Posted: April 25th, 2025

SEC Cybersecurity Rule

Answer the two questions below:

Why did the SEC issue this rule?
How did the SEC respond to comments on the rule proposal? Did the SEC do “too little” or “too much” or is the final rule “just right”? Justify your answer with appropriate evidence from the SEC rule.

Notes: Your answer can be between 300 to 1000 words. Be sure to check your answer for any spelling and grammar errors.

Find attached the material you need to complete the assignment, also if you need more information you can check the below website.

https://www.sec.gov/files/rules/final/2023/33-11216

Conformed to Federal Register version

SECURITIES AND EXCHANGE COMMISSION

17 CFR Parts 229, 232, 239, 240, and 249

[Release Nos. 33-11216; 34-97989; File No. S7-09-22]

RIN 3235-AM89

Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure

AGENCY: Securities and Exchange Commission.

ACTION: Final rule.

SUMMARY: The Securities and Exchange Commission (“Commission”) is adopting new rules

to enhance and standardize disclosures regarding cybersecurity risk management, strategy,

governance, and incidents by public companies that are subject to the reporting requirements of

the Securities Exchange Act of 1934. Specifically, we are adopting amendments to require

current disclosure about material cybersecurity incidents. We are also adopting rules requiring

periodic disclosures about a registrant’s processes to assess, identify, and manage material

cybersecurity risks, management’s role in assessing and managing material cybersecurity risks,

and the board of directors’ oversight of cybersecurity risks. Lastly, the final rules require the

cybersecurity disclosures to be presented in Inline eXtensible Business Reporting Language

(“Inline XBRL”).

DATES: Effective date: The amendments are effective September 5, 2023.

Compliance dates: See Section II.I (Compliance Dates).

FOR FURTHER INFORMATION CONTACT: Nabeel Cheema, Special Counsel, at (202)

551-3430, in the Office of Rulemaking, Division of Corporation Finance; and, with respect to the

application of the rules to business development companies, David Joire, Senior Special

Counsel, at (202) 551-6825 or IMOCC@sec.gov, Chief Counsel’s Office, Division of Investment

Management, U.S. Securities and Exchange Commission, 100 F Street NE, Washington, DC

20549.

SUPPLEMENTARY INFORMATION: We are adopting amendments to:

Commission Reference CFR Citation
(17 CFR)

Regulation S-K §§ 229.10 through 229.1305
Items 106 and 601 §§ 229.106 and 229.601
Regulation S-T §§ 232.10 through 232.903
Rule 405 § 232.405

Securities Act of 1933
(“Securities Act”)1

Form S-3 § 239.13

Securities Exchange Act of 1934
(“Exchange Act”)2

Rule 13a-11 § 240.13a-11

Rule 15d-11 § 240.15d-11
Form 20-F § 249.220f
Form 6-K § 249.306
Form 8-K § 249.308
Form 10-K § 249.310

1 15 U.S.C. 77a et seq.
2 15 U.S.C. 78a et seq.

Table of Contents

I. Introduction and Background ……………………………………………………………………………………. 5
II. Discussion of Final Amendments …………………………………………………………………………….. 13

A. Disclosure of Cybersecurity Incidents on Current Reports ……………………………………. 13
1. Proposed Amendments ……………………………………………………………………………………. 13
2. Comments ……………………………………………………………………………………………………… 16
3. Final Amendments ………………………………………………………………………………………….. 27

B. Disclosures about Cybersecurity Incidents in Periodic Reports ……………………………… 46
1. Proposed Amendments ……………………………………………………………………………………. 46
2. Comments ……………………………………………………………………………………………………… 48
3. Final Amendments ………………………………………………………………………………………….. 50

C. Disclosure of a Registrant’s Risk Management, Strategy and Governance Regarding
Cybersecurity Risks …………………………………………………………………………………………………… 53

1. Risk Management and Strategy ………………………………………………………………………… 53
a. Proposed Amendments ………………………………………………………………………………. 53
b. Comments ………………………………………………………………………………………………… 56
c. Final Amendments …………………………………………………………………………………….. 60

2. Governance ……………………………………………………………………………………………………. 65
a. Proposed Amendments ………………………………………………………………………………. 65
b. Comments ………………………………………………………………………………………………… 67
c. Final Amendments …………………………………………………………………………………….. 68

3. Definitions……………………………………………………………………………………………………… 71
a. Proposed Definitions ………………………………………………………………………………….. 71
b. Comments ………………………………………………………………………………………………… 72
c. Final Definitions ……………………………………………………………………………………….. 75

D. Disclosure Regarding the Board of Directors’ Cybersecurity Expertise ………………….. 81
1. Proposed Amendments ……………………………………………………………………………………. 81
2. Comments ……………………………………………………………………………………………………… 82
3. Final Amendments ………………………………………………………………………………………….. 85

E. Disclosure by Foreign Private Issuers…………………………………………………………………. 85
1. Proposed Amendments ……………………………………………………………………………………. 85
2. Comments ……………………………………………………………………………………………………… 86
3. Final Amendments ………………………………………………………………………………………….. 87

F. Structured Data Requirements …………………………………………………………………………… 88
1. Proposed Amendments ……………………………………………………………………………………. 88
2. Comments ……………………………………………………………………………………………………… 88
3. Final Amendments ………………………………………………………………………………………….. 88

G. Applicability to Certain Issuers …………………………………………………………………………. 89
1. Asset-Backed Issuers ………………………………………………………………………………………. 89
2. Smaller Reporting Companies ………………………………………………………………………….. 91

H. Need for New Rules and Commission Authority …………………………………………………. 93
I. Compliance Dates ………………………………………………………………………………………….. 107

III. OTHER MATTERS……………………………………………………………………………………………… 107
IV. ECONOMIC ANALYSIS …………………………………………………………………………………….. 108

A. Introduction …………………………………………………………………………………………………… 108

B. Economic Baseline…………………………………………………………………………………………. 112
1. Current Regulatory Framework ………………………………………………………………………. 112
2. Affected Parties …………………………………………………………………………………………….. 117

C. Benefits and Costs of the Final Rules ……………………………………………………………….. 118
1. Benefits ……………………………………………………………………………………………………….. 119

a. More Timely and Informative Disclosure……………………………………………………. 119
b. Greater Uniformity and Comparability ……………………………………………………….. 130

2. Costs ……………………………………………………………………………………………………………. 134
3. Indirect Economic Effects………………………………………………………………………………. 143

D. Effects on Efficiency, Competition, and Capital Formation …………………………………. 145
E. Reasonable Alternatives………………………………………………………………………………….. 146

1. Website Disclosure ……………………………………………………………………………………….. 146
2. Disclosure through Periodic Reports ……………………………………………………………….. 147
3. Exempt Smaller Reporting Companies …………………………………………………………….. 148

V. PAPERWORK REDUCTION ACT ……………………………………………………………………….. 150
A. Summary of the Collections of Information ………………………………………………………. 150
B. Summary of Comment Letters and Revisions to PRA Estimates ………………………….. 151
C. Effects of the Amendments on the Collections of Information …………………………….. 152
D. Incremental and Aggregate Burden and Cost Estimates for the Final Amendments .. 154

VI. FINAL REGULATORY FLEXIBILITY ANALYSIS ……………………………………………… 158
A. Need for, and Objectives of, the Final Amendments …………………………………………… 158
B. Significant Issues Raised by Public Comments ………………………………………………….. 158

1. Estimate of Affected Small Entities and Impact to Those Entities ……………………….. 160
2. Consideration of Alternatives …………………………………………………………………………. 162

C. Small Entities Subject to the Final Amendments ……………………………………………….. 165
D. Projected Reporting, Recordkeeping, and other Compliance Requirements …………… 165
E. Agency Action to Minimize Effect on Small Entities …………………………………………. 166

Statutory Authority ……………………………………………………………………………………………………… 169

I. Introduction and Background

On March 9, 2022, the Commission proposed new rules, and rule and form amendments,

to enhance and standardize disclosures regarding cybersecurity risk management, strategy,

governance, and cybersecurity incidents by public companies that are subject to the reporting

requirements of the Exchange Act.3 The proposal followed on interpretive guidance on the

application of existing disclosure requirements to cybersecurity risk and incidents that the

Commission and staff had issued in prior years.

In particular, in 2011, the Division of Corporation Finance issued interpretive guidance

providing the Division’s views concerning operating companies’ disclosure obligations relating

to cybersecurity (“2011 Staff Guidance”).4 In that guidance, the staff observed that “[a]lthough

no existing disclosure requirement explicitly refers to cybersecurity risks and cyber incidents, a

number of disclosure requirements may impose an obligation on registrants to disclose such risks

and incidents,” and further that “material information regarding cybersecurity risks and cyber

incidents is required to be disclosed when necessary in order to make other required disclosures,

in light of the circumstances under which they are made, not misleading.”5 The guidance pointed

specifically to disclosure obligations under 17 CFR 229.503 (Regulation S-K “Item 503(c)”)

(Risk factors) (since moved to 17 CFR 229.105 (Regulation S-K “Item 105”)), 17 CFR 229.303

(Regulation S-K “Item 303”) (Management’s discussion and analysis of financial condition and

results of operations), 17 CFR 229.101 (Regulation S-K “Item 101”) (Description of business),

17 CFR 229.103 (Regulation S-K “Item 103”) (Legal proceedings), and 17 CFR 229.307

3 See Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, Release No. 33-11038

(Mar. 9, 2022) [87 FR 16590 (Mar. 23, 2022)] (“Proposing Release”).
4 See CF Disclosure Guidance: Topic No. 2—Cybersecurity (Oct. 13, 2011), available at

https://www.sec.gov/divisions/corpfin/guidance/cfguidance-topic2.htm.
5 Id.

(Disclosure controls and procedures), as well as to Accounting Standards Codifications 350-40

(Internal-Use Software), 605-50 (Customer Payments and Incentives), 450-20 (Loss

Contingencies), 275-10 (Risks and Uncertainties), and 855-10 (Subsequent Events).6

In 2018, “[i]n light of the increasing significance of cybersecurity incidents,” the

Commission issued interpretive guidance to reinforce and expand upon the 2011 Staff Guidance

and also address the importance of cybersecurity policies and procedures, as well as the

application of insider trading prohibitions in the context of cybersecurity (“2018 Interpretive

Release”).7 In addition to discussing the provisions previously covered in the 2011 Staff

Guidance, the new guidance addressed 17 CFR 229.407 (Regulation S-K “Item 407”) (Corporate

Governance), 17 CFR Part 210 (“Regulation S-X”), and 17 CFR Part 243 (“Regulation FD”).8

The 2018 Interpretive Release noted that companies can provide current reports on Form 8-K

and Form 6-K to maintain the accuracy and completeness of effective shelf registration

statements, and it also advised companies to consider whether it may be appropriate to

implement restrictions on insider trading during the period following an incident and prior to

disclosure.9

As noted in the Proposing Release, current disclosure practices are varied. For example,

while some registrants do report material cybersecurity incidents, most typically on Form 10-K,

review of Form 8-K, Form 10-K, and Form 20-F filings by staff in the Division of Corporation

Finance has shown that companies provide different levels of specificity regarding the cause,

scope, impact, and materiality of cybersecurity incidents. Likewise, staff has also observed that,

6 Id.
7 See Commission Statement and Guidance on Public Company Cybersecurity Disclosures, Release No. 33-

10459 (Feb. 21, 2018) [83 FR 8166 (Feb. 26, 2018)], at 8167.
8 Id.
9 Id.

while the majority of registrants that are disclosing cybersecurity risks appear to be providing

such disclosures in the risk factor section of their annual reports on Form 10-K, the disclosures

are sometimes included with other unrelated disclosures, which makes it more difficult for

investors to locate, interpret, and analyze the information provided.10

In the Proposing Release, the Commission explained that a number of trends underpinned

investors’ and other capital markets participants’ need for more timely and reliable information

related to registrants’ cybersecurity than was produced following the 2011 Staff Guidance and

the 2018 Interpretive Release. First, an ever-increasing share of economic activity is dependent

on electronic systems, such that disruptions to those systems can have significant effects on

registrants and, in the case of large-scale attacks, systemic effects on the economy as a whole.11

Second, there has been a substantial rise in the prevalence of cybersecurity incidents, propelled

by several factors: the increase in remote work spurred by the COVID-19 pandemic; the

increasing reliance on third-party service providers for information technology services; and the

rapid monetization of cyberattacks facilitated by ransomware, black markets for stolen data, and

crypto-asset technology.12 Third, the costs and adverse consequences of cybersecurity incidents

to companies are increasing; such costs include business interruption, lost revenue, ransom

payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost

assets, litigation risks, and reputational damage.13

10 See infra Section IV.A (noting that current cybersecurity disclosures appear in varying sections of companies’

periodic and current reports and are sometimes included with other unrelated disclosures).
11 Proposing Release at 16591-16592. See also U.S. FINANCIAL STABILITY OVERSIGHT COUNCIL, ANNUAL

REPORT (2021), at 168, available at https://home.treasury.gov/system/files/261/FSOC2021AnnualReport
(finding that “a destabilizing cybersecurity incident could potentially threaten the stability of the U.S. financial
system”).

12 Proposing Release at 16591-16592.
13 Id.

Since publication of the Proposing Release, these trends have continued apace, with

significant cybersecurity incidents occurring across companies and industries. For example,

threat actors repeatedly and successfully executed attacks on high-profile companies across

multiple critical industries over the course of 2022 and the first quarter of 2023, causing the

Department of Homeland Security’s Cyber Safety Review Board to initiate multiple reviews.14

Likewise, state actors have perpetrated multiple high-profile attacks, and recent geopolitical

instability has elevated such threats.15 A recent study by two cybersecurity firms found that 98

percent of organizations use at least one third-party vendor that has experienced a breach in the

last two years.16 In addition, recent developments in artificial intelligence may exacerbate

cybersecurity threats, as researchers have shown that artificial intelligence systems can be

leveraged to create code used in cyberattacks, including by actors not versed in programming.17

Overall, evidence suggests companies may be underreporting cybersecurity incidents.18

14 See Department of Homeland Security, Cyber Safety Review Board to Conduct Second Review on Lapsus$

(Dec. 2, 2022), available at https://www.dhs.gov/news/2022/12/02/cyber-safety-review-board-conduct-second-
review-lapsus; see also Tim Starks, The Latest Mass Ransomware Attack Has Been Unfolding For Nearly Two
Months, WASH. POST (Mar. 27, 2023), available at https://www.washingtonpost.com/politics/2023/03/27/latest-
mass-ransomware-attack-has-been-unfolding-nearly-two-months/.

15 See, e.g., Press Release, Federal Bureau of Investigation, FBI Confirms Lazarus Group Cyber Actors
Responsible for Harmony’s Horizon Bridge Currency Theft (Jan. 23, 2023), available at
https://www.fbi.gov/news/press-releases/fbi-confirms-lazarus-group-cyber-actors-responsible-for-harmonys-
horizon-bridge-currency-theft; Alert (AA22-257A), Cybersecurity & Infrastructure Security Agency, Iranian
Islamic Revolutionary Guard Corps-Affiliated Cyber Actors Exploiting Vulnerabilities for Data Extortion and
Disk Encryption for Ransom Operations (Sep. 14, 2022), available at
https://www.cisa.gov/uscert/ncas/alerts/aa22-257a; National Security Agency et al., Joint Cybersecurity
Advisory: Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure (Apr. 20, 2022),
available at https://media.defense.gov/2022/Apr/20/2002980529/-1/-1/1/joint_csa_russian_state-
sponsored_and_criminal_cyber_threats_to_critical_infrastructure_20220420 .

16 SecurityScorecard, Cyentia Institute and SecurityScorecard Research Report: Close Encounters of the Third
(and Fourth) Party Kind (Feb 1, 2023), available at https://securityscorecard.com/research/cyentia-close-
encounters-of-the-third-and-fourth-party-kind/.

17 Check Point Research, OPWNAI: AI that Can Save the Day or Hack it Away (Dec. 19, 2022), available at
https://research.checkpoint.com/2022/opwnai-ai-that-can-save-the-day-or-hack-it-away.

18 Bitdefender, Whitepaper: Bitdefender 2023 Cybersecurity Assessment (Apr. 2023), available at
https://businessresources.bitdefender.com/bitdefender-2023-cybersecurity-assessment.

Legislatively, we note two significant developments occurred following publication of

the Proposing Release. First, the President signed into law the Cyber Incident Reporting for

Critical Infrastructure Act of 2022 (“CIRCIA”)19 on March 15, 2022, as part of the Consolidated

Appropriations Act of 2022.20 The centerpiece of CIRCIA is the reporting obligation placed on

companies in defined critical infrastructure sectors.21 Once rules are adopted by the

Cybersecurity & Infrastructure Security Agency (“CISA”), these companies will be required to

report covered cyber incidents to CISA within 72 hours of discovery, and report ransom

payments within 24 hours.22 Importantly, reports made to CISA pursuant to CIRCIA will remain

confidential; while the information contained therein may be shared across Federal agencies for

cybersecurity, investigatory, and law enforcement purposes, the information may not be

disclosed publicly, except in anonymized form.23 We note that CIRCIA also mandated the

creation of a “Cyber Incident Reporting Council . . . to coordinate, deconflict, and harmonize

Federal incident reporting requirements” (the “CIRC”), of which the Commission is a member.24

Second, on December 21, 2022, the President signed into law the Quantum Computing

Cybersecurity Preparedness Act, which directs the Federal Government to adopt technology that

is protected from decryption by quantum computing, a developing technology that may increase

19 Cyber Incident Reporting for Critical Infrastructure Act of 2022, Pub. L. No. 117-103, 136 Stat. 1038 (2022).
20 Consolidated Appropriations Act of 2022, H.R. 2471, 117th Cong. (2022).
21 The sectors are defined in Presidential Policy Directive / PPD-21, Critical Infrastructure Security and Resilience

(Feb. 12, 2013), as: Chemical; Commercial Facilities; Communications; Critical Manufacturing; Dams; Defense
Industrial Base; Emergency Services; Energy; Financial Services; Food and Agriculture; Government Facilities;
Healthcare and Public Health; Information Technology; Nuclear Reactors, Materials, and Waste; Transportation
Systems; Water and Wastewater Systems. Because these sectors encompass some private companies and do not
encompass all public companies, CIRCIA’s reach is both broader and narrower than the set of companies
subject to the rules we are adopting.

22 6 U.S.C. 681b(a)(1).
23 6 U.S.C. 681e. See infra Section II.A.3 for a discussion of why our final rules serve a different purpose and are

not at odds with the goals of CIRCIA.
24 6 U.S.C. 681f.

computer processing capacity considerably and thereby render existing computer encryption

vulnerable to decryption.25

We received over 150 comment letters in response to the Proposing Release.26 The

majority of comments focused on the proposed incident disclosure requirement, although we also

received substantial comment on the proposed risk management, strategy, governance, and board

expertise requirements. In addition, the Commission’s Investor Advisory Committee adopted

recommendations (“IAC Recommendation”) with respect to the proposal, stating that it: supports

the proposed incident disclosure requirement; supports the proposed risk management, strategy,

and governance disclosure requirements; recommends the Commission reconsider the proposed

board of directors’ cybersecurity expertise disclosure requirement; suggests requiring companies

to disclose the key factors they used to determine the materiality of a reported cybersecurity

25 Quantum Computing Cybersecurity Preparedness Act, H.R. 7535, 117th Cong. (2022). More recently, the

White House released a National Cybersecurity Strategy to combat the ongoing risks associated with
cyberattacks. The National Cybersecurity Strategy seeks to rebalance the responsibility for defending against
cyber threats toward companies instead of the general public, and looks to realign incentives to favor long-term
investments in cybersecurity. See Press Release, White House, FACT SHEET: Biden- ⁠Harris Administration
Announces National Cybersecurity Strategy (Mar. 2, 2023), available at https://www.whitehouse.gov/briefing-
room/statements-releases/2023/03/02/fact-sheet-biden-harris-administration-announces-national-
cybersecurity-strategy/.

26 The public comments we received are available at https://www.sec.gov/comments/s7-09-22/s70922.htm. On
Mar. 9, 2022, the Commission published the Proposing Release on its website. The comment period for the
Proposing Release was open for 60 days from issuance and publication on SEC.gov and ended on May 9, 2022.
One commenter asserted that the comment period was not sufficient and asked the Commission to extend it by
30 days. See letter from American Chemistry Council (“ACC”). In Oct. 2022, the Commission reopened the
comment period for the Proposing Release and other rulemakings because certain comments on the Proposing
Release and other rulemakings were potentially affected by a technological error in the Commission’s internet
comment form. See Resubmission of Comments and Reopening of Comment Periods for Several Rulemaking
Releases Due to a Technological Error in Receiving Certain Comments, Release No. 33-11117 (Oct. 7, 2022)
[87 FR 63016 (Oct. 18, 2022)] (“Reopening Release”). The Reopening Release was published on the
Commission’s website on Oct. 7, 2022 and in the Federal Register on Oct. 18, 2022, and the comment period
ended on Nov. 1, 2022. A few commenters asserted that the comment period for the reopened rulemakings was
not sufficient and asked the Commission to extend the comment period for those rulemakings. See, e.g., letters
from Attorneys General of the states of Montana et al. (Oct. 24, 2022) and U.S. Chamber of Commerce (Nov. 1,
2022). We have considered all comments received since Mar. 9, 2022 and do not believe an additional
extension of the comment period is necessary.

incident; and suggests extending the proposed 17 CFR 229.106 (Regulation S-K “Item 106”)

disclosure requirements to registration statements.27

We are making a number of important changes from the Proposing Release in response to

comments received. With respect to incident disclosure, we are narrowing the scope of

disclosure, adding a limited delay for disclosures that would pose a substantial risk to national

security or public safety, requiring certain updated incident disclosure on an amended Form 8-K

instead of Forms 10-Q and 10-K for domestic registrants, and on Form 6-K instead of Form 20-F

for foreign private issuers (“FPIs”),28 and omitting the proposed aggregation of immaterial

incidents for materiality analyses. We are streamlining the proposed disclosure elements related

to risk management, strategy, and governance, and we are not adopting the proposed requirement

to disclose board cybersecurity expertise. The following table summarizes the requirements we

are adopting, including changes from the Proposing Release, as described more fully in Section

II below:29

27 See U.S. Securities and Exchange Commission Investor Advisory Committee, Recommendation of the Investor

as Owner Subcommittee and Disclosure Subcommittee of the SEC Investor Advisory Committee Regarding
Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure (Sept. 21, 2022), available at
https://www.sec.gov/spotlight/investor-advisory-committee-2012/20220921-cybersecurity-disclosure-
recommendation . The Investor Advisory Committee also held a panel discussion on cybersecurity at its
Mar. 10, 2022 meeting. See U.S. Securities and Exchange Commission Investor Advisory Committee, Meeting
Agenda (Mar. 10, 2022), available at https://www.sec.gov/spotlight/investor-advisory-committee/iac031022-
agenda.htm.

