Deal Diary

With threats of nation-states infiltrating supply chains and landmark laws being passed, cybersecurity and privacy are critical aspects of director oversight. Recent court decisions and speeches from the SEC have made it clear that directors are not able to delegate cybersecurity oversight: directors each have the responsibility to personally understand cybersecurity risk and ask appropriate questions. Directors must focus on internal controls to guard against cyber-threats (including accounting, cybersecurity and insider trading) and expand diligence of thirdparty suppliers. Integrating both privacy and security by design will be critical to minimizing ongoing risk of cybersecurity breaches and state and federal enforcement.

Corporate Culture

The corporate culture of a company starts at the top, with the board of directors, and directors should be attuned not only to the company’s business, but also to its people and values across the company. Ongoing and thoughtful efforts to understand the company’s culture and address any issues will help the board prepare for possible crises, reduce potential liability and facilitate appropriate responses internally and externally.

This week we highlight a report by the EY Center for Board Matters that analyzes how boards, executives, investors, regulators and other governance stakeholders are planning for and responding to cybersecurity threats. The observations conclude that the depth and nature of cybersecurity-related disclosures vary widely, suggesting there is opportunity for enhancement in how cybersecurity risks, cybersecurity risk management frameworks and board oversight are communicated.

SEC regulatory relief

We expect that the Trump administration and the Republican-led U.S. Congress will advance significant policy shifts and rule changes at the SEC that are designed to encourage companies toward public ownership and to facilitate capital formation in both public and private markets.