SEC Adopts Cybersecurity Disclosure Rules For Public Companies

On July 26, 2023, the U.S. Securities and Exchange Commission (SEC) adopted new disclosure rules relating to cybersecurity matters for public companies.

The new disclosure requirements include the following:

• A new trigger for Form 8-K filings. Under new Item 1.05 of Form 8-K, if there is any cybersecurity incident that a registrant experiences that is determined to be material, a Form 8-K must be filed describing the material aspects of: (1) the nature, scope and timing of the incident; and (2) impact or reasonably likely impact of the incident. Registrants must determine the materiality of an incident without unreasonable delay following discovery and, if the incident is determined material, file an Item 1.05 Form 8-K generally within four business days of such determination.