28 An FPI is any foreign issuer other than a foreign government, except for an issuer that (1) has more than 50
percent of its outstanding voting securities held of record by U.S. residents; and (2) any of the following: (i) a
majority of its executive officers or directors are citizens or residents of the United States; (ii) more than 50
percent of its assets are located in the United States; or (iii) its business is principally administered in the United
States. 17 CFR 230.405. See also 17 CFR 240.3b-4(c).

29 The information in this table is not comprehensive and is intended only to highlight some of the more
significant aspects of the final amendments. It does not reflect all of the amendments or all of the rules and
forms that are affected by the final amendments, which are discussed in detail below. As such, this table should
be read together with the entire release, including the regulatory text.

Item Summary Description of the Disclosure Requirement30

Regulation S-K Item 106(b) –
Risk management and
strategy

Registrants must describe their processes, if any, for the
assessment, identification, and management of material risks
from cybersecurity threats, and describe whether any risks
from cybersecurity threats have materially affected or are
reasonably likely to materially affect their business strategy,
results of operations, or financial condition.

Regulation S-K Item 106(c) –
Governance

Registrants must:
– Describe the board’s oversight of risks from cybersecurity

threats.
– Describe management’s role in assessing and managing

material risks from cybersecurity threats.

Form 8-K Item 1.05 –
Material Cybersecurity
Incidents

Registrants must disclose any cybersecurity incident they
experience that is determined to be material, and describe the
material aspects of its:
– Nature, scope, and timing; and
– Impact or reasonably likely impact.

An Item 1.05 Form 8-K must be filed within four business
days of determining an incident was material. A registrant
may delay filing as described below, if the United States
Attorney General (“Attorney General”) determines immediate
disclosure would pose a substantial risk to national security or
public safety.

Registrants must amend a prior Item 1.05 Form 8-K to
disclose any information called for in Item 1.05(a) that was
not determined or was unavailable at the time of the initial
Form 8-K filing.

Form 20-F FPIs must:
– Describe the board’s oversight of risks from cybersecurity

threats.
– Describe management’s role in assessing and managing

material risks from cybersecurity threats.

Form 6-K FPIs must furnish on Form 6-K information on material
cybersecurity incidents that they disclose or otherwise

30 For purposes of this release, the terms “public companies,” “companies,” and “registrants” include issuers that

are business development companies as defined in section 2(a)(48) of the Investment Company Act of 1940,
which are a type of closed-end investment company that is not registered under the Investment Company Act,
but do not include investment companies registered under that Act.

publicize in a foreign jurisdiction, to any stock exchange, or to
security holders.

Overall, we remain persuaded that, as detailed in the Proposing Release: under-disclosure

regarding cybersecurity persists despite the Commission’s prior guidance; investors need more

timely and consistent cybersecurity disclosure to make informed investment decisions; and

recent legislative and regulatory developments elsewhere in the Federal Government, including

those developments subsequent to the issuance of the Proposing Release such as CIRCIA31 and

the Quantum Computing Cybersecurity Preparedness Act,32 while serving related purposes, will

not effectuate the level of public cybersecurity disclosure needed by investors in public

companies.

II. Discussion of Final Amendments

A. Disclosure of Cybersecurity Incidents on Current Reports

1. Proposed Amendments

The Commission proposed to amend Form 8-K by adding new Item 1.05 that would

require a registrant to disclose the following information regarding a material cybersecurity

incident, to the extent known at the time of filing:

• When the incident was discovered and whether it is ongoing;

• A brief description of the nature and scope of the incident;

• Whether any data were stolen, altered, accessed, or used for any other unauthorized

purpose;

• The effect of the incident on the registrant’s operations; and

31 Supra note 19.
32 Supra note 25.

• Whether the registrant has remediated or is currently remediating the incident.33

The Commission clarified in the Proposing Release that this requirement would not extend to

specific, technical information about the registrant’s planned response to the incident or its

cybersecurity systems, related networks and devices, or potential system vulnerabilities in such

detail as would impede the registrant’s response or remediation of the incident.34

The Commission proposed to set the filing trigger for Item 1.05 as the date the registrant

determines that a cybersecurity incident is material; as with all other Form 8-K items, the

proposed filing deadline would be four business days after the trigger.35 To protect against any

inclination on the part of a registrant to delay making a materiality determination with a view

toward prolonging the filing deadline, the Commission proposed adding Instruction 1 to Item

1.05 requiring that “a registrant shall make a materiality determination regarding a cybersecurity

incident as soon as reasonably practicable after discovery of the incident.”36

The Commission affirmed in the Proposing Release that the materiality standard

registrants should apply in evaluating whether a Form 8-K would be triggered under proposed

Item 1.05 would be consistent with that set out in the numerous cases addressing materiality in

the securities laws, including TSC Industries, Inc. v. Northway, Inc.,37 Basic, Inc. v. Levinson,38

and Matrixx Initiatives, Inc. v. Siracusano,39 and likewise with that set forth in 17 CFR 230.405

(“Securities Act Rule 405”) and 17 CFR 240.12b-2 (“Exchange Act Rule 12b-2”). That is,

33 Proposing Release at 16595.
34 Id.
35 Id.
36 Id. at 16596.
37 TSC Indus. v. Northway, 426 U.S. 438, 449 (1976).
38 Basic Inc. v. Levinson, 485 U.S. 224, 232 (1988).
39 Matrixx Initiatives v. Siracusano, 563 U.S. 27 (2011).

information is material if “there is a substantial likelihood that a reasonable shareholder would

consider it important”40 in making an investment decision, or if it would have “significantly

altered the ‘total mix’ of information made available.”41 “Doubts as to the critical nature” of the

relevant information should be “resolved in favor of those the statute is designed to protect,”

namely investors.42

The Commission explained that the timely disclosure of the information required by

proposed Item 1.05 would enable investors and other market participants to assess the possible

effects of a material cybersecurity incident on the registrant, including any short- and long-term

financial effects or operational effects, resulting in information useful for their investment

decisions.43 Aligning the deadline for Item 1.05 with that of the other Form 8-K items would, the

Commission maintained, significantly improve the timeliness of cybersecurity incident

disclosures as well as standardize those disclosures.44 The Commission did not propose to

provide a reporting delay in cases of ongoing internal or external investigations of cybersecurity

incidents.45 Nevertheless, the Proposing Release requested comment on whether to allow a delay

in reporting where the Attorney General determines that a delay is in the interest of national

security.46

40 TSC Indus., 426 U.S. at 449.
41 Id.
42 Id. at 448.
43 Proposing Release at 16595.
44 Id.
45 Id. at 16596.
46 Id. at 16598.

2. Comments

Proposed Item 1.05 received a significant amount of feedback from commenters. Some

commenters supported Item 1.05 as proposed,47 saying that the current level of disclosure on

cybersecurity incidents is inadequate to meet investor needs, and Item 1.05 would remedy this

inadequacy by effectuating the disclosure of decision-useful information.48 One commenter also

anticipated that Item 1.05 would reduce the risk of insider trading by shortening the time

between discovery of an incident and public disclosure.49

Other commenters opposed proposed Item 1.05, for several reasons. Some commenters

said that if proposed Item 1.05 were to result in disclosure while an incident is still ongoing, it

would tip off the threat actor and thus make successful neutralization of the incident more

difficult.50 Commenters also expressed concern that public notice of a vulnerability could draw

attacks from other threat actors who were previously unaware of the vulnerability; and such

attacks could target the disclosing registrant or other companies with the same vulnerability,

particularly if the vulnerability is with a third-party service provider used by multiple

47 See letters from American Institute of CPAs (“AICPA”); Better Markets (“Better Markets”);

BitSight Technologies, Inc. (“BitSight”); California Public Employees’ Retirement System (“CalPERS”);
Crindata, LLC (“Crindata”); Council of Institutional Investors (“CII”); Information Technology and Innovation
Foundation (“ITIF”); North American Securities Administrators Association Inc. (“NASAA”); Professor Jerry
Perullo (“Prof. Perullo”); Professor Preeti Choudhary (“Prof. Choudhary”); Tessa Mishoe (“T. Mishoe”). See
also IAC Recommendation.

48 Id.
49 See letter from Better Markets.
50 See letters from ACC; American Gas Association and Interstate Natural Gas Association of America

(“AGA/INGAA”); BioTechnology Innovation Organization (“BIO”); Bank Policy Institute, American Bankers
Association, and Mid-Size Bank Coalition of America (“BPI et al.”); BSA / The Software Alliance (“BSA”);
Business Roundtable (“Business Roundtable”); Canadian Bankers Association (“CBA”); Edison Electric
Institute (“EEI”); Energy Infrastructure Council (“EIC”); Federation of American Hospitals (“FAH”); Financial
Services Sector Coordinating Council (“FSSCC”); Information Technology Industry Council (“ITI”); LTSE
Services, Inc. (“LTSE”); National Association of Manufacturers (“NAM”); National Defense Industrial
Association (“NDIA”); Quest Diagnostics Incorporated (“Quest”); Rapid7, Inc. (“Rapid7”); Society for
Corporate Governance (“SCG”); Securities Industry and Financial Markets Association (“SIFMA”);
TransUnion; R Street Institute (“R Street”); U.S. Chamber of Commerce (“Chamber”).

companies.51 Some of these commenters objected specifically to the requirement in Item 1.05 to

disclose whether remediation has occurred, stating that this information could assist threat actors

in their targeting or invite further targeted attacks,52 while others more generally stated that the

Item 1.05 disclosure would be overly detailed, such that it would give a road map to threat actors

for planning attacks.53 One commenter argued that the prospect of possibly having to file an

Item 1.05 Form 8-K could chill threat information sharing within industries, because companies

would fear that any cybersecurity risk information they share could later be used to question their

disclosure decisions.54

Some of the commenters that disagreed with the level of disclosure required by proposed

Item 1.05 recommended that the Commission narrow the disclosure requirements of the rule.

For example, one such commenter advised dropping the proposed requirement to disclose “when

the incident was discovered,” arguing that this detail may cause confusion, particularly where an

incident was detected some time ago but a significant aspect rendering it material surfaced only

recently.55 Another commenter opined that “whether the registrant has remediated or is currently

remediating the incident” is duplicative of “whether it is ongoing,” so either of the two could be

51 See letters from ABA Committee on Federal Regulation of Securities (“ABA”); Aerospace Industries

Association of America (“AIA”); Alliance for Automotive Innovation (“Auto Innovators”); AGA/INGAA;
American Property Casualty Insurance Association (“APCIA”); BPI et al.; BSA; Business Roundtable; CBA;
Chamber; Cellular Telecommunications and Internet Assoc. (“CTIA”); Cybersecurity Coalition; EEI; EIC;
Empire State Realty Trust, Inc. (“Empire”); Enbridge Inc. (“Enbridge”); FSSCC; Internet Security Alliance;
ITI; Microsoft Corporation (“Microsoft”); NDIA; PPG Industries, Inc. (“PPG”); PricewaterhouseCoopers LLP
(“PWC”); Rapid7; R Street; SCG; SIFMA; U.S. Senator Rob Portman (“Sen. Portman”); Virtu Financial
(“Virtu”).

52 See letters from ABA; AGA/INGAA; BPI et al.; Cybersecurity Coalition; Empire; Enbridge; PWC; SIFMA;
SCG; Virtu.

53 See letters from AGA/INGAA; BSA; EIC; ITI; PPG.
54 See letter from Consumer Technology Association (“CTA”).
55 See letter from Prof. Perullo.

eliminated.56 One commenter contended that a materiality filter should be added to the details

required by Item 1.05, such that companies would have to disclose only details that themselves

are material, rather than immaterial details of a material incident.57

By contrast, there were also commenters that recommended expanding the disclosure

requirements in the proposed rule. In this regard, some commenters recommended requiring that

registrants disclose asset losses, intellectual property losses, and the value of business lost due to

the incident.58 Other suggestions included requiring that incidents be quantified as to their

severity and impact via standardized rating systems, and that registrants disclose how they

became aware of the incident, as this may shed light on the effectiveness of a company’s

cybersecurity policies and procedures.59 Additionally, commenters suggested banning trading by

insiders during the time between the materiality determination and disclosure of the incident.60

Commenters provided reactions to the application of Item 1.05 to incidents connected

with third-party systems. A number of commenters contended that registrants should be exempt

from having to disclose cybersecurity incidents in third-party systems they use because of their

reduced control over such systems.61 Similarly, several commenters advocated for a safe harbor

for information disclosed about third-party systems, given registrants’ reduced visibility into

such systems.62 A few commenters suggested a longer reporting timeframe for third-party

56 See letter from ABA.
57 See letter from ITI.
58 See letters from Profs. Rajgopal & Sharpe; PWC.
59 See letters from BitSight; Cloud Security Alliance (“CSA”).
60 See letter from Prof. Mitts.
61 See letters from ABA; AIA; APCIA; Business Roundtable; Cybersecurity Coalition; Chamber; EIC; FAH; ISA;

ITI; NAM; NDIA; National Multifamily Housing Council and National Apartment Association (“NMHC”);
Paylocity; SIFMA.

62 See letters from Chevron Corporation (“Chevron”); APCIA; BPI et al.; BIO; CSA; Financial Executive
International’s Committee on Corporate Reporting (“FEI”); ITI; ISA; NMHC; SIFMA.

incidents, because the registrant may be dependent on the third party for information (which may

not be provided in a timely manner), and to avoid harm to other companies reliant on the same

third party.63 Commenters also recommended that Item 1.05 be phased in over a longer period of

time with respect to third-party incidents, to give registrants time to develop information sharing

processes with their third-party service providers.64

Commenters also requested guidance or otherwise raised concerns where the proposed

requirements might trigger disclosures by third-party service providers. A commenter requested

clarity on whether an incident should be disclosed by the third-party service provider registrant

that owns the affected system or the customer registrant that owns the affected information, or

both.65 And two commenters argued that third-party service providers should simply pass along

information to their end customers, who would then make their own materiality determination

and disclose accordingly; this should particularly be the case, a commenter said, where an attack

on a third-party data center results in a data breach for an end customer but does not affect the

services the data center provides.66

The proposed timing of incident disclosure also received a significant level of public

comment. For example, a few commenters said the level of detail required by Item 1.05 is

impractical to produce in the allotted time.67 Other commenters said that the proposed deadline

would lead to the disclosure of tentative, unclear, or potentially inaccurate information that is not

63 See letters from ABA; R Street.
64 See letters from Business Roundtable; Deloitte & Touche LLP (“Deloitte”).
65 See letter from Business Roundtable.
66 See letters from BSA; ITI.
67 See letters from ABA; NMHC; Quest.

decision-useful to investors,68 resulting in the market mispricing the underlying securities.69

Commenters also argued that Item 1.05 is qualitatively different from all other Form 8-K items

in that the trigger for Item 1.05 is largely outside the company’s control.70 Some commenters

worried the proposed deadline would lead to disclosure of “false positives,” that is, incidents that

appear material at first but later on with the emergence of more information turn out not to be

material.71

Commenters suggested a range of alternative reporting deadlines for Item 1.05. A

common suggestion was to modify the measurement date from the determination of materiality

to another point in the lifecycle of the incident when the incident is no longer a threat to the

registrant—commenters variously termed this as “containment,” “remediation,” “mitigation,”

and comparable terms.72 One commenter recommended conditioning a reporting delay on the

registrant being actively engaged in containing the incident and reasonably believing that

containment can be completed in a timely manner.73 Similarly, several commenters

recommended that the rule allow for a delay in providing Item 1.05 disclosure based on a

registrant’s assessment of the potential negative consequences of public disclosure, using a

68 See letters from ABA; ACC; AIA; Auto Innovators; American Investment Council (“AIC”); BIO; Business

Roundtable; CBA; Chamber; Confidentiality Coalition; CTIA; Davis Polk & Wardwell LLP (“Davis Polk”);
Debevoise & Plimpton (“Debevoise”); Federated Hermes; FSSCC; Microsoft; NAM; Nasdaq Stock Market,
LLC (“Nasdaq”); NDIA; Quest; SCG; TransUnion; Wilson Sonsini Goodrich & Rosati (“Wilson Sonsini”);
Virtu.

69 See letters from ABA; ACC; AIA; AIC; BIO; BPI et al.; Business Roundtable; Confidentiality Coalition; Davis
Polk; ISA; Nasdaq; PPG; Quest; Rapid7; SCG; Sen. Portman; SIFMA; Virtu.

70 See letters from CTIA; Debevoise; EIC; LTSE; New York City Bar Association (“NYC Bar”); Quest.
71 See letters from LTSE; PPG; SCG.
72 See letters from American Council of Life Insurers (“ACLI”); BCE Inc., Rogers Communications Inc., TELUS

Corporation (“BCE”); BPI et al.; Business Roundtable; Chamber; CTA; Cybersecurity Coalition; Empire; FAH;
Federated Hermes; FSSCC; ISA; ITI; NAM; Nasdaq; NDIA; NMHC; NYSE Group (“NYSE”); Quest; Rapid7;
Sen. Portman; SCG; SIFMA; SM4RT Secure LLC (“SM4RT Secure”); TransUnion.

73 See letter from Rapid7.

variety of measures they suggested.74 Another suggestion was to replace the proposed deadline

with an instruction to disclose material incidents “without unreasonable delay.”75

Some commenters recommended instead increasing the number of days between the

reporting trigger and the reporting deadline. A few commenters recommended adding one

business day to make the deadline five business days;76 one noted this would result in every

registrant having at least a full calendar week to gather information and prepare the Form 8-K.77

Another commenter recommended a deadline of 15 business days, along with a cure period to

allow registrants a defined period of time to fix potential reporting mistakes.78 A few

commenters recommended a 30-day deadline,79 with their choice of 30 days tending to be a

proxy for some other factor, such as containment or remediation, 80 or state notification

requirements.81

74 See letters from BSA (suggesting a “tailored, balancing test”); EEI (advocating delay “to the extent… the

registrant in good faith concludes that its disclosure will expose it or others to ongoing or additional risks of a
cybersecurity incident”); EIC; Microsoft (requesting that companies be allowed to “manage the timing” of
disclosure “when compelling conditions exist such that premature disclosure would result in greater harm to the
company, its investors, or the national digital ecosystem”); Nareit and The Real Estate Roundtable (“Nareit”)
(stating delay should be permitted where disclosure “would exacerbate injury to the company and/or its
shareholders”); SIFMA (advocating a “‘responsible disclosure’ exception” that applies “where disclosure of a
cyber incident or vulnerability could have a more damaging effect than delayed disclosure”); Wilson Sonsini
(stating “the Commission should allow board members to decide to delay reporting if doing so could cause
material harm to the company”).

75 See letters from CTIA; National Restaurant Association (“NRA”).
76 See letters from AIC; Debevoise; NYC Bar.
77 See letter from AIC.
78 See letter from R Street.
79 See letters from APCIA; Hunton Andrews Kurth, LLP (“Hunton”); Rapid7.
80 See letters from APCIA (“[w]e believe that permitting a registrant to delay the filing for a short period of time

strikes an appropriate balance between timely disclosure to shareholders and an opportunity for a registrant to
achieve the best resolution for itself and its shareholders”); Rapid7 (“[i]n Rapid7’s experience, the vast majority
of incidents can be contained and mitigated within that time frame [30 days]”).

81 See letters from APCIA (“[a]llowing up to 30 days for disclosure would also bring the SEC’s proposal in line
with data breach disclosure requirements at the state level”); Hunton (“[w]hile state data breach notification
laws vary from state to state, 30 days from the cybersecurity incident is the earliest date any state requires that
notification to affected persons be made”).

Several commenters recommended addressing the timing concerns by replacing current

reporting on Form 8-K with periodic reporting on Forms 10-Q and 10-K, to allow additional time

to assess an incident’s impact before reporting to markets.82 In this vein, one commenter likened

cybersecurity incident disclosure to the disclosure of legal proceedings under Regulation S-K

Item 103.83

A few commenters recommended instead that the materiality trigger be replaced with a

quantifiable trigger; for example, an incident implicating a specified percentage of revenue, or

the costs of an incident exceeding a specified benchmark, could trigger disclosure.84 Other

commenters advocated for the disclosure trigger to be tied to any legal obligation that forces a

registrant to notify persons outside the company.85

Commenters also recommended a number of exceptions to the filing deadline. The most

common recommendation was to include a provision allowing for delayed filing where there is

an active law enforcement investigation or the disclosure otherwise implicates national security

or public safety.86 A representative comment in this vein advanced a provision whereby

registrants may “delay reporting of a cybersecurity incident that is the subject of a bona fide

82 See letters from ABA; Davis Polk; Debevoise; LTSE; NYC Bar; Quest; SCG.
83 See letter from Quest.
84 See letters from BIO; Bitsight; EIC; Paylocity.
85 See letters from ABA; Business Roundtable.
86 See letters from ABA; ACC; ACLI; AGA/INGAA; AIA; AICPA; APCIA; Auto Innovators; Rep. Banks; BPI et

al.; BIO; BSA; Business Roundtable; CBA; Chamber; Chevron; CII; CSA; CTA; CTIA; Cybersecurity
Coalition; Debevoise; EEI; EIC; Empire; Enbridge; FAH; FedEx Corporation (“FedEx”); FEI; FSSCC; Global
Privacy Alliance (“GPA”); Hunton; ISA; ITI; ITIF; Microsoft; NAM; Nareit; NASAA; NDIA; NMHC; NRA;
NYC Bar; Prof. Perullo; Sen. Portman; PPG; PWC; Quest; R Street; Profs. Rajgopal & Sharpe; Rapid7; SCG;
SIFMA; TransUnion; Virtu; USTelecom – The Broadband Association (“USTelecom”); U.S. Chamber of
Commerce & various associations (“Chamber et al.”).

investigation by law enforcement,” because such “delay in reporting may not only facilitate such

an investigation, it may be critical to its success.”87

In calling for a law enforcement delay, associations for industries in critical sectors

emphasized the national security implications of public cybersecurity incident disclosure. For

example, one association explained that disclosure “may alert malicious actors that we have

uncovered their illegal activities in circumstances where our defense and intelligence agencies

wish to keep that information secret.”88 Likewise, another association pointed out that, in its

industry, companies “are likely to possess some of the nation’s most critical confidential

information, including cybersecurity threat information furnished by government entities, such as

the Federal Bureau of Investigation (FBI), the Department of Homeland Security (DHS), and the

National Security Agency (NSA),” and therefore, disclosure may not be possible.89

Commenters largely advocated for “a broad law enforcement exception that applies not

only in the interest of national security but also when law enforcement believes disclosure will

hinder their efforts to identify or capture the threat actor.”90 Many commenters that responded to

the Commission’s request for comment regarding a provision whereby the Attorney General

determines that a delay is in the interest of national security indicated that such a provision

should be more expansive and extend to other law enforcement authorities.91 One of these

commenters questioned whether the Attorney General would opine on matters “that are under the

ambit of other Federal agencies, such as the Department of Homeland Security, Department of

87 See letter from Debevoise.
88 See letter from AIA.
89 See letter from EEI.
90 See letter from ABA.
91 See letters from BPI et al.; CBA; CSA; Hunton; ITIF; SCG; Wilson Sonsini.

