SEC finalizes cybersecurity rules

Under new Item 1.05 of Form 8-K registrants must disclose information about a material cybersecurity incident within four business days after the registrant determines that the incident was material.

This information includes:

• A description of the material aspects of the nature, scope, and timing of the incident.
• The material impact or reasonably likely material impact on the registrant, including its financial condition and results of operations.

A registrant may delay providing the disclosures for an initial period of 30 days at the determination of the US Attorney General, if it is determined that the disclosures pose a substantial risk to national security or public safety. Additional requests for delay may be acceptable in certain circumstances. 

Updated incident disclosures on an amended Form 8-K are required for any new information about a previously disclosed material incident that was unavailable or undetermined at the time of the initial Form 8-K filing.

Risk management and strategy

Registrants must provide in their Form 10-K a description of their processes, if any, for assessing, identifying and managing material risks from cybersecurity threats, including whether:

• The described cybersecurity processes have been integrated into the registrant’s overall risk management system or processes, and how. 
  
• The registrant engages assessors, consultants, auditors or other third parties in connection with such processes. 
• The registrant has processes to oversee and identify material risks from cybersecurity threats associated with its use of any third-party service provider. 

Registrants must also describe whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the registrant – including its business strategy, results of operations, or financial condition and if so, how. 

Governance

The final rules require disclosures about the board of directors’ oversight of risks from cybersecurity threats and management’s role in assessing and managing material risks from cybersecurity threats. 

The final rules require registrants to report and disclose cybersecurity information in Inline XBRL format.  

Compliance with the structured data requirements is delayed for one year beyond initial compliance with the related disclosure requirement.  

In December 2023, the SEC staff issued four new C&DIs (Questions 104B.01 to 104B.04) to provide implementation guidance about the deadlines for allowable delays for a registrant to file its Form 8-K when the registrant has submitted a request for the Attorney General to authorize the deferral of the filing because disclosure of the incident would pose a substantial risk to national security or public safety.

The SEC staff also clarified that:

• consulting with the Attorney General about the possibility of a delay does not necessarily result in a determination that the incident was material; and
• registrants are not precluded from consulting with the Attorney General, or other law enforcement or national security agencies, at any point regarding an incident.