binarypublish
The U.S. Securities and Exchange Commission’s (SEC) new Form 8-K rules for disclosing substantial cybersecurity events came into effect on December 18, 2023. The regulation necessitates firms, apart from smaller reporting firms, to inform the SEC within four days after determining the materiality of the incident. Also, it adds to the intricacy of the incident response as the new Form 8-K demands set in.
- The Form 8-K disclosure can be delayed up to 30 days if the U.S. Attorney General issues written approval to the SEC, stating that immediate disclosure would significantly hamper national security or public safety.
- The disclosure deadline applies even if the Attorney General declines or doesn’t respond to a request for disclosure postponement on grounds of substantial risk to national security or public safety, prior to the Form 8-K is due.
- The disclosure must be done within four business days after the delay sanctioned by the Attorney General ends. Even if an additional delay period has been requested and if the Attorney General does not agree or doesn’t respond before the expiration of the existing delay period, the disclosure deadline applies.
- Even if the disclosure on Form 8-K is delayed up to 30 days as specified by the Attorney General, should they determine during the delay period that the disclosure no longer presents a substantial risk to national security or public safety, the disclosure should happen within four business days after the Attorney General informs this new determination.
- The fact that a registrant consults with the Department of Justice regarding the possibility of a delay under Item 1.05(c) does not necessarily imply that the incident is material and hence subject to the requirements of Item 1.05(a).
The article also emphasizes that the Department of Justice is expected to grant delays only under extraordinary circumstances and that public firms should not anticipate delays to be approved frequently. Therefore, it is recommended for public companies to incorporate the new Form 8-K requirement into their incident response plans to assure prompt compliance with the new rules.
