In the wake of the cyber attacks experienced by a number of large companies in recent months, including Citi, Google and Sony, the Securities and Exchange Commission's Division of Corporation Finance provided companies with guidelines last month for disclosing cyber risks and cyber attacks.

Companies should disclose cyber risks and cyber incidents if the information would be important to an investor's decision about the company, according to the guidance. It goes on to detail the various parts of SEC filings where such information might be included.

Alan Charles Raul, a partner who heads the privacy, data security and information law practice at Sidley Austin, says SEC rules already mandate that companies make such disclosures. "The legal requirements are the existing legal requirements," Raul says.