Proposed Reporting about Cybersecurity Incidents on Form 8-K

Blog #2 of 5 in SEC Proposed Changes series

Proposed Reporting of Cybersecurity Incidents on Form 8-K[1]

Introduction

In the first post in this series Overview of the SEC “Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure” Proposed Rule Changes, I cited the four specific proposed changes in the SEC rulemaking:

1. Reporting of Cybersecurity Incidents on Form 8-K
2. Disclosure about Cybersecurity Incidents in Periodic Reports
3. Disclosure of a Registrant’s Risk Management, Strategy and Governance Regarding Cybersecurity Risks
4. Disclosure Regarding the Board of Directors’ Cybersecurity Expertise

This post will focus on the specific requirements around “Reporting of Cybersecurity Incidents on Form 8-K”.

Ernst & Young recently published the results of their analysis of filings by 74 Fortune 100 companies and, comparing 40 material cybersecurity (of 74,098) Form 8-K filings in 2020 to the 2020 Verizon Data Breach Report’s 3,950 confirmed data breaches in 2020, observed a gap in disclosures.[2]  The proposed changes under “Reporting of Cybersecurity Incidents on Form 8-K” address this gap in reporting.

What is proposed?

The SEC proposes to address growing concerns about apparent underreporting and untimely reporting of cyber incidents by requiring registrants to “disclose material cybersecurity incidents in a current report on Form 8-K within four business days after the registrant determines that it has experienced a material cybersecurity incident.”[3]

For those unfamiliar with Form 8-K, it is known as a “current report” and is generally used to announce significant events at a company that investors should know.  It must be filed within four days of the incident that triggers the filing.[4]  Examples of events that trigger a Form 8-K filing include, but are not limited to, a quarterly earnings announcement, a change in leadership, entry into a material definitive agreement, a material audit finding, bankruptcy, etc.  These disclosures inform investors of material events that may influence their investment decisions.

The SEC proposes to amend Form 8-K by adding new Item 1.05 in “Section 1 – Registrant’s Business and Operations,” which would require a registrant to disclose the following information about a material cybersecurity incident to the extent the information is known at the time of the Form 8-K filing:

• When the incident was discovered and whether it is ongoing
• A brief description of the nature and scope of the incident
• Whether any data was stolen, altered, accessed, or used for any other unauthorized purpose
• The effect of the incident on the registrant’s operations, and
• Whether the registrant has remediated or is currently remediating the incident

Healthcare organizations will note some similarities to breach notification requirements under the HIPAA Breach Notification Rule with a notable difference in the reporting timeline (up to 60 days versus four days).[5] Others may compare these seemingly overlapping requirements to what Congress has passed as the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA).  The Cybersecurity and Infrastructure Security Agency (CISA) has issued a Request for Information (RFI) for public comment on new cyber disclosure rules expected to take effect in 2024.  This Act would require operators to report major cyber incidents within 72 hours & ransom payments within 24 hours.[6]

Key terms to consider in this proposed 8-K filing and around which much discussion ensues, if not debate, are “material” and “cybersecurity incidents.” 

According to the SEC, what constitutes “materiality” for purposes of the proposed cybersecurity incidents disclosure would be consistent with that set out in the numerous cases addressing materiality in the securities laws.  Information is material if “there is a substantial likelihood that a reasonable shareholder would consider it important”[7] in making an investment decision or if it would have “significantly altered the ‘total mix of information made available.”  

In the case of cybersecurity incidents, a company must conduct a materiality assessment “as soon as reasonably practicable after discovery of the incident.”[8] Not every cybersecurity incident needs to be reported; only those determined to be material need to be disclosed.  Undoubtedly, this will be a learning process, but consistent with Supreme Court rulings[9] and SEC enforcement, when in doubt about materiality, companies will be expected to err on the side of informing and protecting investors.

The proposed changes include a definition of a cybersecurity incident to mean an unauthorized occurrence on or conducted through a registrant’s information systems that jeopardizes the confidentiality, integrity, or availability of a registrant’s information systems or any information residing therein.

