The SEC's Cyber Disclosure Rules: Compliance Strategies And Pitfalls – A Litigator's Perspective

In an era of escalating cybersecurity threats and increasing investor scrutiny, the Securities and Exchange Commission's (SEC) cybersecurity disclosure rules—now in full effect for all public companies as of mid-2025—continue to reshape how companies assess, respond to, and disclose cyber risk. The final rule became effective on September 5, 2023,¹ with compliance requirements phased in: larger registrants became subject to the new reporting obligations on December 18, 2023,² while smaller reporting companies were granted an extension until June 15, 2024.³ Under the rule, companies must disclose material cybersecurity incidents within four business days of determining materiality (Item 1.05 of Form 8-K), and must also provide annual disclosures in Form 10-Ks describing their cybersecurity risk management, governance, and oversight practices.