Disclosure in annual reports on cyber risks

Introduction

Disclosure in annual reports on cyber risks refers to the legal and corporate governance obligations requiring organisations to communicate material cybersecurity threats, data breaches, technological vulnerabilities, information security incidents, and risk management measures through their annual reporting documents. As businesses increasingly depend on digital infrastructure, cloud computing, artificial intelligence, electronic databases, and interconnected information systems, cybersecurity has become an essential component of corporate accountability.

Cyber risks include ransomware attacks, data theft, unauthorised access, phishing, operational disruptions, intellectual property theft, and attacks on critical information infrastructure. Such incidents may affect financial performance, business continuity, customer confidence, regulatory compliance, and organisational reputation.

Annual reports provide shareholders, investors, regulators, and other stakeholders with information about an organisation's financial position, operational performance, governance practices, and material risks. Therefore, cybersecurity risks that may significantly affect an organisation's operations or financial stability should be appropriately identified and disclosed.

For example, if a pharmaceutical company experiences a cyberattack affecting its clinical research databases, the incident may delay product development, compromise confidential research information, and create regulatory liabilities. Failure to disclose a material incident or its financial consequences may undermine the reliability of corporate reporting.

Disclosure in annual reports on cyber risks is therefore an important mechanism for improving transparency, strengthening board accountability, protecting investors, and promoting responsible corporate governance.

Meaning and conceptual foundations

Cyber risk disclosure refers to the communication of material cybersecurity-related information through corporate reporting systems.

It involves identifying technological threats, evaluating their potential consequences, explaining organisational security arrangements, and informing stakeholders about significant cybersecurity incidents.

The concept has five major dimensions.

Risk identification: Organisations must identify potential cybersecurity threats affecting their information systems, digital infrastructure, customer databases, and business operations.

Risk assessment: Companies should evaluate the likelihood and potential impact of cyber incidents, including financial losses, operational disruptions, legal liabilities, and reputational damage.

Governance accountability: The board of directors and senior management should establish appropriate oversight mechanisms for cybersecurity risks.

Incident transparency: Material cybersecurity incidents should be disclosed in accordance with applicable reporting obligations.

Risk mitigation: Annual reports should provide meaningful information about cybersecurity policies, internal controls, monitoring arrangements, and recovery mechanisms.

The objective is not to publish confidential technical information that could help attackers. Rather, it is to provide investors and stakeholders with sufficient information to understand the company's exposure to cybersecurity threats and its ability to manage them.

Importance of cyber risk disclosure in annual reports

1. Investor protection

Investors need reliable information about risks that may affect the financial performance and stability of an organisation.

Cyberattacks may cause financial losses through operational interruptions, legal claims, regulatory penalties, and recovery expenses.

Transparent disclosure enables investors to evaluate these risks before making investment decisions.

2. Corporate governance accountability

Cybersecurity is no longer exclusively an IT department responsibility.

Boards of directors must understand significant cyber risks and ensure that appropriate management systems are established.

Annual reporting helps demonstrate whether cybersecurity is integrated into corporate risk management.

3. Regulatory compliance

Companies operating in regulated sectors may have reporting obligations under securities laws, data protection legislation, and sector-specific cybersecurity directions.

Annual reports can communicate how organisations manage these obligations.

4. Business continuity

Cyber incidents can interrupt essential business operations, including payment systems, manufacturing, research activities, and customer services.

Disclosure of continuity arrangements provides stakeholders with information about organisational preparedness.

5. Stakeholder confidence

Transparent reporting improves confidence among shareholders, customers, employees, suppliers, and business partners.

It demonstrates that cybersecurity risks are recognised as significant governance issues.

Legal and regulatory framework in India

1. Companies Act, 2013

The Companies Act, 2013, establishes important corporate reporting and governance requirements.

Section 134(3): Requires the Board's Report to contain prescribed information, including relevant explanations and disclosures concerning the company's affairs.

Section 134(3)(n): Requires a statement indicating the development and implementation of a risk management policy, including identification of elements of risk that may threaten the existence of the company.

