Skip to main content

SEC’s New Cyber Incident Disclosure Requirements Will Go Into Effect in December

Kelly Ruane Melchiondo

Photo illustrating a cyber attackCome December 2023, public companies will have a very narrow window to report cybersecurity incidents that materially affect their companies. Companies will also have to report annually how they assess and manage cybersecurity threats at the Board and management levels. 

The Securities and Exchange Commission (SEC) voted on Wednesday, July 26, 2023, 3-2 along party lines, to adopt rules that require registrants to disclose on a new Item 1.05 of Form 8-K any “material” cybersecurity incidents, within four days after registrants determine any such incident to be material. Registrants must also disclose the nature, scope and timing of the incident, and its material or reasonably likely material impact on the registrant. Foreign private issuers must file Form 6-K to report material cybersecurity incidents.

The new four-day disclosure period may only be delayed if the United States Attorney General—not the registrant—believes that immediate disclosure would pose a substantial risk to national security or public safety. 

In addition to ad hoc disclosures of material incidents, starting in December, public companies will now also have to include yearly information on their 10-K annual reports about the processes by which they assess, identify and manage material risks from cybersecurity threats. Registrants’ yearly disclosures must also include the material, or reasonably likely material, effects that cybersecurity threats and incidents pose for those registrants. In their 10-K filings, registrants must also describe their board’s oversight of risks from cybersecurity threats, and their management’s role and expertise in assessing and managing material risks from cyber threats. Foreign private issuers must file Form 20-F to report annually their cybersecurity risk governance and management. 

The SEC touted the rules as beneficial for investors, companies and the market. Not everyone agrees. Business leaders and cybersecurity professionals alike are sounding the alarm over the four-day mandatory public disclosure period. Disclosure to the SEC within four days of determining “materiality” of a breach could tip off bad actors to vulnerable systems before those companies have the chance to fully address or patch the vulnerabilities. Worse yet, public disclosure to a bad actor otherwise unaware that it has been exposed may prompt the bad actor to take further catastrophic action to damage or destroy the company’s systems. 

While we wait to see whether the rules will bring about these doomsday scenarios, here are the deadlines that public companies must watch out for:

Form 10-K and 20-F annual disclosures will be due beginning with the companies’ annual reports for fiscal years ending on or after December 15, 2023. 

Form 8-K and 6-K disclosures will be due beginning the later of 90 days after the date of publication of the SEC’s adopting release in the Federal Register, or December 18, 2023. 

To download a PDF copy of the blog, click here.

Related Practices
Speaking Engagement May 22, 2024
Michael C. Larmoyeux, Jr. moderates "The Art of Real Estate Development: Strategies, Challenges, and Innovations" panel at Bisnow's South Florida Development and Construction event. The panel dives into the commercial real estate development process in South Florida, discussing strategic approaches,...
Blog May 17, 2024
The current housing crisis in Florida is well recognized. One promising solution is the use of surplus or under-utilized government-owned land for the development of new affordable housing. By leveraging their land holdings through ground leases with developers, governments can facilitate the expedi...
Speaking Engagement May 15, 2024
Ryan Coyle moderates the panel Cross-Jurisdictional Tax and Estate Planning Issues for Latin American Private Clients at Bilzin Sumberg's 7th Annual International Tax & Wealth Planning Conference. Practitioners from various jurisdictions in Latin America expound upon the chief tax and reporting ...