The SEC Dropped Board Cybersecurity Credentials. It Kept Yours.
October 19, 2026
Randy Hall, CEO— AI-assisted and reviewed prior to publication.
A public company's 10-K no longer just describes its cybersecurity program in the abstract. Under SEC Regulation S-K Item 106, it has to name the specific executive responsible for managing cyber risk and describe their actual expertise, including certifications. That single disclosure line has turned a resume credential into a matter of public record and legal exposure.
What Does the SEC Actually Require Companies to Disclose?
Item 106 requires two separate things, and the difference between them is the whole story. Public companies must describe their processes for assessing and managing cybersecurity risk, and they must describe the board of directors' oversight of risks from cybersecurity threats and management's role and expertise in assessing and managing material risks. The board half of that sentence stayed vague. The management half did not.
When the SEC first proposed these rules, it floated a separate requirement that would have forced companies to disclose whether any board member personally had cybersecurity expertise. That proposal did not survive. Commenters argued cyber risk was not fundamentally different from other risks directors oversee without specialized credentials, and the SEC was persuaded to drop the board-expertise disclosure item entirely. Boards got a pass. Management did not.
The instructions to Item 106(c) that did survive say relevant expertise disclosures may include prior work experience in cybersecurity, relevant degrees or certifications, and knowledge, skills, or other background in cybersecurity. That is an unusually specific disclosure standard. As Gibson Dunn's own analysis of the rule points out, the SEC is now asking for more biographical detail about a cybersecurity executive's background than it requires for a CEO or CFO.
Why Is This a Bigger Deal Than It Looks?
Because the SEC is not accepting vague answers, and its own staff is pushing back when companies try to give them. Comment letters reviewed by Deloitte's disclosure practice show the SEC Division of Corporation Finance directly telling companies to revise filings and discuss the relevant expertise of senior management members responsible for cyber risk in more detail when the first draft was too generic. "Senior leadership oversees cybersecurity risk" is not an answer the SEC will let stand. It wants the person's name, their years of experience, and often their certifications.
Gibson Dunn's survey of S&P 100 filings confirms this is already happening in practice, not just in theory. Some companies now reference an individual's educational background or certifications, such as CISSP directly in the governance section of their annual report. KBR's most recent 10-K is a clean example of what this looks like in practice: the filing states plainly that its CISO brings over 15 years of experience and maintains CISSP and PMP certifications, filed alongside the CIO's background in the same governance section. That is not marketing copy. It is a legally reviewed disclosure that investors, plaintiffs' attorneys, and short sellers can all read.
What Happens When a Named Executive's Credentials Get Scrutinized
This is where the SolarWinds case changed the calculus for security leaders everywhere, not just at companies under SEC jurisdiction. Once a company names a specific executive and describes their credentials, that person becomes individually visible if a breach happens and a disclosure dispute follows. Security industry analysis of Section 1C disclosures notes that CISOs now face personal exposure as companies name specific executives and describe their roles and decision-making processes in SEC filings. A credential listed in a 10-K is no longer a private qualification. It is evidence a regulator, a plaintiff, or a reporter can point to and ask whether it was accurate, current, and sufficient for the role.
That changes the calculation for how companies choose who gets named in the filing in the first place. A vague "our security team has relevant experience" line invites a comment letter. A named CISO with a specific, recognized credential gives outside counsel something concrete to stand behind.
Which Credentials Are Actually Showing Up in Filings
The certifications that recur across 10-K cybersecurity sections are not a mystery. They cluster around a small set of recognized management and governance credentials rather than purely technical ones.
| Certification | What it signals in a filing |
|---|---|
| CISSP | Broad security and risk management expertise |
| CISM | Security program governance and risk management |
| CRISC | Enterprise risk and control decision-making |
| CCISO | Executive-level security leadership and board communication |
This pattern lines up with how the certifications themselves are built. Industry comparisons of these paths note that CISSP provides breadth, CISM strengthens management, and CCISO is positioned to validate executive-level leadership once a security leader is operating at or near the CISO level. For a company preparing a disclosure that names its CISO, those are precisely the credentials that read as credible to an outside investor rather than as padding.
How Should You Build a Security Leadership Bench That Holds Up Under Disclosure?
Stop treating CISO-track certification as a personal career decision you leave to individual employees. If your company is public, or heading toward an acquisition, IPO, or major contract that will trigger similar scrutiny, the person you eventually name in a governance disclosure needs credentials that were earned, not assembled after the fact under deadline pressure. That argues for identifying your next CISO candidate now and funding their path toward a credential built specifically for that disclosure moment, such as CCISO certification prep, which covers governance, risk strategy, and board-level communication rather than only technical controls.
This is also a reason to treat certification planning as a standing line item rather than a one-off expense. If you are mapping out which credentials matter for which roles across your security organization, the curriculum overview and FAQ on exam paths is a reasonable place to compare what each certification actually tests before committing budget to one over another. If you want a study plan built around the specific credential your next disclosure will need to name, you can start training now rather than scrambling once the filing deadline is close.
The Business Decision Underneath the Compliance Requirement
None of this is really about satisfying a single disclosure line. It is about whether the person your company puts in front of investors, regulators, and eventually a courtroom if something goes wrong, has a credential that holds up to scrutiny. The board expertise disclosure rule died in committee. The management expertise rule did not, and the SEC's own comment letters show it is willing to send a filing back until the answer is specific enough to matter.
That is a different kind of pressure than the usual "get your team certified" argument. It is not about filling a job requisition or passing a vendor questionnaire. It is about whether the name and credential sitting in your public filing right now would survive a plaintiff's attorney reading it line by line after an incident. Companies that treat CISO-track certification as a strategic bench-building exercise, rather than something an employee does on their own time, are the ones whose disclosures will read as substance instead of filler the next time the SEC staff pulls the file.