(2) add new Item 106(d) of Regulation S-K to require registrants to
provide updated disclosure in its periodic reports relating to
previously disclosed incidents; and (3) amend Form 20-F and Form 6-K to
require FPIs to provide cybersecurity disclosures consistent with the
disclosure that we propose to require in the domestic forms.
---------------------------------------------------------------------------

    \106\ See supra section II.
---------------------------------------------------------------------------

    For disclosures regarding cybersecurity risk management, strategy,
and governance, we are proposing the following. First, we propose to
amend Regulation S-K to require disclosure specified in proposed new
Item 106(b) and (c) regarding: (1) A registrant's policies and
procedures if any, for identifying and managing cybersecurity risks,
(2) a registrant's cybersecurity governance, including the board of
directors' oversight role regarding cybersecurity-related issues, and
(3) management's role and expertise in assessing and managing
cybersecurity risks and implementing related policies, procedures and
strategies. Second, we propose to amend Item 407 of Regulation S-K to
require disclosure about cybersecurity expertise of any member of the
board.
    The discussion below addresses the potential economic effects of
the proposed amendments, including the likely benefits and costs, as
well as the likely effects on efficiency, competition, and capital
formation.\107\ At the outset, we note that, where possible, we have
attempted to quantify the benefits, costs, and effects on efficiency,
competition, and capital formation expected to result from the proposed
amendments. In many cases, however, we are unable to quantify the
potential economic effects because we lack information necessary to
provide a reasonable estimate. Where we are unable to quantify the
economic effects of the proposed amendments, we provide a qualitative
assessment of the potential effects and encourage commenters to provide
data and information that would help quantify the benefits, costs, and
the potential impacts of the proposed amendments on efficiency,
competition, and capital formation.
---------------------------------------------------------------------------

    \107\ Section 2(b) of the Securities Act [15 U.S.C. 77b(b)] and
Section 3(f) of the Exchange Act [15 U.S.C. 78c(f)] directs the
Commission, when engaging in rulemaking where it is required to
consider or determine whether an action is necessary or appropriate
in the public interest, to consider, in addition to the protection
of investors, whether the action will promote efficiency,
competition, and capital formation. Further, Section 23(a)(2) of the
Exchange Act (15 U.S.C. 78w(a)(2)) requires the Commission, when
making rules under the Exchange Act, to consider the impact that the
rules would have on competition, and prohibits the Commission from
adopting any rule that would impose a burden on competition not
necessary or appropriate in furtherance of the Exchange Act.
---------------------------------------------------------------------------

B. Economic Baseline

1. Current Regulatory Framework
    To assess the economic impact of the proposed rules, the Commission
is using as its baseline the existing regulatory framework for
cybersecurity disclosure. As discussed in Section I, although a number
of rules and regulations impose an obligation on companies to disclose
cybersecurity risks and incidents in certain circumstances, the
Commission's regulations currently do not explicitly address
cybersecurity.
    In 2011, the Division of Corporation Finance issued interpretive
guidance providing the Division's views concerning operating companies'
disclosure obligations relating to cybersecurity risks and
incidents.\108\ The 2011 Staff Guidance provided an overview of
existing specific disclosure obligations that may require a discussion
of cybersecurity risks and

cybersecurity incidents, along with examples of potential
disclosures.\109\ Building on the 2011 Staff Guidance, the Commission
issued the 2018 Interpretive Release to assist operating companies in
preparing disclosure about cybersecurity risks and incidents under
existing disclosure rules.\110\ In the 2018 Interpretive Release, the
Commission instructed companies to provide timely and ongoing
information in periodic reports (Form 10-Q, Form 10-K, and Form 20-F)
about material cybersecurity risks and incidents that trigger
disclosure obligations. Additionally, the 2018 Interpretive Release
encouraged companies to continue to use current reports (Form 8-K or
Form 6-K) to disclose material information promptly, including
disclosure pertaining to cybersecurity matters. Further, the 2018
Interpretive Release noted that to the extent cybersecurity risks are
material to a company's business, the Commission believes that the
required disclosure of the company's risk oversight should include the
nature of the board's role in overseeing the management of that
cybersecurity risk. The 2018 Interpretive Release also stated that a
company's controls and procedures should enable them to, among other
things, identify cybersecurity risks and incidents and make timely
disclosures regarding such risks and incidents. Finally, the 2018
Interpretive Release highlighted the importance of insider trading
prohibitions and the need to refrain from making selective disclosures
of cybersecurity risks or incidents.
---------------------------------------------------------------------------

    \108\ See supra section I.A and note 26.
    \109\ Id.
    \110\ See supra section I.A and note 27.
---------------------------------------------------------------------------

    Companies currently may also be subject to other cybersecurity
incident disclosure requirements adopted by various industry regulators
and contractual counterparties. For example, federal contractors may be
required to monitor and report cybersecurity incidents and breaches or
face liability under the False Claims Act.\111\ The Health Insurance
Portability and Accountability Act (HIPAA) requires covered entities
and their business associates to provide notification following a
breach of unsecured protected health information.\112\ Similar rules
require vendors of personal health records and related entities to
report data breaches to affected individuals and the Federal Trade
Commission.\113\ All 50 states have data breach laws that require
businesses to notify individuals of security breaches involving their
personally identifiable information.\114\ There are other rules that
companies must follow in international jurisdictions that are similar
in scope to the proposed rules. For example, in the European Union, the
General Data Protection Regulation mandates disclosure of cybersecurity
breaches.\115\ All of the aforementioned data breach disclosure
requirements may cover some of the material incidents that companies
would need to report under the proposed amendments, but not all
incidents. Additionally, the timeliness and public reporting
requirements of these requirements vary, making it difficult for
investors and other market participants to be alerted to the breaches,
and to be provided with an adequate understanding of the impact of such
incidents to registrants.
---------------------------------------------------------------------------

    \111\ See Department of Justice, Office of Public Affairs,
Justice News: Deputy Attorney General Lisa O. Monaco Announces New
Civil Cyber-Fraud Initiative, (Oct. 6, 2021), available at https://www.justice.gov/opa/pr/deputy-attorney-general-lisa-o-monaco-announces-new-civil-cyber-fraud-initiative; see, e.g., FAR 52.239-1
(requiring contractors to ``immediately'' notify the federal
government if they become aware of ``new or unanticipated threats or
hazards . . . or if existing safeguards have ceased to function'').
    \112\ See 45 CFR 164.400-164.414 (Notification in the Case of
Breach of Unsecured Protected Health Information).
    \113\ See 16 CFR 318 (Health Breach Notification Rule).
    \114\ Note that there are carve outs to these rules, and not
every company may fall under any particular rule. See Security
Breach Notification Laws, National Conference of State Legislatures
(Jan. 17, 2022), available at https://www.ncsl.org/research/telecommunications-and-information-technology/security-breach-notification-laws.aspx.
    \115\ See Regulation (EU) 2016/679, of the European Parliament
and the Council of 27 April 2016 on the protection of natural
persons with regard to the processing of personal data and on the
free movement of such data, and repealing Directive 95/46/EC
(General Data Protection Regulation), arts. 33 (Notification of a
personal data breach to the supervisory authority), 34
(Communication of a personal data breach to the data subject), 2016
O.J. (L 119) 1 (``GDPR'').
---------------------------------------------------------------------------

