Disclosure Of Material And Other Cybersecurity Incidents

1. Introduction

Erik Gerding, Director of the Division of Corporation Finance at the US Securities and Exchange Commission ("SEC"), recently issued two guidance statements regarding Item 1.05 of Form 8-K. Adopted by the SEC last year, Item 1.05 requires public companies to disclose material cybersecurity incidents. Gerding's first statement, issued in May, focused on the voluntary disclosure of cybersecurity incidents in Form 8-K. The second statement in June addressed Regulation Fair Disclosure ("Regulation FD") considerations regarding the private sharing of additional information on cybersecurity incidents.

2. Key Details

First Statement (May 2024)

Only cybersecurity incidents that companies have determined to be material should be disclosed under Item 1.05 of Form 8-K. In addition, to avoid investor confusion or the dilution of the value of Item 1.05 disclosures, if a company wishes to disclose a cybersecurity incident that is not material or has not