"For example, if a registrant experienced a material cyberattack in which malware was embedded in its systems and customer data was compromised, it likely would not be sufficient for the registrant to disclose that there is a risk that such an attack may occur." Instead, they would probably be required to reveal specifics of the incident, the SEC said.

The guidelines come in a year that has seen numerous high-profile hacking incidents, including a massive attack on Sony that forced it to take its PlayStation Network offline for more than a month.

The risk of cyberattacks has always been a potential disclosure issue, but the SEC guidance "really highlights the issue and brings it to the fore," according to David Navetta, a founding partner of Information Law Group, which provides legal services related to IT matters.

Even so, he wrote in , "materiality is still going to be a big issue, and not every breach will need to be reported as many/most will not likely involve the potential for a material impact to a company."

One interpretation of the guidelines is that "companies internally are going to have to more carefully forecast and estimate the impact of cyber incidents and the consequences of failing to implement adequate security," Navetta wrote.