    Some companies are also subject to other mandates to fulfill a
basic level of cybersecurity risk management, strategy, and governance.
For instance, government contractors may be subject to the Federal
Information Security Modernization Act, and use the National Institute
of Standards and Technology framework to manage information and privacy
risks.\116\ Financial institutions may be subject to the Federal Trade
Commission's Standards for Safeguarding Customer Information Rule,
requiring an information security program and a qualified individual to
oversee the security program and to provide periodic reports to a
company's board of directors or equivalent governing body.\117\ Under
HIPAA regulations, covered entities are also subject to rules that
require protection against reasonably anticipated threats to electronic
protected health information.\118\ International jurisdictions also
have cybersecurity risk mitigation measures, for example, the GDPR
requires basic cybersecurity risk mitigation measures and has
governance requirements.\119\ These various requirements have varying
standards and requirements for reporting cybersecurity risk management,
strategy, and governance, and may not provide investors with clear and
comparable disclosure regarding how a particular registrant manages its
cybersecurity risk profile.
---------------------------------------------------------------------------

    \116\ See NIST Risk Management Framework, NIST (updated Jan. 31,
2022), available at https://csrc.nist.gov/projects/risk-management/fisma-background.
    \117\ See 16 CFR 314.
    \118\ See 45 CFR 164 (Security and Privacy).
    \119\ See supra note 115, GDPR, Sec.  32, Sec.  37.
---------------------------------------------------------------------------

2. Affected Parties
    The proposed new disclosure requirements would apply to various
filings, including current reports, periodic reports, and certain proxy
statements filed with the Commission. Thus, the parties that are likely
to be affected by the proposed rules include investors, registrants,
other market participants that use the information in these filings
(such as financial analysts, investment advisers, and portfolio
managers) and external stakeholders such as consumers and other
companies in the same industry as affected firms.
    We expect the proposed rules to affect all companies with relevant
disclosure obligations on Forms 10-K, 10-Q, 20-F, 8-K, or 6-K, and
proxy statements. This includes approximately 7,848 companies filing on
domestic forms and 973 FPIs filing on foreign forms based on all
companies that filed such forms or an amendment thereto during calendar
year 2020.\120\
---------------------------------------------------------------------------

    \120\ Estimates of affected registrants here are based on the
number of unique CIKs with at least one periodic report, current
report, proxy filing, or an amendment to one of the three filed in
calendar year 2020.
---------------------------------------------------------------------------

    Our textual analysis \121\ of all calendar year 2020 Form 10-K
filings and amendments (7,683) reveals that out of 6,634 domestic
filers approximately 64% (4,272) of them made any cybersecurity-related
disclosures. The filers' average size in terms of total assets and
market capitalization was

approximately $14.1 billion and $7.5 billion, respectively.\122\ By
comparison, the average size of domestic annual report filers that did
not make any cyber disclosures was $892.6 million and $2.2 billion in
terms of total assets and market capitalization, respectively. However,
the average size of all baseline affected filers was approximately
$14.1 billion and $5.6 billion in total assets and market
capitalization respectively. The nature of these disclosures is
summarized in the table below, which reports the relative frequency of
cyber-related disclosures by location within the annual report
conditional on a report having at least one discussion of
cybersecurity. We note that the average number of reporting locations
for registrants making cybersecurity-related disclosures on the annual
report is 1.5, and registrants making cybersecurity-related disclosures
often only did so in one section of the annual report (64%). However,
many annual reports featured cybersecurity discussions in more than one
section: 25% had disclosures in 2 sections, 7% in 3 sections, and 1% in
5 or more sections. Because of this, the percentages in Table 1 sum to
greater than 100%.
---------------------------------------------------------------------------

    \121\ In performing this analysis, staff executed a combination
of computer program-based keyword (and combination of key words)
searches followed by manual review to classify disclosures by
location within the document. This analysis covered 7,683 Forms 10-K
and 10-K/A filed in calendar year 2020 by 6,634 registrants as
identified by unique CIK.
    \122\ Market capitalization averages are estimated as of end of
calendar year 2020. Total Asset averages are estimated from the
value for the most recently completed fiscal year reported by a
registrant by year end 2020.

Table 1--Incidence of Cybersecurity-Related Disclosures by 10-K Location
                                    a
------------------------------------------------------------------------
        Disclosure location           Item description      Percentage
------------------------------------------------------------------------
Item 1A...........................  Risk Factors........            94.3
Item 1............................  Description of                  20.5
                                     Business *.
PSLRA.............................  Cautionary Language             16.3
                                     regarding Forward
                                     Looking Statements.
Item 7............................  Management's                    10.0
                                     Discussion and
                                     Analysis *.
Item 10...........................  Directors, Executive             3.4
                                     Officers and
                                     Corporate
                                     Governance.
Item 8............................  Financial Statements             2.8
                                     and Supplementary
                                     Data.
                                    Exhibits (attached).             0.9
Item 11...........................  Executive                        0.4
                                     Compensation.
Item 15...........................  Exhibits, Financial              0.4
                                     Statement Schedules.
Item 2............................  Properties..........             0.3
Item 3............................  Legal Proceedings...             0.3
Item 9............................  Changes in and                   0.2
                                     Disagreements with
                                     Accountants on
                                     Accounting and
                                     Financial
                                     Disclosure *.
Item 13...........................  Certain                          0.2
                                     Relationships and
                                     Related
                                     Transactions, and
                                     Director
                                     Independence.
Item 6............................  Selected Financial               0.2
                                     Data.
Item 5............................  Market for                       0.1
                                     Registrant's Common
                                     Equity, Related
                                     Stockholder Matters
                                     and Issuer
                                     Purchases of Equity
                                     Securities.
Item 4............................  Mine Safety                      0.1
                                     Disclosures.
Item 14...........................  Principal Accountant             0.1
                                     Fees and Services.
Item 12...........................  Security Ownership               0.0
                                     of Certain
                                     Beneficial Owners
                                     and Management and
                                     Related Stockholder
                                     Matters.
------------------------------------------------------------------------
\a\ Because of heterogeneity in registrants' labeling of sections, Items
  other than 1A are grouped only at the numeric level. An asterisk in
  the table denotes that the identified Item may contain disclosures
  located in a more specific subsection. Item 1, for instance, includes
  Item 1B disclosures; Item 7 includes 7A; and Item 9 includes 9A, 9B,
  and 9C.

