Privacy & Information Security Law Blog

On March 9, 2022, the Securities and Exchange Commission (“SEC”) held an open meeting and proposed new cybersecurity disclosure rules for public companies by a 3-1 vote. If adopted, the new rules would impose substantial new reporting obligations with respect to material cybersecurity incidents and cybersecurity risk management, strategy, and governance for both domestic and foreign private issuers subject to the reporting requirements under the Securities Exchange Act of 1934.

The proposed rules are motivated by what the SEC staff and several commissioners characterized as shortcomings in the current disclosure regime, which they believe have led to public company cybersecurity disclosures that are inconsistent in their level of detail, timing, and placement. In proposing the rules, the SEC hopes to improve the consistency and comparability of cybersecurity disclosures among public companies. The proposal posits that investors would benefit from more timely and consistent disclosures regarding material cybersecurity incidents, due to the potential impact that such incidents can have on the financial performance or position of a company, and that investors would be able to better assess whether and how companies are managing cybersecurity risks across companies and industries.

Key Definitions

Under the proposed rules, the following key terms are defined as follows:

• “Cybersecurity incident” means an unauthorized occurrence on or conducted through a company’s information systems that jeopardizes the confidentiality, integrity, or availability of its information systems or any information residing therein. What constitutes a “cybersecurity incident” for purposes of the proposal should, according to the proposing release, be construed broadly and may result from any one or more of the following: an accidental exposure of data, a deliberate action or activity to gain unauthorized access to systems or to steal or alter data, or other system compromises or data breaches.
• “Cybersecurity threat” means any potential occurrence that may result in an unauthorized effort to adversely affect the confidentiality, integrity, or availability of a company’s information systems or any information residing therein.
• “Information systems” means information resources, owned or used by a company, including physical or virtual infrastructure controlled by such information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of the company’s information to maintain or support the registrant’s operations.

Current Reporting on Form 8-K and Form 6-K

A central element of the proposal is the amendment of Form 8-K to add Item 1.05, which would require domestic public companies to disclose information about a cybersecurity incident within four business days after the company determines that it has experienced a material cybersecurity incident. The proposal notes that in some cases, the date of the company’s materiality determination may coincide with the date of discovery of an incident, but in other cases the materiality determination will come after the discovery date. The new disclosure would require the following information about a material cybersecurity incident, to the extent the information is known at the time of the Form 8-K filing:

• When the incident was discovered and whether it is ongoing;
• A brief description of the nature and scope of the incident;
• Whether any data was stolen, altered, accessed, or used for any other unauthorized purpose;
• The effect of the incident on the registrant’s operations; and
• Whether the company has remediated or is currently remediating the incident.

A company’s materiality determination would be based on existing principles as explained by the SEC and courts over the years. The proposal includes a non-exclusive list of examples of cybersecurity incidents that may, if determined to be material, trigger the proposed Item 1.05 disclosure requirement:

• An unauthorized incident that has compromised the confidentiality, integrity, or availability of an information asset (data, system, or network), or violated the registrant’s security policies or procedures. Such incidents may stem from the accidental exposure of data or from a deliberate attack to steal or alter data;
• An unauthorized incident that caused degradation, interruption, loss of control, damage to, or loss of operational technology systems;
• An incident in which an unauthorized party accessed, or a party exceeded authorized access, and altered, or has stolen sensitive business information, personally identifiable information, intellectual property, or information that has resulted, or may result, in a loss or liability for the company;
• An incident in which a malicious actor has offered to sell or has threatened to publicly disclose sensitive company data; or,
• An incident in which a malicious actor has demanded payment to restore company data that was stolen or altered.

Failure to file a timely Form 8-K under Item 1.05 would not lead to the loss of eligibility to offer securities on Form S-3, nor would such a failure be deemed an automatic violation of the antifraud provisions of Rule 10b-5. Under the proposal, foreign private issuers not subject to reporting on Form 8-K would instead be required to furnish Form 6-K to report material cybersecurity incidents.

