The SEC Dropped Board Cyber Expertise Rules. Your CISO's Credentials Filled the Gap.
October 28, 2026
Randy Hall, CEO— AI-assisted and reviewed prior to publication.
Public companies no longer have to disclose whether their board has cybersecurity expertise. But they do have to name the executive responsible for managing cyber risk and describe that person's qualifications in the 10-K itself. That shift moves the scrutiny from an abstract board checkbox to a specific name, a specific title, and a specific set of credentials that now sit in a document regulators, investors, and plaintiffs' attorneys all read.
What Does the SEC Actually Require Companies to Disclose About Cybersecurity Leadership?
Item 106 of Regulation S-K requires public companies to describe management's role in assessing and managing material cybersecurity risk, including the relevant expertise of the people or committees responsible for it. The rule, finalized in 2023, requires registrants to address whether and which management positions or committees are responsible for assessing and managing such risks, and the relevant expertise of such persons in enough detail to fully describe the nature of that expertise.
That is a narrower requirement than what the SEC originally proposed. The agency's 2022 proposal would have forced companies to disclose whether any board member had cybersecurity expertise, a move that worried corporate governance lawyers and directors alike. In the final rule, the SEC declined to adopt a requirement for disclosure of cybersecurity expertise at the board level, shifting the disclosure burden down to management instead.
Why Did Regulators Pull Back on Board-Level Expertise Requirements?
The SEC worried the board disclosure rule would create a check-the-box exercise instead of real oversight. In public remarks, the Commission explained that commenters expressed concerns that the proposal might inadvertently pressure companies to retain board members purely to satisfy a disclosure line, rather than to strengthen actual governance.
That reasoning makes sense for boards, where a single credentialed director can't realistically run point on technical risk decisions day to day. It does not make the pressure disappear. It relocates it. The management-level disclosure that survived the final rule asks for exactly the kind of specificity a board-level requirement was criticized for lacking, which means the people actually named in these filings carry a heavier documentation burden than directors would have.
What Companies Are Actually Putting in the Filing
Most large companies are choosing to be specific rather than vague. A review of 97 S&P 100 companies' 2024 Form 10-K filings found that a substantial majority, 88%, disclose the experience and qualifications of the individuals responsible for assessing and managing cybersecurity risk. Some of those disclosures go further than a job title and years of experience.
The same review found that a number of companies reference an individual's educational background or professional certifications, naming the specific credential held by the executive in charge. Once a certification appears in a 10-K, it is no longer a line on a LinkedIn profile. It is a factual assertion in a filing subject to SEC review, shareholder scrutiny, and litigation discovery if an incident later calls that expertise into question.
This is also happening against a backdrop of rising board attention to cyber risk generally. Gartner has projected that 40% of boards of directors will have a dedicated cybersecurity committee, which means more directors are now asking management pointed questions about who holds the credentials behind the disclosure, even without a formal board-level requirement to answer them.
The Precedent That Makes This More Than a Paperwork Question
Naming a security leader's credentials in a public filing carries real exposure if the substance behind those credentials doesn't hold up under pressure. The SEC's case against SolarWinds and its CISO, filed in 2023 before Item 106 took full effect, centered on cybersecurity disclosures and public statements rather than credential claims specifically. A federal judge later dismissed most of the SEC's case against the company and its CISO in 2024, but the case still named an individual security executive personally and forced years of legal defense over what the company said about its own security posture.
That outcome should not read as reassurance. It reads as a preview. Item 106 now requires companies to make specific, documented claims about who runs cybersecurity risk management and what qualifies them to do it. A named executive whose disclosed expertise doesn't match their actual background, or whose certification has lapsed, is a far easier target in a securities complaint than a company making general statements about its security program.
Why Credentialed Leadership Is a Governance Decision, Not Just a Hiring Preference
Boards and general counsel now have a direct reason to care whether the person named in Item 106 disclosures holds a credential that actually maps to the job description. A title like Chief Information Security Officer means different things at different companies, but a certification like CISM Certification Prep is built specifically around the governance, risk, and program-management responsibilities that Item 106(c) asks companies to describe.
That matters because the disclosure requirement doesn't ask for a job title. It asks for the nature of the expertise, in detail. A company that can point to a named, current, third-party-verified credential has a cleaner answer than one leaning on tenure alone. If you're building out a security leadership bench and want a clear picture of which certifications map to which governance and disclosure obligations, Forge University's certification resources walk through the curriculum differences between management-track and technical-track credentials.
How Should Leadership Teams Prepare Before the Next Filing Cycle?
Start by auditing who is actually named, or who would be named, in your next Item 106 disclosure, and whether their credentials are current and verifiable. This is not a one-time check. Certifications lapse, continuing education requirements go unmet, and a company that disclosed expertise two filing cycles ago may be overstating it now without anyone noticing until an incident forces a closer look.
Treat the credentialing question the same way you'd treat any other disclosure control, with an owner, a renewal calendar, and documentation that would hold up if a regulator or plaintiff's attorney asked for it. If your security leadership team needs a structured path to close that gap, you can start training with a program built around the exact domains regulators expect named executives to understand.
The SEC's decision to drop board-level expertise disclosure was framed as a win for boards wary of tokenism. For the executives actually named in these filings, the practical effect is the opposite of relief. Their credentials are now part of the public record, read by investors, compared against peer companies, and available to anyone building a case after the next incident.