    As presented in Table 1, approximately 94% (4,029) of Form 10-K or
amendment filers that provided any cyber-related disclosures included
discussion of cybersecurity as a material risk factor in Item 1A.
    We further estimate that, in 2020, approximately 603 domestic
companies reported having a director on their board with cybersecurity
experience or expertise. This estimate is based on a review of
cybersecurity disclosures by registrants that filed either a Form 10-K
or an amended Form 10-K in 2020 that included cybersecurity-related
language in their Item 10 (Directors and Executive Officers of the
Registrant) discussion or provided similar disclosures in a proxy
filing instead.\123\
---------------------------------------------------------------------------

    \123\ Based on manual review of the total of 15,565 proxy
filings filed in 2020 and the 1,600 of them that mentioned
cybersecurity.
---------------------------------------------------------------------------

    Finally, there were a total of 74,098 Form 8-K filings in 2020,
involving 7,021 filers, out of which 40 filings reported material
cybersecurity incidents. Similarly, there were a total of 23,373 Form
6-K filings in 2020, involving 979 filers, out of which 27 filings
reported material cybersecurity incidents. Filers of annual, quarterly,
or current reports (Forms 10-K, 10-Q, 20-F, 8-K, or 6-K) including a
cybersecurity discussion in any form included 104 business development
companies.

C. Potential Benefits and Costs of the Proposed Amendments

    We have considered the potential benefits and costs associated with
the proposed amendments. The proposed rules would benefit investors and
other market participants by providing more timely and informative
disclosures relating to cybersecurity incidents and cybersecurity risk
management, strategy, and governance, facilitating investor decision-
making and reducing information asymmetry in the market. The proposed
amendments also would entail costs. For instance, in addition to the
costs of providing the disclosure itself, more detailed disclosure
could potentially increase the vulnerability of registrants and the
risk of future attacks. A discussion of the anticipated economic costs
and benefits of the proposed amendments is set forth in more detail
below. We first discuss benefits to investors (and other market
participants, such as financial analysts, investment advisers, and
portfolio managers) and registrants. We subsequently discuss costs to
investors and registrants. We conclude with a discussion of indirect
economic effects on registrants and external stakeholders, such as
consumers, and companies in the same industry with registrants or those
facing similar cybersecurity threats.
    We also expect the proposed amendments to affect compliance
burdens. The quantitative estimates of changes in those burdens for
purposes of the Paperwork Reduction Act of 1995 (``PRA'') are further
discussed in Section [IV] below. For purposes of the PRA, we estimate
that the proposed amendments would result in an increase of 2,000 and

180 burden hours from the increase in the number Form 8-K and Form 6-K
filings respectively.\124\ In addition, the estimated increase in the
paperwork burden as a result of the proposed amendments for Form 10-Q,
Form 10-K, Form 20-F, Schedule 14A, and Schedule 14C would be 3,000
hours, 132,576 hours, 12,028.50 hours, 3,900 hours, and 342 hours
respectively.\125\
---------------------------------------------------------------------------

    \124\ See infra section IV.
    \125\ Id.
---------------------------------------------------------------------------

1. Benefits
    Investors would be the main beneficiaries from the enhanced
disclosure of both cybersecurity incidents and cybersecurity risk
management, strategy, and governance as a result of the proposed
amendments. Specifically, investors would benefit because: (1) More
informative and timely disclosure would reduce mispricing of securities
in the market and facilitate their decision making; and (2) more
uniform and comparable disclosures would lower search costs and
information processing costs. Other market participants that rely on
financial statement information to provide services to investors, such
as financial analysts, investment advisers, and portfolio managers,
could also benefit. Registrants could benefit, because the enhanced
disclosure as a result of the proposed amendments could reduce
information asymmetry and potentially lower registrants' cost of
capital.
a. Benefits to Investors
(i) More Informative and More Timely Disclosure
    More informative and timely disclosures would reduce mispricing of
securities in the market and facilitate investor decision making.
Information benefits would result from both types of disclosure,\126\
and timeliness benefits would result from the proposed cybersecurity
incident disclosure.
---------------------------------------------------------------------------

    \126\ Throughout this section, we use the term ``both types of
disclosure'' to refer to the disclosure of (1) cybersecurity
incidents and (2) cybersecurity risk management, strategy, and
governance.
---------------------------------------------------------------------------

    The proposed amendments would provide more informative disclosures
related to cybersecurity incidents and cybersecurity risk management,
strategy, and governance compared to the current disclosure framework,
benefiting investors. The increase in disclosure would allow investors
to better understand a registrant's cybersecurity risks and ability to
manage such risks, and thereby make more informed investment decisions.
As discussed in Section I, currently, there are no disclosure
requirements that explicitly refer to cybersecurity risks or incidents.
While existing disclosure requirements may apply to material
cybersecurity incidents and various cybersecurity risks and mitigation
efforts, as highlighted in the 2011 Staff Guidance and the 2018
Interpretive Release, the existing disclosure requirements are more
general in nature, and the resulting disclosures have not been
consistently sufficient or necessarily informative.
    Specifically, regarding incident reporting, there is concern that
material cybersecurity incidents are underreported,\127\ and staff has
observed that certain cybersecurity incidents were reported in the
media but not disclosed in a registrant's filings.\128\ Even when
registrants have filed Form 8-K to report an incident, the Form 8-K did
not necessarily state whether or not the incident was material, and in
some cases, the Form 8-K stated that the incident was immaterial.\129\
By requiring registrants to disclose material cybersecurity incidents
in a current report and disclose any material changes, additions, or
updates in a periodic report, the proposed amendments could elicit more
incident reporting. Because the proposed incident disclosure
requirements also specify that registrants would disclose information
such as when the incident was discovered, and the nature and scope of
the incident, they could also result in more informative incident
reporting.
---------------------------------------------------------------------------

    \127\ See supra section II.B and note 46.
    \128\ See supra section I.B.
    \129\ Based on staff analysis of the current and periodic
reports in 2021 for companies identified by as having been affected
by a cybersecurity incident.
---------------------------------------------------------------------------

    Similarly, the proposed disclosure about cybersecurity risk
management, strategy, and governance would include a number of specific
items that registrants must disclose. For instance, the proposed rules
would require disclosure regarding a registrant's policies and
procedures for identifying and managing cybersecurity risks.\130\ The
proposed rules would also require disclosure concerning whether and how
cybersecurity considerations affect a registrant's selection and
oversight of third-party service providers because a significant number
of cybersecurity incidents pertain to third party service
providers.\131\ As a result, the proposed rules related to risk
management, strategy, and governance could also lead to more
informative disclosure to investors.
---------------------------------------------------------------------------

    \130\ See supra section II.D.
    \131\ See supra section II.D.
---------------------------------------------------------------------------

    We anticipate the proposed cybersecurity incident reporting would
also lead to more timely disclosure to investors. As discussed above,
currently, it could take months for registrants to disclose a material
cybersecurity incident after its discovery.\132\ The proposed
amendments would require these incidents to be disclosed in a current
report on Form 8-K within four business days after the registrant
determines that it has experienced a material cybersecurity incident.
---------------------------------------------------------------------------

    \132\ See supra note 95, section III.A.
---------------------------------------------------------------------------

