Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Washington, D.C.

On July 26 the SEC adopted final rules requiring certain cybersecurity-related disclosures, which were initially proposed in March 2022. The new rules are intended to “enhance and standardize disclosures regarding cybersecurity risk management, strategy, governance and incidents by public companies.”

contentpilot/introduction

As adopted, the final rules differ in a number of ways from the proposal; among other areas, the SEC narrowed the scope of the cybersecurity incident-related disclosures in Form 8-K; provided that updated incident disclosures are required to be included on an amended Form 8-K, rather than Form 10-Q or 10-K; did not adopt proposed rules requiring disclosures of directors’ cybersecurity expertise; and streamlined the proposed disclosure elements related to risk management. While many of these changes decreased the disclosure burdens compared to the proposed rules, many companies, particularly smaller reporting companies, may still find it costly and difficult to provide the required disclosures.

core/paragraph

The varying obligations within the final rule will enter into force on a rolling basis, with the earliest requirements starting on December 18, 2023. Importantly, the SEC noted that the cybersecurity and data breach reporting obligations set forth in its rule are intended to “serve[] a different purpose” than the cybersecurity and data breach requirements being proposed by <a href="https://admin.thompsonhine.com/wp-content/uploads/1137/doc/Law360_-_Preparing_For_New_Mandatory_Cyber_Reporting_Rules.pdf" target="_blank" rel="noreferrer noopener">the U.S. Department of Homeland Security</a> (DHS), and therefore the SEC’s rule is not contingent on similar rulemaking being undertaken by DHS (or others in the federal government). Accordingly, organizations that are impacted by the final rule should immediately start updating their compliance programs.

core/heading

Below is a summary chart provided by the SEC in the final release; see below under “New Disclosure Requirements” additional information regarding the new disclosures.

Regulation S-K Item 106(b) – Risk management and strategy

Registrants must describe their processes, if any, for the assessment, identification, and management of material risks from cybersecurity threats, and describe whether any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect their business strategy, results of operations, or financial condition.

Regulation S-K Item 106(c) – Governance

Registrants must describe (i) the board’s oversight of risks from cybersecurity threats, and (ii) management’s role in assessing and managing material risks from cybersecurity threats.

Form 8-K Item 1.05 – Material Cybersecurity Incidents

Registrants must disclose any cybersecurity incident they experience that is determined to be material, and describe the material aspects of its (i) nature, scope, and timing; and (ii) impact or reasonably likely impact. An Item 1.05 Form 8-K must be filed within four business days of determining an incident was material. A registrant may delay filing as described below, if the United States Attorney General (“Attorney General”) determines immediate disclosure would pose a substantial risk to national security or public safety. Registrants must amend a prior Item 1.05 Form 8-K to disclose any information called for in Item 1.05(a) that was not determined or was unavailable at the time of the initial Form 8-K filing.

Summary Description of Disclosure Requirement

core/table

Annual disclosures will be required for annual reports on Form 10-K for fiscal years ending on or after December 15, 2023, and the Form 8-K requirements will become effective by the later of 90 days following publication of the release in the Federal Register or December 18, 2023. (Smaller reporting companies have an additional six months to provide the Form 8-K disclosures.)

Companies should begin preparing to comply with the new SEC disclosure requirements, which may include:

core/list

Companies will now be required to file an “Item 1.05 Material Cybersecurity Incidents” Form 8-K to report any material “cybersecurity incidents,” which are defined as “an unauthorized occurrence, or a series of related unauthorized occurrences, on or conducted through a [company’s] information systems that jeopardizes the confidentiality, integrity or availability of a [company’s] information systems or any information residing therein.” Accordingly, the SEC adopted a very broad definition that may be implicated by a wide range of cybersecurity attacks, including from network intrusion, data exfiltration, and extortion incidents to ransomware events that prevent access and use of key infrastructure or data.

Disclosure requirements. The Form 8-K is required to include (i) a description of the material aspects of the nature, scope and timing of the incident and (ii) the material impact, or reasonably likely material impact, of the incident on the company, including its financial condition and results of operations. Companies should consider both qualitative and quantitative factors in assessing whether an incident’s impact is material, as “lack of quantifiable harm does not necessarily mean an incident is not material”; for example, harm to a company’s reputation, customer or vendor relationships, or competitiveness, or the possibility of litigation or regulatory investigations or actions may constitute material or reasonably likely material impacts. However, companies are not required to disclose specific or technical information about their planned incident response or their cybersecurity systems, related networks and devices, or potential system vulnerabilities in such detail as would impede their response to, or remediation of, the incident.

