The SEC Division of Corporate Financing has published what can be described as an advisory notice on the reporting of cybersecurity incidents under…

← Back to Blog

The SEC Division of Corporate Financing has published what can be described as an advisory notice on the reporting of cybersecurity incidents under the SECs cyber rule, effective 5th September 2023.

The ‘advisory’ relates to the reporting of cyber incidents under item 1.05 of Form 8-K. The message coveys to the need for covered entities to be careful about the cyber incident reporting, to be clear about the reporting of cyber incidents under 1.05 and the message that inappropriate reporting of cyber incidents coveys to financial markets. Item 1.05 is is used to disclose ‘Material Cyber Incidents’, once a determination of materiality has been made.

The SEC reaffirms the determination of whether a cybersecurity incident is material. When ‘assessing the incident’s impact (or reasonably likely impact), companies should assess all relevant factors. As the Commission noted in the Adopting Release, that assessment should not be limited to the impact on “financial condition and results of operation,” and “companies should consider qualitative factors alongside quantitative factors.” For example, companies should consider whether the incident will “harm . . . [its] reputation, customer or vendor relationships, or competitiveness.” Companies also should consider “the possibility of litigation or regulatory investigations or actions, including regulatory actions by state and Federal Governmental authorities and non-U.S. authorities.”’

@Thaddeus Dziekanowski Brian D. McCarthy

Veritas GRC U.S. Securities and Exchange Commission

#cybersecurity #cyberriskmanagement #cyberattack

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7198941630521823232