Statement of Administration Policy: S.J. Res. 50 - Congressional Disapproval of the Rule Submitted by the Securities and Exchange Commission (SEC) Relating to "Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure"

STATEMENT OF ADMINISTRATION POLICY

(Senate)
(Sen. Tillis, R-NC, and eight cosponsors)

The Administration strongly opposes passage of S.J. Res. 50, a joint resolution to disapprove of the SEC rule relating to informing investors about cybersecurity incidents and establishing uniform standards for corporate disclosures for oversight and governance of cyber risks.

Ransomware attacks are up 45 percent year over year. The lack of transparency by public companies about cyber incidents impacting their operations and data is fueling increasing cyberattacks across all sectors and all industries. Greater transparency about cyber incidents, as required in the SEC's rule, will incentivize corporate executives to invest in cybersecurity and cyber risk management.

Moreover, publicly-traded companies have a fiduciary duty to inform their investors of material cybersecurity incidents—as they do for all adverse events—that could be reasonably expected to affect corporate operations, brands, and share prices. Reversing the SEC's rulemaking would not only disadvantage investors who deserve to have a clear understanding of the cyber risk underlying their investment but would also cause companies to undervalue investments in cyber programs to the detriment of our economic and national security. The Administration believes these SEC disclosure requirements provide needed transparency to protect investors and incentivize cybersecurity investment.

If the President were presented with S.J. Res. 50, he would veto it.