Skip to content
CISO Spotlights

Board cybersecurity-expertise record

Which boards name a director with cybersecurity expertise?

No SEC rule requires a company to say whether any of its directors has cybersecurity expertise. The Commission proposed exactly that requirement in 2022 (Item 407(j) of Regulation S-K), then dropped it from its final 2023 cybersecurity-disclosure rule, reasoning that boards can oversee cybersecurity risk through general risk-management skill rather than a named specialist. Some companies name one anyway, usually in a proxy statement's director qualifications or skills matrix. This record states that exactly as each company's own filing describes it, one company at a time, built as this site reads filings rather than pulled from a feed. It carries no view on whether naming a director this way is meaningful; a voluntary disclosure is a fact about the filing, not a mark of quality.