The SEC Proposes Cybersecurity Disclosure Rules! 4 Things to Know

Yesterday, the SEC proposed cybersecurity disclosure rules. Here's the 129-page proposing release - and here's the fact sheet. This proposal was much anticipated as it's no secret that cybersecurity incidents are one of the more serious types of risk that any company faces today. As highlighted in SEC Chair Gary Gensler's statement, the intent of the rules is to make disclosures regarding cybersecurity more "consistent, comparable, and decision-useful." Overall, the proposed rules are fairly prescriptive, consistent with other recent SEC proposals and a departure from the more principles-based focus of rulemaking under the prior SEC Chair. For cybersecurity topics, the specificity may be helpful to companies in determining how to craft disclosures. But, as noted in Commissioner Hester Peirce's dissenting statement, "the proposed rules pressure companies to consider adapting their existing policies and procedures to conform to the Commission's preferred approach." The comment period extends until the later of May 9th or 30 days after publication in the Federal Register. Here are four things to know about the proposal: 1. Form 8-K Disclosure of Cyber Incidents, With Materiality-Linked Trigger: The proposed rules include new Form 8-K Item 1.05, which would be triggered by a company's determination that it has experienced a material cybersecurity incident. Notably, like other Form 8-K items that rely on materiality determinations, the proposal provides that an untimely filing would not result in a loss of Form S-3 or Form SF-3 eligibility. By making the disclosure trigger dependent upon a company's determination that a material incident has occurred, the proposal provides needed flexibility in what can be a complicated process of assessing the effect of an incident. The proposal also places guardrails on this flexibility, including an instruction that "a registrant shall make a materiality determination regarding a cybersecurity incident as soon as reasonably practicable after discovery of the incident." But, in her comments during the open Commission meeting, Commissioner Allison Herren Lee called on commenters to provide insight on whether this flexibility makes the disclosure threshold too flexible. Similarly, the proposing release asks whether Form 8-K disclosure should be triggered by any cybersecurity incident. If the final rules were to require Form 8-K disclosure of all cybersecurity incidents, companies probably would face incredibly burdensome challenges in making meaningful and accurate disclosure in all cases, particularly considering the four-business day reporting requirement. This is one of more challenging areas for disclosure controls and materiality determinations. Companies on the one hand don't want to jump the gun and disclose a cybersecurity incident that makes it look more serious than it is. But they also should want to get disclosure about an incident out there as soon as possible - if it's material - to stave off any potential litigation. It's a tough road to navigate, particularly if the extent of an incident takes time to sleuth out accurately once the incident is detected.