In July 2023, the SEC adopted new cybersecurity disclosure rules for public companies, which include new 8‑K reporting requirements that are effective beginning December 18, 2023 and new 10‑K or 20‑F annual report disclosure requirements that are due for all fiscal years ending on or after December 15, 2023. Thus, all calendar year companies will have to include the new disclosure in their annual reports.

Under the new rules, a Form 8‑K must be filed within four business days of the company’s determination that it has experienced a material cyber incident. The company must disclose the following information to the extent the information is known at the time of the Form 8‑K filing:

• When the incident was discovered;
• Whether the incident is ongoing;
• A brief description of the nature and scope of the incident;
• Whether any data was stolen, altered, accessed, or used for any other unauthorized purpose;
• The effect of the incident on the registrant’s operations; and
• Whether the registrant has remediated or is currently remediating the incident.

Under the new rule, “a registrant shall make a materiality determination regarding a cybersecurity incident as soon as reasonably practicable after discovery of the incident.” Therefore, the timing of 8‑K disclosure will be tricky, since it can be weeks or more for a company to determine whether an incident is material and, if so, how it will impact the company’s results of operations, depending on the nature and scope of the incident, and the industry in question.

For foreign private issuers, Form 6‑K will require companies to furnish information on material cybersecurity incidents that they make, or are required to make public or otherwise disclose in a foreign jurisdiction to any stock exchange or to security holders.

For annual reports on Form 10‑K, expanded disclosure of cyber incidents will include:

• companies’ processes for assessing, identifying, and managing material risks from cybersecurity threats;

• whether any risks from cybersecurity threats, including in the context of any previous cybersecurity incidents, have materially impacted or are reasonably likely to materially impact the company and/or its results of operations; and

• a description of the directors’ oversight of risks from cybersecurity threats and management’s role and expertise in assessing and managing material risks from cybersecurity threats.

Some of the information required by the second bullet above is already required in the MD&A section of the company’s annual or quarterly reports, so consistency with prior reports is something that should be considered. Form 20‑F for foreign private issuers will require similar disclosure.

We recommend that companies consider as soon as possible what kind of disclosure they would like to see in their annual reports, and that any substantive changes in policies are effected before year‑end so that they can be reflected in the new disclosure.