SEC Security Incident

Last week, Erik Gerding, Director of the SECs Division of Corporation Finance (the Division), issued a statement [1] providing clarification regarding the disclosure of cybersecurity incidents by reporting companies. This follows the cybersecurity rules adopted on July 26, 2023 , which, among other things, require that material cybersecurity incidents be disclosed under Item 1.05 of Form 8-K (See our earlier Viewpoints advisory ). The SECs clarification also follows an initial flurry of voluntary disclosures of cybersecurity incidents under Item 1.05 of Form 8-K by reporting companies that did not appear to have made any determination related to the materiality of the reported incidents at the time of filing the Item 1.05 Form 8-K. Here are the key points from Erik Gerdings statement. For more detailed information, please refer to the full statement from Erik Gerding here . Mandatory Disclosure Upon Materiality Determination : According to the cybersecurity rules adopted on July 26, 2023, reporting companies are required to disclose material cybersecurity incidents under Item 1.05 of Form 8-K. This mandatory disclosure is triggered once the reporting company determines the incident is material. The Divisions clarification emphasizes that the required filing under the cybersecurity rules is not voluntary, in response to the noted Form 8-K filings by some reporting companies that seem to have been made in an abundance of caution. Key Takeaway: Voluntary Disclosuresof Non-Material Incidents : Item 1.05 of Form 8-K does not expressly prohibit voluntary disclosure of non-material cybersecurity incidents or incidents still under materiality assessment, as the SEC recognizes that such disclosures would provide value to investors and the market. Voluntary disclosure of non-material incidents or incidents where materiality has not yet been determined should be made under a different item of Form 8-K (for example, Item 8.01). This would help avoid investor confusion (a...

... (truncated for display)