August 1, 2025

The Future of Cyber Disclosure Enforcement: Non-Existent, or Just “Back to Basics”?

The question of what Congress will fund next year is still a very open one, since our lawmakers sprinted out of Washington before making much progress on the appropriations bills. Just the same, some of the early activity can give us a sense of what type of budget the SEC will be working with, and which enforcement and rulemaking priorities will get those precious dollars.

As Meredith blogged in June, the SEC had requested that its funding level not change from last year. It’s not too surprising to see that the current subcommittee version of the House appropriations bill would actually reduce the Commission’s funding by about 7% compared to last year. What may be more interesting is the laundry list of items that the bill would “defund” (i.e., the SEC wouldn’t be able to use the appropriated funds for these items):

– SEC. 527. None of the funds made available by this Act may be used to compel a private company to make a public offering under the Securities Act of 1933 by amending the ‘‘held of record’’ definition under section 12(g)(1) of the Securities Exchange Act of 1934.

– SEC. 528. None of the funds made available by this Act may be used to implement any program that requires a national securities exchange, a national securities association, or a member of such an exchange or association to collect and provide personally identifiable information with respect to a retail market participant to meet the requirements relating to an order or a reportable event under section 242.613(c)(7) of title 17, Code of Federal Regulations, or any successor regulations thereof.

– SEC. 529. None of the funds made available by this Act may be used to review or approve the budget for the Financial Accounting Standards Board (FASB) as described in 15 U.S.C. 7219, until the FASB withdraws the Accounting Standards Update on Income Tax Disclosures issued in December 2023 (No. 2023-09).

– SEC. 530. None of the funds made available by this Act may be used to develop, promulgate, finalize, implement, or enforce rulemaking that would, directly or indirectly, create new disclosure requirements under Regulation D or lower the amount of money an issuer can raise through Regulation D.

– SEC. 531. None of the funds made available by this Act may be used to implement or enforce the final rule entitled ‘‘Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure’’ (88 Fed. Reg. 51896 (August 4, 2023)).

The tax and cybersecurity disclosure restrictions are interesting, since some companies have been wondering whether they need to worry about these rules anymore under the current regime. For cyber, it’s worth remembering that even though Commissioners Peirce and Uyeda objected to the cybersecurity disclosure rules when they were adopted, it was in part because they believed the preexisting rules and guidance already required disclosure of material cybersecurity risks and incidents. That suggests we will still need to keep principles-based disclosures in mind for these issues. Plus, the laws are still on the books (for now) and enforcement could resume after a regime change. All that said, it does seem that when it comes to obsessing over the finest, most technical disclosure points, we may get a little breathing room for the time being – especially if the spending prohibition makes it into the final appropriations bill.

Liz Dunshee

Take Me Back to the Main Blog Page

Blog Preferences: Subscribe, unsubscribe, or change the frequency of email notifications for this blog.

UPDATE EMAIL PREFERENCES

Try Out The Full Member Experience: Not a member of TheCorporateCounsel.net? Start a free trial to explore the benefits of membership.

START MY FREE TRIAL