SEC Disclosure Requirements For Material Cybersecurity Incidents Updated

The Securities and Exchange Commission ("SEC") has admonished companies to report material cybersecurity incidents in their public filings since 2011, but yesterday the SEC announced a new rule actually requiring disclosure of cybersecurity incidents and providing a standardized means and timeline for how and when companies should report such incidents.

Specifically, a new Item 1.05 of the 8-K will be required within four business days of when a registrant determines a cybersecurity incident has been material. Item 1.05 will require disclosure of "the material aspects of the incident's nature, scope, and timing, as well as its material impact or reasonably likely material impact on the registrant." In addition, registrants and foreign private issuers will be required to "describe their processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats, as well as the material effects or reasonably likely material effects of risks