commenters, particularly when you are dealing with a controversial rulemaking that is likely to be subject to legal challenge.

One thing that is important to not lose sight of is that while the final rules are not “negotiated” per se, the Commission will sometimes propose rule changes that may go farther than what the Commission actually expects to adopt as final rules, recognizing that some matters may be pared back or changed in response to comments. For this very reason, in the not-too-distant past, we did not always provide a whole lot of coverage in law firm client alerts and publications such as The Corporate Counsel on proposed rules, given the understanding that proposed rules may not necessarily be indicative of what the final rules will turn out to be, so it did not make much sense to dedicate scarce resources toward understanding the proposed rules. In recent years, there has been increased concern (whether warranted or not) that the Commission is proposing rules that it intends to adopt largely as proposed, without perhaps fully considering the concerns raised by commenters. The shifting sands have made things much harder to predict as the Commission tackles some very significant public disclosure issues through the rulemaking process.

Which brings us to the question that everyone is asking these days – what will the final climate change disclosure rules look like? In trying to answer this question like Zoltar, I am encouraged by the outcome we recently observed with the cybersecurity disclosure rules. In March 2022, the SEC originally proposed cybersecurity disclosure rules that included complex and highly detailed requirements that struck companies and their advisers as overly prescriptive and seeking too much detail. Consistent with other recent rulemakings, the Commission went down the path of proposing very prescriptive disclosure requirements on the topic of cybersecurity risk management and oversight for periodic reports and for the type of information that would be required to be disclosed when it is determined that a cybersecurity incident is material. The Commission also took what proved to be a controversial step of proposing that companies disclose information about the cybersecurity expertise of corporate directors.

In the final rules, the Commission clearly considered the concerns of commenters on a number of important issues and modified the final rules as a result, including paring back the disclosure required on a current basis when an incident is determined to be material, pivoting to a more principles-based approach for the disclosure related to risk management, strategy, and governance and not adopting the proposed requirement to disclose board cybersecurity expertise.

While it is obviously difficult to draw too many conclusions from just this one rulemaking, this recent outcome with the cybersecurity disclosure rules may give us hope that the Commission will make some significant adjustments to the proposed climate change disclosure requirements that were also proposed back in March 2022, particularly with respect to the disclosure of Scope 3 emissions, the detailed disclosure requirements regarding risk management and governance and the financial statement footnote disclosure requirements. The horse trading on these and other points is undoubtedly going on as we speak. I think that maybe only Zoltar knows how it will all come out.

– Dave Lynn