State and the Department of Defense.”92 Another commenter pointed out that “the Department

of Justice is not the primary, or even the lead, organization in the Federal Government for

cybersecurity response, rather the Department of Homeland Security’s Cybersecurity and

Infrastructure Security Agency is often the first call that companies make,” while “[f]or defense

contractors, the Department of Defense is likely to have the highest interest in the timing of an

announcement.”93 For the financial industry specifically, one suggestion was to permit a delay if

the Federal Reserve, Federal Deposit Insurance Corporation, or Office of the Comptroller of the

Currency finds that disclosure would compromise the safety or soundness of the financial

institution or of the financial system as a whole.94

Some commenters specifically urged that state law enforcement be included within any

delay provision,95 and one commenter appeared to contemplate inclusion of foreign law

enforcement.96 A few commenters advocated for a confidential reporting system, whereby a

registrant would initially file a nonpublic report with the Commission while a law enforcement

investigation is ongoing, and then unseal the report upon the investigation’s completion.97

A number of commenters provided feedback regarding proposed Instruction 1, which

would have directed registrants to make their materiality determination regarding an incident “as

92 See letter from Hunton. This commenter also questioned whether law enforcement would be inclined to

provide a written determination, particularly within four business days, because in its experience with State data
breach laws, “the relevant state and federal law enforcement agencies seldom (if ever) provide written
instructions when the relevant exception comes into play.”

93 See letter from Wilson Sonsini.
94 See letter from BPI et al. Cf. letter from FSSCC.
95 See, e.g., letter from ITIF.
96 See letter from CBA (stating “the scope of the contemplated exemption is indefensibly narrow, particularly for

registrants with operations outside of the United States . . . there should be an exemption to permit delayed
disclosure upon the request of any competent national, state or local law enforcement authority”).

97 See letters from CSA; Hunton; SCG. See also letter from LTSE (positing the Regulation SCI disclosure
framework as a model for Item 1.05).

soon as reasonably practicable after discovery of the incident.” Several commenters

recommended removing the instruction altogether as, in their view, it would place unnecessary

pressure on companies to make premature determinations before they have sufficient

information.98 Other commenters stated that the instruction is too ambiguous for registrants to

ascertain whether they have complied with it.99 Conversely, one commenter advised the

Commission not to provide further guidance on the meaning of “as soon as reasonably

practicable,” explaining that doing so would interfere with each registrant’s individual

assessment of what is practicable given its specific context, resulting in pressure to move more

quickly than may be appropriate.100 Another commenter likewise found that “as soon as

reasonably practicable” is a “reasonable approach” that “provides public companies with the

appropriate degree of flexibility to conduct a thorough assessment while ensuring that the

markets get timely and relevant information.”101 One commenter recommended a safe harbor for

actions and determinations made in good faith to satisfy Instruction 1 that later turn out to be

mistaken.102

In response to a request for comment in the Proposing Release, several commenters

recommended registrants be permitted to furnish rather than file an Item 1.05 Form 8-K, so that

filers of an Item 1.05 Form 8-K would not be subject to liability under Section 18 of the

Exchange Act.103 A significant number of commenters also endorsed the proposal to amend 17

98 See letters from ABA; AGA/INGAA; Federated Hermes; ISA; Paylocity; Quest; SCG.
99 See letter from Center for Audit Quality (“CAQ”); CSA; Institute of Internal Auditors (“IIA”); LTSE; NYC

Bar.
100 See letter from Cybersecurity Coalition.
101 See letter from NASAA.
102 See letter from Nasdaq.
103 See letters from BPI et al.; Business Roundtable; Chevron; CSA; EEI; LTSE; NAM; SCG.

CFR 240.13a-11(c) (“Rule 13a-11(c)”) and 17 CFR 240.15d-11(c) (“Rule 15d-11(c)”) under the

Exchange Act to include Item 1.05 in the list of Form 8-K items eligible for a limited safe harbor

from liability under Section 10(b) or 17 CFR 240.10b-5 (“Rule 10b-5”) under the Exchange

Act.104 Likewise, the proposal to amend General Instruction I.A.3.(b) of Form S-3 and General

Instruction I.A.2 of Form SF-3 to provide that an untimely filing on Form 8-K regarding new

Item 1.05 would not result in loss of Form S-3 or Form SF-3 eligibility received much support.105

Finally, a number of commenters averred that Item 1.05 would conflict with other

Federal and state cybersecurity reporting or other regulatory regimes. For example, one

commenter stated Item 1.05 would counteract the goals of CIRCIA by requiring public

disclosure of information the act would keep confidential, and went on to assert that CIRCIA

was intended as the primary means for reporting incidents to the Federal Government.106 Also

related to CIRCIA, a number of commenters urged harmonization of the Commission’s proposal

with forthcoming regulations expected from CISA pursuant to CIRCIA.107 Several commenters

alleged Item 1.05 would conflict with rules the Department of Health and Human Services

(“HHS”) has adopted pursuant to the Health Insurance Portability and Accountability Act

(“HIPAA”) regarding the reporting of private health information breaches.108 A few commenters

likewise said Item 1.05 would conflict with the reporting regime set forth in Federal

Communications Commission (“FCC”) regulations for breaches of customer proprietary network

104 See letters from ABA; APCIA; BIO; Business Roundtable; Chevron; CTIA; Cybersecurity Coalition;

Debevoise; EEI; LTSE; NYC Bar; PWC; SCG.
105 See letters from ABA; APCIA; BIO; Business Roundtable; Chevron; CTIA; Cybersecurity Coalition;

Debevoise; EEI; LTSE; NYC Bar; PWC; SCG.
106 See letter from Sen. Portman.
107 See letters from ACC; ACLI; APCIA; BPI et al.; BIO; Confidentiality Coalition; Chamber; CTA; CTIA;

Cybersecurity Coalition; EIC; FEI; FSSCC; Insurance Coalition (“IC”); ISA; ITI; ITIF; Nareit; NAM; NRA; R
Street; SCG; SIFMA; USTelecom.

108 See letters from Chamber; Confidentiality Coalition; FAH; R Street.

information.109 Conflicts were also alleged with regulations and programs of the Department of

Defense (“DOD”),110 Department of Energy (“DOE”),111 and Department of Homeland Security

(“DHS”).112 Commenters called for harmonization of Item 1.05 with regulations issued by

Federal banking regulators,113 as well as with regulations of the Federal Trade Commission

(“FTC”).114 Some commenters noted the potential interaction between the proposed rules and

state laws.115 One commenter noted the McCarran-Ferguson Act, which provides that a state law

preempts a Federal statute if the state law was enacted for the purpose of regulating the business

of insurance and the Federal statute does not specifically relate to the business of insurance.116

3. Final Amendments

Having considered the comments, we remain convinced that investors need timely,

standardized disclosure regarding cybersecurity incidents materially affecting registrants’

businesses, and that the existing regulatory landscape is not yielding consistent and informative

disclosure of cybersecurity incidents from registrants.117 However, we are revising the proposal

109 See letters from Chamber; CTIA; USTelecom.
110 See letter from Chamber et al.
111 See letter from EEI.
112 See letter from ACC. This letter additionally alleged conflicts with regulations of the Department of Energy,

Transportation Security Agency, Department of Defense, and Environmental Protection Agency, but did not
explain specifically where those conflicts lie.

113 See letters from FSSCC; Structured Finance Association (“SFA”); SIFMA.
114 See letters from BIO; CTIA.
115 See letters from IC (noting “[a]n important issue will be to ensure harmonized regulation between the federal

government and the several states with proposed or preexisting cybersecurity regulations”); R Street (noting that
state privacy laws “mandate reporting of incidents across very different timelines”); SIFMA (noting that “many
state financial services and/or insurance regulators already require regulated entities certify cybersecurity
compliance”).

116 See letter from IC.
117 As the Commission has previously stated, markets rely on timely dissemination of information to accurately and

quickly value securities. Additional Form 8-K Disclosure Requirements and Acceleration of Filing Date,
Release No. 33-8400 (Mar. 16, 2004) [69 FR 15593 (Mar. 25, 2004)] (“Additional Form 8-K Disclosure
Release”). Congress recognized that the ongoing dissemination of accurate information by issuers about

in two important respects in response to concerns raised by commenters. First, we are narrowing

the amount of information required to be disclosed, to better balance investors’ needs and

registrants’ cybersecurity posture. And second, we are providing for a delay for disclosures that

would pose a substantial risk to national security or public safety, contingent on a written

notification by the Attorney General, who may take into consideration other Federal or other law

enforcement agencies’ findings.

As described above, commenters’ criticisms of Item 1.05 generally arose from two

aspects of the proposal: (1) the scope of disclosure; and (2) the timing of disclosure. With

respect to disclosure scope, we note in particular commenter concerns that the disclosure of

certain details required by proposed Item 1.05 could exacerbate security threats, both for the

registrants’ systems and for systems in the same industry or beyond, and could chill threat

information sharing within industries. We agree that a balancing of concerns consistent with our

statutory authority is necessary in crafting Item 1.05 to avoid empowering threat actors with

actionable information that could harm a registrant and its investors. However, we are not

persuaded, as some commenters suggested,118 that we should forgo requiring disclosure of the

existence of an incident while it is ongoing to avoid risks, such as the risk of tipping off threat

actors. Some companies already disclose material cybersecurity incidents while they are

ongoing and before they are fully remediated, but the timing, form, and substance of those

disclosures are inconsistent. Several commenters indicated both that investors look for

information regarding registrants’ cybersecurity incidents and that current disclosure levels are

themselves and their securities is essential to the effective operation of the markets, and specifically recognized
the importance of current reporting in this regard by requiring that “[e]ach issuer reporting under Section 13(a)
or 15(d) … disclose to the public on a rapid and current basis such additional information concerning material
changes in the financial condition or operations of the issuer … as the Commission determines … is necessary
or useful for the protection of investors and in the public interest.” 15 U.S.C. 78m(l).

118 See supra note 50.

inadequate to their needs in making investment decisions.119 In addition, we note below in

Section IV evidence showing that delayed reporting of cybersecurity incidents can result in

mispricing of securities, and that such mispricing can be exploited by threat actors, employees,

related third parties, and others through trades made before an incident becomes public.120

Accordingly, we believe it is necessary to adopt a requirement for uniform current reporting of

material cybersecurity incidents.

To that end, and to balance investors’ needs with the concerns raised by commenters, we

are streamlining Item 1.05 to focus the disclosure primarily on the impacts of a material

cybersecurity incident, rather than on requiring details regarding the incident itself. The final

rules will require the registrant to “describe the material aspects of the nature, scope, and timing

of the incident, and the material impact or reasonably likely material impact on the registrant,

including its financial condition and results of operations.” We believe this formulation more

precisely focuses the disclosure on what the company determines is the material impact of the

incident, which may vary from incident to incident. The rule’s inclusion of “financial condition

and results of operations” is not exclusive; companies should consider qualitative factors

alongside quantitative factors in assessing the material impact of an incident.121 By way of

illustration, harm to a company’s reputation, customer or vendor relationships, or

competitiveness may be examples of a material impact on the company. Similarly, the

possibility of litigation or regulatory investigations or actions, including regulatory actions by

119 See letters from Better Markets; CalPERS; CII.
120 See infra notes 413 and 462.
121 See also Proposing Release at 16596 (stating that “[a] materiality analysis is not a mechanical exercise” and not

solely quantitative, but rather should take into consideration “all relevant facts and circumstances surrounding
the cybersecurity incident, including both quantitative and qualitative factors”).

state and Federal Governmental authorities and non-U.S. authorities, may constitute a reasonably

likely material impact on the registrant.

We are not adopting, as proposed, a requirement for disclosure regarding the incident’s

remediation status, whether it is ongoing, and whether data were compromised. While some

incidents may still necessitate, for example, discussion of data theft, asset loss, intellectual

property loss, reputational damage, or business value loss, registrants will make those

determinations as part of their materiality analyses. Further, we are adding an Instruction 4 to

Item 1.05 to provide that a “registrant need not disclose specific or technical information about

its planned response to the incident or its cybersecurity systems, related networks and devices, or

potential system vulnerabilities in such detail as would impede the registrant’s response or

remediation of the incident.” While the Commission provided this assurance in the Proposing

Release,122 we agree with some commenters that codifying it in the Item 1.05 instructions should

provide added clarity to registrants on the type of disclosure required by Item 1.05.

With respect to commenters’ questions concerning the application of Item 1.05 to

incidents occurring on third-party systems, we are not exempting registrants from providing

disclosures regarding cybersecurity incidents on third-party systems they use, nor are we

providing a safe harbor for information disclosed about third-party systems. While we

appreciate the commenters’ concerns about a registrant’s reduced control over such systems, we

note the centrality of the materiality determination: whether an incident is material is not

contingent on where the relevant electronic systems reside or who owns them. In other words,

we do not believe a reasonable investor would view a significant breach of a registrant’s data as

immaterial merely because the data were housed on a third-party system, especially as

122 Id. at 16595.

companies increasingly rely on third-party cloud services that may place their data out of their

immediate control.123 Instead, as discussed above, materiality turns on how a reasonable investor

would consider the incident’s impact on the registrant.

Depending on the circumstances of an incident that occurs on a third-party system,

disclosure may be required by both the service provider and the customer, or by one but not the

other, or by neither. We appreciate that companies may have reduced visibility into third-party

systems; registrants should disclose based on the information available to them. The final rules

generally do not require that registrants conduct additional inquiries outside of their regular

channels of communication with third-party service providers pursuant to those contracts and in

accordance with registrants’ disclosure controls and procedures. This is consistent with the

Commission’s general rules regarding the disclosure of information that is difficult to obtain.124

Turning to disclosure timing, we believe that the modifications from the proposed rules

regarding the disclosures called for by Item 1.05 alleviate many of the concerns some

commenters had regarding the proposed disclosure deadline of four business days from the

materiality determination. Because the streamlined disclosure requirements we are adopting are

focused on an incident’s basic identifying details and its material impact or reasonably likely

material impact, the registrant should have the information required to be disclosed under this

rule as part of conducting the materiality determination. For example, most organizations’

materiality analyses will include consideration of the financial impact of a cybersecurity

123 See Deloitte, Global Third-Party Risk Management Survey 2022, at 15, available at

https://www2.deloitte.com/content/dam/Deloitte/uk/Documents/risk/deloitte-uk-global-tprm-survey-report-
2022 (discussing results of a global survey of 1,309 “senior leaders from a variety of organizations”
indicating that “73% of respondents currently have a moderate to high level of dependence on [cloud-service
providers]” and “[t]hat is expected to increase to 88% in the years ahead”).

124 See 17 CFR 230.409 and 17 CFR 240.12b-21, which provide that information need only be disclosed insofar as
it is known or reasonably available to the registrant. Accordingly, we are not providing additional time to
comply with Item 1.05 as it relates to third-party incidents, as requested by some commenters.

incident, so information regarding the incident’s impact on the registrant’s financial condition

and results of operations will likely have already been developed when Item 1.05 is triggered.125

Thus, we believe that the four business day timeframe from the date of a materiality

determination will be workable.

The reformulation of Item 1.05 also addresses the concern among commenters that the

disclosure may be tentative and unclear, resulting in false positives and mispricing in the market.

In the majority of cases, the registrant will likely be unable to determine materiality the same day

the incident is discovered. The registrant will develop information after discovery until it is

sufficient to facilitate a materiality analysis.126 At that point, we believe investors are best served

knowing, within four business days after the materiality determination, that the incident occurred

and what led management to conclude the incident is material. While it is possible that

occasionally there may be incidents that initially appear material but developments after the

filing of the Item 1.05 Form 8-K reveal to be not material, the alternative of delaying disclosure

beyond the four business day period after a materiality determination has the potential to lead to

far more mispricing and will negatively impact investors making investment and voting

decisions without the benefit of knowing that there is a material cybersecurity incident.

Commenters posited an array of alternative deadlines for the Item 1.05 Form 8-K, as

recounted above. We are not persuaded by commenters’ arguments that disclosure should be

delayed until companies mitigate, contain, remediate, or otherwise diminish the harm of the

incident, because, as discussed above, Item 1.05 does not require disclosure of the types of

125 To the extent any required information is not determined or is unavailable at the time of the required filing,

Instruction 2 to Item 1.05, as adopted, directs the registrant to include a statement to this effect in the Form 8-K
and then file a Form 8-K amendment containing such information within four business days after the registrant,
without unreasonable delay, determines such information or within four business days after such information
becomes available. See infra Section II.B.3.

126 As discussed below, registrants should develop such information without unreasonable delay.

details that have the potential to be exploited by threat actors, but rather focuses on the incident’s

material impact or reasonably likely material impact on the registrant. While there may be, as

commenters noted, some residual risk of the disclosure of an incident’s existence tipping off

threat actors, such risk is justified, in our view, by investors’ need for timely information, and

similar risk already exists today with some companies’ current cybersecurity incident disclosure

practices. We are also not persuaded that Item 1.05 is sufficiently different from other Form 8-K

items such that deviating from the form’s four business day deadline following the relevant

trigger would be indicated. While some commenters argued that Item 1.05 is qualitatively

different from all other Form 8-K filings in that its trigger is largely outside the company’s

control, we disagree because other Form 8-K items may also be triggered unexpectedly, such as

Item 4.01 (Changes in Registrant’s Certifying Accountants) and Item 5.02 (Departure of

Directors or Principal Officers). And as compared to those items, the information needed for

Item 1.05 may be further along in development when the filing is triggered, whereas, for

example, a company may have no advance warning that a principal officer is departing.

With respect to the five business day deadline suggested by a few commenters to allow

registrants a full calendar week from the materiality determination to the disclosure, we note that

in the majority of cases registrants will have had additional time leading up to the materiality

determination, such that disclosure becoming due less than a week after discovery should be

uncommon. More generally with respect to the various alternative timing suggestions, we

observe that the Commission adopted the uniform four business day deadline in 2004 to simplify

the previous bifurcated deadlines, and we find commenters have not offered any compelling

rationale to return to bifurcated deadlines.127 Form 8-K provides for current reporting of events

that tend to be material to investor decision-making, and we see no reason to render the reporting

of Item 1.05 less current than other Form 8-K items.

In the Proposing Release, the Commission requested comment on whether to allow

registrants to delay filing an Item 1.05 Form 8-K where the Attorney General determines that a

delay is in the interest of national security.128 In response to comments, we are adopting a delay

provision in cases where disclosure poses a substantial risk to national security or public safety.

Pursuant to Item 1.05(c), a registrant may delay making an Item 1.05 Form 8-K filing if the

Attorney General determines that the disclosure poses a substantial risk to national security or

public safety and notifies the Commission of such determination in writing.129 Initially,

disclosure may be delayed for a time period specified by the Attorney General, up to 30 days

following the date when the disclosure was otherwise required to be provided. The delay may be

extended for an additional period of up to 30 days if the Attorney General determines that

disclosure continues to pose a substantial risk to national security or public safety and notifies

the Commission of such determination in writing.

In extraordinary circumstances, disclosure may be delayed for a final additional period of

up to 60 days if the Attorney General determines that disclosure continues to pose a substantial

risk to national security and notifies the Commission of such determination in writing. We are

127 See Additional Form 8-K Disclosure Release. See also Proposed Rule: Additional Form 8-K Disclosure

Requirements and Acceleration of Filing Date, Release No. 33-8106 (June 17, 2002) [67 FR 42914 (June 25,
2002)].

128 Proposing Release at 16598.
129 We note that the delay provision we are adopting does not relieve a company’s obligations under Regulation FD

or with respect to the securities laws’ antifraud prohibitions that proscribe certain insider trading, including
Exchange Act Section 10(b). Under Regulation FD, material nonpublic information disclosed to any investor,
for example, through investor outreach activities, would be required to be disclosed publicly, subject to limited
exceptions. See 17 CFR 243.100 et seq.

providing for the final additional delay period in recognition that, in extraordinary circumstances,

national security concerns may justify additional delay beyond that warranted by public safety

concerns, due to the relatively more critical nature of national security concerns. Beyond the

final 60-day delay, if the Attorney General indicates that further delay is necessary, the

Commission will consider additional requests for delay and may grant such relief through

Commission exemptive order.130

We have consulted with the Department of Justice to establish an interagency

communication process to allow for the Attorney General’s determination to be communicated to

the Commission in a timely manner. The Department of Justice will notify the affected

registrant that communication to the Commission has been made, so that the registrant may delay

filing its Form 8-K.

We agree with commenters that a delay is appropriate for the limited instances in which

public disclosure of a cybersecurity incident may cause harm to national security or public

safety. The final rules appropriately balance such security concerns against investors’

informational needs. In particular, the provision’s “substantial risk to national security or public

safety” bases are sufficiently expansive to ensure that significant risks of harm from disclosure

may be protected against, while also ensuring that investors are not denied timely access to

material information.131 With respect to commenters who recommended that other Federal

130 Any exercise of exemptive authority in these circumstances would need to meet all of the standards of Section

36 of the Exchange Act. Furthermore, Item 1.05 of Form 8-K in no way limits the Commission’s general
exemptive authority under Section 36.