    More informative and timely disclosure as a result of the proposed
amendments would benefit investors because the enhanced disclosure
could allow them to better understand the impact of a cybersecurity
incident on the registrant, the risk a registrant is facing and its
ability to manage the risk. Such information is relevant to the
valuation of registrants' securities and thereby investors' decision
making. It is well documented in the academic literature that the
market reacts negatively to announcements of cybersecurity incidents.
For example, one study finds a significant mean cumulative abnormal
return of -0.84% in the three days following cyberattack announcements,
which, according to the study, translates into an average value loss of
$495 million per attack.\133\ Another study finds that firms with
higher exposure to cybersecurity risk have a higher cost of capital,
suggesting

that this risk is important to investors.\134\ Therefore, whether a
registrant is prepared for cybersecurity risks and has adequate
cybersecurity risk management, strategy, and governance measures in
place to reduce the likelihood of future incidents are important
information for investors and the market. Delayed or incomplete
reporting of cybersecurity incidents and risks could lead to mispricing
of the securities and information asymmetry in the market, harming
investors.
---------------------------------------------------------------------------

    \133\ See Shinichi Kamiya, Jun-Koo Kang, Jungmin Kim, Andreas
Milidonis, and Ren[eacute] M. Stulz, Risk Management, Firm
Reputation, and the Impact of Successful Cyberattacks on Target
Firms, 139 (3) J. of Fin. Econ. 721, 719-749 (2021). See also
Lawrence A. Gordon, Martin P. Loeb, and Lei Zhou, The Impact of
Information Security Breaches: Has There Been a Downward Shift in
Costs?, 19 (1) J. of Comput. Sec. 33, 33-56 (2011) (finding ``the
impact of the broad class of information security breaches on stock
market returns of firms is significant''); see also Georgios Spanos
and Lefteris Angelis, The Impact of Information Security Events to
the Stock Market: A Systematic Literature Review, 58 Comput. & Sec.
216-229 (2016) (documenting that the majority (75.6%) of the studies
the paper reviewed report statistical significance of the impact of
security events to the stock prices of firms). But see Katherine
Campbell, Lawrence A. Gordon, Martin P. Loeb, and Lei Zhou, The
Economic Cost of Publicly Announced Information Security Breaches:
Empirical Evidence From the Stock Market, 11 (3) J. of Comput. Sec.
432, 431-448 (2003) (while finding limited evidence of an overall
negative stock market reaction to public announcements of
information security breaches, they also find ``the nature of the
breach affects this result'', and ``a highly significant negative
market reaction for information security breaches involving
unauthorized access to confidential data, but no significant
reaction when the breach does not involve confidential
information''; they thus conclude that ``stock market participants
appear to discriminate across types of breaches when assessing their
economic impact on affected firms'').
    \134\ See Chris Florakis, Christodoulos Louca, Roni Michaely,
and Michael Weber, Cybersecurity Risk. (No. w28196), Nat'l Bureau of
Econ. Rsch, (2020).
---------------------------------------------------------------------------

    In addition, the mispricing resulting from delayed or limited
disclosure could be exploited by the malicious actors who caused a
cybersecurity incident, or those who could access and trade on material
information stolen during a cybersecurity incident, causing further
harm to investors.\135\ Malicious actors may trade ahead of an
announcement of a data breach that they caused or pilfer material
information to trade on ahead of company announcements. Trading on
undisclosed cybersecurity information is particularly pernicious,
because profits generated from this type of trading would provide
incentives for malicious actors to ``create'' more incidents and
proprietary information to trade on.\136\ More informative and timely
disclosure as a result of the proposed amendments would reduce
mispricing and information asymmetry, and thereby reduce opportunities
for malicious actors to exploit the mispricing, all of which would
enhance investor protection.
---------------------------------------------------------------------------

    \135\ See Joshua Mitts and Eric Talley, Informed Trading and
Cybersecurity Breaches, 9 Harv. Bus. L. Rev. 1 (2019) (``In many
respects, then, the cyberhacker plays a role in creating and
imposing a unique harm on the targeted company--one that (in our
view) is qualitatively different from ``exogenous'' information
shocks serendipitously observed by an information trader. Allowing a
coordinated hacker-trader team to capture these arbitrage gains
would implicitly subsidize the very harm-creating activity that is
being ``discovered'' in the first instance.'').
    \136\ Id.
---------------------------------------------------------------------------

    Overall, we believe enhanced disclosure as a result of the proposed
amendments could benefit investors by allowing them to make more
informed decisions. Similarly, other market participants that rely on
financial statement information to provide services to investors would
also benefit, because more informative and timely disclosure would
allow them to better understand a registrant's cybersecurity risks and
ability to manage such risks. As a result, they would be able to better
evaluate registrants' securities and provide better recommendations.
However, we note that the potential benefit could be reduced to the
extent that registrants have already been providing the relevant
disclosures.
    We are unable to quantify the potential benefit to investors and
other market participants as a result of the increase in disclosure and
improvement in pricing under the proposed amendments. The estimation
requires information about the fundamental value of securities and the
extent of the mispricing. We do not have access to such information,
and therefore cannot provide a reasonable estimate.
(ii) Greater Uniformity and Comparability
    The proposed disclosure about cybersecurity incidents and
cybersecurity risk management, strategy, and governance could also lead
to more uniform and comparable disclosures, benefiting investors by
lowering their search costs and information processing costs. As
discussed in Section I, while some registrants currently file Form 8-K
to report an incident, their reporting practices vary widely.\137\ Some
provide a discussion of materiality, the estimated costs of an
incident, or the remedial steps taken as a result of an incident, while
others do not provide such disclosure or provide much less detail in
their disclosure. Disclosures related to risk management, strategy, and
governance also vary significantly across registrants--such information
could be disclosed in places such as the risk factors section, or in
the management's discussion and analysis section of Form 10-K, or not
at all. Investors currently may find it costly to compare the
disclosures of different companies because they would have to spend
time to search and retrieve information from different locations. For
both types of disclosures, the proposed amendments would specify the
topics to be disclosed and the reporting sections to include such
disclosures, and as a result, both the incident disclosure and risk
management, strategy, and governance disclosure should be more uniform
across registrants, making it easier to compare. By specifying a set of
topics that registrants should disclose, the proposed disclosure
requirement should provide investors and other market participants with
a benchmark of a minimum set of information for registrants to
disclose, allowing them to better evaluate and compare registrants'
cybersecurity risk and disclosure.
---------------------------------------------------------------------------

    \137\ See supra section I.B.
---------------------------------------------------------------------------

    We note that to the extent that the disclosures related to
cybersecurity risk management, strategy, and governance become too
uniform or ``boilerplate,'' the benefit of comparability may be
diminished. However, we also note that given the level of the
specificity that would be required, the resulting disclosures are
unlikely to become boilerplate.
    The proposed requirement to tag the cybersecurity disclosure in
Inline XBRL would likely augment the aforementioned informational and
comparability benefits by making the proposed disclosures more easily
retrievable and usable for aggregation, comparison, filtering, and
other analysis. XBRL requirements for public operating company
financial statement disclosures have been observed to mitigate
information asymmetry by reducing information processing costs, thereby
making the disclosures easier to access and analyze.\138\
---------------------------------------------------------------------------