Disclosure about Cybersecurity Incidents in Periodic Reports

In order to balance the need for prompt and timely disclosure regarding material cybersecurity incidents with the fact that a company may not have complete information about a material cybersecurity incident at the time it determines the incident to be material, proposed Item 106(d)(1) of Regulation S-K would require companies to disclose any material changes, additions, or updates to information required to be disclosed pursuant to Item 1.05 of Form 8-K in the company’s quarterly report on Form 10-Q or annual report on Form 10-K for the period in which the material change, addition, or update occurred. According to the SEC, proposed Item 106(d)(1) provides a means for investors to receive regular updates regarding the previously reported incident when and for so long as there are material changes, additions, or updates during a given reporting period. For example, the proposing release suggests that after filing the initial Form 8-K disclosure, a company may become aware of additional material information about the scope of the incident and whether any data was stolen or altered, in which case the proposed Item 106(d)(1) disclosure requirements would allow investors to stay informed of such developments. Proposed Item 106(d)(1) lists the following non-exclusive examples of the types of disclosures that should be provided, if applicable:

• Any material impact of the incident on the company’s operations and financial condition;
• Any potential material future impacts on the company’s operations and financial condition;
• Whether the company has remediated or is currently remediating the incident; and
• Any changes in the company’s policies and procedures as a result of the cybersecurity incident, and how the incident may have informed such changes.

Additionally, the proposing release indicates that public companies would on an ongoing basis need to analyze related cybersecurity incidents for materiality, both individually and in the aggregate. Proposed Item 106(d)(2) would require disclosure when a series of previously undisclosed individually immaterial cybersecurity incidents become material in the aggregate. Item 106(d)(2) would require disclosure of when the incidents were discovered and whether they are ongoing; a brief description of the nature and scope of such incidents; whether any data was stolen or altered; the impact of such incidents on the registrant’s operations and the registrant’s actions; and whether the registrant has remediated or is currently remediating the incidents. The proposing release notes that while such incidents conceptually could take a variety of forms, one example requiring disclosure would be where one malicious actor engages in several smaller but continuous cyber-attacks related in time and form against the same company and collectively they are either quantitatively or qualitatively material, or both.

Disclosure Regarding Risk Management, Strategy and Governance

The proposed rules also amend Form 10-K to require disclosure around cybersecurity risk management, strategy, and governance, each as specified in Items 106(b) and 106(c) of Regulation S-K. Specifically, Proposed Item 106(b) would require public companies to disclose their policies and procedures, if any, to identify and manage cybersecurity risks and threats, including: operational risk; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. As proposed, Item 106(b) of Regulation S-K would require disclosure, as applicable, of whether:

• The company has a cybersecurity risk assessment program (and if so, the company must provide a description of such program);
• The company engages assessors, consultants, auditors, or other third parties in connection with any cybersecurity risk assessment program;
• The company has policies and procedures to oversee and identify the cybersecurity risks associated with its use of any third-party service provider (including, but not limited to, those providers that have access to the registrant’s customer and employee data), including whether and how cybersecurity considerations affect the selection and oversight of these providers and contractual and other mechanisms the company uses to mitigate cybersecurity risks related to these providers;
• The company undertakes activities to prevent, detect, and minimize effects of cybersecurity incidents;
• The company has business continuity, contingency, and recovery plans in the event of a cybersecurity incident;
• Previous cybersecurity incidents have informed changes in the registrant’s governance, policies and procedures, or technologies;
• Cybersecurity related risk and incidents have affected or are reasonably likely to affect the registrant’s results of operations or financial condition (and if so, how); and
• Cybersecurity risks are considered as part of the registrant’s business strategy, financial planning, and capital allocation (and if so, how).

