Five Key Takeaways From The SEC's Final Cybersecurity Rules For Public Companies

On July 26, 2023, the SEC finalized long-awaited disclosure rules (the "Final Rules") regarding cybersecurity risk management, strategy, governance, and incidents by public companies that are subject to the reporting requirements of the Securities Exchange Act of 1934. While the end results are substantially similar to rules proposed by the SEC in March 2022, there are some key distinctions.

The top five takeaways are:

1. Disclosure of Cybersecurity Incidents within 4 Days of Materiality Determination. Public companies must now disclose in their Form 8-K Item 1.05 filings "any cybersecurity incident that they experience that is determined to be material" and describe "material aspects" of the reported incident, including a description of its nature, scope, timing, and impact on the company, within four business days of determining a cybersecurity incident is material.