In February 2018, the SEC updated its cybersecurity disclosure guidelines for reporting companies, emphasizing the importance to investors and markets for prompt and robust disclosure relating to cyber issues. Indeed, in April, the agency brought its first enforcement action relating to cybersecurity enforcement issues. In its recent annual report, the agency’s enforcement division emphasized that cybersecurity disclosure is a priority issue. Clearly, public company’s cybersecurity-related disclosure practices are receiving a great deal of attention and scrutiny.
But what are public companies actually doing in terms of cybersecurity disclosures? A recent study by EY took a look at the actual cybersecurity disclosure practices. Their analysis shows that cybersecurity-related disclosure practices “vary widely,” suggesting there is an “opportunity for enhancement.” The October 22, 2018 report, entitled “Cybersecurity Disclosure Benchmarking,” can be found here. Continue Reading Cybersecurity Disclosure Practices and Standards
Both the volume of SEC enforcement activity and the level of financial recoveries increased in the fiscal year that ended September 30, 2018, according to the agency’s annual enforcement activity report. The increases came after activity had been down in the prior year, the first year under the current presidential administration. However, the agency’s enforcement chiefs cautioned against placing too much weight on the numbers alone. The report contains some interesting signs of what we might expect in the current fiscal year. The SEC’s enforcement report can be found
In June 2017 when the U.S. Supreme Court
As I have noted in prior posts (most recently
In the latest example of a D&O lawsuit following in the wake of allegations of sexual misconduct, three shareholders have filed a state court derivative lawsuit in Oregon against Nike’s Board of Directors alleging that the defendants failed in their oversight duties and allowing a toxic “boys club” culture of sexual harassment and bullying to take hold. The Nike complaint shows yet again that the accountability process that has emerged as part of the #MeToo movement in many cases has involved efforts to hold company’s boards accountable for permitting misconduct or turning a blind eye. The Nike derivative complaint can be found
As I have detailed in
As has been well-documented (on
Alleged deficiencies in climate change-related disclosures have been a target of advocacy groups, shareholders, and regulators. The latest example of this phenomenon is the civil lawsuit the New York Attorney General filed on Wednesday against Exxon Mobil Corporation. The NYAG alleges that the company sought to “systematically and repeatedly deceive investors” about the future impacts climate change regulation could have on the company’s assets and value. The lawsuit underscores the fact that climate change disclosures are and will remain under scrutiny and that the claims alleging insufficient or deceptive climate change-related disclosures remain a significant area of corporate liability exposure. The October 24, 2018 complaint can be found 
In 1995, Congress passed the Private Securities Class Action Reform Act (PLSRA) over President Clinton’s veto in order to try to address perceived securities class action litigation abuses. According to a new report from the U.S. Chamber Institute for Legal Reform entitled “A Rising Threat: The New Class Actions Racket That Harms Investors and the Economy,” despite the PSLRA’s reforms, many of the same abuses that led to the PSLRA’s enactment have returned, and as a result the securities class action system is “spinning out of control.” According to the report, the time has come for Congress to intervene again to curb “abusive practices that enable the filing of unjustified actions.” The Institute’s October 23, 2018 report can be found