An important note. In the proposed rule, the SEC provides a non-exclusive list of examples of cybersecurity incidents.[10] I will not repeat them here. From the examples provided, it is clear that the SEC is thinking broadly about all threat sources, not just those nefarious hackers out there.  That is, both the definition of a cybersecurity incident and the examples provided make it clear that one needs to consider all incidents emanating from all classic threat source categories – accidental, structural, and environmental in addition to adversarial.

There are concerns about the consistent application of these definitions and that certain disclosures required would have the potential to undermine a company’s cybersecurity defense efforts or even provide a road map for more attacks. There are also concerns that rigorous compliance in our current incident-rich environment could erode investor confidence unnecessarily. 

I expect the SEC to consider these and other concerns raised in the comments of 156 parties.

While the final rule is not expected until next Spring, I also fully expect that there will be some form of incident disclosure required by all publicly traded companies.  And while not-for-profit, private, startup, and emerging companies may not immediately face these requirements, I recommend all organizations implement robust incident response and reporting policies, procedures, and practices starting today.

Questions Management and Board Should Ask and Discuss

Here are several starter questions around the proposed Reporting of Cybersecurity Incidents on Form 8-K:

1. What is the current state of your cyber incident response and reporting practices today? Do you have reasonable and appropriate policies, procedures, and forms to ensure documentation and follow-up?
2. Does your organization regularly and consistently conduct tabletop exercises to test your incident response program?
3. Do you include “materiality assessments” in your incident response, and are you prepared to identify “material cybersecurity incidents” according to the SEC’s definitions?
4. Are you currently prepared to evaluate the total mix of information related to a cybersecurity incident, considering all relevant facts and circumstances, including quantitative and qualitative factors, to determine whether the incident is material?
5. Should you start conducting “materiality assessments” today to prepare for these likely reporting requirements? (Yes!)
6. Is there clarity around the roles and responsibilities of C-suite executives and the board?
7. What governance structure should you implement to assess cybersecurity incidents today?

Endnotes

[1] SEC. “Proposed Rule Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure”. March 9, 2022. Available at https://www.sec.gov/rules/proposed/2022/33-11038.pdf

[2] Seets, Chuck and Niemann Pat, EY. Harvard Law School Forum on Corporate Governance. “How cyber governance and disclosures are closing the gaps in 2022.” October 2, 2022. Available at https://corpgov.law.harvard.edu/2022/10/02/how-cyber-governance-and-disclosures-are-closing-the-gaps-in-2022/

[3] SEC. “Proposed Rule Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure”. March 9, 2022. Available at https://www.sec.gov/rules/proposed/2022/33-11038.pdf

[4] Glossary. U.S. Securities and Exchange Commission. “Form 8-K definition”. Accessed October 15, 2022.  Available at https://www.investor.gov/introduction-investing/investing-basics/glossary/form-8-k

[5] U.S. Department of Health and Human Services. The HIPAA Breach Notification Rule.  Accessed October 15, 2022.  Available at https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html

[6] Cybersecurity & Infrastructure Security Agency (CISA). “CYBER INCIDENT REPORTING FOR CRITICAL INFRASTRUCTURE ACT OF 2022 (CIRCIA)”. March 2022. Available at https://www.cisa.gov/circia

[7] Business Roundtable. “The Materiality Standard for Public Company Disclosure: Maintain What Works.” 2015. Available at https://s3.amazonaws.com/brt.org/archive/reports/BRT.The%20Materiality%20Standard%20for%20Public%20Company%20Disclosure.2015.10.29.pdf

[8] SEC. “Proposed Rule Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure”. March 9, 2022. Available at https://www.sec.gov/rules/proposed/2022/33-11038.pdf

[9] TSC INDUSTRIES, INC., et al., Petitioners, v. NORTHWAY, INC. Cornell Law School. June 6, 1976. Available at https://www.law.cornell.edu/supremecourt/text/426/438.

[10] SEC. “Proposed Rule Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure”. March 9, 2022. Available at https://www.sec.gov/rules/proposed/2022/33-11038.pdf