5 Trends Under SEC's New Cybersecurity Incident Disclosure Rule

Since the Securities and Exchange Commission's Cybersecurity Incident Disclosure Rule (SEC Rule) took effect Dec. 18, 2023, about a dozen companies have filed a Form 8-K reporting a material cybersecurity incident. This GT Alert discusses the trends on how companies have made these disclosures thus far. In short, the companies who have filed an 8-K have erred on the side of caution, hedging on whether the materiality threshold has been met, reporting an incident early, and providing only high-level information about the incident.

Recap of the SEC Rule Disclosure Requirements

GT wrote a series of alerts and blogs on the SEC Rule and the obligations thereunder.² As a recap, the SEC Rule requires the following: