SEC Adopts New Rules On Cybersecurity Disclosures For Public Companies

On July 26, 2023, the U.S. Securities and Exchange Commission (SEC) adopted cybersecurity rules requiring public companies to disclose:

• material cybersecurity incidents they experience on a current report on Form 8-K generally within four business days after the company determines the incident is material; and
• material information regarding their cybersecurity risk management, strategy, and governance in their annual report on Form 10-K each year.

Effective Date: The new Form 10-K disclosures will be required beginning with annual reports for fiscal years ending on or after December 15, 2023. Accordingly, companies with a calendar-year end will need to include the applicable disclosures in their upcoming Form 10-K for the year ending December 31, 2023. The new Form 8-K disclosures will be required beginning December 18, 2023, with some relief for smaller reporting companies, as discussed below.