SEC Clarifies Reporting Of Material vs. Immaterial Cybersecurity Incidents

The U.S. Securities and Exchange Commission's (SEC) Division of Corporate Finance (Division) published a  statement on May 21, 2024, regarding how public companies may disclose cyber incidents they determined to be immaterial. The Division's director said the statement was addressing confusion about reporting immaterial cyber incidents that arose after the SEC issued its  Cybersecurity Risk Management, Strategy, Governance and Incident Disclosure rule (Cyber Rule) in July 2023. The Cyber Rule, which we discussed in a  prior post, requires a public company to disclose a cyber incident that it determines was material in Item 1.05 of  Form 8-K. However, since the Cyber Rule was issued, numerous companies have disclosed cyber incidents they have determined to be immaterial  in Item 1.05, apparently as a potential hedge against SEC enforcement.