Reuters/Albert Gea
-
The Securities and Exchange Commission issued new guidelines on Wednesday for public companies regarding their duties concerning the disclosure of security breaches and vulnerabilities.
-
The guidelines come amid scrutiny of a massive stock sale Intel CEO Brian Krzanich made last fall after his company found out about — but before it publicly disclosed — the Meltdown and Spectre attacks.
-
The agency advised companies to disclose such incidents to investors in a "timely" manner.
-
It also warned executives and directors not to trade in their companies shares in the time in between finding out about a "material" security problem and disclosing it to the public.
Intel CEO Brian Krzanich sold millions of dollars worth of company stock after his company became aware of the Spectre and Meltdown security vulnerabilities, but before they became public.
The Securities and Exchange Commission has a bit of advice for other executives thinking of doing something similar: Don't.
In new guidelines issued on Wednesday, the agency warned that security breaches and vulnerabilities could constitute "material" information, noting that it's illegal under US securities laws for insiders to trade stocks based on such information before it becomes public. Such sales may also violate companies' ethics and insider trading policies.
"Directors, officers, and other corporate insiders must not trade a public company’s securities while in possession of material nonpublic information, which may include knowledge regarding a significant cybersecurity incident experienced by the company," the SEC said in the guidelines.
It continued: "Companies should have policies and procedures in place to [...] guard against directors, officers, and other corporate insiders taking advantage of the period between the company’s discovery of a cybersecurity incident and public disclosure of the incident to trade on material nonpublic information."
Additionally, the SEC encouraged companies to disclose security breaches and vulnerabilities to investors in a "timely fashion."
The new guidelines follow disclosures of the Meltdown and Spectre attacks
The guidelines come less than two months after Intel and other tech companies disclosed the Spectre and Meltdown vulnerabilities. Those vulnerabilities, which take advantage of a feature found in nearly all computer processors, could be used in cyberattacks that would allow malicious actors to steal private data stored on computers, such as passwords.