131 The delay provision for substantial risk to national security or public safety is separate from Exchange Act Rule
0-6, which provides for the omission of information that has been classified by an appropriate department or
agency of the Federal Government for the protection of the interest of national defense or foreign policy. If the
information a registrant would otherwise disclose on an Item 1.05 Form 8-K or pursuant to Item 106 of
Regulation S-K or Item 16K of Form 20-F is classified, the registrant should comply with Exchange Act Rule
0-6.

agencies and non-Federal law enforcement agencies also be permitted to trigger a delay or who

argued that other agencies may be the primary organization in the Federal Government for the

response, we note that the rule does not preclude any such agency from requesting that the

Attorney General determine that the disclosure poses a substantial risk to national security or

public safety and communicate that determination to the Commission. However, we believe that

designating a single law enforcement agency as the Commission’s point of contact on such

delays is critical to ensuring that the rule is administrable.

Turning to other timing-related issues raised by commenters, we are not adopting

commenters’ suggestion to replace Item 1.05 with periodic reporting of material cybersecurity

incidents on Forms 10-Q and 10-K because such an approach may result in significant variance

as to when investors learn of material cybersecurity incidents. Based on when an incident occurs

during a company’s reporting cycle, the timing between the materiality determination and

reporting on the next Form 10-Q or Form 10-K could vary from a matter of months to a matter of

weeks or less. For example, if two companies experience a similar cybersecurity incident, but

one determines the incident is material early during a quarterly period and the other makes such

determination at the end of the quarterly period, commenters’ suggested approach would have

both companies report the incident around the same time despite the first company having

determined the incident was material weeks or months sooner, which would result in a

significant delay in this information being provided to investors. Such variance would therefore

reduce comparability across registrants and may put certain registrants at a competitive

disadvantage.

We also decline to use a quantifiable trigger for Item 1.05 because some cybersecurity

incidents may be material yet not cross a particular financial threshold. We note above that the

material impact of an incident may encompass a range of harms, some quantitative and others

qualitative. A lack of quantifiable harm does not necessarily mean an incident is not material.

For example, an incident that results in significant reputational harm to a registrant may not be

readily quantifiable and therefore may not cross a particular quantitative threshold, but it should

nonetheless be reported if the reputational harm is material. Similarly, whereas a cybersecurity

incident that results in the theft of information may not be deemed material based on quantitative

financial measures alone, it may in fact be material given the impact to the registrant that results

from the scope or nature of harm to individuals, customers, or others, and therefore may need to

be disclosed.

In another change from the proposal, and to respond to commenters’ concerns that the

proposed “as soon as reasonably practicable” language in Instruction 1 could pressure companies

to draw conclusions about incidents with insufficient information, we are revising the instruction

to state that companies must make their materiality determinations “without unreasonable delay.”

As explained in the Proposing Release, the instruction was intended to address any concern that

some registrants may delay making such a determination to avoid a disclosure obligation.132 We

understand commenter concerns that the proposed instruction could result in undue pressure to

make a materiality determination before a registrant has sufficient information to do so, and we

recognize that a materiality determination necessitates an informed and deliberative process. We

believe the revised language should alleviate this unintended consequence, while providing

registrants notice that, though the determination need not be rushed prematurely, it also cannot

be unreasonably delayed in an effort to avoid timely disclosure. For example, for incidents that

132 Proposing Release at 16596.

impact key systems and information, such as those the company considers its “crown jewels,”133

as well as incidents involving unauthorized access to or exfiltration of large quantities of

particularly important data, a company may not have complete information about the incident but

may know enough about the incident to determine whether the incident was material. In other

words, a company being unable to determine the full extent of an incident because of the nature

of the incident or the company’s systems, or otherwise the need for continued investigation

regarding the incident, should not delay the company from determining materiality. Similarly, if

the materiality determination is to be made by a board committee, intentionally deferring the

committee’s meeting on the materiality determination past the normal time it takes to convene its

members would constitute unreasonable delay.134 As another example, if a company were to

revise existing incident response policies and procedures in order to support a delayed

materiality determination for or delayed disclosure of an ongoing cybersecurity event, such as by

extending the incident severity assessment deadlines, changing the criteria that would require

reporting an incident to management or committees with responsibility for public disclosures, or

introducing other steps to delay the determination or disclosure, that would constitute

unreasonable delay. In light of the revision to Instruction 1, we find that a safe harbor, as

suggested by some commenters, is unnecessary; adhering to normal internal practices and

disclosure controls and procedures will suffice to demonstrate good faith compliance.

Importantly, we remind registrants, as the Commission did in the Proposing Release, that

133 See National Cybersecurity Alliance, Identify Your “Crown Jewels” (July 1, 2022), available at

https://staysafeonline.org/cybersecurity-for-business/identify-your-crown-jewels/ (explaining that “[c]rown
jewels are the data without which your business would have difficulty operating and/or the information that
could be a high-value target for cybercriminals”).

134 We note that Form 8-K Item 1.05 does not specify whether the materiality determination should be performed
by the board, a board committee, or one or more officers. The company may establish a policy tasking one or
more persons to make the materiality determination. Companies should seek to provide those tasked with the
materiality determination information sufficient to make disclosure decisions.

“[d]oubts as to the critical nature” of the relevant information “will be commonplace” and should

“be resolved in favor of those the statute is designed to protect,” namely investors.135

Revised Instruction 1 should also reassure registrants that they should continue sharing

information with other companies or government actors about emerging threats. Such

information sharing may not necessarily result in an Item 1.05 disclosure obligation. The

obligation to file the Item 1.05 disclosure is triggered once a company has developed information

regarding an incident sufficient to make a materiality determination, and a decision to share

information with other companies or government actors does not in itself necessarily constitute a

determination of materiality. A registrant may alert similarly situated companies as well as

government actors immediately after discovering an incident and before determining materiality,

so long as it does not unreasonably delay its internal processes for determining materiality.

As proposed, we are adding Item 1.05 to the list of Form 8-K items in General Instruction

I.A.3.(b) of Form S-3 , so that the untimely filing of an Item 1.05 Form 8-K will not result in the

loss of Form S-3 eligibility.136 We note the significant support from commenters regarding this

proposal, and as noted in the Proposing Release, continue to believe that the consequences of the

loss of Form S-3 eligibility would be unduly severe given the circumstances that will surround

Item 1.05 disclosures. Likewise, as supported by many commenters, we are adopting as

proposed amendments to Rules 13a-11(c) and 15d-11(c) under the Exchange Act to include new

Item 1.05 in the list of Form 8-K items eligible for a limited safe harbor from liability under

Section 10(b) or Rule 10b-5 under the Exchange Act. This accords with the view the

135 Proposing Release at 16596 (quoting TSC Indus. v. Northway, 426 U.S. at 448). The Court’s opinion in TSC

Indus. has a nuanced discussion of the balance of considerations in setting a materiality standard. 426 U.S. at
448-450.

136 Because of our decision to exempt asset-backed issuers from the new rules (see infra Section II.G.1), we are not
amending Form SF-3.

Commission articulated in 2004 that the safe harbor is appropriate if the triggering event for the

Form 8-K requires management to make a rapid materiality determination.137

We decline to permit registrants to furnish rather than file the Item 1.05 Form 8-K, as

suggested by some commenters. While we understand commenters’ points that reducing liability

may ease the burden on registrants, we believe that treating Item 1.05 disclosures as filed will

help promote the accuracy and reliability of such disclosures for the benefit of investors. Of the

existing Form 8-K items, only Items 2.02 (Results of Operations and Financial Condition) and

7.01 (Regulation FD Disclosure) are permitted to be furnished rather than filed. The

Commission created exceptions for those two items to allay concerns that do not pertain here.

Specifically, with respect to Item 2.02, the Commission was motivated by concerns that

requiring the information to be filed would discourage registrants from proactively issuing

earnings releases and similar disclosures.138 Similarly, with respect to Item 7.01, the

Commission decided to allow the disclosure to be furnished to address concerns that, if required

to be filed, the disclosure could be construed as an admission of materiality, which might lead

some registrants to avoid making proactive disclosure.139 By contrast, Item 1.05 is not a

voluntary disclosure, and it is by definition material because it is not triggered until the registrant

determines the materiality of an incident. It is thus more akin to the Form 8-K items other than

Items 2.02 and 7.01, in that it is a description of a material event that has occurred about which

investors need adequate information. Therefore, the final rules require an Item 1.05 Form 8-K to

be filed.

137 Additional Form 8-K Disclosure Release at 15607.
138 See Conditions for Use of Non-GAAP Financial Measures, Release No. 33-8176 (Jan. 22, 2003) [68 FR 4819

(Jan. 30, 2003)].
139 See Selective Disclosure and Insider Trading, Release No. 33-7881 (Aug. 15, 2000) [65 FR 51715 (Aug. 24,

2000)].

We are not including a new rule to ban trading by insiders during the materiality

determination time period, as suggested by some commenters. Those with a fiduciary duty or

other relationship of trust and confidence are already prohibited from trading while in possession

of material, nonpublic information.140 And because we are adopting the four business days from

materiality determination deadline, we agree with the point raised by some commenters that the

risk of insider trading is low given the limited time period between experiencing a material

incident and public disclosure. We also note that we recently adopted amendments to 17 CFR

240.10b5-1 (“Rule 10b5-1”) that added a certification condition for directors and officers

wishing to avail themselves of the rule’s affirmative defense; specifically, if relying on the

amended affirmative defense, directors and officers need to certify in writing, at the time they

adopt the trading plan, that they are unaware of material nonpublic information about the issuer

or its securities, and are adopting the plan in good faith and not as part of a plan or scheme to

evade the insider trading prohibitions.141 Therefore, given the timing of the incident disclosure

requirement as well as the recently adopted amendments to Rule 10b5-1, we do not find need for

a new rule banning trading by insiders during the time period between the materiality

determination and disclosure.

A number of commenters raised concerns about conflicts with other Federal laws and

regulations. Of the Federal laws and regulations that we reviewed and commenters raised

concerns with, we have identified one conflict, with the FCC’s notification rule for breaches of

140 United States v. O’Hagan, 521 U.S. 642 (1997).
141 See Insider Trading Arrangements and Related Disclosures, Release No. 33-11138 (Dec. 14, 2022) [87 FR

80362 (Dec. 29, 2022)].

customer proprietary network information (“CPNI”).142 Of the remaining Federal laws and

regulations noted by commenters as presenting conflicts, our view is that Item 1.05 neither

directly conflicts with nor impedes the purposes of other such laws and regulations.

The FCC’s rule for notification in the event of breaches of CPNI requires covered entities

to notify the United States Secret Service (“USSS”) and the Federal Bureau of Investigation

(“FBI”) no later than seven business days after reasonable determination of a CPNI breach, and

further directs the entities to refrain from notifying customers or disclosing the breach publicly

until seven business days have passed following the notification to the USSS and FBI.143 To

accommodate registrants who are subject to this rule and may as a result face conflicting

disclosure timelines,144 we are adding paragraph (d) to Item 1.05 providing that such registrants

may delay making a Form 8-K disclosure up to the seven business day period following

notification to the USSS and FBI specified in the FCC rule, 145 with written notification to the

Commission.146

142 47 CFR 64.2011. CPNI is defined in 47 CFR 222(h)(1) as: “(A) information that relates to the quantity,

technical configuration, type, destination, location, and amount of use of a telecommunications service
subscribed to by any customer of a telecommunications carrier, and that is made available to the carrier by the
customer solely by virtue of the carrier-customer relationship; and (B) information contained in the bills
pertaining to telephone exchange service or telephone toll service received by a customer of a carrier; except
that such term does not include subscriber list information.”

143 We note that the FCC recently proposed amending its rule; among other things, the proposal would eliminate
the seven-business day waiting period, potentially eliminating the conflict. Federal Communications
Commission, Data Breach Reporting Requirements, 88 FR 3953 (Jan. 23, 2023).

144 Commission staff consulted with FCC staff about a potential delay provision to address any conflict between
the FCC rule and the Form 8-K reporting requirements.

145 The exception we are creating does not apply to 47 CFR 64.2011(b)(3), which provides that the USSS or FBI
may direct the entity to further delay notification to customers or public disclosure beyond seven business days
if such disclosure “would impede or compromise an ongoing or potential criminal investigation or national
security.” If the USSS or FBI believes that disclosure would result in a substantial risk to national security or
public safety, it may, as explained above, work with the Department of Justice to seek a delay of disclosure.

146 Such notice should be provided through correspondence on EDGAR no later than the date when the disclosure
required by Item 1.05 was otherwise required to be provided.

We also considered the conflicts commenters alleged with CIRCIA. Specifically, they

stated that Item 1.05 is at odds with the goals of CIRCIA, and that it may conflict with

forthcoming regulations from CISA. The confidential reporting system established by CIRCIA

serves a different purpose from Item 1.05 and through different means; the former focuses on

facilitating the Federal Government’s preparation for and rapid response to cybersecurity threats,

while the latter focuses on providing material information about public companies to investors in

a timely manner. While CISA has yet to propose regulations to implement CIRCIA, given the

statutory authority, text, and legislative history of CIRCIA, it appears unlikely the regulations

would affect the balance of material information available to investors about public companies,

because the reporting regime CIRCIA establishes is confidential.147 Nonetheless, the

Commission participates in interagency working groups on cybersecurity regulatory

implementation, and will continue to monitor developments in this area to determine if

modification to Item 1.05 becomes appropriate in light of future developments.148

We also considered the HIPAA-related conflict alleged by commenters, specifically with

respect to HHS’s rule on Notification in the Case of Breach of Unsecured Protected Health

Information. That rule provides, in the event of a breach of unsecured protected health

information, for the covered entity to provide notification to affected individuals “without

unreasonable delay and in no case later than 60 calendar days after discovery of a breach.”149 If

the breach involves more than 500 residents of a state or jurisdiction, the rule directs the covered

147 6 U.S.C. 681e.
148 Should a conflict arise in the future with CISA regulations or regulations of another Federal agency, the

Commission can address such conflict via rulemaking or other action at that time.
149 45 CFR 164.404(b). The notification must describe the breach, the types of unsecured protected health

information involved, steps the individuals should take to protect themselves, what the entity is doing to
mitigate harm and remediate, and where the individuals can seek additional information. Id.

entity to also notify prominent media outlets within the same timeframe.150 The rule further

provides that if a company receives written notice from “a law enforcement official” requesting a

delay and specifying the length of the delay, then the company “shall … delay such notification,

notice, or posting for the time period specified by the official.”151

We do not view Form 8-K Item 1.05 as implicated by the HHS rule. Importantly, the

HHS rule’s delay provision applies specifically to any “notification, notice, or posting required

under this subpart,” or in other words notice to affected individuals, media, and the Secretary of

HHS.152 Such notification focuses on the consequences of the breach for the affected individuals;

for example, individuals must be told what types of protected health information were accessed,

and what steps they should take to protect themselves from harm.153 This is different from the

disclosure required by Item 1.05, which focuses on the consequences for the company that are

material to investors, and whose timing is tied not to discovery but to a materiality

determination. The HHS rule does not expressly preclude the latter type of public disclosure, or

other potential communications companies experiencing a breach may make. Therefore, we

believe that a registrant subject to the HHS rule will not face a conflict in complying with Item

1.05.154

We also considered the conflicts commenters alleged with regulations and programs of

DOD, DOE, DHS, the Federal banking regulatory agencies, state insurance laws, and

miscellaneous other Federal agencies or laws. We find that, while there may be some overlap of

150 45 CFR 164.406.
151 45 CFR 164.412.
152 Id.
153 45 CFR 164.404(c).
154 For the same reason, the Federal Trade Commission’s Health Breach Notification rule, which is similar to

HHS’s rule, does not present a conflict either. See 16 CFR part 318.

subject matter, Item 1.05 neither conflicts with nor impedes the purpose of those regulations and

programs.155 We disagree with one commenter’s assertion that cybersecurity incident disclosure

“falls squarely within the jurisdiction of state insurance commissioners” as state cybersecurity

incident reporting regulations would not pertain to the “business of insurance” as courts have

interpreted the McCarran-Ferguson Act, and the commenter did not note any particular state

insurance laws that would present a conflict.156 With respect to Federal banking regulatory

agencies specifically, we note that, in the event they believe that the disclosure of a material

cybersecurity incident would threaten the health of the financial system in such a way that results

in a substantial risk to national security or public safety, they may, as explained above, work

with the Department of Justice to seek to delay disclosure.

It would not be practical to further harmonize Item 1.05 with other agencies’

cybersecurity incident reporting regulations, as one commenter suggested,157 because Item 1.05

serves a different purpose—it is focused on the needs of investors, rather than the needs of

regulatory agencies, affected individuals, or the like. With respect to state insurance and privacy

laws, commenters did not provide any evidence sufficient to alter the Commission’s finding in

the Proposing Release that, to the extent that Item 1.05 would require disclosure in a situation

where state law would excuse or delay notification, we consider prompt reporting of material

cybersecurity incidents to investors critical to investor protection and well-functioning, orderly,

and efficient markets.

155 For example, one commenter alleged conflicts with DHS’s Chemical Facilities Anti-Terrorism Standards

program (“CFATS”) and with the Maritime Transportation Security Act (“MTSA”). See letter from American
Chemistry Council. Both CFATS and MTSA provide for the protection of certain sensitive information, but
neither is implicated by cybersecurity incident disclosure to the Commission.

156 See, e.g., SEC v. National Sec., Inc., 393 U.S. 453 (1969).
157 See letter from BIO.

B. Disclosures about Cybersecurity Incidents in Periodic Reports

1. Proposed Amendments

The Commission proposed to add new Item 106 to Regulation S-K to, among other

things, require updated cybersecurity disclosure in periodic reports. If a registrant previously

provided disclosure regarding one or more cybersecurity incidents pursuant to Item 1.05 of Form

8-K, proposed 17 CFR 229.106(d)(1) (Regulation S-K “Item 106(d)(1)”) would require such

registrant to disclose “any material changes, additions, or updates” on the registrant’s quarterly

report on Form 10-Q or annual report on Form 10-K.158 In addition, proposed Item 106(d)(1)

would require disclosure of the following information:

• Any material effect of the incident on the registrant’s operations and financial

condition;

• Any potential material future impacts on the registrant’s operations and financial

condition;

• Whether the registrant has remediated or is currently remediating the incident; and

• Any changes in the registrant’s policies and procedures as a result of the

cybersecurity incident, and how the incident may have informed such changes.159

The Commission explained that it paired current reporting under Item 1.05 of Form 8-K

with periodic reporting under 17 CFR 229.106(d) (Regulation S-K “Item 106(d)”) to balance

investors’ need for timely disclosure with their need for complete disclosure.160 When an Item

1.05 Form 8-K becomes due, the Commission noted, a registrant may not possess complete

158 Proposing Release at 16598.
159 Id.
160 Id.

information about the material cybersecurity incident. Accordingly, under the proposed rules, a

registrant would provide the information known at the time of the Form 8-K filing and follow up

in its periodic reports with more complete information as it becomes available, along with any

updates to previously disclosed information.

The Commission also proposed 17 CFR 229.106(d)(2) (Regulation S-K “Item

106(d)(2)”) to require disclosure in a registrant’s next periodic report when, to the extent known

to management, a series of previously undisclosed individually immaterial cybersecurity

incidents become material in the aggregate.161 The Proposing Release explained that this

requirement may be triggered where, for example, a threat actor engages in a number of smaller

but continuous related cyberattacks against the same company and collectively they become

material.162 Item 106(d)(2) would require disclosure of essentially the same information required

in proposed Item 1.05 of Form 8-K, as follows:

• A general description of when the incidents were discovered and whether they are

ongoing;

• A brief description of the nature and scope of the incidents;

• Whether any data were stolen or altered in connection with the incidents;

• The effect of the incidents on the registrant’s operations; and

• Whether the registrant has remediated or is currently remediating the incidents.163

161 Id. at 16599.
162 Id.
163 Id. at 16619-16620.

2. Comments

Reaction among commenters to proposed Item 106(d)(1) was mixed. Some wrote in

support, noting that updated incident disclosure is needed to avoid previously disclosed

information becoming stale and misleading as more information becomes available, and saying

that updates help investors assess the efficacy of companies’ cybersecurity procedures.164 Others

took issue with specific aspects of the proposed rule. For example, some commenters stated that

the proposed requirement to disclose “any potential material future impacts” is vague and

difficult to apply, and urged removing or revising it.165 Similarly, other commenters said that

registrants should not be required to describe progress on remediation, noting that such

information could open them up to more attacks.166 In the same vein, one commenter suggested

that no updates be required until remediation is sufficiently complete.167 One commenter said the

requirement to disclose changes in policies and procedures is unnecessary and overly broad,168

and another commenter said the requirement should be narrowed to “material changes.”169

More generally, commenters sought clarification on how to differentiate instances where

updates should be included in periodic reports from instances where updates should be filed on

Form 8-K; they found the guidance in the Proposing Release on this point “unclear.”170 And one

164 See letters from AICPA; Crindata; R Street. See also IAC Recommendation.
165 See letters from EEI; Prof. Perullo; PWC; SCG.
166 See letters from BCE; BPI et al.; Enbridge. See also letter from EEI (suggesting narrowing the rule to “material

remediation,” and delaying such disclosure until remediation is complete).
167 See letter from EEI.
168 See letter from Prof. Perullo.
169 See letter from EEI.
170 See letter from PWC; accord letter from Deloitte. The Proposing Release stated: “Notwithstanding proposed

Item 106(d)(1), there may be situations where a registrant would need to file an amended Form 8-K to correct
disclosure from the initial Item 1.05 Form 8-K, such as where that disclosure becomes inaccurate or materially
misleading as a result of subsequent developments regarding the incident. For example, if the impact of the
incident is determined after the initial Item 1.05 Form 8-K filing to be significantly more severe than previously
disclosed, an amended Form 8-K may be required.” Proposing Release at 16598.

commenter argued that, regardless of where the update is filed, the incremental availability of

information would make it difficult for companies to determine when the update requirement is

triggered.171

With respect to proposed Item 106(d)(2), a large number of commenters expressed

concern about the aggregation requirement, saying, for example, that companies experience too

many events to realistically communicate internally upward to senior management, and that

retaining and analyzing data on past events would be too costly.172 A number of other

commenters relatedly said that, for the aggregation requirement to be workable, companies need

more guidance on the nature, timeframe, and breadth of incidents that should be collated.173 In

this regard, one supporter of the requirement explained in its request for additional guidance that

“cybersecurity incidents are so unfortunately common that a strict reading of this section could

cause overreporting to the point that it is meaningless for shareholders.”174

Some commenters suggested revising the rule to cover only “related” incidents.175

Possible definitions offered for “related” incidents included those “performed by the same

malicious actor or that exploited the same vulnerability,”176 and those resulting from “attacks on

the same systems, processes or controls of a registrant over a specified period of time.”177

Suggestions for limiting the time period over which aggregation should occur included the

171 See letter from Quest.
172 See letters from ABA; ACLI; AIA; Business Roundtable; EEI; Enbridge; Ernst & Young LLP (“E&Y”); FAH;

FedEx; Center on Cyber and Technology Innovation at the Foundation for Defense of Democracies (“FDD”);
GPA; Hunton; ITI; ISA; LTSE; Microsoft; Nareit; NAM; NDIA; NRA; Prof. Perullo; SCG; SIFMA.

