The U.S. Securities and Exchange Commission (SEC) updated guidance to public companies this week on how and when they are to disclose cybersecurity risks and breaches. The SEC suggests that public companies should disclose potential weaknesses that have not been targeted by hackers.

There has always been a tension between the SEC and public companies on the SEC’s cybersecurity disclosure guidelines. The SEC stresses that “clearer and more robust disclosure” is urged, yet public companies stress that the disclosure of weaknesses makes them vulnerable to attacks against those weaknesses.

The guidance provides a strong comment on discouraging company executives from trading the company’s securities while investigating a cyber-attack and while possessing non-public information about an intrusion.