Cybersecurity risks may fall within this broader risk management framework where they materially affect the company's operations or financial position.

Section 134(5): Establishes directors' responsibilities concerning financial records, accounting policies, internal financial controls, and compliance with applicable laws.

Section 177: Establishes the Audit Committee framework for specified companies. The committee's responsibilities include evaluation of risk management systems.

Section 92: Governs the preparation and filing of annual returns, which are distinct from the annual report but form part of the broader corporate disclosure framework.

2. SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015

SEBI's LODR Regulations establish disclosure and corporate governance requirements for listed entities.

Important provisions include:

Regulation 17: Establishes requirements concerning the board of directors and corporate governance.

Regulation 21: Addresses the Risk Management Committee for specified listed entities.

Regulation 23: Regulates related-party transactions.

Regulation 30: Requires disclosure of material events and information to stock exchanges.

Material cybersecurity incidents may require disclosure under Regulation 30, subject to applicable materiality requirements and SEBI's prescribed disclosure framework.

Regulation 34: Requires listed entities to submit an annual report containing prescribed information.

The annual report should be read together with applicable SEBI disclosure circulars and other relevant securities requirements.

3. SEBI Circular on Cybersecurity and Cyber Resilience Framework, 2024

SEBI issued its Cybersecurity and Cyber Resilience Framework (CSCRF) for regulated entities on 20 August 2024, with subsequent clarifications and implementation-related changes.

The framework addresses cybersecurity governance, risk management, incident reporting, security controls, resilience, and compliance for entities within its scope.

It is relevant to annual reporting because regulated entities need to maintain appropriate governance and risk management arrangements and comply with applicable reporting requirements.

4. Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023, establishes obligations concerning the processing and protection of digital personal data.

Section 8: Establishes obligations of data fiduciaries, including responsibility for appropriate technical and organisational measures and reasonable security safeguards.

A material personal data breach may create statutory reporting and accountability obligations under the applicable provisions and rules.

Companies should ensure that their annual reporting accurately reflects material data protection risks without treating annual disclosure as a substitute for mandatory breach notifications.

5. CERT-In Directions, 2022

The Indian Computer Emergency Response Team issued directions on 28 April 2022 under Section 70B of the Information Technology Act, 2000.

The directions address specified cybersecurity incident reporting, log retention, time synchronisation, and other security requirements.

Applicable entities must report specified cybersecurity incidents within six hours of noticing them or being informed of them.

These requirements should be integrated into corporate incident response and reporting procedures.

Major categories of cyber risks requiring disclosure

1. Data breaches

Data breaches involve unauthorised access, disclosure, alteration, or extraction of sensitive organisational information.

Companies may need to evaluate whether such incidents create material financial, legal, operational, or reputational consequences.

2. Ransomware attacks

Ransomware attacks can interrupt business operations and affect access to essential databases.

Annual reports may explain the material operational impact, financial consequences, and recovery arrangements where disclosure is required.

3. Third-party and supply-chain risks

Companies frequently depend on cloud providers, software vendors, payment processors, and external service providers.

Security failures involving these providers may create significant risks for the reporting organisation.

4. Critical infrastructure vulnerabilities

Organisations operating in electricity, telecommunications, healthcare, biotechnology, and transportation may face cyber risks capable of disrupting essential services.

Their annual reports should address material exposure and relevant continuity arrangements.

5. Artificial intelligence and automated systems

AI systems may introduce additional risks involving data integrity, algorithmic vulnerabilities, unauthorised access, and automated decision-making.

Companies should evaluate these risks as part of their wider technology governance framework.

Essential elements of annual report cyber risk disclosure

A meaningful cyber risk disclosure should address the following matters:

Cyber risk governance: Identify the board-level committee or management structure responsible for cybersecurity oversight.

Risk exposure: Explain significant cybersecurity threats affecting business operations.

Incident history: Provide relevant information about material cyber incidents, subject to applicable disclosure requirements.

Financial impact: Explain material financial consequences, including recovery expenses, business interruption, and regulatory exposure.