173 See letters from ACC; APCIA; BDO USA, LLP (“BDO”); BPI et al.; CAQ; Chamber; Chevron; Deloitte; EIC;
FEI; M. Barragan; PWC; R Street.; TransUnion.

174 See letter from R Street.
175 See letters from ABA; APCIA; EEI; E&Y; PWC.
176 See letter from ABA.
177 See letter from E&Y.

preceding one year,178 and the preceding two years.179 One commenter requested the

Commission clarify that a company’s Item 106(d)(2) disclosure need describe only the aggregate

material impact of the incidents, rather than describing each incident individually; the

commenter was concerned with threat actors becoming informed of a company’s vulnerabilities

through overly detailed disclosure.180 Another commenter suggested granting registrants

additional time to come into compliance with Item 106(d)(2) after Commission adoption, so that

they can develop system functionality to retain details about immaterial incidents.181

Commenters also wrote in support of the aggregation requirement.182 One of these

commenters stated that aggregation is needed especially where an advanced persistent threat

actor183 seeks to exfiltrate data or intellectual property over time.184

3. Final Amendments

In response to comments, we are not adopting proposed Item 106(d)(1) and instead are

adopting a new instruction to clarify that updated incident disclosure must be provided in a Form

8-K amendment. Specifically, we are revising proposed Instruction 2 to Item 1.05 of Form 8-K

to direct the registrant to include in its Item 1.05 Form 8-K a statement identifying any

178 See letter from APCIA.
179 See letter from EEI.
180 See letter from AGA/INGAA.
181 See letter from Deloitte.
182 See letters from CII; CSA; R Street; NASAA.
183 The National Institute of Standards and Technology explains that an advanced persistent threat “is an adversary

or adversarial group that possesses the expertise and resources that allow it to create opportunities to achieve its
objectives by using multiple attack vectors, including cyber, physical, and deception. The APT objectives
include establishing a foothold within the infrastructure of targeted organizations for purposes of exfiltrating
information; undermining or impeding critical aspects of a mission, function, program, or organization; or
positioning itself to carry out these objectives in the future. The APT pursues its objectives repeatedly over an
extended period, adapts to defenders’ efforts to resist it, and is determined to maintain the level of interaction
needed to execute its objectives.” National Institute of Standards and Technology, NIST Special Publication
800-172, Enhanced Security Requirements for Protecting Controlled Unclassified Information (Feb. 2021), at 2.

184 See letter from CSA.

information called for in Item 1.05(a) that is not determined or is unavailable at the time of the

required filing and then file an amendment to its Form 8-K containing such information within

four business days after the registrant, without unreasonable delay, determines such information

or within four business days after such information becomes available. This change mitigates

commenters’ concerns with Item 106(d)(1). In particular, under the final rules, companies will

not have to distinguish whether information regarding a material cybersecurity incident that was

not determined or was unavailable at the time of the initial Form 8-K filing should be included

on current reports or periodic reports, as the reporting would be in an amended Form 8-K; details

that commenters suggested raised security concerns, such as remediation status, are not required;

and concerns that the proposed rule was vague or overbroad have been addressed by narrowing

the required disclosure to the information required by Item 1.05(a). We also believe that use of a

Form 8-K amendment rather than a periodic report will allow investors to more quickly identify

updates regarding incidents that previously were disclosed.

We appreciate that new information on a reported cybersecurity incident may surface

only in pieces; the final rules, however, do not require updated reporting for all new information.

Rather, Instruction 2 to Item 1.05 directs companies to file an amended Form 8-K with respect to

any information called for in Item 1.05(a) that was not determined or was unavailable at the time

of the initial Form 8-K filing. Other than with respect to such previously undetermined or

unavailable information, the final rules do not separately create or otherwise affect a registrant’s

duty to update its prior statements. We remind registrants, however, that they may have a duty to

correct prior disclosure that the registrant determines was untrue (or omitted a material fact

necessary to make the disclosure not misleading) at the time it was made185 (for example, if the

registrant subsequently discovers contradictory information that existed at the time of the initial

disclosure), or a duty to update disclosure that becomes materially inaccurate after it is made186

(for example, when the original statement is still being relied on by reasonable investors).

Registrants should consider whether they need to revisit or refresh previous disclosure, including

during the process of investigating a cybersecurity incident.187

We are not adopting proposed Item 106(d)(2), in response to concerns that the proposed

aggregation requirement was vague or difficult to apply. We are persuaded by commenters that

the proposed requirement might be difficult to differentiate from Item 1.05 disclosure, or by

contrast, could result in the need for extensive internal controls and procedures to monitor all

immaterial events to determine whether they have become collectively material. The intent of

the proposed requirement was to capture the material impacts of related incidents, and prevent

the avoidance of incident disclosure through disaggregation of such related events. However,

upon further reflection, and after review of comments, we believe that the proposed requirement

is not necessary based on the scope of Item 1.05.

To that end, we emphasize that the term “cybersecurity incident” as used in the final rules

is to be construed broadly, as the Commission stated in the Proposing Release.188 The definition

185 See Backman v. Polaroid Corp., 910 F.2d 10, 16-17 (1st Cir. 1990) (en banc) (finding that the duty to correct

applies “if a disclosure is in fact misleading when made, and the speaker thereafter learns of this”).
186 See id. at 17 (describing the duty to update as potentially applying “if a prior disclosure ‘becomes materially

misleading in light of subsequent events’” (quoting Greenfield v. Heublein, Inc., 742 F.2d 751, 758 (3d Cir.
1984))). But see Higginbotham v. Baxter Intern., Inc., 495 F.3d 753, 760 (7th Cir. 2007) (rejecting duty to
update before next quarterly report); Gallagher v. Abbott Laboratories, 269 F.3d 806, 808-11 (7th Cir. 2001)
(explaining that securities laws do not require continuous disclosure).

187 Relatedly, registrants should be aware of the requirement under Item 106(b)(2) of Regulation S-K to describe
“[w]hether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents,
have materially affected or are reasonably likely to materially affect the registrant” (emphasis added). See infra
Section II.C.1.c.

188 Proposing Release at 16601.

of “cybersecurity incident” we are adopting extends to “a series of related unauthorized

occurrences.”189 This reflects that cyberattacks sometimes compound over time, rather than

present as a discrete event. Accordingly, when a company finds that it has been materially

affected by what may appear as a series of related cyber intrusions, Item 1.05 may be triggered

even if the material impact or reasonably likely material impact could be parceled among the

multiple intrusions to render each by itself immaterial. One example was provided in the

Proposing Release: the same malicious actor engages in a number of smaller but continuous

cyberattacks related in time and form against the same company and collectively, they are either

quantitatively or qualitatively material.190 Another example is a series of related attacks from

multiple actors exploiting the same vulnerability and collectively impeding the company’s

business materially.

C. Disclosure of a Registrant’s Risk Management, Strategy and Governance

Regarding Cybersecurity Risks

1. Risk Management and Strategy

a. Proposed Amendments

The Commission proposed to add 17 CFR 229.106(b) (Regulation S-K “Item 106(b)”) to

require registrants to provide more consistent and informative disclosure regarding their

cybersecurity risk management and strategy in their annual reports. The Commission noted the

Division of Corporation Finance staff’s experience that most registrants disclosing a

cybersecurity incident do not describe their cybersecurity risk oversight or any related policies

and procedures, even though companies typically address significant risks by developing risk

189 See infra Section II.C.3.
190 Proposing Release at 16599.

107

I. Compliance Dates

The final rules are effective September 5, 2023. With respect to Item 106 of Regulation

S-K and item 16K of Form 20-F, all registrants must provide such disclosures beginning with

annual reports for fiscal years ending on or after December 15, 2023. With respect to

compliance with the incident disclosure requirements in Item 1.05 of Form 8-K and in Form 6-K,

all registrants other than smaller reporting companies must begin complying on December 18,

2023. As discussed above, smaller reporting companies are being given an additional 180 days

from the non-smaller reporting company compliance date before they must begin complying

with Item 1.05 of Form 8-K, on June 15, 2024.

With respect to compliance with the structured data requirements, as noted above, all

registrants must tag disclosures required under the final rules in Inline XBRL beginning one year

after the initial compliance date for any issuer for the related disclosure requirement.

Specifically:

• For Item 106 of Regulation S-K and item 16K of Form 20-F, all registrants must begin

tagging responsive disclosure in Inline XBRL beginning with annual reports for fiscal

years ending on or after December 15, 2024; and

• For Item 1.05 of Form 8-K and Form 6-K all registrants must begin tagging responsive

disclosure in Inline XBRL beginning on December 18, 2024.

III. OTHER MATTERS

If any of the provisions of these rules, or the application thereof to any person or

circumstance, is held to be invalid, such invalidity shall not affect other provisions or application

of such provisions to other persons or circumstances that can be given effect without the invalid

provision or application.

108

Pursuant to the Congressional Review Act, the Office of Information and Regulatory

Affairs has designated these rules as not a “major rule,” as defined by 5 U.S.C. 804(2).

IV. ECONOMIC ANALYSIS

A. Introduction

We are mindful of the costs imposed by, and the benefits to be obtained from, our rules.

Section 2(b) of the Securities Act408 and Section 3(f) of the Exchange Act409 direct the

Commission, when engaging in rulemaking where it is required to consider or determine whether

an action is necessary or appropriate in the public interest, to consider, in addition to the

protection of investors, whether the action will promote efficiency, competition, and capital

formation. Further, Section 23(a)(2) of the Exchange Act410 requires the Commission, when

making rules under the Exchange Act, to consider the impact that the rules would have on

competition, and prohibits the Commission from adopting any rule that would impose a burden

on competition not necessary or appropriate in furtherance of the Exchange Act. The discussion

below addresses the economic effects of the final rules, including the likely benefits and costs, as

well as the likely effects on efficiency, competition, and capital formation.

Where possible, we have attempted to quantify the benefits, costs, and effects on

efficiency, competition, and capital formation expected to result from the final rules. In some

cases, however, we are unable to quantify the potential economic effects because we lack

information necessary to provide a reasonable estimate. For example, we lack the data to

estimate any potential decrease in mispricing that might result from the rule, because we do not

know how registrants’ disclosures of cybersecurity risk and governance will change or which

408 15 U.S.C. 77b(b).
409 15 U.S.C. 78c(f).
410 15 U.S.C. 78w(a)(2).

109

cybersecurity incidents that would go undisclosed under the current guidance will be disclosed

under the final rules. Where we are unable to quantify the economic effects of the final rules, we

provide a qualitative assessment of the effects, and of the impacts of the final rule on efficiency,

competition, and capital formation. To the extent applicable, the views of commenters relevant

to our analysis of the economic effects, costs, and benefits of these rules are included in the

discussion below.

While cybersecurity incident disclosure has become more frequent since the issuance of

the 2011 Staff Guidance and 2018 Interpretive Release, there is concern that variation persists in

the timing, content, and format of registrants’ existing cybersecurity disclosure, and that such

variation may harm investors (as further discussed below).411 When disclosures about

cybersecurity breaches are made, they may not be timely or consistent. Because of the lack of

consistency in when and how companies currently disclose incidents, it is difficult to assess

quantitatively the timeliness of disclosures under current practices. According to Audit

Analytics data, in 2021, it took on average of 42 days for companies to discover breaches, and

then it took an average of 80 days and a median of 56 days for companies to disclose a breach

after its discovery.412 These data do not tell us when disclosure occurs relative to companies’

materiality determinations. That said, the report notes that some breaches were disclosed for the

first time to investors in periodic reports, the timing of which are unrelated to the timing of the

411 See supra Section I. See also supra note 18 and accompanying text; Eli Amir, Shai Levi, & Tsafrir Livne, Do

Firms Underreport Information on Cyber-Attacks? Evidence from Capital Markets, 23 REV. ACCT. STUD. 1177
(2018).

412 AUDIT ANALYTICS, Trends in Cybersecurity Breaches (Apr. 2022), available at
https://www.auditanalytics.com/doc/AA_Trends_in_Cybersecurity_Report_April_2022 (“Audit Analytics”)
(looking specifically at disclosures by companies with SEC filing requirements and stating that:
“[c]ybersecurity breaches can result in a litany of costs, such as investigations, legal fees, and remediation.
There is also the risk of economic and reputational costs that can directly impact financial performance, such as
reduced revenue due to lost sales.”).

110

incident or the company’s assessment of the materiality of the incident. This implies at least

some cybersecurity incident disclosures were not timely with respect to determination of

materiality. Because cybersecurity incidents can significantly affect registrants’ stock prices,

delayed disclosure results in mispricing of securities, harming investors.413 Incident disclosure

practices, with respect to both location and content, currently vary across registrants. For

example, some registrants disclose incidents through Form 10-K, others Form 8-K, and still

others on a company website, or in a press release. Some disclosures do not discuss whether the

cybersecurity incident had material impact on the company.414 Additionally, evidence suggests

registrants may be underreporting cybersecurity incidents.415 More timely, informative, and

standardized disclosure of material cybersecurity incidents may help investors to assess an

incident’s impact better.

While disclosures about cybersecurity risk management, strategy, and governance have

been increasing at least since the issuance of the 2018 Interpretive Release, they are not currently

provided by all registrants. Despite the increasing prevalence of references to cybersecurity risks

in disclosures, however, registrants do not consistently or uniformly disclose information related

to cybersecurity risk management, strategy, and governance.416 Registrants currently make such

disclosures in varying sections of a company’s periodic and current reports, such as in risk

factors, in management’s discussion and analysis, in a description of business and legal

proceedings, or in financial statement disclosures, and sometimes include them with other

413 See Shinichi Kamiya, et al., Risk Management, Firm Reputation, and the Impact of Successful Cyberattacks on

Target Firms, 139 J. FIN. ECON. 721 (2021).
414 Based on staff analysis of the current and periodic reports in 2022 for companies identified by having been

affected by a cybersecurity incident.
415 See BITDEFENDER, supra note 18 and accompanying text.
416 See supra Section II.C.1.b. and c.; see also letter from Better Markets.

111

unrelated disclosures.417 One commenter noted that current disclosure is “piecemeal” in nature

and that the varying content and placement make it difficult for investors and other market

participants to locate and understand the cybersecurity risks that registrants face and their

preparedness for an attack, and to make comparisons across registrants.418

As we discuss in more detail below, some commenters supported the proposed rule.

Specifically, one commenter noted that markets responded negatively to delayed cybersecurity

disclosures, suggesting that timeliness in disclosing incidents is valuable to investors.419 Further,

some academic commenters submitted papers that they authored finding that evidence suggests

that companies experiencing data breaches subsequently experience higher borrowing costs.420

On the other hand, other commenters contended that the proposed rules would hinder capital

formation, particularly for small registrants,421 or that a more cost-effective alternative to the

proposed rules would be to look to existing rules to elicit relevant disclosures, as articulated by

the 2011 Staff Guidance and the 2018 Interpretive Release.422 Several commenters pointed out

that the proposed disclosures on cybersecurity risk management, strategy, and governance might

be overly prescriptive and would potentially provide a roadmap for threat actors, and that these

rules could increase, not decrease costs.423 In response to those comments, these provisions have

417 See Proposing Release at 16606 (Table 1. Incidence of Cybersecurity-Related Disclosures by 10-K Location).
418 See letter from Better Markets.
419 See letter from Prof. Choudhary.
420 See letters from Profs. Huang & Wang; Prof. Sheneman.
421 See letter from BIO.
422 See letter from NRF.
423 See letters from ABA; ACLI; APCIA; BIO; BPI et al.; Business Roundtable; Chamber; CSA; CTIA; EIC;

Enbridge; FAH; Federated Hermes; GPA; ITI; ISA; Nareit; NAM; NMHC; NRA; NRF; SIFMA; Sen. Portman;
TechNet; TransUnion; USTelecom; Virtu.

112

been modified in the final rule, which should reduce the perceived risk of providing a roadmap

for threat actors compared with the proposal.

B. Economic Baseline

1. Current Regulatory Framework

To assess the economic impact of the final rules, the Commission is using as its baseline

the existing regulatory framework and market practice for cybersecurity disclosure. Although a

number of Federal and State rules and regulations obligate registrants to disclose cybersecurity

risks and incidents in certain circumstances, the Commission’s regulations currently do not

explicitly address cybersecurity.424

As noted in the Proposing Release, cybersecurity threats and incidents continue to

increase in prevalence and seriousness, posing an ongoing and escalating risk to public

registrants, investors, and other market participants.425 The number of reported breaches

disclosed by public companies has increased almost 600 percent over the last decade, from 28 in

2011 to 131 in 2020 and 188 in 2021.426 Although estimating the total cost of cybersecurity

incidents is difficult, as many events may be unreported, some estimates put the economy-wide

total costs as high as trillions of dollars per year in the U.S. alone.427 The U.S. Council of

Economic Advisers estimated that in 2016 the total cost of cybersecurity incidents was between

424 See Proposing Release at 16593-94 for a detailed discussion of the existing regulatory framework.
425 Unless otherwise noted, when we discuss the economic effects of the final rules on “other market participants,”

we mean those market participants that typically provide services for investors and who rely on the information
in companies’ filings (such as financial analysts, investment advisers, and portfolio managers).

426 Audit Analytics, supra note 412.
427 See CYBERSECURITY & INFRASTRUCTURE SEC. AGENCY, Cost of a Cyber Incident: Systemic Review and Cross-

Validation (Oct. 26, 2020), available at https://www.cisa.gov/sites/default/files/publications/CISA-
OCE_Cost_of_Cyber_Incidents_Study-FINAL_508 (based on a literature review of publications discussing
incidents that occurred in the United States or to U.S.-based companies).

113

$57 billion and $109 billion, or between 0.31 and 0.58 percent of U.S. GDP in that year.428 A

more recent estimate suggests the average cost of a data breach in the U.S. is $9.44 million.429

Executives, boards of directors, and investors remain focused on the emerging risk of

cybersecurity. A 2022 survey of bank Chief Risk Officers found that they identified managing

cybersecurity risk as the top strategic risk.430 In 2022, a survey of audit committee members

again identified cybersecurity as a top area of focus in the coming year.431

In 2011, the Division of Corporation Finance issued interpretive guidance providing the

Division’s views concerning operating registrants’ disclosure obligations relating to

cybersecurity risks and incidents.432 This 2011 Staff Guidance provided an overview of existing

disclosure obligations that may require a discussion of cybersecurity risks and cybersecurity

incidents, along with examples of potential disclosures.433 Building on the 2011 Staff Guidance,

the Commission issued the 2018 Interpretive Release to assist operating companies in preparing

disclosure about cybersecurity risks and incidents under existing disclosure rules.434 In the 2018

428 COUNCIL OF ECON. ADVISERS, The Cost of Malicious Cyber Activity to the U.S. Economy (Feb. 2018), available

at https://trumpwhitehouse.archives.gov/articles/cea-report-cost-malicious-cyber-activity-u-s-economy/
(estimating total costs, rather than costs of only known and disclosed incidents).

429 Ponemon Institute & IBM Security, Cost of a Data Breach Report 2022 (July 2022), available at
https://www.ibm.com/downloads/cas/3R8N1DZJ (estimating based on analysis of 550 organizations impacted
by data breaches that occurred between Mar. 2021 and Mar. 2022).

430 EY AND INSTITUTE OF INTERNATIONAL FINANCE, 12th Annual EY/IIF Global Bank Risk Management Survey, at
14 (2022), available at https://www.iif.com/portals/0/Files/content/32370132_ey-
iif_global_bank_risk_management_survey_2022_final (stating 58% of surveyed banks’ Chief Risk Officers
cite “inability to manage cybersecurity risk” as the top strategic risk). See also EY, EY CEO Imperative Study
(July 2019), available at https://assets.ey.com/content/dam/ey-sites/ey-com/en_gl/topics/growth/ey-ceo-
imperative-exec-summ-single-spread-final .

431 CENTER FOR AUDIT QUAL. & DELOITTE, Audit Committee Practices Report: Priorities and Committee
Composition (Jan. 2023) available at https://www.thecaq.org/audit-committee-practices-report-2023/. See also
CENTER FOR AUDIT QUAL. & DELOITTE, Audit Committee Practices Report: Common Threads Across Audit
Committees (Jan. 2022), available at https://www.thecaq.org/2022-ac-practices-report/.

432 See 2011 Staff Guidance.
433 Id.
434 See 2018 Interpretive Release.

114

Interpretive Release, the Commission reiterated that registrants must provide timely and ongoing

information in periodic reports (Form 10-Q, Form 10-K, and Form 20-F) about material

cybersecurity risks and incidents that trigger disclosure obligations.435 Additionally, the 2018

Interpretive Release encouraged registrants to continue to use current reports (Form 8-K or Form

6-K) to disclose material information promptly, including disclosure pertaining to cybersecurity

matters.436 Further, the 2018 Interpretive Release noted that to the extent cybersecurity risks are

material to a registrant’s business, the Commission believes that the required disclosure of the

registrant’s risk oversight should include the nature of the board’s role in overseeing the

management of that cybersecurity risk.437 The 2018 Interpretive Release also stated that a

registrant’s controls and procedures should enable it to, among other things, identify

cybersecurity risks and incidents and make timely disclosures regarding such risks and

incidents.438 Finally, the 2018 Interpretive Release highlighted the importance of insider trading

prohibitions and the need to refrain from making selective disclosures of cybersecurity risks or

incidents.439

In keeping with existing obligations, companies are increasingly acknowledging

cybersecurity risks in their disclosures. One analysis of disclosures made by Fortune 100

companies that filed 10-Ks and proxy statements found 95 percent of those companies disclosed

a focus on cybersecurity risk in the risk oversight section of their proxy statements filed in the

435 Id. at 8168-8170.
436 Id. at 8168.
437 Id. at 8170.
438 Id. at 8171.
439 Id. at 8171-8172.

115

period ending in May 2022, up from 89 percent of filings in 2020 and 76 percent in 2018.440

Disclosures of efforts to mitigate cybersecurity risk were found in 99 percent of proxy statements

or Forms 10-K, up from 93 percent in 2020 and 85 percent in 2018.441 The Fortune 100 list is

composed of the highest-revenue companies in the United States. As discussed later in this

economic analysis, we observed the overall rate of disclosure across not just the largest, but all

filers, approximately 8,400, to be approximately 73 percent.442 Further, one commenter noted

that current disclosures are “scattered and unpredictable” rather than “uniform,” which

“diminishes their effectiveness,” and so the final rule should improve investors’ ability to find

and compare disclosures.443

Registrants currently are and may continue to be subject to other cybersecurity incident

disclosure requirements developed by various industry regulators and contractual counterparties.

