SEC cyber disclosure rules

Who it applies to

Companies that file reports with the SEC, including foreign private issuers (through their own forms).

Key requirements

• Disclose material cybersecurity incidents on Form 8-K Item 1.05.
• Determine materiality without unreasonable delay after discovering an incident.
• Describe cybersecurity risk management and strategy annually (Form 10-K Item 106).
• Describe board oversight and management's role and expertise in cyber risk.

Breach and incident notification

Form 8-K within four business days after the company determines an incident is material, with a limited delay possible where the US Attorney General finds a substantial risk to national security or public safety.

Penalties

SEC enforcement for disclosure failures, including civil penalties.

Go deeper