Debevoise & Plimpton LLP Security Incident

Capabilities Professionals Experience Insights & Publications News Careers About Us Pro Bono Alumni Locations Contact Us Search 2025 Debevoise & Plimpton LLP Back to Top SEC Releases New Guidance on Material Cybersecurity Incident Disclosure 27 June 2024 View the Debrief Share On June 24, 2024, the staff of the Division of Corporation Finance of the Securities and Exchange Commission (the SEC) released five new Compliance & Disclosure Interpretations (C&DIs) relating to the disclosure of material cybersecurity incidents under Item 1.05 of Form 8-K. A summary of the updates is below, followed by the full text of the new C&DIs. While the fact patterns underlying the new C&DIs focus on ransomware, issuers should consider the guidance generally in analyzing disclosure obligations for cybersecurity events. ITEM 1.05 OF FORM 8-K Completed ransomware attack does not absolve materiality determination : The cessation or apparent cessation of the incident prior to the materiality determination does not necessarily indicate that the incident was not material, and the registrant still needs to make a determination. If a registrant experiences a cybersecurity incident involving a ransomware attack and, prior to any materiality determination by the registrant, the registrant pays the ransom and the threat actor ends their disruption of operations and returns any exfiltrated data, the registrant must still make a determination regarding the incidents materiality. Completed material cybersecurity event must still be disclosed : A cybersecurity incident that a registrant determines to have had a material impact or that is reasonably likely to result in a material impact on the registrant must still be disclosed on a Form 8-K within four business days after the registrant makes a materiality determination, even if the cessation or apparent cessation of the incident occurs prior to the filing of the Form 8-K. Insurance coverage : When determining whether a cybersecurity incident...

... (truncated for display)