Darned If You Do, Darned If You Don't: Recent Lessons From The SEC On Cyber Reporting

The Security and Exchange Commission (SEC) Director of the Division of Corporate Finance, Erik Gerding, released a statement on May 21, 2024 that may have regulated entities scratching their heads about compliance and the agency's views on cyber incident reporting.

The statement addresses what he characterizes as the persistent filing of "voluntary" cyber incident disclosures by companies that have not determined their respective incident had a material impact on overall "financial condition and results of operations" of the company in accordance with a new SEC rule on cybersecurity incident reporting.¹ We previously wrote about the new rule after it was adopted in July 2023. The rule requires disclosure of a material cybersecurity incident within 4 business days on a registrant's Form 8-K at Item 1.05. Specifically, registrants are required to disclose any cybersecurity incident that is considered material and to describe the: (1) material aspects of its nature,