    \138\ See, e.g., J.Z. Chen, H.A. Hong, J.B. Kim, and J.W. Ryou,
Information processing costs and corporate tax avoidance: Evidence
from the SEC's XBRL mandate, 40 J. of Acct. and Pub. Pol'y. 2
(finding XBRL reporting decreases likelihood of firm tax avoidance
because ``XBRL reporting reduces the cost of IRS monitoring in terms
of information processing, which dampens managerial incentives to
engage in tax avoidance behavior''); see also P.A. Griffin, H.A.,
Hong, J-B, Kim, and Jee- Hae Lim, The SEC's XBRL Mandate and Credit
Risk: Evidence on a Link between Credit Default Swap Pricing and
XBRL Disclosure, 2014 American Accounting Association Annual Meeting
(2014) (finding XBRL reporting enables better outside monitoring of
firms by creditors, leading to a reduction in firm default risk);
see also E. Blankespoor, The Impact of Information Processing Costs
on Firm Disclosure Choice: Evidence from the XBRL Mandate, 57 J. of
Acc. Res. 919, 919-967 (2019) (finding ``firms increase their
quantitative footnote disclosures upon implementation of XBRL
detailed tagging requirements designed to reduce information users'
processing costs,'' and ``both regulatory and non-regulatory market
participants play a role in monitoring firm disclosures,''
suggesting ``that the processing costs of market participants can be
significant enough to impact firms' disclosure decisions'').
---------------------------------------------------------------------------

    While these observations are specific to operating company
financial statement disclosures and not to disclosures outside the
financial statements, such as the proposed cybersecurity disclosures,
they suggest that the proposed Inline XBRL requirements could directly
or indirectly (i.e., through information intermediaries such as
financial media, data aggregators, and academic researchers) provide
investors with increased insight into cybersecurity-related information
at specific companies and across companies, industries, and time
periods.\139\ Also,

unlike XBRL financial statements (including footnotes), which consist
of tagged quantitative and narrative disclosures, the proposed
cybersecurity disclosures would consist largely of tagged narrative
disclosures.\140\ Tagging narrative disclosures can facilitate
analytical benefits such as automatic comparison or redlining of these
disclosures against prior periods and the performance of targeted
artificial intelligence or machine learning assessments (tonality,
sentiment, risk words, etc.) of specific cybersecurity disclosures
rather than the entire unstructured document.\141\
---------------------------------------------------------------------------

    \139\ See, e.g., N. Trentmann, Companies Adjust Earnings for
Covid-19 Costs, but Are They Still a One-Time Expense?, The Wall
Street J. (2020) (citing an XBRL research software provider as a
source for the analysis described in the article); see also
Bloomberg Lists BSE XBRL Data, XBRL.org (2018); see also R. Hoitash,
and U. Hoitash, Measuring Accounting Reporting Complexity with XBRL,
93 Account. Rev. 259 (2018).
    \140\ The proposed cybersecurity disclosure requirements do not
expressly require the disclosure of any quantitative values; if a
registrant includes any quantitative values that are nested within
the required discussion (e.g., disclosing the number of days until
containment of a cybersecurity incident), those values would be
individually detail tagged, in addition to the block text tagging of
the narrative disclosures.
    \141\ To illustrate, without Inline XBRL, using the search term
``remediation'' to search through the text of all registrants'
filings over a certain period of time, so as to analyze the trends
in registrants' disclosures related to cybersecurity incident
remediation efforts during that period, could return many narrative
disclosures outside of the cybersecurity incident discussion (e.g.,
disclosures related to potential environmental liabilities in the
risk factors section). If Inline XBRL is used, however, it would
enable a user to search for the term ``remediation'' exclusively
within the proposed cybersecurity disclosures, thereby likely
reducing the number of irrelevant results.
---------------------------------------------------------------------------

b. Benefits to Registrants \142\
---------------------------------------------------------------------------

    \142\ While registrants are legally distinct entities from
investors, benefits and costs to registrants as a result of the
proposed amendments would ultimately accrue to their investors.
---------------------------------------------------------------------------

    The proposed amendments regarding both incident reporting and risk
management, strategy, and governance disclosure could potentially lower
registrants' cost of capital, especially for those who currently have
strong cybersecurity risk management, strategy, and governance measures
in place. Economic theory suggests that better disclosure could reduce
information asymmetry between management and investors, reducing the
cost of capital, and thereby improving firms' liquidity and their
access to capital markets.\143\ In an asymmetric information
environment, investors recognize that registrants may take advantage of
their position by issuing securities at a price that is higher than
justified by the issuer's fundamental value. As a result, investors
demand a discount to compensate for the risk of adverse selection. This
discount translates into a higher cost of capital.\144\ By providing
more disclosure, the firm can reduce the risk of adverse selection
faced by investors and the discount they demand, ultimately decreasing
the firm's cost of capital.\145\ Applying this theory to cybersecurity
disclosure, the increased disclosure as a result of the proposed
amendments could decrease the cost of capital and increase firm value.
---------------------------------------------------------------------------

    \143\ See Douglas W. Diamond and Robert E. Verrecchia,
Disclosure, Liquidity, and the Cost of Capital, 46 J. Fin. 1325,
1325-1359 (1991) (finding that revealing public information to
reduce information asymmetry can reduce a firm's cost of capital
through increased liquidity). See also Christian Leuz and Robert E.
Verrecchia, The Economic Consequences of Increased Disclosure, 38 J.
Acct. Res. 91 (2000) (providing empirical evidence that increased
disclosure lowers the information asymmetry component of the cost of
capital in a sample of German firms); see also Christian Leuz and
Peter D. Wysocki, The Economics of Disclosure and Financial
Reporting Regulation: Evidence and Suggestions for Future Research,
54 J. Acct. Res. 525 (2016) (providing a comprehensive survey of the
literature on the economic effect of disclosure).
    \144\ See Leuz and Verrecchia, The Economic Consequences of
Increased Disclosure, 38 J. Acct. Res. 91 (2000) (stating: ``A brief
sketch of the economic theory is as follows. Information asymmetries
create costs by introducing adverse selection into transactions
between buyers and sellers of firm shares. In real institutional
settings, adverse selection is typically manifest in reduced levels
of liquidity for firm shares (e.g., Copeland and Galai [1983], Kyle
[1985], and Glosten and Milgrom [1985]). To overcome the reluctance
of potential investors to hold firm shares in illiquid markets,
firms must issue capital at a discount. Discounting results in fewer
proceeds to the firm and hence higher costs of capital. A commitment
to increased levels of disclosure reduces the possibility of
information asymmetries arising either between the firm and its
shareholders or among potential buyers and sellers of firm shares.
This, in turn, should reduce the discount at which firm shares are
sold, and hence lower the costs of issuing capital (e.g., Diamond
and Verrecchia [1991] and Baiman and Verrecchia [1996]).'').
    \145\ Although disclosure could be beneficial for the firm,
several conditions must be met for firms to voluntarily disclose all
their private information. See Anne Beyer, Daniel A. Cohen, Thomas
Z. Lys, and Beverly R. Walther, The Financial Reporting Environment:
Review Of The Recent Literature, 50 J. Acct. & Econ. 296, 296-343
(2010) (discussing conditions under which firms voluntarily disclose
all their private information, and these conditions include ``(1)
disclosures are costless; (2) investors know that firms have, in
fact, private information; (3) all investors interpret the firms'
disclosure in the same way and firms know how investors will
interpret that disclosure; (4) managers want to maximize their
firms' share prices; (5) firms can credibly disclose their private
information; and (6) firms cannot commit ex-ante to a specific
disclosure policy.''). Increased reporting could also help determine
the effect of investment on firm value. See Lawrence A. Gordon,
Martin P. Loeb, William Lucyshyn, and Lei Zhou, The Impact of
Information Sharing on Cybersecurity Underinvestment: A Real Options
Perspective, 34 (5) J. Acct. & Pub. Policy 509, 509-519 (2015)
(arguing that ``information sharing could reduce the tendency by
firms to defer cybersecurity investments.'').
---------------------------------------------------------------------------

