The SEC Dropped the Board Cyber Expert Rule. Management's Expertise Is Now the Disclosure.
October 1, 2026
Ric Hall, CRO— AI-assisted and reviewed prior to publication.
Public companies no longer have to name a cybersecurity expert on the board. But Regulation S-K Item 106 still requires them to describe which management positions handle cyber risk and what expertise those people actually have. That disclosure has to be true, specific, and defensible, which means the certifications behind it now carry real weight.
What does the SEC actually require companies to disclose about cybersecurity management?
Item 106 requires registrants to describe their processes for assessing, identifying, and managing material cybersecurity risk, and that description can include which management positions or committees own that work along with the relevant expertise of the people in them. The SEC's own small business compliance guide lays this out directly, tying the disclosure to named roles rather than a general statement that "the company takes security seriously." A CPA Journal analysis of the final rule notes the disclosure may cover whether and which management positions or committees are responsible for assessing and managing cyber risk, and the relevant expertise of the people who hold them.
That last phrase, relevant expertise, is where most disclosure committees get vague. Legal counsel wants specifics they can defend if a shareholder suit or SEC enforcement action later asks how the company knew its cyber risk program was competently run. "Years of experience" is soft. A named certification tied to a named role is not.
Why the board expertise rule died but the management expertise rule survived
The SEC's original 2022 proposal would have forced companies to disclose whether any board member had cybersecurity expertise, and it explicitly floated relevant certifications as one way to define that expertise. Commenters pushed back hard, arguing the term was undefined and would pressure boards into recruiting technical specialists rather than governance generalists. The final rule dropped it. A Barnes & Thornburg summary of the rulemaking confirms the SEC pulled the proposed board expertise disclosure item entirely, along with much of the other prescriptive language in the draft.
What did not disappear is the management-level disclosure under Item 106(c). The SEC's adopting release fact sheet still requires registrants to describe their processes for assessing, identifying, and managing material cybersecurity risk, and law firm commentary on the rule confirms companies retain latitude to describe management's role and expertise even without a mandated board-level credential disclosure. That leaves a gap. Nobody has to name a cyber expert on the board, but somebody in management is still on the hook to have documented expertise, because the company said so in its 10-K.
An NACD analysis of the SEC's search for cybersecurity expertise points out that the original proposal, before it was withdrawn, listed relevant certifications as one concrete example of what counted as expertise. That example didn't survive into the final board-level rule, but the underlying logic still applies wherever a company chooses to describe management expertise under Item 106. If you are going to claim expertise in a public filing, you need something more durable than a job title to back it up.
Why certification is the cleanest way to satisfy that language
A certification is a third-party attestation, dated, scoped, and revocable, that a named person met a defined competency bar. That is exactly the kind of evidence disclosure counsel and audit committees want when a filing states that a specific role carries cybersecurity risk expertise. It is verifiable in a way "extensive background in IT" is not, and it holds up better if a plaintiff's attorney or SEC examiner asks the company to substantiate what it wrote.
ISACA's CGEIT credential is built for exactly this kind of governance-level claim. It covers four domains: governance of enterprise IT, IT resources, benefits realization, and risk optimization, and it requires five or more years of relevant governance or assurance experience to earn, according to ISACA's exam content outline. That is a governance credential, not a hands-on technical one, which matches the language of Item 106 far better than a purely operational security certification does. The person accountable for describing how the company governs cyber risk needs to demonstrate governance competency, not just incident response skill.
Forge University's CGEIT certification prep is built around those same four domains, so a governance, risk, or compliance leader can walk into the recertification conversation with a credential that maps directly onto what the disclosure describes. If your company's 10-K names a chief risk officer, a GRC director, or a cyber governance committee chair as the person responsible for assessing material risk, that person's credential should say governance, not just security operations.
What happens if the disclosure and the credentials don't match
A mismatch between what a filing claims and what the named role can actually document becomes a materiality and internal-controls problem, not just an HR gap. Disclosure controls and procedures under the SEC's own framework are supposed to catch exactly this kind of unsupported statement before it goes out the door.
Materiality determination is where this bites hardest in practice. Multiple securities law firms have written about how companies are standing up cross-functional committees to make the call on whether an incident is material within the four business day disclosure window, and a Perkins Coie analysis of materiality determinations describes the operational pressure these committees face under the final rule. If the company's own 10-K says a named role owns that judgment call, and the same filing describes that role's expertise, the two statements need to line up under audit and litigation scrutiny.
That is the accountability chain a general counsel actually cares about: named role, named expertise, named credential, all consistent across the filing. Certification is the piece of that chain that is easiest to get wrong through neglect, because credentials lapse, people change jobs, and continuing education requirements slip. A governance program that treats certification status as a tracked, audited control, the same way it tracks access reviews or vendor attestations, closes that gap before an examiner or plaintiff's attorney finds it first.
Building this into your governance documentation now
Start by mapping every role named in your cybersecurity risk disclosure to a specific, current credential, not a general description of experience. If the mapping has holes, that is a training and certification gap you can close before the next 10-K cycle rather than after a materiality dispute forces the question. Forge University's resources hub walks through how these certification paths line up against governance, risk, and compliance job functions if you need a starting point for that mapping exercise.
Then treat the credential like any other control: track expiration dates, continuing education hours, and renewal status the same way you track SOC 2 evidence or access certifications. A named role with a lapsed credential is arguably worse than no credential claim at all, because it turns an accurate disclosure into a stale one without anyone deciding to make that change. If you want a study plan built around closing that specific gap for your GRC team, you can start training whenever you're ready.
The SEC did not require a named cyber expert on your board. It still requires an honest, specific answer about who manages your cyber risk and what qualifies them to do it. Get that answer right once, in writing, with credentials that back it up, and the next audit or examiner conversation about your governance program becomes a formality instead of a fire drill.