Corp Fin issues new statement and C&DIs on cybersecurity

On June 20, SEC Division of Corporation Finance (Corp Fin) Director Erik Gerding issued a statement regarding the SEC's July 2023 cybersecurity disclosure rule. The July 2023 rule requires disclosure of certain information about material cyber incidents in Item 1.05 (Material Cybersecurity Incidents) of Form 8-K. However, a company may elect to voluntarily disclose a cyber incident it has determined was not material or an incident for which it has not yet made a materiality determination.

The June statement reminds registrants that nothing in the new cyber disclosure rules prohibits the registrant from providing information to other parties about material cyber incidents beyond what is disclosed in Item 1.05 Form 8-K (Material Cybersecurity Incidents). However, registrants should consider the requirements of Regulation FD in connection with any such disclosures to private parties.

This statement follows a May Corp Fin statement that had encouraged companies voluntarily disclosing cyber incidents to make the disclosures under Item 8.01 (Other Events) of Form 8-K instead of Item 1.05. Then, if a company later concludes that the incident is material, it must file an Item 1.05 Form 8-K within four business days of that materiality determination. The May statement also reminded companies of the factors to consider in the materiality assessment.

In addition, on June 24, Corp Fin issued five new Compliance and Disclosure Interpretations (C&DIs) related to evaluating the materiality and Form 8-K reporting requirements of ransomware-related cybersecurity incidents.

For more on the disclosure rules, read SEC adopts cybersecurity disclosure rules. For more on the materiality assessment for cyber incidents, read Making materiality judgments in cybersecurity incident reporting.