DOJ Issues New Guidelines On National Security Exception For SEC Required Disclosure Of Material Cybersecurity Incidents

As detailed in our July 2023 GT Alert, the Securities and Exchange Commission (SEC) now requires public companies to file a Form 8-K and disclose a material cybersecurity incident within four days of determining the incident's materiality. Form 8-K Item 1.05(c) includes an exception to the four-day requirement: where disclosure poses a substantial risk to national security or public safety. Disclosure of certain incidents can be delayed if approved by the attorney general. On Dec. 12, 2023, the Department of Justice (DOJ) released guidelines explaining what will be considered a national security or public safety risk, the process for notifying the government of such a risk, the delays available, and the implementation of delays.