It's December 18, 2023: Do You Know Where Your Cybersecurity Disclosure Controls And Procedures Are

The requirement to disclose material cybersecurity events under new Item 1.05 of Form 8-K takes effect today (other than for smaller reporting companies, for which the new requirement will take effect on June 15, 2024).

While companies' disclosure controls and procedures regarding this new requirement will continue to evolve, and will differ from company to company based on the nature and extent of the evolving cybersecurity risks they face, below are a few key points to keep in mind:

• The trigger date under Item 1.05 of Form 8-K is the date on which the company determines that a cybersecurity incident is material, not the date the incident occurs or when the company first discovers the incident. In addition, as highlighted in a speech last week by Erik Gerding, the Director of the SEC's Division of Corporation Finance, and in a new SEC staff Compliance and Disclosure Interpretation, simply discussing an incident with the government or other third parties does