SEC Staff Issues New Cybersecurity Interpretations

On June 24, 2024, the U.S. Securities and Exchange Commission's (SEC) Division of Corporation Finance issued five new Compliance and Disclosure Interpretations (104B.05-B.09) with respect to Item 1.05 of Form 8-K, summarized below.

• If after discovering a ransomware attack which results in a disruption in operations or exfiltration of data, but before determining whether the incident is material: (1) the registrant makes a ransomware payment and (2) the threat actor ends the disruption or returns the data, the registrant must still make a materiality determination regarding the incident and, if it determines the incident to be material, disclose it pursuant to Item 1.05 of Form 8-K. In assessing the materiality of the incident, the registrant should determine "if there is a substantial likelihood that a reasonable shareholder would consider it important in making an investment decision, or if it would have significantly altered the total mix of information