Motivated by the SEC’s new proposal to require firms to publicly disclose their cybersecurity incidents within four days of discovery, we study whether there are trade-offs with mandating a disclosure deadline for cybersecurity incidents. In the U.S., state-level data breach disclosure laws...

On March 23, 2022, the SEC proposed that firms publicly disclose their cybersecurity incidents within four days of discovery. In the U.S., state-level data breach disclosure laws require firms to disclose the occurrence of a data breach, with some mandating disclosure within a deadline while...