New SEC Cybersecurity Rules: A Tactical Guide for Companies

• Public companies must disclose material cybersecurity incidents on Form 8-K within four business days of deciding they are material.
• Annual reports must describe how the company assesses and manages cyber risk.
• Companies must also explain how the board oversees cybersecurity risk.
• The SEC says the goal is consistent, comparable information for investors.

What the SEC now requires

The U.S. Securities and Exchange Commission (SEC) adopted new cybersecurity disclosure rules in July 2023. They cover two things. One is telling investors quickly about serious incidents, and the other is explaining each year, in the annual report, how the company finds, weighs and manages cyber risk. Most public companies are affected.

Four business days to report a material incident

Under the rules, companies must disclose cybersecurity incidents they determine to be material within four business days after making that determination. The filing goes on Form 8-K under Item 1.05 and describes the nature, scope and timing of the incident and its likely impact. The rules do not require companies to publish details of unpatched vulnerabilities or every threat they see. The trigger is a material incident.

Determining materiality has to happen without unreasonable delay after the incident is discovered. A narrow exception allows delay if the U.S. Attorney General finds that disclosure would pose a substantial risk to national security or public safety.

Building a cyber risk management program

The annual part of the rules, Regulation S-K Item 106, asks companies to describe their processes for assessing, identifying and managing material cyber risks in the Form 10-K. That means showing how security fits into overall risk management, not just what happens after an attack.

In practice, a defensible program includes regular risk assessments, a tested incident response plan and oversight of third-party service providers, since the rules specifically ask whether companies use outside assessors and how they handle vendor risk.

The board’s role

Companies must also describe how the board of directors oversees cybersecurity risk, including which committee is responsible and how it is kept informed. They must describe management’s role too, including the expertise of the people who run security.

The rules do not require a cybersecurity expert on the board. Directors still need enough understanding to ask the right questions, because the company has to explain in writing how they do their oversight job.

What investors get out of it

The SEC’s stated goal is consistent, comparable and decision-useful information for investors. Before the rules, incident disclosure varied widely.

More disclosure may push companies to manage cyber risk more carefully, since weaknesses in the program now appear in public filings. Investors also get faster notice of serious incidents.

How to get ready

The rules create work for legal, finance and security teams. Companies that write down their materiality process, rehearse an incident filing and brief the board regularly will be in better shape when a real incident hits.

Start with the materiality decision. It sets the four-day clock running, and it is the step most companies have never practiced.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.