SEC Approves Transformative Cybersecurity Disclosure Requirements

Last week, the US Securities and Exchange Commission (SEC) voted 3-2 on a series of rules relating to cybersecurity disclosures, including a new requirement for public companies to publicly disclose "significant impacts" of cyber-attacks within four days. Public companies would be well-served to review the new requirements immediately to form a plan of action to address the newly approved rules.

The New Requirements – Current Reporting of Material Cybersecurity Incidents

Per the new requirements, public companies will have four business days to disclose a material cybersecurity incident with the SEC on Form 8-K. A material cybersecurity incident is any incident likely to have a "significant impact on the company's business, financial condition, or operations." Unlike other data breach notification requirements imposed at the federal or state level, this requirement sets the four-day notification window from determination of materiality, and not discovery of the