Furthermore, proposed Item 106(c) would require disclosure of a company’s cybersecurity governance, including the board’s oversight of cybersecurity risks and a description of management’s role in assessing and managing cybersecurity risks, the relevant expertise of such management, and its role in implementing the registrant’s cybersecurity policies, procedures, and strategies. Regarding the board’s oversight of cybersecurity risk, disclosure required by proposed Item 106(c)(1) would include a discussion, as applicable, of the following:

• Whether the entire board, specific board members or a board committee is responsible for the oversight of cybersecurity risks;
• The processes by which the board is informed about cybersecurity risks, and the frequency of its discussions on this topic; and
• Whether and how the board or board committee considers cybersecurity risks as part of its business strategy, risk management, and financial oversight.

Proposed Item 106(c)(2) would require a description of management’s role in assessing and managing cybersecurity-related risks and in implementing the company’s cybersecurity policies, procedures, and strategies. Under the proposal, this description would include, but not be limited to, the following information:

• Whether certain management positions or committees are responsible for measuring and managing cybersecurity risk, specifically the prevention, mitigation, detection, and remediation of cybersecurity incidents, and the relevant expertise of such persons or members;
• Whether the company has a designated a chief information security officer, or someone in a comparable position, and if so, to whom that individual reports within the registrant’s organizational chart, and the relevant expertise of any such persons;
• The processes by which such persons or committees are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents; and
• Whether and how frequently such persons or committees report to the board of directors or a committee of the board of directors on cybersecurity risk.

Disclosure Regarding Board Cybersecurity Expertise

The proposal would also amend Item 407 of Regulation S-K by adding paragraph (j) to require disclosure in Form 10-K or the proxy statement about the cybersecurity expertise of members of the board of directors. If any member of the board has cybersecurity expertise, the company would have to disclose the names of such directors, and provide such detail as necessary to fully describe the nature of the expertise. Proposed Item 407(j) would not define what constitutes “cybersecurity expertise,” given that such expertise may cover different experiences, skills, and tasks. Instead, it would include the following non-exclusive list of criteria that a company should consider in reaching a determination on whether a director has expertise in cybersecurity:

• Whether the director has prior work experience in cybersecurity, including, for example, prior experience as an information security officer, security policy analyst, security auditor, security architect or engineer, security operations or incident response manager, or business continuity planner;
• Whether the director has obtained a certification or degree in cybersecurity; and
• Whether the director has knowledge, skills, or other background in cybersecurity, including, for example, in the areas of security policy and governance, risk management, security assessment, control evaluation, security architecture and engineering, security operations, incident handling, or business continuity planning.

Proposed Item 407(j)(2) would state that a person who is determined to have expertise in cybersecurity will not be deemed an expert for any purpose, including, for purposes of Section 11 of the Securities Act of 1933, as a result of being designated or identified as a director with expertise in cybersecurity.

Disclosure by Foreign Private Issuers

Because foreign private issuers are not subject to the same filing requirements as domestic issuers, the proposal would amend Form 20-F to require a foreign private issuer to include in its annual report on Form 20-F the same type of disclosure as would be required under proposed Items 106 and 407(j) of Regulation S-K. With respect to incident disclosure, when a foreign private issuer has previously reported an incident on Form 6-K, the proposed amendments would require an update regarding such incidents, consistent with proposed Item 106(d)(1) of Regulation S-K. The proposal also seeks to amend Form 20-F to require foreign private issuers to disclose on an annual basis information regarding any previously undisclosed material cybersecurity incidents that have occurred during the reporting period, including a series of previously undisclosed individually immaterial cybersecurity incidents that has become material in the aggregate. Notably, Canadian foreign private issuers availing themselves of the multijurisdictional disclosure system would be excluded from the scope of the proposal and not be subject to prescriptive cybersecurity disclosure requirements on Form 40-F.

To enable automated extraction and analysis of the data required by the proposed rules, companies would be required to tag the information specified in the proposal using Inline XBRL. The SEC’s proposed rules are open for public comment until the later of May 9, 2022, or 30 days after publication of the proposal in the Federal Register.