    The proposed amendments' effect on cost of capital might vary
depending on registrants' current level of cybersecurity risk
management, strategy, and governance and whether they are already
making disclosures regarding their efforts. To the extent that they
have not been making the proposed disclosure, registrants with stronger
cybersecurity risk management, strategy, and governance measures could
be priced more favorably under the proposed amendments because the
proposed disclosure would allow the market to better differentiate them
from the registrants with less robust measures. To the extent that some
registrants are already making disclosures about their robust
cybersecurity risk management, strategy, and governance programs, these
registrants would benefit less. However, if registrants that previously
had less robust cybersecurity risk management, strategy, and governance
disclose improvements in their cybersecurity risk management, strategy,
and governance in response to the proposed amendments, their cost of
capital could also decrease.
    Registrants could also benefit from more uniform regulations
regarding the timing of disclosures and the types of cybersecurity
incident and risk disclosures as a result of the proposed amendments.
Currently, the stigma or reputation loss associated with cybersecurity
breaches may result in companies limiting reporting about or delaying
reporting of cybersecurity incidents.\146\ If all registrants are
required to report cybersecurity incidents on Form 8-K within four
business days as proposed, this could reduce the reputation costs that
any one company might suffer after reporting an attack and also reduce
the incentives to underreport.
---------------------------------------------------------------------------

    \146\ See supra note 133, Kamiya, at 720 (Kamiya et al.) (2021),
(stating ``we find that successful cyberattacks have potentially
economically large reputation costs in that the shareholder wealth
loss far exceeds the out-of-pocket costs from the attack''). See
also Eli Amir, Shai Levi, and Tsafrir Livne, Do Firms Underreport
Information on Cyber-Attacks? Evidence from Capital Markets, 23 (3)
Review of Accounting Studies 1177-1206 (2018) (finding evidence that
is consistent with managers withholding information on cyber-
attacks, and particularly the information on the more severe
attacks).
---------------------------------------------------------------------------

    In addition, by formalizing the disclosure requirements related to
cybersecurity incidents and cybersecurity risk management, strategy,
and governance and specifying the topics to be discussed, the proposed
amendments could reduce compliance costs for those registrants who are
currently providing disclosure about these topics. The compliance costs
would only be reduced to the extent that those registrants may be over-
disclosing information, because there is uncertainty about what is
required under the current rules. For instance,

the staff has observed that some registrants provide Form 8-K filings
even when they do not anticipate the incident will have a material
adverse impact on their business operations, or financial results.\147\
---------------------------------------------------------------------------

    \147\ See supra note 129 and accompanying text.
---------------------------------------------------------------------------

    We are unable to quantify these potential benefits to registrants
as a result of the proposed amendments due to lack of data. For
example, we are unable to observe the actual cybersecurity risk
registrants are facing. Without such information, we cannot provide a
reasonable estimate on how registrants' cybersecurity risk and
therefore their cost of capital may decrease.
2. Costs
    We also recognize that enhanced cybersecurity disclosure could
result in costs to registrants, depending on the timing and extent of
the disclosure. These costs include potential increases in registrants'
vulnerability, information uncertainty, and compliance costs. We
discuss these costs below.
    First, the proposed disclosure about cybersecurity incidents and
cybersecurity risk management, strategy, and governance could
potentially increase the vulnerability of registrants. Ever since the
issuance of the 2011 Staff Guidance, concerns have been raised that
providing detailed disclosures of cybersecurity incidents can create
the risk of providing a road map for future attacks.\148\ The concern
is that malicious actors could use the disclosures to potentially gain
insights into a registrant's practices on cybersecurity issues and thus
better calibrate future attacks.
---------------------------------------------------------------------------

    \148\ See, e.g., Roland L. Trope and Sarah Jane Hughes, The SEC
Staff's Cybersecurity Disclosure Guidance: Will It Help Investors or
Cyber-Thieves More, 2011 Bus. L. Today 2, 1-4 (2011).
---------------------------------------------------------------------------

    The proposed changes to Form 8-K and Form 6-K would require
registrants to timely file current reports on these forms to disclose
material cybersecurity incidents. The proposed disclosures include, for
example, the nature and scope of the disclosed incident and whether the
registrant has remediated or is currently remediating the incidents.
While we have clarified that we would not expect a registrant to
publicly disclose specific, technical information about its planned
response to the incident or its cybersecurity systems, related networks
and devices, or potential system vulnerabilities in such detail as
would impede the registrant's response or remediation of the incident
(to the extent that a registrant discloses information that could
provide clues to malicious actors regarding a registrant's areas of
vulnerability) it may face increased risk. Malicious actors could
engage in further attacks based on the information, especially given
that registrants would also need to make timely disclosure, which could
mean that the underlying security issues might not have been completely
resolved, thereby potentially exacerbating the ongoing attack. As a
result, the proposed incident disclosure rules could potentially
increase the vulnerability of registrants, imposing a cost on them and
their investors.
    Similar concerns could be raised about the proposed risk
management, strategy, and governance disclosure. Specifically, proposed
Item 407(j) would require registrants to disclose whether a member of
its board of directors has cybersecurity expertise, and proposed new
Items 106(b) and (c) would require registrants to provide specified
disclosure regarding their cybersecurity policies and procedures and
cybersecurity governance by a company's management and board. The
required disclosure could provide malicious actors information about
which companies lack a board of directors with cybersecurity expertise,
and which ones have weak policies and procedures related to
cybersecurity risk management, and allow such malicious actors to
determine their targets accordingly.
    However, academic research so far has not provided evidence that
more detailed cybersecurity risk disclosures would necessarily lead to
more attacks.\149\ For example, one study finds that measures for
specificity (e.g., the uniqueness of the disclosure) do not have a
statistically significant relation with subsequent cybersecurity
incidents.\150\ Another study finds that the disclosed security risk
factors with risk-mitigation themes are less likely to be related to
future breach announcements.\151\ On the other hand, we note that the
proposed amendments would require more details than under the current
rules, and the uniformity of the proposed requirements might also make
it easier for malicious actors to identify firms with deficiencies.
Therefore, these findings might not be generalizable to the effects of
the proposed amendments. Additionally, the costs resulting from this
potential vulnerability might be partially mitigated to the extent that
registrants may decide to enhance their cybersecurity risk management
in anticipation of the increased disclosure.
---------------------------------------------------------------------------

