US Securities and Exchange Commission (SEC) Security Incident

JavaScript is turned off in your web browser. Turn it on to take full advantage of this site, then refresh the page. Close Skip to content Skip to main navigation Skip to footer Home > Our Thinking > Publications > SEC Adopts Rules on Mandatory Cybersecurity Disclosures Publications SUBSCRIBE LawFlash SEC Adopts Rules on Mandatory Cybersecurity Disclosures August 01, 2023 The US Securities and Exchange Commission (SEC) adopted on July 26, 2023 final rules and amendments for mandating disclosure regarding cybersecurity risk management, strategy, governance, and incident reporting, including amendments to Forms 8-K, 6-K, 10-K, and 20-F. Under the new framework, public companies must report certain details of a cybersecurity incident within four days of determining such an incident is material and provide certain expanded standardized cybersecurity-related disclosures and assessments in annual reports. Approved in a 3-2 vote, the new rules and amendments (the Final Rule) amend Regulation S-K, Regulation S-T, and certain provisions of the Securities Act of 1933, as amended (the Securities Act), and the Securities Exchange Act of 1934, as amended (the Exchange Act), by expanding and standardizing companies disclosures concerning cybersecurity risk management, strategy, governance, and incident reporting. Following the promulgation of more informal principles-based interpretative guidance by the SEC in recent years, the Final Rule formalizes the SECs efforts to address its concerns regarding information asymmetry and under-disclosure around the cause, scope, impact, and materiality of cybersecurity incidents. In summary, the Final Rule adds a new Item 1.05 to Form 8-K requiring disclosure of material cybersecurity incidents; and through revisions to Form 10-K and the addition of a new Item 106 to Regulation S-K, requires periodic disclosures regarding cybersecurity matters, namely the processes employed by a company to assess, identify, and manage cybersecurity risks;...

... (truncated for display)