Cybersecurity Disclosure Act of 2018

This bill directs the Securities and Exchange Commission (SEC) to issue final rules requiring a registered issuer to:

• disclose in its mandatory annual report or annual proxy statement whether any member of its governing body has expertise or experience in cybersecurity, including details necessary to describe fully the nature of that expertise or experience; and
• if no member has such expertise or experience, describe what other company cybersecurity steps were taken into account by the persons responsible for identifying and evaluating nominees for the governing body.

The SEC shall, in coordination with the National Institute of Standards and Technology, define what constitutes expertise or experience in cybersecurity.