Federal Acquisition Regulatory Council

Dropping Item 407(j) left boards learning cyber risk from the people they supervise

The 2023 disclosure rules ask public companies to describe their cyber oversight without asking whether any director can judge it, and a 2025 field study finds that gap produces oversight that only looks like oversight.