As discussed in Section II, CIRCIA was passed in March 2022 and requires CISA to develop and

issue regulations on cybersecurity reporting. As set forth in CIRCIA, once those regulations are

adopted, covered entities will have 72 hours to report covered cybersecurity incidents to CISA

and will also be required to report a ransom payment as the result of a ransomware attack within

24 hours of the payment being made.444 In addition, Federal contractors may be required to

monitor and report cybersecurity incidents and breaches or face liability under the False Claims

440 See EY CTR FOR BD MATTERS, How Cyber Governance and Disclosures are Closing the Gaps in 2022 (Aug.

2022), available at https://www.ey.com/en_us/board-matters/how-cyber-governance-and-disclosures-are-
closing-the-gaps-in-2022.

441 Id.
442 See infra note 456 (describing textual analysis) and accompanying text.
443 See letter from Better Markets. Although uniformity should improve investors’ ability to find and compare

disclosures, within that structure the final rule allows customization to capture complexity and avoid
unnecessarily simplifying issues for the sake of standardization.

444 6 U.S.C. 681b. See also supra notes 21 to 23 and accompanying text.

116

Act.445 An FCC rule directs covered telecommunications providers on how and when to disclose

breaches of certain customer data.446 HIPAA requires covered entities and their business

associates to provide notification following a breach of unsecured protected health

information.447 Similar rules require vendors of personal health records and related entities to

report data breaches to affected individuals and the FTC.448 All 50 states have data breach laws

that require businesses to notify individuals of security breaches involving their personally

identifiable information.449 There are other rules that registrants must follow in international

jurisdictions. For example, in the European Union, the General Data Protection Regulation

mandates disclosure of cybersecurity breaches.450

These other cybersecurity incident disclosure requirements may cover some of the

material incidents that registrants will need to disclose under the final rules. However, not all

registrants are subject to each of these other incident disclosure requirements and the timeliness

and public reporting elements of these requirements vary, making it difficult for investors and

445 See DEP’T OF JUSTICE, OFFICE OF PUB. AFFAIRS, Justice News: Deputy Attorney General Lisa O. Monaco

Announces New Civil Cyber-Fraud Initiative, (Oct. 6, 2021), available at
https://www.justice.gov/opa/pr/deputy-attorney-general-lisa-o-monaco-announces-new-civil-cyber-fraud-
initiative; see, e.g., FAR 52.239-1 (requiring contractors to “immediately” notify the Federal Government if
they become aware of “new or unanticipated threats or hazards . . . or if existing safeguards have ceased to
function”).

446 See 47 CFR 64.2011; see also supra Section II.A.3.
447 See 45 CFR 164.400 through 414 (Notification in the Case of Breach of Unsecured Protected Health

Information).
448 See 16 CFR 318 (Health Breach Notification Rule).
449 Note that there are carve-outs to these rules, and not every company may fall under any particular rule. See

NAT’L CONFERENCE OF STATE LEGISLATURES, Security Breach Notification Laws (updated Jan. 17, 2022),
available at https://www.ncsl.org/technology-and-communication/security-breach-notification-laws.

450 See Regulation (EU) 2016/679, of the European Parliament and the Council of 27 Apr. 2016 on the protection
of natural persons with regard to the processing of personal data and on the free movement of such data, and
repealing Directive 95/46/EC (General Data Protection Regulation), arts. 33 (Notification of a personal data
breach to the supervisory authority), 34 (Communication of a personal data breach to the data subject), 2016
O.J. (L 119) 1 (“GDPR”).

117

other market participants to be alerted to the breaches and to gain an adequate understanding of

the impact of such incidents on a registrant.

Some registrants are also subject to other mandates regarding cybersecurity risk

management, strategy, and governance. For instance, government contractors may be subject to

the Federal Information Security Modernization Act, and use the NIST framework to manage

information and privacy risks.451 Certain financial institutions may be subject to the FTC’s

Standards for Safeguarding Customer Information Rule, requiring an information security

program, including a qualified individual to oversee the security program, and the provision of

periodic reports on the cybersecurity program to a company’s board of directors or equivalent

governing body.452 Under HIPAA regulations, covered entities are subject to rules that require

protection against reasonably anticipated threats to electronic protected health information.453

International jurisdictions also have cybersecurity risk mitigation measures and governance

requirements (see, for example, the GDPR).454 These rules and regulations provide varying

standards and requirements for disclosing cybersecurity risk management, strategy, and

governance, and may not provide investors with public or clear and comparable disclosure

regarding how a particular registrant manages its cybersecurity risk profile.

2. Affected Parties

The parties that are likely to be affected by the final rules include investors, registrants,

other market participants that use the information provided in company filings (such as financial

451 See NIST, NIST Risk Management Framework (updated Jan. 31, 2022), available at

https://csrc.nist.gov/projects/risk-management/fisma-background.
452 See 16 CFR 314.
453 See 45 CFR 164 (Security and Privacy); see also supra Section II.A.3.
454 See, e.g., GDPR, arts. 32 (Security of processing), 37 (Designation of the data protection officer).

118

analysts, investment advisers, and portfolio managers), and external stakeholders such as

consumers and other companies in the same industry as affected companies.

We expect the final rules to affect all registrants with relevant disclosure obligations on

Forms 10-K, 20-F, 8-K, or 6-K. This includes (1) approximately 7,300 operating companies

filing on domestic forms (of which, approximately 120 are business development companies)

and (2) 1,174 FPIs filing on foreign forms, based on all companies that filed such forms or an

amendment thereto during calendar year 2022.455 Our textual analysis456 of all calendar year

2022 Form 10-K filings and amendments reveals that approximately 73 percent of domestic

filers made some kind of cybersecurity-related disclosures, whether of incidents, risk, or

governance.

We also analyzed calendar year 2022 Form 8-K and Form 6-K filings. There were

71,505 Form 8-K filings in 2022, involving 7,416 filers, out of which 35 filings reported material

cybersecurity incidents.457 Similarly, there were 27,296 Form 6-K filings in 2022, involving

1,161 filers, out of which 22 filings reported material cybersecurity incidents.

C. Benefits and Costs of the Final Rules

The final rules will benefit investors, registrants, and other market participants, such as

financial analysts, investment advisers, and portfolio managers, by providing more timely and

informative disclosures relating to cybersecurity incidents and cybersecurity risk management,

strategy, and governance, facilitating investor decision-making and reducing information

455 Estimates of affected companies here are based on the number of unique CIKs with at least one periodic report,

current report, or an amendment to one of the two filed in calendar year 2022.
456 In performing this analysis, staff executed computer program-based keyword (and combination of key words)

searches. This analysis covered 8,405 Forms 10-K and 10-K/A available in Intelligize (a division of RELX
Inc.) filed in calendar year 2022 by 7,486 companies as identified by unique CIK.

457 The number of filers in our sample is larger than the number of estimated affected parties because, among other
reasons, it includes 8-K filings by companies that have not yet filed their first annual report.

119

asymmetry in the market. The final rules also will entail costs. A discussion of the anticipated

economic costs and benefits of the final rules is set forth in more detail below. We first discuss

benefits, including benefits to investors and other market participants. We subsequently discuss

costs, including the cost of compliance with the final rules. We conclude with a discussion of

indirect economic effects on investors, external stakeholders such as consumers, and companies

in the same industry with registrants subject to this rule, or those facing similar cybersecurity

threats.

1. Benefits

Existing shareholders, and those seeking to purchase shares in registrants subject to the

final rules, will be the main beneficiaries of the enhanced disclosure of both cybersecurity

incidents and cybersecurity risk management, strategy, and governance as a result of the final

rules. Specifically, investors will benefit because: (1) more informative and timely disclosure

will improve investor decision-making by allowing investors to better understand a registrant’s

material cybersecurity incidents, material cybersecurity risks, and ability to manage such risks,

reducing information asymmetry and the mispricing of securities in the market; and (2) more

uniform and comparable disclosures will lower search costs and information processing costs.

Other market participants that rely on financial statement information to provide services to

investors, such as financial analysts, investment advisers, and portfolio managers, will also

benefit.

a. More Timely and Informative Disclosure

The final rules provide more timely and informative disclosures, relative to the current

disclosure environment, which will allow investors to better understand registrants’

cybersecurity incidents, risks, and ability to manage such risks as well as reduce mispricing of

120

securities in the market. Timeliness benefits to investors will result from the requirement to

disclose cybersecurity incidents within four business days of determining an incident was

material, as well as the requirement to amend the disclosure to reflect material changes.

Information benefits to investors will result from the disclosure of both (1) cybersecurity

incidents and (2) cybersecurity risk management, strategy, and governance. Together, the

timeliness and information benefits created by the final rules will reduce market mispricing and

information asymmetry and potentially lower firms’ cost of capital.

We anticipate Item 1.05, governing cybersecurity incident disclosure on Form 8-K, will

lead to more timely disclosure to investors.458 Currently, there is not a specific requirement for

a registrant to disclose a cybersecurity incident to investors in a timely manner after its discovery

and determination of material impact.459 Item 1.05’s requirement to disclose a material

cybersecurity incident on Form 8-K within four business days after determining the incident is

material will improve the overall timeliness of the disclosure offered to investors—disclosure

that is relevant to the valuation of registrants’ securities. It is well-documented in the academic

literature that the market reacts negatively to announcements of cybersecurity incidents. For

example, one study finds a statistically significant mean cumulative abnormal return of -0.84

percent in the three days following cyberattack announcements, which, according to the study,

translates into an average value loss of $495 million per attack.460 One commenter argued that

458 For foreign issuers, the disclosure is made via Form 6-K.
459 See supra Sections I and IV.B.1.
460 See Shinichi Kamiya, et al., supra note 413, at 719-749. See also Lawrence A. Gordon, Martin P. Loeb, & Lei

Zhou, The Impact of Information Security Breaches: Has There Been a Downward Shift in Costs?, 19 (1) J. OF
COMPUT. SEC. 33, 33-56 (2011) (finding “the impact of the broad class of information security breaches on
stock market returns of firms is significant”); Georgios Spanos & Lefteris Angelis, The Impact of Information
Security Events to the Stock Market: A Systematic Literature Review, 58 COMPUT. & SEC. 216-229 (2016)
(documenting that the majority (75.6%) of the studies the paper reviewed report statistical significance of the
impact of security events to the stock prices of companies). But see Katherine Campbell, et al., The Economic

121

the magnitude of stock market reaction to cybersecurity incidents from this study would not be

considered significant by market participants, stating that “if a stock had a historical standard

deviation of 1 percent and moved 0.8 percent on news, most market participants would suggest

that the news was either not significant or the market had priced in that news so the reaction was

muted.”461 We note, however, that a cumulative abnormal return (CAR) of -0.84 percent refers

not to the total return but to the return relative to how stocks in similar industries and with

similar risk profiles moved; thus, indeed, a statistically significantly negative CAR represents a

meaningful reaction and change to how the stock price would have moved that day absent the

announcement of the cybersecurity incident. By allowing investors to make decisions based on

more current, material, information, Item 1.05 will reduce mispricing of securities and

information asymmetry in the market.

Information asymmetries due to timing could also be exploited by the malicious actors

who caused a cybersecurity incident, those who could access and trade on material information

stolen during a cybersecurity incident, or those who learn about the incident before public

disclosure, causing further harm to investors who trade unknowingly against those with inside

information.462 Malicious actors may trade ahead of an announcement of a data breach that they

Cost of Publicly Announced Information Security Breaches: Empirical Evidence From the Stock Market, 11 (3)
J. OF COMPUT. SEC. 432, 431-448 (2003) (while finding limited evidence of an overall negative stock market
reaction to public announcements of information security breaches, they also find “the nature of the breach
affects this result,” and “a highly significant negative market reaction for information security breaches
involving unauthorized access to confidential data, but no significant reaction when the breach does not involve
confidential information;” they thus conclude that “stock market participants appear to discriminate across types
of breaches when assessing their economic impact on affected firms”).

461 See letter from BIO.
462 See Joshua Mitts & Eric Talley, Informed Trading and Cybersecurity Breaches, 9 HARV. BUS. L. REV. 1 (2019)

(“In many respects, then, the cyberhacker plays a role in creating and imposing a unique harm on the targeted
company—one that (in our view) is qualitatively different from ‘exogenous’ information shocks serendipitously
observed by an information trader. Allowing a coordinated hacker-trader team to capture these arbitrage gains
would implicitly subsidize the very harm-creating activity that is being ‘discovered’ in the first instance.”).

122

caused or pilfer material information to trade on ahead of company announcements. Trading on

undisclosed cybersecurity information is particularly pernicious, because profits generated from

this type of trading provide incentives for malicious actors to “create” more incidents and

proprietary information to trade on, further harming the shareholders of impacted companies.463

Employees or related third-party vendors of a company experiencing a cybersecurity incident

may also learn of the incident and trade against investors in the absence of disclosure. More

timely disclosure as a result of Item 1.05 will reduce mispricing by reducing windows of

information asymmetry in connection with a material cybersecurity incident, thereby reducing

opportunities to exploit the mispricing, enhancing investor protection.

A commenter noted that there is risk the rule could, under certain conditions, aid stock

manipulation efforts by malicious actors, offsetting these benefits.464 One commenter

suggested that mandated disclosure timing could make public cybersecurity incident disclosure

dates more predictable, and thus trading strategies based on the accompanying negative stock

price reaction more consistent, to the extent malicious actors can monitor or control discovery

of breaches they cause and correctly anticipate materiality determination timing. Their ability

to do this is unclear, but we note that if the final rules increase the precision of strategies by

attackers that involve shorting the stock of their targets, that would reduce the benefit of the

final rules.

Item 1.05 allows registrants to delay filing for up to 30 days if the Attorney General

determines that the incident disclosure would pose a substantial risk to national security or public

safety and notifies the Commission of such determination in writing. The delay may be extended

463 Id.
464 See letter from ISA.

123

up to an additional 30 days if the Attorney General determines disclosure continues to pose a

substantial risk to national security or public safety and notifies the Commission of such

determination in writing. In extraordinary circumstances, disclosure may be delayed for a final

additional period of up to 60 days if the Attorney General determines that disclosure continues to

pose a substantial risk to national security and notifies the Commission of such determination in

writing. Beyond the final 60-day delay, if the Attorney General indicates that further delay is

necessary, the Commission will consider additional requests for delay and may grant such relief

through Commission exemptive order. These delay periods and possible exemptive relief would

curb the timeliness benefits discussed above but would reduce the costs of premature disclosure

such as alerting malicious actors targeting critical infrastructure that their activities have been

discovered.

By requiring all material cybersecurity incidents to be disclosed, Item 1.05 will also

provide investors more informative disclosure by increasing material cybersecurity incident

disclosure.465 There are currently reasons that registrants do not disclose cybersecurity incidents.

For example, a registrant’s managers may be reluctant to release information that they expect or

anticipate will cause their stock price to suffer.466 Thus an agency problem prevents investors

from receiving this useful information. In addition, registrants may consider only the benefits

and costs that accrue to them when deciding whether to disclose an incident. As discussed in

Section IV.C.3, incident disclosure can create indirect economic effects that accrue to parties

other than the company itself. Companies focused on direct economic benefits, however, may

not factor in this full range of effects resulting from disclosing cybersecurity incidents, resulting

465 See Amir, Levi, & Levine, supra note 411.
466 See, e.g., Kamiya, et al., supra note 413, at 719-749.

124

in less reporting and less information released to the market. The mandatory disclosure in Item

1.05 should thus lead to more incidents being disclosed, reducing mispricing of securities and

information asymmetry in the market as stock prices will more accurately reflect registrants

having experienced a cybersecurity incident.

Item 1.05 will also improve the informativeness of the content of cybersecurity incident

disclosures. In 2022, when registrants filed a Form 8-K to report an incident, the Form 8-K did

not necessarily state whether the incident was material, and in some cases, the Form 8-K stated

that the incident was immaterial.467 Item 1.05 will require registrants to describe in an 8-K

filing the material aspects of the nature, scope, and timing of a material cybersecurity incident

and the material impact or reasonably likely material impact on the registrant, including on its

financial condition and results of operations. The disclosure must also identify any information

called for in Item 1.05(a) that is not determined or is unavailable at the time of the required

filing. Registrants will then need to disclose this information in a Form 8-K amendment

containing such information within four business days after the information is determined or

becomes available. Item 1.05 is thus expected to elicit more pertinent information to aid investor

decision-making. Additionally, the materiality requirement should minimize immaterial incident

disclosure that might divert investor attention, which should reduce mispricing of securities.

Numerous commenters on the Proposing Release agreed that more informative incident

disclosure would be useful for investors.468

Regulation S-K Items 106(b) and (c) of the final rules provide further benefits by

requiring registrants to disclose, in their annual reports on Form 10-K, information about their

467 Based on staff analysis of the 10,941 current and periodic reports in 2022 for companies available in Intelligize

and identified as having been affected by a cybersecurity incident using a keyword search.
468 See, e.g., letters from Better Markets; CalPERS; PWC; Prof. Perullo.

125

cybersecurity risk management, strategy, and governance. The final rules require disclosure

regarding a registrant’s processes, if any, for assessing, identifying, and managing material risks

from cybersecurity threats, as well as disclosure of the registrant’s board of directors’ oversight

of risks from cybersecurity threats and management’s role in assessing and managing material

risks from cybersecurity threats.469 There are currently no disclosure requirements on Forms 10-

K or 10-Q that explicitly refer to cybersecurity risks or governance, and thus Item 106 will

benefit investors by eliciting relevant information about how registrants are managing their

material cybersecurity risks.

One commenter took issue with the usefulness of the proposed disclosures, arguing, for

example, that the particular requirement to disclose whether a registrant engages assessors,

consultants, auditors, or other third parties in connection with any cybersecurity risk assessment

program was unnecessary because there was no evidence that such third parties improved a

registrant’s cyber risk management, and some companies have internal cybersecurity risk

management capabilities.470 Some, however, have noted that the use of independent third-party

advisors may be “vital to enhancing cyber resiliency” by validating that the risk management

program is meeting its objectives.471 As discussed in Section II.C.1.c., it may be important for

investors to know a registrant’s level of in-house versus outsourced cybersecurity capacity.

Another commenter suggested that the requirement to disclose governance and risk management

practices would be of limited value to investors, while being administratively burdensome.472

469 See supra Sections II.B and C. For foreign issuers, the disclosure is made via Form 20-F.
470 See letter from NRF.
471 See Harvard Law School Forum on Corporate Governance Blog, posted by Steve W. Klemash, Jamie C. Smith,

and Chuck Seets, What Companies are Disclosing About Cybersecurity Risk and Oversight, (posted Aug. 25,
2020), available at https://corpgov.law.harvard.edu/2020/08/25/what-companies-are-disclosing-about-
cybersecurity-risk-and-oversight/.

472 See letter from SIMFA.

126

Other commenters said that the required disclosures about cybersecurity governance and risk

management were too granular to be useful and suggested that the specific disclosures be

replaced with a more high-level explanation of management’s and the board’s roles in

cybersecurity risk management and governance.473 One such commenter stated that the

proposed disclosures would create pressures to provide boilerplate responses to the specific items

that would need to be disclosed instead of providing a robust discussion of the way a registrant

would manage cybersecurity risk management and governance.474 Another commenter stated

that granular disclosures “may result in overly detailed filings that have little utility to

investors.”475 These commenters suggested that the specific disclosures should be replaced with

a more high-level explanation of management’s and the board’s roles in cybersecurity risk

management and governance.

In response to these comments, the Commission is not adopting certain proposed

disclosure requirements, such as disclosure of whether the registrant has a designated chief

information security officer. However, Items 106(b) and (c) still require risk, strategy and

governance disclosures as we continue to believe disclosures of cybersecurity risk oversight and

processes, as well as management’s role and relevant expertise, are important to investors.

Improved timeliness and informativeness of cybersecurity disclosures may provide

further benefit by lowering companies’ cost of capital.476 As detailed above, the final rules

473 See letters from ABA; AGA/INGAA; EEI; Nareit; NYSE.
474 See letter from ABA.
475 See letter from NYSE.
476 See Leuz & Verrecchia, The Economic Consequences of Increased Disclosure, 38 J. ACCT. RES. 91 (2000) (“A

brief sketch of the economic theory is as follows. Information asymmetries create costs by introducing adverse
selection into transactions between buyers and sellers of firm shares. In real institutional settings, adverse
selection is typically manifest in reduced levels of liquidity for firm shares (e.g., Copeland and Galai [1983],
Kyle [1985], and Glosten and Milgrom [1985]). To overcome the reluctance of potential investors to hold firm
shares in illiquid markets, firms must issue capital at a discount. Discounting results in fewer proceeds to the

127

should reduce information asymmetry and mispricing of securities. In an asymmetric

information environment, investors are less willing to hold shares, reducing liquidity.

Registrants may respond by issuing shares at a discount, increasing their cost of capital. By

providing more and more credible disclosure, however, companies can reduce the risk of adverse

selection faced by investors and the discount they demand, ultimately increasing liquidity and

decreasing the company’s cost of capital.477 Investors benefit when the companies they are

invested in enjoy higher liquidity. Item 1.05 enables companies to provide more credible

disclosure because currently, investors do not know whether an absence of incident disclosure

means no incidents have occurred, or one has but the company has not yet chosen to reveal it.