Security controls: Describe important information security and monitoring arrangements at an appropriate level.

Third-party risks: Explain significant dependencies on external technology providers.

Business continuity: Describe disaster recovery and operational resilience arrangements.

Regulatory compliance: Explain relevant cybersecurity and data protection compliance responsibilities.

Future risk management: Identify major planned improvements in cybersecurity governance.

Important case laws

The following judgments establish relevant legal principles concerning corporate disclosure, investor protection, privacy, and accountability. They do not directly create a standalone judicial doctrine specifically requiring cyber risk disclosure in annual reports.

1. Sahara India Real Estate Corporation Ltd. v. Securities and Exchange Board of India (2013)

Citation: (2013) 1 SCC 1.

The Supreme Court examined the obligations of companies raising funds from investors and the regulatory authority of SEBI.

The judgment recognised the importance of investor protection and the regulatory framework governing securities markets.

It emphasised that companies cannot avoid statutory disclosure and regulatory obligations by relying on the form or structure of their transactions.

Relevance to cyber risk disclosure:

The judgment supports the broader principle that corporate transparency and investor protection are essential components of securities regulation.

Where cybersecurity incidents materially affect a company's financial position or business operations, applicable disclosure requirements should be followed so that investors are not deprived of important information.

2. N. Narayanan v. Adjudicating Officer, SEBI (2013)

Citation: (2013) 12 SCC 152.

The Supreme Court examined corporate governance failures involving false financial statements and misleading disclosures.

The judgment emphasised the importance of accurate financial reporting and the responsibility of company directors and management.

It recognised that misleading corporate disclosures can undermine investor confidence and market integrity.

Relevance to cyber risk disclosure:

Cybersecurity risks can materially affect financial statements, operational performance, and contingent liabilities.

If management deliberately conceals material cyber incidents or misrepresents their financial consequences, the conduct may raise similar concerns about the integrity of corporate reporting.

The judgment supports the principle that directors and corporate officers must ensure that material information is reported accurately.

3. Securities and Exchange Board of India v. Burren Energy India Ltd. (2010)

Citation: (2010) 3 SCC 765.

The Supreme Court considered issues concerning securities regulation and the exercise of SEBI's statutory powers.

The decision forms part of the broader judicial framework recognising the importance of effective securities regulation and investor protection.

Relevance to cyber risk disclosure:

Cybersecurity disclosure forms part of the wider regulatory objective of ensuring fair and transparent capital markets.

Companies should therefore treat material cybersecurity incidents as potential corporate governance and securities compliance issues rather than exclusively internal technical matters.

4. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

Citation: (2017) 10 SCC 1.

A nine-judge bench of the Supreme Court unanimously recognised privacy as a fundamental right under the Constitution of India.

The judgment recognised informational privacy, personal autonomy, and dignity as important components of the right to privacy.

Relevance to cyber risk disclosure:

Companies holding personal information have responsibilities concerning its protection and appropriate use.

Cybersecurity failures involving customer, employee, or research participant information may raise privacy and data protection concerns.

The judgment provides an important constitutional foundation for responsible corporate data governance.

5. Shreya Singhal v. Union of India (2015)

Citation: (2015) 5 SCC 1.

The Supreme Court examined the constitutionality of Section 66A of the Information Technology Act, 2000, and struck it down for violating freedom of speech and expression.

The judgment also considered provisions concerning intermediary liability and online content regulation.

Relevance to cyber risk disclosure:

The decision demonstrates that digital governance and cybersecurity regulation must operate within constitutional limits.

Corporate cybersecurity policies should therefore protect information systems while respecting applicable constitutional and statutory rights.

Its relevance is primarily to the broader digital regulatory framework rather than annual reporting obligations.

6. Internet and Mobile Association of India v. Reserve Bank of India (2020)

Citation: (2020) 10 SCC 274.

The Supreme Court considered the RBI circular restricting regulated financial institutions from providing banking services connected with virtual currencies.

The Court held that the regulatory restriction was disproportionate in the circumstances and set it aside.

Relevance to cyber risk disclosure:

The judgment highlights the importance of proportionality when regulators impose technology-related obligations.

