In July 2023, the SEC implemented new rules mandating disclosures for both domestic and foreign companies regarding cybersecurity incidents, risk management, strategy, and governance. As part of these new rules, three Compliance and Disclosure Interpretations (C&DI) have been released, specifically addressing the Form 8-K reporting requirements and potential delays in reporting due to national security concerns.

KEY ASPECTS OF THE NEW CYBERSECURITY RULES

Form 8-K Item 1.05 Requirements:

• Companies must disclose material cybersecurity incidents, including details on the incident’s nature, scope, timing, and impact.
• This disclosure is required within four business days of determining that the incident is material.

Provisions for Delay:

• Disclosure can be delayed if the U.S. Attorney General notifies the SEC in writing that immediate disclosure would significantly risk national security or public safety.
• The delay period can be specified by the Attorney General or extend up to 30 days, with possible extensions up to 90 days in total under extraordinary circumstances.
• A company may also delay filing for up to seven business days following notification to the Secret Service and FBI if the incident involves a breach of customer proprietary network information.

NEW C&DI QUESTIONS AND ANSWERS

Question 104B.01:

• If the Attorney General declines or does not respond to a delay request, the company must file the Item 1.05 Form 8-K within four business days of determining the incident’s materiality.
• The filing obligation is only delayed if the Attorney General formally determines a risk to national security or public safety and notifies the SEC in writing.

Question 104B.02:

• If the Attorney General initially grants a delay but declines a subsequent request or does not respond before the current delay period ends, the company must file the Item 1.05 Form 8-K within four business days of the delay period's expiration.

Question 104B.03:

• If during an approved delay period, the Attorney General decides that the incident no longer poses a substantial risk and notifies the SEC and the company, the company must file the Item 1.05 Form 8-K within four business days of this notification.

These guidelines ensure that companies have clear directives on when and how to report material cybersecurity incidents, balancing transparency with national security considerations. For more details, you can refer to the Department of Justice's procedures on material cybersecurity incident delay determinations.