By requiring all material incidents to be reported, Item 1.05 supplies investors greater assurance

that, indeed, barring extraordinary circumstances, no disclosure means the company has not been

aware for more than four business days of a material incident having occurred. Similarly, Item

firm and hence higher costs of capital. A commitment to increased levels of disclosure reduces the possibility
of information asymmetries arising either between the firm and its shareholders or among potential buyers and
sellers of firm shares. This, in turn, should reduce the discount at which firm shares are sold, and hence lower
the costs of issuing capital (e.g., Diamond and Verrecchia [1991] and Baiman and Verrecchia [1996]).”).

477 See Douglas W. Diamond & Robert E. Verrecchia, Disclosure, Liquidity, and the Cost of Capital, 46 J. FIN.
1325, 1325–1359 (1991) (finding that revealing public information to reduce information asymmetry can reduce
a company’s cost of capital through increased liquidity). See also Christian Leuz & Robert E. Verrecchia, The
Economic Consequences of Increased Disclosure, 38 J. ACCT. RES. 91 (2000) (providing empirical evidence
that increased disclosure lowers the information asymmetry component of the cost of capital in a sample of
German companies); see also Christian Leuz & Peter D. Wysocki, The Economics of Disclosure and Financial
Reporting Regulation: Evidence and Suggestions for Future Research, 54 J. ACCT. RES. 525 (2016) (providing
a comprehensive survey of the literature on the economic effect of disclosure). Although disclosure could be
beneficial for the company, several conditions must be met for companies to voluntarily disclose all their
private information. See Anne Beyer, et al., The Financial Reporting Environment: Review Of The Recent
Literature, 50 J. ACCT. & ECON. 296, 296-343 (2010) (discussing conditions under which companies voluntarily
disclose all their private information, and these conditions include “(1) disclosures are costless; (2) investors
know that companies have, in fact, private information; (3) all investors interpret the companies’ disclosure in
the same way and companies know how investors will interpret that disclosure; (4) managers want to maximize
their companies’ share prices; (5) companies can credibly disclose their private information; and (6) companies
cannot commit ex-ante to a specific disclosure policy”). Increased reporting could also help determine the
effect of investment on company value. See Lawrence A. Gordon, et al., The Impact of Information Sharing on
Cybersecurity Underinvestment: A Real Options Perspective, 34 (5) J. ACCT. & PUB. POLICY 509, 509-519
(2015) (arguing that “information sharing could reduce the tendency by firms to defer cybersecurity
investments”).

128

106 should also generate more credible disclosure. Currently, voluntary cybersecurity risk

management, strategy, and governance disclosures lack standardization and consistency,

reducing their comparability and usefulness for investors. Without set topics that must be

addressed, companies may disclose only the strongest aspects of their cybersecurity processes, if

they disclose at all. By clarifying what registrants must disclose with respect to their

cybersecurity risk management, strategy, and governance, Item 106 will reduce information

asymmetry and provide investors and other market participants more certainty and easier

comparability of registrants’ vulnerability to and ability to manage cybersecurity breaches,

reducing adverse selection and increasing liquidity. Thus, the final rules could decrease cost of

capital across registrants and increase company value, benefiting investors.

One commenter argued that smaller registrants are less likely than larger registrants to

experience cybersecurity incidents and that cyberattacks are not material for smaller

registrants.478 This could imply that the degree of cybersecurity-driven adverse selection faced

by investors in small registrants might be less severe. If so, the potential benefit from

improvement in liquidity and cost of capital due to the timeliness and information benefits from

the final rules might be smaller for small registrants and their investors. The research this

commenter cited to support this assertion found larger companies were more susceptible than

smaller companies to a particular category of cybersecurity incidents—those involving personal

information lost through hacking by an outside party—which composed less than one-quarter of

478 See comment letter from BIO. The letter argues that the Commission, when citing the study by Kamiya, et al.

(2021) in the Proposing Release, “ignored and omitted” the fact that the mean market capitalization of impacted
companies in this study was $58.9 billion, much higher than the average for small companies, and thus
“cyberattacks mainly affect large companies and are not material for smaller companies.” We observe that an
average market capitalization of impacted companies of $58.9 billion would generally indicate that companies
both larger and smaller than that size were impacted by cyberattacks.

129

all cyber incidents in the sample (1,580 out of 6,382).479 It is possible that malicious strategies

that target personal information are particularly suited to larger, well-known companies, and thus

the research may overstate the degree to which large companies are more susceptible to

cybersecurity incidents generally. These strategies explicitly harm companies’ customers, and

customer ill will is potentially more newsworthy and consequential for a larger, well-known

company as compared to a smaller one. In contrast, ransomware attacks that target non-personal,

internal company operations such as an information technology network, for example, are less

concerned with causing reputational loss and thus may have an optimal target profile that favors

smaller firms as much as larger firms. Additionally, smaller companies may have fewer

resources and weaker processes in place to prevent cybersecurity attacks.480 Hence, it is not clear

that smaller companies experience fewer material cybersecurity incidents generally. Others have

noted that small companies are frequently targeted victims of cyberattacks, potentially leading to

dissolution of the business.481 Thus, overall, we maintain that cybersecurity attacks are material

for smaller reporting companies and that the final rules will serve to benefit them and their

investors.

Overall, Form 8-K Item 1.05 and Regulation S-K Item 106 provide for timely,

informative, and up-to-date disclosure of cybersecurity incidents, as well as disclosure that may

provide insight into whether a registrant is prepared for risks from cybersecurity threats and has

adequate cybersecurity risk management, strategy, and governance measures in place to reduce

479 See Kamiya, et al., supra note 413.
480 See letter from Tenable.
481 See Testimony of Dr. Jane LeClair, Chief Operating Officer, National Cybersecurity Institute at Excelsior

College, before the U.S. House of Representatives Committee on Small Business (Apr. 22, 2015), available at
https://docs.house.gov/meetings/SM/SM00/20150422/103276/HHRG-114-SM00-20150422-SD003-U4
(describing the cybersecurity risks small businesses face and noting “fifty percent of SMB’s have been the
victims of cyberattack and over 60 percent of those attacked go out of business”).

130

the likelihood of future incidents, reducing the likelihood of delayed or incomplete disclosure

and benefiting investors and the market.

We believe enhanced information, timing, and completeness of disclosures as a result of

Form 8-K Item 1.05 and Regulation S-K Item 106 will benefit not only investors but also other

market participants that rely on registrant disclosures to provide services to investors. They,

too, will be able to better evaluate registrants’ cybersecurity preparations and risks and thus

provide better recommendations. We note that the potential benefit of these amendments could

be reduced because some registrants already provide relevant disclosures. That said, we expect

this same information will become more useful due to added context from, and easier

comparisons with, the increased number of other registrants now providing these disclosures.

We are unable to quantify the potential benefit to investors and other market participants

as a result of the increase in disclosure and improvement in pricing under the final rules. Such

estimation requires information about the fundamental value of securities and the extent of the

mispricing. We do not have access to such information and therefore cannot provide a

reasonable estimate. One commenter suggested we use existing cyber disclosure models to

“empirically determine” the current degree of market mispricing, but did not suggest what data

the Commission could use to do so.482 The Commission cannot estimate the effects of

undisclosed cybersecurity incidents that are creating market mispricing, as the relevant

information was never released and the market was unable to react.

b. Greater Uniformity and Comparability

The final rules requiring disclosure about cybersecurity incidents and cybersecurity risk

management, strategy, and governance should also lead to more uniform and comparable

482 See letter from ISA.

131

disclosures, in terms of both content and location, benefiting investors by lowering their search

and information processing costs. Currently, registrants do not always use Form 8-K to report

cybersecurity incidents. Even among registrants that do, reporting practices vary widely.483

Some provide a discussion of materiality, the estimated costs of an incident, or the remedial steps

taken as a result of an incident, while others do not provide such disclosure or provide much less

detail. Disclosures related to risk management, strategy, and governance also vary significantly

across registrants—such information could be disclosed in places such as the risk factors section,

the management’s discussion and analysis section, or not at all. For both types of disclosures,

the final rules specify the topics that registrants should disclose. As a result, both incident

disclosure and risk management, strategy, and governance disclosure should become more

uniform across registrants, making them easier for investors and other market participants to

compare. The final rules also specify the disclosure locations (e.g., Item 1C of Form 10-K),

benefiting investors and other market participants further by reducing the time, cost, and effort it

takes them to search for and retrieve information (as pointed out by commenters 484).

We note that to the extent that the disclosures related to cybersecurity risk management,

strategy, and governance become too uniform or “boilerplate,” the benefit of comparability may

be diminished. However, we believe that Item 106 requires sufficient specificity, tailored to the

registrant’s facts and circumstances, to help mitigate any tendency towards boilerplate

disclosures. Item 106 also provides a non-exclusive list of information that registrants should

disclose, as applicable, which should help in this regard.

483 See Proposing Release at 16594.
484 See, e.g., letters from Better Markets; CalPERS.

132

The requirement to tag the cybersecurity disclosure in Inline XBRL will likely augment

the informational and comparability benefits by making the disclosures more easily retrievable

and usable for aggregation, comparison, filtering, and other analysis. XBRL requirements for

public operating company financial statement disclosures have been observed to mitigate

information asymmetry by reducing information processing costs, thereby making the

disclosures easier to access and analyze.485 While these observations are specific to operating

company financial statement disclosures and not to disclosures outside the financial statements,

such as the cybersecurity disclosures, they suggest that the Inline XBRL requirements should

directly or indirectly (i.e., through information intermediaries such as financial media, data

aggregators, and academic researchers) provide investors with increased insight into

cybersecurity-related information at specific companies and across companies, industries, and

time periods.486 Also, unlike XBRL financial statements (including footnotes), which consist of

tagged quantitative and narrative disclosures, the cybersecurity disclosures consist largely of

tagged narrative disclosures.487 Tagging narrative disclosures can facilitate analytical benefits

485 See, e.g., J.Z. Chen, et al., Information processing costs and corporate tax avoidance: Evidence from the SEC’s

XBRL mandate, 40 J. OF ACCT. AND PUB. POL’Y 2 (finding XBRL reporting decreases likelihood of company tax
avoidance because “XBRL reporting reduces the cost of IRS monitoring in terms of information processing,
which dampens managerial incentives to engage in tax avoidance behavior”). See also P.A. Griffin, et al., The
SEC’s XBRL Mandate and Credit Risk: Evidence on a Link between Credit Default Swap Pricing and XBRL
Disclosure, 2014 AMERICAN ACCOUNTING ASSOCIATION ANNUAL MEETING (2014) (finding XBRL reporting
enables better outside monitoring of companies by creditors, leading to a reduction in company default risk); E.
Blankespoor, The Impact of Information Processing Costs on Firm Disclosure Choice: Evidence from the XBRL
Mandate, 57 J. OF ACC. RES. 919, 919-967 (2019) (finding “firms increase their quantitative footnote disclosures
upon implementation of XBRL detailed tagging requirements designed to reduce information users’ processing
costs,” and “both regulatory and non-regulatory market participants play a role in monitoring firm disclosures,”
suggesting “that the processing costs of market participants can be significant enough to impact firms’
disclosure decisions”).

486 See, e.g., N. Trentmann, Companies Adjust Earnings for Covid-19 Costs, but Are They Still a One-Time
Expense?, WALL ST. J. (2020) (citing an XBRL research software provider as a source for the analysis described
in the article). See also Bloomberg Lists BSE XBRL Data, XBRL.org (2018); R. Hoitash, and U. Hoitash,
Measuring Accounting Reporting Complexity with XBRL, 93 ACCOUNT. REV. 259 (2018).

487 The cybersecurity disclosure requirements do not expressly require the disclosure of any quantitative values; if
a company includes any quantitative values that are nested within the required discussion (e.g., disclosing the

133

such as automatic comparison or redlining of these disclosures against prior periods and the

performance of targeted artificial intelligence or machine learning assessments (tonality,

sentiment, risk words, etc.) of specific cybersecurity disclosures rather than the entire

unstructured document.488

In addition, by formalizing the disclosure requirements related to cybersecurity incidents

and cybersecurity risk management, strategy, and governance, the final rules could reduce

compliance costs for those registrants that are currently providing disclosure about these topics.

The compliance costs would be reduced to the extent that those registrants may be currently

over-disclosing information out of caution, to increase the perceived credibility of their

disclosures, or to signal to investors that they are diligent with regard to cybersecurity. For

instance, the staff has observed that some registrants provide Form 8-K filings even when they

do not anticipate the incident will have a material impact on their business operations or financial

results.489 By specifying that only material incidents require disclosure, the final rules should

ease some of these concerns and reduce costs to the extent those costs currently exist.490

Investors will benefit to the extent the registrants they invest in enjoy lower compliance costs.

number of days until containment of a cybersecurity incident), those values will be individually detail tagged, in
addition to the block text tagging of the narrative disclosures.

488 To illustrate, without Inline XBRL, using the search term “remediation” to search through the text of all
companies’ filings over a certain period of time, so as to analyze the trends in companies’ disclosures related to
cybersecurity incident remediation efforts during that period, could return many narrative disclosures outside of
the cybersecurity incident discussion (e.g., disclosures related to potential environmental liabilities in the risk
factors section). Inline XBRL, however, enables a user to search for the term “remediation” exclusively within
the required cybersecurity disclosures, thereby likely reducing the number of irrelevant results.

489 Based on staff analysis of the 10,941 current and periodic reports in 2022 for companies available in Intelligize
and identified as having been affected by a cybersecurity incident using a keyword search.

490 We note that registrants may still over-disclose due to uncertainty over when a cybersecurity incident crosses
the threshold of materiality. This may impact how fully costs from immaterial incident disclosure are reduced.

134

2. Costs

We also recognize that enhanced cybersecurity disclosure would result in costs to

registrants, borne by investors. These costs include potential increases in registrants’

vulnerability to cybersecurity incidents and compliance costs. We discuss these costs below.

First, the disclosure about cybersecurity incidents and cybersecurity risk management,

strategy, and governance could potentially increase the vulnerability of registrants. Since the

issuance of the 2011 Staff Guidance, concerns have been raised that providing detailed

disclosures of cybersecurity incidents could, potentially, provide a road map for future attacks,

and, if the underlying security issues are not completely resolved, could exacerbate the ongoing

attack.491 The concern is that malicious actors could use the disclosures to potentially gain

insights into a registrant’s practices on cybersecurity. As a result, the final incident disclosure

rules could potentially impose costs on registrants and their investors, if, for example, additional

threat actors steal more data or hamper breach resolution.

The final rules have been modified from the Proposing Release to mitigate disclosure of

details that could aid threat actors, while remaining informative for investors. Form 8-K Item

1.05 will require registrants to timely disclose material cybersecurity incidents, describe the

material aspects of the nature, scope, and timing of the incident, and, importantly, describe the

material impact or reasonably likely material impact of the incident on the registrant. Focusing

on the material impact or reasonably likely material impact of the incident rather than the

specific or technical details of the incident should reduce the likelihood of providing a road map

491 See, e.g., Roland L. Trope & Sarah Jane Hughes, The SEC Staff’s Cybersecurity Disclosure Guidance: Will It

Help Investors or Cyber-Thieves More, 2011 BUS. L. TODAY 2, 1-4 (2011).

135

that threat actors can exploit for future attacks, and should reduce the risks and costs stemming

from threat actors acting in this manner.492

Similar concerns were raised by commenters about the required risk management,

strategy, and governance disclosure.493 Items 106(b) and (c) require registrants to provide

specified disclosure regarding their cybersecurity risk management processes and cybersecurity

governance by the management and board. The required disclosure could provide malicious

actors information about which registrants have weak processes related to cybersecurity risk

management and allow such malicious actors to determine their targets accordingly.

However, academic research so far has not provided evidence that more detailed

cybersecurity risk disclosures necessarily lead to more attacks. For example, one study finds that

measures for specificity (e.g., the uniqueness of the disclosure) do not have a statistically

significant relation with subsequent cybersecurity incidents.494 Another study finds that

cybersecurity risk factor disclosures that involve terms about processes are less likely to be

related to future breach announcements than disclosures that employ more general language.495

On the other hand, we note that the final rules will require more details of cybersecurity

processes than what is explicitly required under the current rules, and the uniformity of the final

rules might also make it easier for malicious actors to identify registrants with relatively weaker

492 Instruction 4 to Item 1.05 provides that a “registrant need not disclose specific or technical information about its

planned response to the incident or its cybersecurity systems, related networks and devices, or potential system
vulnerabilities in such detail as would impede the registrant’s response or remediation of the incident.”

493 See letters from ABA; ACLI; APCIA; BIO; BPI et al.; Business Roundtable; Chamber; CSA; CTIA; EIC;
Enbridge; FAH; Federated Hermes; GPA; ITI; ISA; Nareit; NAM; NMHC; NRA; NRF; SIFMA; Sen. Portman;
TechNet; TransUnion; USTelecom; Virtu; see also supra note 201 and accompanying text.

494 See He Li, Won Gyun No, & Tawei Wang, SEC’s Cybersecurity Disclosure Guidance and Disclosed
Cybersecurity Risk Factors, 30 INT’L. J. OF ACCT. INFO. SYS. 40-55 (2018) (“while Ferraro (2013) criticizes that
the SEC did little to resolve the concern about publicly revealing too much information [that] could provide
potential hackers with a roadmap for successful attacks, we find no evidence supporting such claim”).

495 See Tawei Wang, Karthik N. Kannan, & Jackie Rees Ulmer, The Association Between the Disclosure and the
Realization of Information Security Risk Factors, 24.2 INFO. SYS. RES. 201, 201-218 (2013).

136

processes. Therefore, these academic findings might not be generalizable to the effects of the

final rules.496 However, we also note that we have streamlined the disclosure obligations for

Items 106 (b) and (c), in response to commenters’ concerns, to require a more principles-based

discussion of a registrant’s processes instead of detailed disclosures on a specific set of items.

This change should help ease concerns that the required cybersecurity risk management, strategy,

and governance disclosures will help malicious actors choose targets. In addition, the potential

costs resulting from the disclosure requirements might be partially mitigated to the extent that

registrants decide to enhance their cybersecurity risk management in anticipation of the increased

disclosure. This possibility is discussed below under Indirect Economic Effects.

The final rules will also impose compliance costs. Registrants, and thus their investors,

will incur one-time and ongoing costs to fulfill the new disclosure requirements under Item 106

of Regulation S-K. These costs will include costs to gather the information and prepare the

disclosures. Registrants will also incur compliance costs to fulfill the disclosure requirements

related to Form 8-K (Form 6-K for FPIs) incident disclosure.497 These costs include one-time

costs to implement or revise their incident disclosure practices, so that any registrant that

determines it has experienced a material cybersecurity incident will disclose such incident with

the required information within four business days. Registrants may also incur ongoing costs to

disclose in a Form 8-K report any material changes or updates relating to previously disclosed

incidents, and we expect these costs to be higher for registrants with more incidents to disclose.

The costs will be mitigated for registrants whose current disclosure practices match or are similar

496 We note that the papers we cited above study the effect of voluntary disclosure and the 2011 Staff Guidance,

which could also reduce the generalizability of these studies to the mandatory disclosures under the final rules.
497 We note that the compliance costs related to Form 6-K filings will be mitigated, because a condition of the form

is that the information is disclosed or required to be disclosed elsewhere.

137

to those that are in the final rules. One commenter suggested that companies could incur costs to

reconcile their existing cybersecurity activities and NIST-based best practices with the

requirements of the final rules498 but, as discussed in Section II.C.3.c, the final rules are not in

conflict with NIST and we do not anticipate that significant reconciliation will be needed.

The compliance costs will also include costs attributable to the Inline XBRL tagging

requirements. Many commenters supported the XBRL tagging requirement,499 while one

commenter suggested that it would be burdensome to add tagging given the time-sensitive nature

of the disclosure requirements.500 Various preparation solutions have been developed and used

by operating companies to fulfill XBRL requirements, and some evidence suggests that, for

smaller companies, XBRL compliance costs have decreased over time.501 The incremental

compliance costs associated with Inline XBRL tagging of cybersecurity disclosures will also be

mitigated by the fact that most companies that will be subject to the requirements are already

subject to other Inline XBRL requirements for other disclosures in Commission filings, including

financial statement and cover page disclosures in certain periodic reports and registration

498 See letter from SIFMA.
499 See letters from E&Y; CAQ; PWC; NACD; AICPA; XBRL.
500 See letter from NYC Bar.
501 An AICPA survey of 1,032 reporting companies with $75 million or less in market capitalization in 2018 found

an average cost of $5,850 per year, a median cost of $2,500 per year, and a maximum cost of $51,500 per year
for fully outsourced XBRL creation and filing, representing a 45% decline in average cost and a 69% decline in
median cost since 2014. See AICPA, XBRL Costs for Small Companies Have Declined 45% since 2014 (2018),
available at
https://us.aicpa.org/content/dam/aicpa/interestareas/frc/accountingfinancialreporting/xbrl/downloadabledocum
ents/xbrl-costs-for-small-companies . See also Letter from Nasdaq, Inc. (Mar. 21, 2019) (responding to
Request for Comment on Earnings Releases and Quarterly Reports, Release No. 33-10588 (Dec. 18, 2018) [83
FR 65601 (Dec. 21, 2018)]) (stating that a 2018 NASDAQ survey of 151 listed companies found an average
XBRL compliance cost of $20,000 per quarter, a median XBRL compliance cost of $7,500 per quarter, and a
maximum XBRL compliance cost of $350,000 per quarter).

138

statements.502 Such companies may be able to leverage existing Inline XBRL preparation

processes and expertise in complying with the cybersecurity disclosure tagging requirements.

Moreover, the one-year XBRL compliance period extension could further assuage concerns

about the transition for registrants to comply with the new requirements.503

Some commenters contended that the Proposing Release failed to consider the costs of

the proposed rules adequately.504 We are generally unable to quantify costs related to the final

rules due to a lack of data. For example, we are unable to quantify the impact of any increased

vulnerability to existing or new threat actors arising from the required incident or risk

management, strategy, or governance disclosures. Moreover, costs related to preparing cyber-

related disclosures are generally private information known only to the issuing firm, hence such

data are not readily available to the Commission. There is also likely considerable variation in

these costs depending on a given firm’s size, industry, complexity of operations, and other

characteristics, which makes comprehensive estimates difficult to obtain. We note that the

Commission has provided certain estimates for purposes of compliance with the Paperwork

Reduction Act of 1995, as further discussed in Section V below. Those estimates, while useful

to understanding the collection of information burden associated with the final rules, do not

purport to reflect the full costs associated with making the required disclosures.