    \149\ We note that the papers we cited below study the effect of
voluntary disclosure and 2011 Staff Guidance. The results from these
studies might not be generalizable to the mandatory disclosures
under the proposed rules.
    \150\ See He Li, Won Gyun No, and Tawei Wang, SEC's
Cybersecurity Disclosure Guidance and Disclosed Cybersecurity Risk
Factors, 30 Int'l. J. of Acct. Info. Sys. 40-55 (2018) (stating:
``while Ferraro (2013) criticizes that the SEC did little to resolve
the concern about publicly revealing too much information [that]
could provide potential hackers with a roadmap for successful
attacks, we find no evidence supporting such claim'').
    \151\ See Tawei Wang, Karthik N. Kannan, and Jackie Rees Ulmer,
The Association Between the Disclosure and the Realization of
Information Security Risk Factors, 24.2 Info. Sys. Rsch. 201, 201-
218 (2013).
---------------------------------------------------------------------------

    Second, the proposed cybersecurity incident disclosure could
potentially increase information uncertainty related to securities,
because the disclosure about the impact of the incident on the
registrant's operations may lack the precision needed for investors and
the market to properly value these securities. While the proposed
changes to Form 8-K could improve the timeliness of cybersecurity
incident reporting and result in more disclosure about the impact of
the incident on the registrant's operations, the proposed rules do not
require registrants to quantify the impact of the incident. As a
result, registrants' disclosure about the impact of a cybersecurity
incident could be qualitative in nature or lack the precision needed
for investors and the market to properly value the securities,
potentially leading to information uncertainty, investor under or
overreaction to certain disclosures, and thereby mispricing of
registrants' securities.\152\
---------------------------------------------------------------------------

    \152\ See Daniel Kent, David Hirshleifer, and Avanidhar
Subrahmanyam, Investor Psychology and Security Market under-and
Overreactions, J. of Fin. 1839-1885 (1998) (showing that investor
behavioral biases such as overconfidence can cause them to under- or
over-react to information); see Nicholas Barberis, Andrei Shleifer,
and Robert Vishny, A Model of Investor Sentiment, 49 (3) J. of Fin.
Econ. 307-343 (1998) (presenting a model of investor sentiment to
explain the empirical findings of underreaction of stock prices to
news such as earnings announcements, and overreaction of stock
prices to a series of good or bad news based on two psychological
phenomena, conservatism and representativeness heuristic); see also
David Hirshleifer, Investor Psychology and Asset Pricing, 56 J. of
Fin. 1533, 1533-1596 (2001) (stating: ``[m]ore generally, greater
uncertainty about a set of stocks, and a lack of accurate feedback
about their fundamentals, leaves more room for psychological biases.
At the extreme, it is relatively hard to misperceive an asset that
is nearly risk-free. Thus, the misvaluation effects of almost any
mistaken-beliefs model should be strongest among firms about which
there is high uncertainty/poor information (cash flow variance is
one possible proxy).'').
---------------------------------------------------------------------------

    Additionally, while the proposed disclosure could have the overall
effect of reducing registrants' cost of capital as discussed in Section
III.C.1.b, we also recognize that a subset of registrants might
experience an increase in costs of capital. More specifically, under
the

proposed amendments, registrants with less robust cybersecurity risk
management measures might be priced more unfavorably compared to those
with stronger measures, potentially leading to an increase in cost of
capital for these registrants. This is because the increased
transparency as a result of the proposed disclosure could allow
investors to better differentiate registrants' preparedness and ability
to manage cybersecurity risks. However, except for this scenario, we
expect that registrants overall would benefit from reduced cost of
capital as a result of the proposed disclosure as discussed in Section
III.C.1.b.
    Finally, the proposed rules would impose compliance costs for
registrants. Registrants would incur one-time and ongoing costs to
fulfill the proposed new disclosure requirements under Items 106 and
407 of Regulation S-K. These costs would include costs to gather the
information and prepare the disclosures.
    Registrants would also incur compliance costs to fulfill the
proposed disclosure requirements related to Form 8-K (Form 6-K for
FPIs) incident reporting and Form 10-Q/10-K (Form 20-F for FPIs)
ongoing reporting.\153\ These costs include one-time costs to implement
or revise their incident disclosure practices, so that any registrant
that determines it has experienced a material cybersecurity incident
would disclose such incident with the required information within four
business days. Registrants would also incur ongoing costs to disclose
in a periodic report any material changes, additions, or updates
relating to previously disclosed incidents, and to monitor whether any
previously undisclosed immaterial cybersecurity incidents have become
material in the aggregate, triggering a disclosure obligation. The
costs would be mitigated for registrants whose current disclosure
practices match or are similar to those that are proposed. To the
extent that registrants fall under other incident reporting
requirements or cybersecurity risk management, strategy, and governance
mandates as outlined in Section III.B.1, their costs from the proposed
amendments would be mitigated as well.
---------------------------------------------------------------------------

    \153\ We note that the compliance costs related to Form 6-K
filings would be mitigated, because a condition of the form is that
the information is disclosed or required to be disclosed elsewhere.
---------------------------------------------------------------------------

    We note that BDCs could be subject to both the proposed rules and
rule amendments in the Investment Management Cybersecurity Proposing
Release \154\ and those proposed in this release if both proposals were
to be adopted. To the extent that BDCs would need to provide
substantively the same or similar disclosure on both Form 8-K and in
registration statements, the compliance costs could be duplicative.
However, the potential duplication should not result in a significant
increase in compliance costs, because BDCs should be able to provide
similar disclosure for both sets of rules.\155\
---------------------------------------------------------------------------

    \154\ See Investment Management Cybersecurity Proposing Release.
    \155\ See infra section VI.E.
---------------------------------------------------------------------------

    The compliance costs would also include costs attributable to the
Inline XBRL tagging requirements. Various preparation solutions have
been developed and used by operating companies to fulfill XBRL
requirements, and some evidence suggests that, for smaller companies,
XBRL compliance costs have decreased over time.\156\ The incremental
compliance costs associated with Inline XBRL tagging of cybersecurity
disclosures would also be mitigated by the fact that most registrants
who would be subject to the proposed requirements are already subject
to other Inline XBRL requirements for other disclosures in Commission
filings, including financial statement and cover page disclosures in
certain periodic reports and registration statements.\157\ Such
registrants may be able to leverage existing Inline XBRL preparation
processes and expertise in complying with the proposed cybersecurity
disclosure tagging requirements. Asset-backed securities issuers,
however, are not subject to Inline XBRL requirements in Commission
filings and would likely incur initial Inline XBRL compliance
implementation costs (such as the cost of training in-house staff to
prepare filings in Inline XBRL, and the cost to license Inline XBRL
filing preparation software from vendors).\158\
---------------------------------------------------------------------------

