Reporting cybersecurity incidents on Form 8-K
Yesterday, Corp Fin Director Erik Gerding issued a statement designed to clarify the use of Form 8-K Item 1.05 versus Form 8-K Item 8.01 when reporting cybersecurity incidents. Sounds like some of us might be doing it incorrectly—or at least sub-optimally—potentially resulting in investor confusion. Gerding’s statement is designed to set us straight. He also offers a little guidance about making materiality determinations regarding cybersecurity incidents.
In 2023, the SEC adopted new rules on cybersecurity disclosure. (See this PubCo post.) Under the final rules, if a public company experiences a cybersecurity incident that the company determines to be material, the company is required to file a Form 8-K under new Item 1.05, describing the “material aspects of the nature, scope, and timing of the incident, and the material impact or reasonably likely material impact on the registrant, including its financial condition and results of operations.” But Gerding’s statement highlights that Item 1.05 is intended to be used to report a cybersecurity incident “that is determined by the registrant to be material.” Moreover, in adopting Item 1.05, the SEC made clear that “Item 1.05 is not a voluntary disclosure, and it is by definition material because it is not triggered until the company determines the materiality of an incident.”