One commenter provided a numerical cost estimate, stating the initial costs of complying

with the proposed rules would be $317.5 million to $523.4 million ($38,690 to $69,151 per

regulated company), and future annual costs would be $184.8 million to $308.1 million ($22,300

502 See 17 CFR 229.601(b)(101) and 17 CFR 232.405 (for requirements related to tagging financial statements,

including footnotes and schedules in Inline XBRL). See 17 CFR 229.601(b)(104) and 17 CFR 232.406 (for
requirements related to tagging cover page disclosures in Inline XBRL).

503 See supra Section II.I.
504 See, e.g., letters from Chamber and SIFMA.

139

to $37,500 per regulated company).505 We cannot directly evaluate the accuracy of these

estimates because the commenter did not provide any explanation for how they were derived.

We believe, however, these estimates likely significantly overstate the costs of the final rules.

First, the commenter overestimates the number of registrants who are likely to bear the

full costs of new disclosures. Converting the total and per company cost estimates to registrant

counts implies the commenter assumed these costs would be borne by approximately 8,000

companies, which would be nearly every registrant.506 As stated in Section IV.B.2 above,

however, 73 percent of domestic filers in 2022 already made cybersecurity-related disclosures

in Form 10-K filings and amendments, and 35 Form 8-K filings disclosed material

cybersecurity incidents.507 While the degree to which registrants’ existing disclosures already

may be in line with the requirements of the final rules varies—some registrants may need to

make significant changes while others may not, especially given the guidance from the 2018

Interpretive Release—most registrants should not bear the full costs of compliance. In addition,

while cybersecurity incident disclosure is expected to increase as a result of Item 1.05, we do not

expect that most companies will need to report in any given year. Extrapolating from the current

numbers of incidents reported—for example, public companies disclosed 188 reported breaches

in 2021508—we expect that the overwhelming majority of registrants will not experience a

material breach and will not need to disclose cybersecurity incidents and incur the ongoing

505 See letter from Chamber.
506 $317.5 million divided by $38,690 per registrant equals 8,206 registrants; $523.4 million divided by $69,151

per registrant equals 7,569 registrants; $184.8 million divided by $22,300 per registrant equals 8,287 registrants;
$308.1 million divided by $37,500 per registrant equals 8,216 registrants. In Section IV.B.2, supra, we find the
number of affected parties to include approximately 7,300 operating companies filing on domestic forms and
1,174 FPIs filing on foreign forms.

507 See supra notes 456 and 457 and accompanying text.
508 See supra note 426 and accompanying text.

140

associated costs.509 They may, however, revisit their disclosure controls initially, to ensure they

are capturing what the rule requires.

Second, we have made changes from the proposed rules that would also reduce costs as

compared with the proposal. Some of these changes concerned aspects of the proposed rules that

the commenter noted would be burdensome. For example, the commenter states that “potential

material incidents in the aggregate would be difficult to identify and operationally challenging to

track.”510 The commenter also states “the SEC underestimates the burdens related to tracking

‘several small but continuous cyberattacks against a company,’ which may or may not prove to

be material.”511 These comments refer to proposed Item 106(d)(2), which would have required

disclosure when a series of previously undisclosed individually immaterial cybersecurity

incidents become material in the aggregate. In response to comments, we are not adopting this

aspect of the proposal and instead have added “a series of related unauthorized occurrences” to

the definition of “cybersecurity incident,” which may help address this concern about the burden

of the proposal. The comment letter also stated that “cybersecurity talent is scar[c]e globally.

From a personnel standpoint, it’s unclear where companies would get the so-called cybersecurity

experts that the proposed regulation would mandate. There is a well-documented lack of

cybersecurity talent for the public and private sectors that would unquestionably affect

companies’ recruitment of board cybersecurity experts.”512 We are not adopting proposed 407(j)

about the cybersecurity expertise, if any, of a registrant’s board members, which may have

factored into the commenter’s cost estimates. Additionally, the proposal would not have

509 This conclusion is based on relative quantities. Note that 188 is very small relative to the total number of

registrants, 8,474, from Section IV.B.2 (188 divided by 8,474 is roughly 2%).
510 See letter from Chamber.
511 Id.
512 Id.

141

mandated recruitment of cybersecurity experts, only disclosure of their presence. Additional

streamlining of requirements in the final rules (e.g., reduced granularity of cybersecurity incident

disclosure requirements) should further reduce costs from what might have been estimated using

the Proposing Release.

Another commenter stated that the Commission’s calculation of costs and benefits does

not adequately address the impact of different but overlapping disclosure and reporting

requirements that may escalate burdens and costs.513 We acknowledge the possibility that to the

extent different information has to be reported pursuant to different regulations, laws, or other

requirements, there could be a greater cost because of the demands to keep track of and manage

the multiple different disclosure regimes. However, to the extent that certain other existing

requirements may involve monitoring cybersecurity incidents or assessing an incident’s impact

on the registrant, the registrant may be able to leverage existing disclosures to reduce the burden

of complying with the final rules. Additionally, as noted in Section II.A.3 those other

regulations generally serve different purposes than the final rules, and we believe that the

benefits of the final rules justify the costs.

One commenter raised a concern that the costs of the rules reached the threshold of an

“economically significant rulemaking” under the Unfunded Mandate Reform Act of 1995

(“UMRA”) and the Small Business Regulatory Enforcement Fairness Act, thus requiring an

“enhanced economic analysis.”514 The requirement to issue an analysis under the UMRA does

not apply to rules issued by independent regulatory agencies.515

513 See letter from SIFMA.
514 See letter from Chamber.
515 See 2 U.S.C. 658 (“The term ‘agency’ has the same meaning as defined in section 551(1) of title 5, United

States Code, but does not include independent regulatory agencies.”). See also Congressional Research Service,

142

The compliance costs of the final rules could be disproportionately burdensome to

smaller registrants, as some of these costs may have a fixed component that does not scale with

the size of the registrant.516 Also, smaller registrants may have fewer resources with which to

implement these changes.517 One commenter suggested this could lead some small companies

seeking to conduct an initial public offering to reconsider.518 Commenters also noted that smaller

companies may not yet have a mature reporting regime and organizational structure and would

benefit from an onramp to compliance.519 We are not adopting some proposed requirements

(e.g., disclosing whether the board includes a cybersecurity expert), and thus the cost burden of

the final rules should not be as high as initially proposed. We also are delaying compliance for

incident disclosure for smaller reporting companies by providing an additional phase-in period of

180 days after the non-smaller reporting company compliance date for smaller reporting

companies, which will delay compliance with these requirements for 270 days from

effectiveness of the rules.520 To the extent smaller reporting companies are less likely than larger

companies to have incident disclosure processes in place, they could benefit from additional time

to comply. An extended compliance date may also permit smaller reporting companies to

benefit from seeing how larger companies implement these disclosures. Investors in these

smaller registrants could benefit from higher disclosure quality afforded by the delay, although

Unfunded Mandates Reform Act: History, Impact, and Issues (July 17, 2020), available at
https://sgp.fas.org/crs/misc/R40957 (noting “[UMRA] does not apply to duties stemming from participation
in voluntary federal programs [or] rules issued by independent regulatory agencies”).

516 See infra Section VI.
517 See, e.g., letter from SBA.
518 See letter from BIO.
519 See, e.g., letter from BIO.
520 See supra Section II.I.

143

some benefits, such as the reduction in asymmetric information and mispricing, would also be

delayed.

3. Indirect Economic Effects

While the final rules only require disclosures—not changes to risk management

practices—the requirement to disclose and the disclosures themselves could result in certain

indirect benefits and costs. In anticipating investor reactions to the required disclosures, for

example, registrants might devote more resources to cybersecurity governance and risk

management in order to be able to disclose those efforts. Although not the purpose of this rule,

registrants devoting resources to cybersecurity governance and risk management could reduce

both their susceptibility to a cybersecurity attack, reducing the likelihood of future incidents, as

well as the degree of harm suffered from an incident, benefiting registrants and investors. The

choice to dedicate these resources would also represent an indirect cost of the final rules, to the

extent registrants do not already have governance and risk management measures in place. As

with compliance costs, the cost of improving cybersecurity governance and risk management

could be proportionally higher for smaller companies if these registrants have fewer resources to

implement these changes, and to the extent these costs do not scale with registrant size.

In addition, the requirement to tag the cybersecurity disclosure in Inline XBRL could

have indirect effects on registrants. As discussed in Section III.C.1.a.(ii), XBRL requirements

for public operating company financial statement disclosures have been observed to reduce

information processing cost. This reduction in information processing cost has been observed to

facilitate the monitoring of registrants by other market participants, and, as a result, to influence

registrants’ behavior, including their disclosure choices.521

521 See supra note 485.

144

The requirement in Item 1.05 that registrants timely disclose material cybersecurity

incidents could also indirectly affect consumers, and external stakeholders such as other

registrants in the same industry and those facing similar cybersecurity threats. Cybersecurity

incidents can harm not only the company that suffers the incident but also other businesses and

consumers. For example, a cybersecurity breach at one company, such as a gas pipeline, or a

power company, may cause a major disruption or shutdown of a critical infrastructure industry,

resulting in broad losses throughout the economy.522 Timely disclosure of cybersecurity

incidents required by Item 1.05 could increase awareness by those external stakeholders and

companies in the same industry that the malicious activities are occurring, giving them more

time to mitigate any potential damage.

To the extent that Item 1.05 increases incident disclosure, consumers may learn about a

particular cybersecurity breach and therefore take appropriate actions to limit potential economic

harm that they may incur from the breach. For example, there is evidence that increased

disclosure of cybersecurity incidents by companies can reduce the risk of identity theft for

individuals.523 Also, consumers may be able to make better informed decisions about which

companies to entrust with their personal information.

522 See Lawrence A. Gordon, et al., Externalities and the Magnitude of Cyber Security Underinvestment by Private

Sector Firms: A Modification of the Gordon-Loeb Model, 6 J. INFO. SEC. 24, 25 (2015) (“Firms in the private
sector of many countries own a large share of critical infrastructure assets. Hence, cybersecurity breaches in
private sector firms could cause a major disruption of a critical infrastructure industry (e.g., delivery of
electricity), resulting in massive losses throughout the economy, putting the defense of the nation at risk.”). See
also Collin Eaton and Dustin Volz, U.S. Pipeline Cyberattack Forces Closure, WALL ST. J. (MAY 8, 2021),
available at https://www.wsj.com/articles/cyberattack-forces-closure-of-largest-u-s-refined-fuel-pipeline-
11620479737.

523 See Sasha Romanosky, Rahul Telang, and Alessandro Acquisti, Do Data Breach Disclosure Laws Reduce
Identity Theft?, 30 (2) J. OF POL’Y. ANALYSIS AND MGMT. 272, 256-286 (2011) (finding that the adoption of
State-level data breach disclosure laws reduced identity theft by 6.1%).

145

As discussed above, to the extent that registrants may decide to enhance their

cybersecurity risk management in anticipation of the increased disclosure, that could reduce

registrants’ susceptibility to and damage incurred from a cybersecurity attack. This reduced

likelihood of and vulnerability to future incidents could reduce the negative externalities of those

incidents, leading to positive spillover effects and a reduction in overall costs to society from

these attacks.

However, the magnitude of this and the other indirect effects discussed above would

depend upon factors outside of the specific disclosures provided in response to the final rule, and

therefore it is difficult to assess with certainty the likelihood or extent of these effects.

D. Effects on Efficiency, Competition, and Capital Formation

We believe the final rules should have positive effects on market efficiency. As

discussed above, the final rules should improve the timeliness and informativeness of

cybersecurity incident and risk disclosure. As a result of the disclosure required by the final

rules, investors and other market participants should better understand the cybersecurity threats

registrants are facing, their potential impact, and registrants’ ability to respond to and manage

risks. Investors and other market participants should thereby better evaluate registrants’

securities and make more informed decisions. As a result, the required disclosures should reduce

information asymmetry and mispricing in the market, improving market efficiency. More

efficient prices should improve capital formation by increasing overall public trust in markets,

leading to greater investor participation and market liquidity.

The final rules also could promote competition among registrants with respect to

improvement in both their cybersecurity risk management and transparency in communicating

their cybersecurity processes. To the extent investors view strong cybersecurity risk

146

management, strategy, and governance favorably, registrants disclosing more robust processes,

more clearly, could benefit from greater interest from investors, leading to higher market

liquidity relative to companies that do not. Customers may also be more likely to entrust their

business to companies that protect their data. Registrants that to date have invested less in

cybersecurity preparation could thus be incentivized to invest more, to the benefit of investors

and customers, in order to become more competitive. To the extent that increased compliance

costs resulting from the final rules prevent smaller companies from entering the market, as a

commenter suggested,524 the final rules could reduce the ability of smaller companies to compete

and thereby reduce competition overall.

E. Reasonable Alternatives

1. Website Disclosure

As an alternative to Form 8-K disclosure of material cybersecurity incidents, we

considered providing registrants with the option of disclosing this information instead through

company websites, if the company disclosed its intention to do so in its most recent annual

report, and subject to information availability and retention requirements. While this approach

may be less costly for the company because it may involve fewer compliance costs, disclosures

made on company websites would not be located in a central depository, such as the EDGAR

system,525 and would not be in the same place as other registrants’ disclosures of material

cybersecurity incidents, nor would they be organized into the standardized sections found in

Form 8-K and could thus be less uniform. Even if we required registrants to announce the

524 See letter from BIO.
525 EDGAR, the Electronic Data Gathering, Analysis, and Retrieval system, is the primary system for companies

and others submitting documents under the Securities Act, the Exchange Act, the Trust Indenture Act of 1939,
and the Investment Company Act. EDGAR’s public database can be used to research a public company’s
financial information and operations.

147

disclosure, or to alert the Commission to it, the information would still be more difficult for

investors and market participants to locate and less uniform than Form 8-K.

The lack of a central repository, and a lack of uniformity of website disclosures, could

increase the costs for investors and other market participants to search for and process the

information to compare cybersecurity risks across registrants. Additionally, such disclosure

might not be preserved on the company’s website for as long as it would be on the EDGAR

system when the disclosure is filed with the Commission, because registrants may not keep

historical information available on their websites indefinitely and it could be difficult to

determine whether the website information had moved or changed. Therefore, this approach

would be less beneficial to investors, other market participants, and the overall efficiency of the

market.

2. Disclosure through Periodic Reports

We also considered requiring disclosure of material cybersecurity incidents through

quarterly or annual reports, as proposed, instead of Form 8-K. Reporting material cybersecurity

incidents at the end of the quarter or year would allow registrants more time to assess the

financial impact of such incidents. The resulting disclosure might be more specific or

informative for investors and other market participants to value the securities and make more

informed decisions. The compliance costs would be less under this alternative, because

registrants would not have to file as frequently. And, it might further reduce the risk that

disclosure could provide timely information to attackers.

However, this alternative also would lead to less timely reporting on material

cybersecurity incidents. As a result, the market would not be able to incorporate the information

related to cybersecurity risk into securities prices in as timely a manner, and investors and other

148

market participants would not be able to make as informed decisions as they could under the

requirements of Item 1.05. Additionally, as previously discussed, less timely reporting could

adversely impact external stakeholders, such as other registrants in the same industry and those

facing similar cybersecurity threats, and consumers whose data were compromised.

Relatedly, we proposed requiring registrants to disclose material changes and additions to

previously reported cybersecurity incidents on Forms 10-K and 10-Q instead of on an amended

Form 8-K. However, as discussed above, we believe using Form 8-K would be more timely and

consistent;526 all disclosures concerning material cybersecurity incidents, whether new or

containing information not determined or unavailable initially, will be disclosed on the same

form.

3. Exempt Smaller Reporting Companies

We also considered exempting smaller reporting companies from the final rules.527

Exempting smaller reporting companies from the disclosure requirements of the final rules

would avoid compliance costs for smaller companies, including those compliance costs that

could disproportionately affect smaller companies.528 As noted earlier, however, we are not

adopting some proposed requirements (e.g., disclosing whether the board includes a

cybersecurity expert) and modifying others (e.g., requiring a description of cybersecurity

“processes” instead of more formal “policies and procedures”), and thus the cost burden of the

final rules should not be as high as initially proposed. This should mitigate some of the concerns

raised by commenters and would also reduce the potential value of an exemption. Moreover, an

exemption would remove the benefit to investors of informative, timely, uniform, and

526 See supra Section II.B.3.
527 See supra Section II.G.2.
528 See supra Section II.G.2

149

comparable disclosure with regard to smaller companies. And although one commenter argued

for an exemption based on a perception that smaller companies are less likely to experience

cybersecurity incidents,529 for the reasons explained in Section IV.C.1.b, we believe that smaller

companies are still at risk for material cybersecurity incidents. This aligns with comments we

received opposing an exemption for smaller reporting companies.530

Lastly, one commenter that argued for an exemption cited the Proposing Release, which

noted a potential for increased cost of capital for registrants that do not have cybersecurity

programs once disclosures are mandated; the commenter stated that these would

disproportionately be smaller registrants.531 We have reconsidered the argument that registrants

without robust cybersecurity processes in place might face a higher cost of capital and as a result

would be priced unfavorably, and no longer believe it to be accurate. It is indeed possible that

companies that reveal what investors consider to be less robust cybersecurity risk management,

strategy, and governance processes may experience a decline in stock price. However, because

the risk of cybersecurity attacks should be idiosyncratic, this decline would likely be due to

investors updating their expectations of future cash flows for this firm to incorporate higher

likelihood of a future incident—moderating the decline should future incidents occur—not an

increase in fundamental market risk and thus cost of capital. In addition, to the extent investors

already rationally anticipate that smaller registrants or registrants that have not previously

disclosed such information have less robust policies, there may be less or no stock price decline

as a result of Item 106, as these disclosures would merely confirm expectations. Thus, increases

529 See letter from BIO.
530 See, e.g., letters from Cybersecurity Coalition; Tenable.
531 See letter from BIO.

150

in cost of capital should not be prevalent in this regard and should not be a reason to exempt

small firms from the final rules.

V. PAPERWORK REDUCTION ACT

A. Summary of the Collections of Information

Certain provisions of our rules and forms that will be affected by the final rules contain

“collection of information” requirements within the meaning of the Paperwork Reduction Act

(“PRA”).532 The Commission published a notice requesting comment on changes to these

collections of information in the Proposing Release and submitted these requirements to the

Office of Management and Budget (“OMB”) for review in accordance with the PRA.533

The hours and costs associated with preparing, filing, and sending the forms constitute

reporting and cost burdens imposed by each collection of information. An agency may not

conduct or sponsor, and a person is not required to comply with, a collection of information

unless it displays a currently valid OMB control number. Compliance with the information

collections is mandatory. Responses to the information collections are not kept confidential and

there is no mandatory retention period for the information disclosed. The titles for the affected

collections of information are:534

• “Form 8-K” (OMB Control No. 3235-0060);

• “Form 6-K” (OMB Control No. 3235-0116);

• “Form 10-K” (OMB Control No. 3235-0063); and

• “Form 20-F” (OMB Control No. 3235-0288).

532 44 U.S.C. 3501 et seq.
533 44 U.S.C. 3507(d) and 5 CFR 1320.11.
534 The Proposing Release also listed “Schedule 14A” (OMB Control No. 3235-0059), “Schedule 14C” (OMB

Control No. 3235-0057), and “Form 10-Q” (OMB Control No. 3235-0070) as affected collections of
information. However, under the final rules, these schedules and form are no longer affected.

I. Introduction and Background

II. Discussion of Final Amendments

A. Disclosure of Cybersecurity Incidents on Current Reports

1. Proposed Amendments

2. Comments

3. Final Amendments

B. Disclosures about Cybersecurity Incidents in Periodic Reports

1. Proposed Amendments

2. Comments

3. Final Amendments

C. Disclosure of a Registrant’s Risk Management, Strategy and Governance Regarding Cybersecurity Risks

1. Risk Management and Strategy

a. Proposed Amendments

b. Comments

c. Final Amendments

2. Governance

a. Proposed Amendments

b. Comments

c. Final Amendments

3. Definitions

a. Proposed Definitions

b. Comments

c. Final Definitions

D. Disclosure Regarding the Board of Directors’ Cybersecurity Expertise

1. Proposed Amendments

2. Comments

3. Final Amendments

E. Disclosure by Foreign Private Issuers

1. Proposed Amendments

2. Comments

3. Final Amendments

F. Structured Data Requirements

1. Proposed Amendments

2. Comments

3. Final Amendments

G. Applicability to Certain Issuers

1. Asset-Backed Issuers

2. Smaller Reporting Companies

H. Need for New Rules and Commission Authority

I. Compliance Dates

III. OTHER MATTERS

IV. ECONOMIC ANALYSIS

A. Introduction

B. Economic Baseline

1. Current Regulatory Framework

2. Affected Parties

C. Benefits and Costs of the Final Rules

1. Benefits

a. More Timely and Informative Disclosure

b. Greater Uniformity and Comparability

2. Costs

3. Indirect Economic Effects

D. Effects on Efficiency, Competition, and Capital Formation

E. Reasonable Alternatives

1. Website Disclosure

2. Disclosure through Periodic Reports

3. Exempt Smaller Reporting Companies

V. PAPERWORK REDUCTION ACT

A. Summary of the Collections of Information

B. Summary of Comment Letters and Revisions to PRA Estimates

C. Effects of the Amendments on the Collections of Information

D. Incremental and Aggregate Burden and Cost Estimates for the Final Amendments

VI. FINAL REGULATORY FLEXIBILITY ANALYSIS

A. Need for, and Objectives of, the Final Amendments

B. Significant Issues Raised by Public Comments

1. Estimate of Affected Small Entities and Impact to Those Entities

2. Consideration of Alternatives

C. Small Entities Subject to the Final Amendments

D. Projected Reporting, Recordkeeping, and other Compliance Requirements

E. Agency Action to Minimize Effect on Small Entities

Statutory Authority

Expert paper writers are just a few clicks away

Place an order in 3 easy steps. Takes less than 5 mins.

Calculate the price of your order

Type of paper needed:

Pages:

You will get a personal manager and a discount.

Academic level:

We'll send you the first draft for approval by at

Total price:

$0.00