SEC's Cybersecurity Rules – SEC Issues Guidance And DOJ Establishes Processes For The National Security Or Public Safety Exception

Executive Summary

Our Securities and Privacy, Cyber & Data Strategy teams unpack the Department of Justice's (DOJ) process for companies seeking to delay Form 8-K disclosures under the Securities and Exchange Commission's (SEC) cybersecurity rules.

• The SEC requires companies to report material cybersecurity incidents within four days
• The DOJ (through the FBI) can grant delays of up to 30 days if disclosure threatens national security or public safety
• Because of the four-day deadline, companies should prepare their Forms 8-K anyway, in case their request is denied

As the new cybersecurity disclosure rules for public companies adopted by the Securities and Exchange Commission (SEC) took effect on December 18, 2023, the SEC Division of Corporation Finance, U.S. Department of Justice (DOJ), and Federal Bureau of Investigation (FBI) have released guidance intended to aid public companies as they comply with the rules. Under the recently adopted rules, public