Cyber risk disclosure frameworks should provide meaningful transparency while maintaining a reasonable balance between regulatory objectives, business operations, and legitimate confidentiality requirements.

International regulatory frameworks

1. United States Securities and Exchange Commission (SEC) Cybersecurity Disclosure Rules, 2023

The SEC adopted cybersecurity disclosure requirements for public companies in July 2023.

The framework requires covered public companies to disclose material cybersecurity incidents on Form 8-K, generally within four business days after determining that an incident is material, subject to applicable national security and public safety provisions.

It also requires annual disclosures concerning cybersecurity risk management, strategy, and governance in Form 10-K.

These rules provide an important international example of integrating cybersecurity into securities disclosure obligations.

2. European Union NIS2 Directive

The NIS2 Directive strengthens cybersecurity risk management and incident-reporting requirements for entities within its scope.

It addresses management accountability, cybersecurity measures, and reporting of significant incidents.

Its framework demonstrates how cybersecurity governance can become an institutional responsibility rather than remaining limited to technical departments.

3. ISO/IEC 27001

ISO/IEC 27001 provides an internationally recognised information security management framework.

It supports the identification, assessment, treatment, and monitoring of information security risks.

Companies may refer to relevant certification and control arrangements in annual reports, provided their statements accurately reflect the organisation's actual security practices.

Challenges in cyber risk disclosure

Several difficulties affect the implementation of effective cyber risk reporting.

Materiality assessment: Companies may find it difficult to determine whether a cyber incident is sufficiently significant to require public disclosure.

Confidentiality concerns: Excessive disclosure of technical vulnerabilities may expose organisations to further cyberattacks.

Underreporting: Organisations may hesitate to disclose incidents because of reputational or financial concerns.

Third-party dependencies: Companies may lack complete visibility into cybersecurity weaknesses within their supply chains.

Rapid technological changes: Emerging threats involving AI, cloud computing, and interconnected systems make risk assessment increasingly complex.

Lack of uniform reporting standards: Different industries and jurisdictions may impose different disclosure requirements, making comparison difficult.

Measures to strengthen cyber risk disclosure governance

Board-level supervision: Assign clear responsibility for cybersecurity oversight to the board and relevant committees.

Materiality assessment: Establish documented procedures for determining whether cyber incidents require disclosure.

Transparent reporting: Provide accurate information about material incidents and their business consequences.

Integrated risk management: Connect cybersecurity with financial, operational, legal, and strategic risk management.

Independent audits: Conduct regular cybersecurity assessments and evaluate the effectiveness of internal controls.

Incident reporting systems: Establish clear communication channels between IT departments, legal teams, compliance officers, and senior management.

Third-party risk management: Assess cybersecurity arrangements maintained by external service providers.

Annual review: Update cybersecurity disclosures to reflect emerging threats, significant incidents, and improvements in risk management.

Conclusion

Disclosure in annual reports on cyber risks is an increasingly important component of corporate governance, investor protection, and digital accountability. As organisations become dependent on interconnected information systems, cybersecurity incidents can affect financial performance, business continuity, customer privacy, and market confidence.

In India, the Companies Act, 2013, SEBI (LODR) Regulations, 2015, Digital Personal Data Protection Act, 2023, Information Technology Act, 2000, and applicable CERT-In Directions provide important legal and regulatory foundations for cybersecurity governance and disclosure.

The judgments in Sahara India Real Estate Corporation Ltd. v. SEBI, N. Narayanan v. SEBI, and K.S. Puttaswamy v. Union of India establish relevant principles concerning investor protection, accurate corporate reporting, and informational privacy.

Ultimately, cybersecurity disclosure is not merely a technical reporting exercise; it is an essential element of corporate transparency and institutional accountability. Companies must identify material cyber risks, communicate relevant information accurately, maintain effective security controls, and ensure that directors remain responsible for overseeing digital threats. A transparent annual reporting framework strengthens investor confidence, improves regulatory supervision, and promotes responsible corporate governance in an increasingly digital economy.