SEC Adopts New Rule on Cybersecurity Incident Disclosure Requirements

This article originally appeared on Dark Reading.

The Securities and Exchange Commission (SEC) has adopted a rule "requiring registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance," according to an SEC statement released today.

"Whether a company loses a factory in a fire — or millions of files in a cybersecurity incident — it may be material to investors," said SEC chair Gary Gensler. "Currently, many public companies provide cybersecurity disclosure to investors. I think companies and investors alike, however, would benefit if this disclosure were made in a more consistent, comparable, and decision-useful way. Through helping to ensure that companies disclose material cybersecurity information, today's rules will benefit investors, companies, and the markets connecting them."

The rule itself noted that "under-disclosure regarding cybersecurity persists despite the Commission's prior guidance; investors need more timely and consistent cybersecurity disclosure to make informed investment decisions; and recent legislative and regulatory developments elsewhere in the Federal government, including those developments subsequent to the issuance of the Proposing Release such as CIRCIA and the Quantum Computing Cybersecurity Preparedness Act, while serving related purposes, will not effectuate the level of public cybersecurity disclosure needed by investors in public companies."

Related:Why Are IT Professionals Keeping Quiet About Data Breaches?

The new rule requires a Form 8-K to be filed within "four business days of determining an incident was material." However, the SEC, similar to the General Data Protection Regulation and US state data breach disclosure rules, does not clarify what constitutes an enterprise making that determination about an incident being material, and thus when the clock starts.

As to what makes an incident material, the SEC is defining it slightly differently than it has on other matters. Traditionally, material meant anything that is significant enough to likely move the stock price — so a $20 million loss might be material for a smaller company but not for a much larger one.

In the July 26 cybersecurity rule, the SEC took a slightly more aggressive stance. "Information is material if there is a substantial likelihood that a reasonable shareholder would consider it important in making an investment decision, or if it would have significantly altered the 'total mix' of information made available. Doubts as to the critical nature of the relevant information should be resolved in favor of those the statute is designed to protect, namely investors."

Related:How Third-party Risks Increase Data Breach Vulnerabilities

The SEC also excluded some specific details.

"This requirement would not extend to specific, technical information about the registrant's planned response to the incident or its cybersecurity systems, related networks and devices, or potential system vulnerabilities in such detail as would impede the registrant's response or remediation of the incident.