Lesson 2.11: Board oversight and what you disclose about it
Regulators now ask boards to own cyber risk, and to say in public how they do it. Since 2023 the US SEC's Regulation S-K Item 106 requires listed companies to describe in their annual report how they assess and manage cyber risk and how the board and management oversee it. In the EU, NIS2 makes management bodies approve cybersecurity measures, follow training and answer for failures. A disclosure that the minutes don't support is a liability of its own. In the lab you check a draft Item 106 text against a year of board and committee minutes and director training records, and send the drafting team the corrections.
20 min
You will learn to
- Explain what SEC Item 106 and NIS2 ask of boards
- Test disclosure claims against minutes
- Measure how often the board actually hears about cyber risk
- Check management-body training
- Write evidence-based corrections to a disclosure
Key terms
- Regulation S-K Item 106
- SEC rule (adopted July 2023) requiring annual disclosure of cyber risk management, strategy and governance.
- Management body (NIS2)
- Under NIS2 Art. 20, it approves cybersecurity risk measures, oversees them, follows training and can be held liable.
- Audit committee
- A board committee that oversees risk, controls and audit, often including cyber.
- Evidence index
- A list mapping each disclosure claim to the document that supports it.
- Misstatement
- A published statement that isn't accurate; in securities law it can lead to enforcement.
← Spending a security budget for the most risk reduction · All lessons · Which controls actually worked? Reading the year's incidents →