For most filers, the U.S. Securities and Exchange Commission’s (SEC) new Form 8-K rules for reporting material cybersecurity incidents took effect yesterday, December 18, 2023. The rule has been controversial and created some confusion, about which we have blogged before. We are helping clients adapt to the new rules, at the same time they face other new rules at multiple federal agencies.

The SEC’s now-effective breach reporting rule adds Item 1.05 to Form 8-K, which, subject to a narrow exception, generally requires that companies disclose material cybersecurity incidents within four business days of a company’s materiality determination and that a reporting company describe the material aspects of the nature, scope, timing, and material impact of the breach on the company. Smaller reporting companies will have an additional 180 days before they must begin providing the Form 8-K disclosure. There has already been one public 8-K filing under the new rule, which received commentary on social media for its discussion of the event and materiality.

The SEC’s breach reporting rules add to an already complicated cybersecurity landscape of federal and state regulations. As explained in more detail here, the SEC’s four-day disclosure requirement contains a narrow exception that permits the Department of Justice (DOJ) to grant a 30-day delay of a company’s 8-K disclosure for national security or public safety reasons. However, the DOJ’s guidance seems to indicate that it will grant such delays sparingly and in only the most extraordinary of circumstances. Thus, companies should review their incident response procedures and be prepared to disclose any material incidents within four business days.

[View source.]