Navigating SEC Cybersecurity Disclosure Guidance For Public Companies

Last week the SEC's Division of Corporation Finance released compliance and disclosure interpretations (C&DIs) pertaining to the latest cybersecurity disclosure requirements. The C&DIs provide guidance on when public companies can postpone Form 8-K cyber incident disclosures for reasons related to national security or public policy.

Starting December 18, 2023, companies encountering a material cyber incident must disclose under Item 1.05(a) of Form 8-K, to the extent known at the time of filing, the material aspects of the nature, scope, and timing of the incident, and the incident's material impact or reasonably likely material impact on them, including their financial condition and results of operations. Importantly, smaller reporting companies will be required to comply with Item 1.05(a) of Form 8-K starting on June 15, 2024.