S 808 Introduced - Cybersecurity Disclosure Act of 2021

Last month Sen Reed (D,RI) introduced S 808, the Cybersecurity Disclosure Act of 2021. The bill would require the Securities and Exchange Commission to establish rules requiring the reporting of whether there was cybersecurity expertise on the board of directors or other governing body of each company required to file annual reports. The bill is nearly identical to S 592 that was introduced last session. No action was taken on the earlier bill.

Moving Forward

Reed is a member of the Senate Banking, Housing, and Urban Affairs Committee to which this bill was assigned for consideration as are three of his cosponsors {Cortez-Masto (D,NV), Cramer (R,ND), and Warner (D,VA)}. This means that there should be enough influence to see the bill considered in Committee. I would expect there to be some resistance to this bill from business supporters in the Republican conference. With the increasing concern, however, in Congress about cybersecurity issues, there should be somewhat reduced opposition to this bill. That means that the bill could pass in Committee with some bipartisan support.

This bill will not make it directly to the floor of the Senate. The bill is not important enough to take the time required for the normal debate and amendment process. That would leave just the unanimous consent process as the means for this bill to make it to the floor; there will be at least one Republican Senator that would object to the consideration of the bill. The bill could make it to the floor as an amendment to a must pass spending or authorization bill.

Commentary

I would like to reiterate a point I made in my discussion of S 592 back in 2019, is this realistic? Does every corporation in the United States (no matter the size) need to have a cybersecurity expert on their Board? According to Scott A Hodge, at the TaxFoundation.org, in 2014 there were 1.7 million C corporations and 7.4 million partnerships and S Corporations in the United States. Where are all of the cybersecurity experts going to come from?