The SEC Dropped the Board Cyber-Expert Rule. Your 10-K Still Has to Name a Credential.
October 6, 2026
Randy Hall, CEO— AI-assisted and reviewed prior to publication.
Public companies no longer have to disclose whether a board member has cybersecurity expertise, but they still have to name the actual credentials of the executives running their security program. The SEC's final cyber disclosure rule dropped the board-level requirement in 2023, while keeping a separate mandate under Regulation S-K Item 106 that forces companies to describe management's relevant expertise, including specific certifications, in every annual report.
Did the SEC require boards to have a cybersecurity expert?
No. The SEC proposed that requirement in 2022 and then walked it back. The final rule, as Gibson Dunn's summary of the adopted rules explains, "omits the proposed requirement to disclose cybersecurity expertise within the board of directors," even though the agency left room for companies to volunteer that information if they consider it material.
Commenters argued the proposal was too prescriptive and worried it would pressure companies to chase a small pool of board-ready cyber experts. According to a legal analysis of the SEC's decision to drop the director-expertise rule, some commenters flagged that the disclosure item could even reduce board diversity by narrowing the nomination pool to a handful of credentialed specialists. The agency agreed and scrapped it.
That outcome got most of the headlines. It also obscured the part of the rule that survived, and that part is the one that actually touches your hiring plan.
What does the SEC still require companies to disclose about security staff?
Item 106(c)(2) requires every public company to describe management's role in assessing and managing cybersecurity risk, including the relevant expertise of the people or committees doing that work. A 10-K filed by Energy & Water Development Corp spells out exactly what counts, noting that relevant expertise may include prior work experience in cybersecurity, relevant degrees or certifications, and other cybersecurity knowledge or skills. The SEC's own guidance on the provision also states this disclosure would typically identify whether the company has a CISO or someone in a comparable role, and describe that person's background in detail that goes beyond what's required for any other executive.
That last point is easy to miss. Companies are not required to detail the CFO's accounting credentials or the general counsel's bar admissions in the same filing. The cybersecurity leader is singled out for a level of credential-specific disclosure no other officer gets, and regulators are enforcing it. Deloitte's roadmap of SEC comment letters on cybersecurity disclosure shows the agency directly pressing companies to go back and disclose the relevant expertise of the specific individuals or committees managing cyber risk when the first draft named a title without naming a qualification.
What this looks like in an actual filing
Real 10-Ks already show what compliant disclosure looks like, and it reads like a résumé. Freddie Mac's annual report states plainly that its Chief Information Security Officer and leadership team have, on average, over 15 years of security experience and hold certifications including CISSP, CISM, and FAIR. Telos Corporation goes further, listing an entire roster of credentials held across its information security team, from CompTIA Security+ and PenTest+ through CISSP, SSCP, and CISM.
Gibson Dunn's review of S&P 100 filings confirms this isn't a one-off. Its survey found that some companies reference an individual's certifications, such as CISSP, directly in their cybersecurity governance disclosures, as part of how they satisfy the management-expertise requirement. A credential isn't a line on an internal org chart anymore. It's a fact that can end up in a federal filing, attached to a named role, reviewed by auditors, and scrutinized by the SEC in a comment letter if it's missing.
Why boards are still chasing cyber credentials anyway
Even without a mandate, boards are voting with their nominations. EY's 2025 board disclosure analysis found that cybersecurity expertise is now disclosed as a sought-after skill or director background at 86% of Fortune 100 companies, up from 53% in 2019. That's a voluntary market response to a rule the SEC chose not to write, and it tells you where governance expectations are heading even in the absence of a legal floor.
The same EY analysis notes that companies are building that expertise through multiple paths, including board members who pursue briefings, conference attendance, or professional certifications of their own. Nomination committees that once treated "cyber background" as a vague line item are now expected to be able to point to something specific when a regulator or activist investor asks what that background actually is.
| Disclosure layer | Legally required? | What satisfies it |
|---|---|---|
| Board member cyber expertise | No (proposed, then dropped) | Voluntary, but disclosed by 86% of Fortune 100 boards anyway |
| Management's cyber expertise (Item 106(c)(2)) | Yes | Named role, work history, degrees, and certifications |
| Material incident reporting (Item 1.05, Form 8-K) | Yes | Four business days after a materiality determination |
The business case this creates
If you run security hiring or budget decisions, this split matters more than the headline about the board rule going away. The compliance obligation that survived lands squarely on the people you hire into CISO and senior security management roles, not on your board roster. That means the certifications those hires carry are no longer just a résumé screen. They're language your legal and investor relations teams may lean on when drafting the one part of your 10-K the SEC has actually pushed companies to tighten up.
For a CISO candidate or a sitting security leader, a credential like the EC-Council C|CISO certification is built specifically around the governance, risk, and executive communication skills that Item 106(c)(2) asks companies to describe. It's not a technical add-on. It's documentation of exactly the kind of background the rule's language calls out: prior work experience, formal credentials, and demonstrated skill in running a security program at the level a 10-K has to describe.
If you're building out a security leadership bench and want a clearer picture of how different certifications map to different parts of a governance program, Forge University's certification resources hub breaks down curriculum overlap and exam structure across the major credentials. And if your current security leadership can't yet point to the kind of named, document-ready expertise this rule expects, you can start training toward it before the next filing cycle forces the question.
What to do before your next 10-K cycle
Don't wait for a comment letter to find out your disclosure is thin. Audit committees and general counsel should sit down with the CISO now and confirm the filing can name specific credentials, not just a job title and years of tenure. If the answer is vague, that's a staffing gap with a filing deadline attached to it, not a someday project.
The SEC's decision to drop the board-expertise rule was, in practical terms, a decision to put the weight entirely on management disclosure instead. Companies that treat Item 106(c)(2) as boilerplate are taking on exposure they don't need to carry, especially when the fix is as straightforward as making sure the people already running the program hold, and can document, the credentials the rule was written to surface.