Alert

SEC Breach Reporting Rules Effective as of December 18

December 19, 2023

For most filers, the U.S. Securities and Exchange Commission’s (SEC) new Form 8-K rules for reporting material cybersecurity incidents took effect yesterday, December 18, 2023. The rule has been controversial and created some confusion, about which we have blogged before. We are helping clients adapt to the new rules, at the same time they face other new rules at multiple federal agencies. 

The SEC’s now-effective breach reporting rule adds Item 1.05 to Form 8-K, which, subject to a narrow exception, generally requires that companies disclose material cybersecurity incidents within four business days of a company’s materiality determination and that a reporting company describe the material aspects of the nature, scope, timing, and material impact of the breach on the company. Smaller reporting companies will have an additional 180 days before they must begin providing the Form 8-K disclosure. There has already been one public 8-K filing under the new rule, which received commentary on social media for its discussion of the event and materiality.

The SEC’s breach reporting rules add to an already complicated cybersecurity landscape of federal and state regulations. As explained in more detail here, the SEC’s four-day disclosure requirement contains a narrow exception that permits the Department of Justice (DOJ) to grant a 30-day delay of a company’s 8-K disclosure for national security or public safety reasons. However, the DOJ’s guidance seems to indicate that it will grant such delays sparingly and in only the most extraordinary of circumstances. Thus, companies should review their incident response procedures and be prepared to disclose any material incidents within four business days.

* * *

Wiley’s Privacy, Cyber & Data Governance team has helped companies of all sizes comply with their state and federal privacy and cyber obligations. Please reach out to Megan Brown (mbrown@wiley.law), Lyn Brown (lbrown@wiley.law), Tyler Bridegan (tbridegan@wiley.law), or Melissa Alba (malba@wiley.law) if you need any assistance with your compliance obligations.

Read Time: 2 min
Jump to top of page

Wiley Rein LLP Cookie Preference Center

Your Privacy

When you visit our website, we use cookies on your browser to collect information. The information collected might relate to you, your preferences, or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. For more information about how we use Cookies, please see our Privacy Policy.

Strictly Necessary Cookies

Always Active

Necessary cookies enable core functionality such as security, network management, and accessibility. These cookies may only be disabled by changing your browser settings, but this may affect how the website functions.

Functional Cookies

Always Active

Some functions of the site require remembering user choices, for example your cookie preference, or keyword search highlighting. These do not store any personal information.

Form Submissions

Always Active

When submitting your data, for example on a contact form or event registration, a cookie might be used to monitor the state of your submission across pages.

Performance Cookies

Performance cookies help us improve our website by collecting and reporting information on its usage. We access and process information from these cookies at an aggregate level.

Powered by Firmseek