Another issue for companies to keep in mind is that cybersecurity incidents on a third-party system may trigger the required Form 8-K disclosure. According to the SEC rule, “[d]epending on the circumstances of an incident that occurs on a third-party system, disclosure may be required by both the service provider and the customer, or by one but not the other, or by neither.” While companies should ensure they maintain regular contact with their third-party providers, the new rules “generally do not require that [companies] conduct additional inquiries outside of their regular channels of communication with third-party service providers pursuant to those contracts and in accordance with [companies]’ disclosure controls and procedures.” It is important for companies to delineate within their service provider contracts the data incident roles and responsibilities between the companies and their providers, including any notification and liability obligations. In addition, companies may consider requiring their service providers to periodically (e.g., quarterly, biannually) certify to them that they have not been subject to a material data security incident during the reporting period.

Timing of disclosures. The Form 8-K is generally due within four business days of determining that a cybersecurity incident is material. Following discovery of an incident, companies are required to determine whether such incident is material “without unreasonable delay.” Although “without unreasonable delay” is not specifically defined, the SEC indicates that “a company being unable to determine the full extent of an incident because of the nature of the incident or the company’s systems, or otherwise the need for continued investigation regarding the incident, should not delay the company from determining materiality.” It also provides specific examples of what the SEC would consider an unreasonable delay, including <a>intentionally deferring </a>a board or committee meeting to determine materiality of an incident or revising existing policies or procedures to support delayed materiality determination or disclosure of the incident (e.g., extending incident severity assessment deadlines, changing the criteria that would require reporting an incident to internal management or committees).

In addition, if a company determines an incident is material, and information required by Item 1.05 is not determined or available at the time filing is required, the company must include a statement to that effect in its initial Form 8-K and file a Form 8-K/A disclosing such information within four business days after it determines such information or such information becomes available.

The Form 8-K filing may be delayed in certain specified instances, including when the U.S. Attorney General notifies the SEC in writing that it has determined that immediate disclosure would pose a substantial risk to national security or public safety and for companies complying with FCC rules regarding breaches of customer proprietary network information. The SEC expressly noted that it has established an <a>interagency communication </a>process with the Justice Department that is intended to allow for the U.S. Attorney General’s determination to be communicated to the SEC in a timely manner. These breach notification exceptions are especially narrow and generally do not align with broader exceptions in state data breach notification requirements that allow for delays in incident reporting when such reporting would interfere with or impede a federal, state, or local criminal investigation or would be inconsistent with the legitimate needs of law enforcement agencies. Any failure to timely report an incident under Item 1.05 will not affect a company’s eligibility to file a registration statement on Form S-3.

Effective date. Form 8-K Item 1.05 disclosure requirements will become effective as follows: (i) for non-smaller reporting companies, the later of 90 days following publication of the release in the Federal Register or December 18, 2023; and (ii) for smaller reporting companies, the later of 270 days following publication of the release in the Federal Register or June 15, 2024. All companies will be required to include iXBRL tags beginning on the later of 465 days following publication of the release in the Federal Register or December 18, 2024.

The SEC also adopted new Regulation S-K Item 106, which requires cybersecurity-related disclosures in companies’ annual reports on Forms 10-K under a new “Item 1C. Cybersecurity.”

Disclosure requirements. Under Item 106, companies will be required to describe, among other things:

Effective date. The Form 10-K Item 106 disclosure requirements will become effective for all companies beginning with annual reports on Form 10-K for fiscal years ending on or after December 15, 2023, or the 2023 Form 10-K for fiscal year-end companies. Companies will be required to include iXBRL tags beginning with annual reports for fiscal years ending on or after December 15, 2024, or the 2024 Form 10-K for fiscal year-end companies.

This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.

This document may be considered attorney advertising in some jurisdictions.

https://admin.thompsonhine.com/wp-content/uploads/2023/07/Securities-Law-Update-SEC-Finalizes-Rules-Requiring-Mandatory-Cybersecurity-Disclosure.pdf

SEC Finalizes Rules Requiring Mandatory Cybersecurity Disclosure

Services