    \156\ An AICPA survey of 1,032 reporting companies with $75
million or less in market capitalization in 2018 found an average
cost of $5,850 per year, a median cost of $2,500 per year, and a
maximum cost of $51,500 per year for fully outsourced XBRL creation
and filing, representing a 45% decline in average cost and a 69%
decline in median cost since 2014. See Michael Cohn, AICPA Sees 45%
Drop in XBRL Costs for Small Companies, Accounting Today (Aug. 15,
2018) (stating that a 2018 NASDAQ survey of 151 listed registrants
found an average XBRL compliance cost of $20,000 per quarter, a
median XBRL compliance cost of $7,500 per quarter, and a maximum,
XBRL compliance cost of $350,000 per quarter in XBRL costs per
quarter), available at https://www.accountingtoday.com/news/aicpa-sees-45-drop-in-xbrl-costs-for-small-reporting-companies (retrieved
from Factiva database); Letter from Nasdaq, Inc. (March 21, 2019)
(to the Request for Comment on Earnings Releases and Quarterly
Reports); see Release No. 33-10588 (Dec. 18, 2018) [83 FR 65601
(Dec. 21, 2018)].
    \157\ See 17 CFR 229.601(b)(101) and 17 CFR 232.405 (for
requirements related to tagging financial statements, including
footnotes and schedules in Inline XBRL). See 17 CFR 229.601(b)(104)
and 17 CFR 232.406 (for requirements related to tagging cover page
disclosures in Inline XBRL).
    \158\ See infra section IV.
---------------------------------------------------------------------------

    Other than the Paperwork Reduction Act costs discussed in Section
IV below, we are unable to quantify the potential increase in costs
related to the proposed rules due to the lack of data. For example, we
lack data to estimate how registrants' cybersecurity vulnerability
would change under the proposal, because such change would depend on
their current level of vulnerability. We are also unable to estimate
the potential increase in mispricing as a result of the information
uncertainty, because the level of the uncertainty would depend on
registrants' disclosure.
3. Indirect Economic Effects
    Besides the direct economic effects on investors, registrants and
other market participants we discussed above, we recognize that the
proposed amendments could also indirectly affect registrants and
external stakeholders, such as consumers, companies in the same
industry with registrants or those facing similar cybersecurity
threats.
    While the proposal would only require disclosures--not changes to
registrants' board composition or risk management practices--the
disclosures themselves could result in certain indirect benefits.
Registrants might respond to the proposed disclosures by devoting more
resources to cybersecurity governance and risk management. To the
extent that registrants may decide to enhance their cybersecurity risk
management in anticipation of the increased disclosure, it could reduce
registrants' susceptibility to a cybersecurity-attack and thereby the
likelihood of future incidents, indirectly benefiting registrants.
    Registrants may also decide to incur certain indirect costs as a
result of the proposed amendments. For example, the proposed rules
would require disclosure of whether members of the board or management
staff have expertise in cybersecurity.

Although not required, some registrants may respond by adding a board
member or staff to their management team with cybersecurity expertise.
Similarly, the proposed rules would require disclosure on policies and
procedures to identify and manage cybersecurity risks. While not
required under the proposed rules, it is possible that registrants
would respond by allocating more resources to devise, implement, or
improve their policies and procedures related to cybersecurity to the
extent they currently do not have similar policies and procedures in
place. Similarly, indirect costs could result if a registrant were to
decide to hire a chief information security officer or other
individuals with cybersecurity expertise to their management team.
Further, if many registrants move to add a board member or staff to
their management team with cybersecurity expertise, or a chief
information security officer at the same time, the costs to registrants
associated with adding such individuals may increase if demand for
cybersecurity expertise increases. This is especially true to the
extent that certain relevant certifications or degrees are seen as
important designations of cybersecurity expertise and there are a
limited pool of individuals holding such certifications.
    In addition, the proposed requirement to tag the cybersecurity
disclosure in Inline XBRL could have indirect effects on registrants.
As discussed in section III.C.1.a.(ii), XBRL requirements for public
operating company financial statement disclosures could reduce
information processing cost. This reduction in information processing
cost has been observed to facilitate the monitoring of companies by
other market participants, and, as a result, to influence companies'
behavior, including their disclosure choices.\159\
---------------------------------------------------------------------------

    \159\ See supra note 138.
---------------------------------------------------------------------------

    The proposed amendments to require registrants to timely disclose
material cybersecurity incidents could indirectly benefit external
stakeholders such as other companies in the same industry, those facing
similar cybersecurity threats or consumers. Cybersecurity incidents
could result in costs not only to the company that suffers the
incident, but also to other businesses and consumers. For example, a
cybersecurity breach at one company may cause a major disruption or
shut down of a critical infrastructure industry, such as a gas
pipeline, a bank, or power company, resulting in massive losses
throughout the economy.\160\ Timely disclosure of cybersecurity
incidents as proposed could increase awareness by those external
stakeholders that the malicious activities are occurring. More
specifically, for companies in the same industry as registrants or for
those facing similar cybersecurity threats, the proposed disclosure
could alert them to a potential threat and allow them to better prepare
for a specific potential cybersecurity attack. To the extent that the
proposed amendments increase available disclosure, consumers may
benefit from learning the extent of a particular cybersecurity breach,
and therefore take appropriate actions to limit potential economic
costs that they may incur from the breach. For example, there is
evidence that increased disclosure of cybersecurity incidents by
registrants can reduce the risk of identity theft for individuals.\161\
Also, consumers may be able to make better informed decisions about
which companies to trust with their personal information.
---------------------------------------------------------------------------

    \160\ See Lawrence A. Gordon, Martin P. Loeb, William Lucyshyn,
and Lei Zhou, Externalities and the Magnitude of Cyber Security
Underinvestment by Private Sector Firms: A Modification of the
Gordon-Loeb Model, 6 (1) J. of Info. Sec. 24, 24-30 (2014) (stating:
``[f]irms in the private sector of many countries own a large share
of critical infrastructure assets. Hence, cybersecurity breaches in
private sector firms could cause a major disruption of a critical
infrastructure industry (e.g., delivery of electricity), resulting
in massive losses throughout the economy, putting the defense of the
nation at risk.''). We note that this study focused on private
firms; however, same statement could be made about public companies
that own a large share of critical infrastructure assets. See also
U.S. Pipeline Cyberattack Forces Closure, Wall St J., available at
https://www.wsj.com/articles/cyberattack-forces-closure-of-largest-u-s-refined-fuel-pipeline-11620479737.
    \161\ See Sasha Romanosky, Rahul Telang, and Alessandro
Acquisti, Do Data Breach Disclosure Laws Reduce Identity Theft?, 30
(2) J. of Pol'y. Analysis and Mgmt. 272, 256-286 (2011) (finding
that the adoption of state-level data breach disclosure laws reduced
identity theft by 6.1 percent).
---------------------------------------------------------------------------

    In addition, the proposed amendments regarding cybersecurity risk
management, strategy, and governance disclosure could indirectly
benefit external stakeholders through potentially reduced likelihood of
future incidents and negative externalities associated with the
incidents. As discussed above, to the extent that registrants may
decide to enhance their cybersecurity risk management in anticipation
of the increased disclosure, it could reduce registrants'
susceptibility to a cybersecurity-attack and thereby the likelihood of
future incidents, leading to positive spillover effects.
    We are unable to quantify the indirect effects as a result of the
proposed amendments because we lack data or basis to estimate the
potential changes in disclosure of cybersecurity incidents, risk
management, strategy, and governance disclosure and the reduction in
negative spill-over effects.

D. Anticipated Effects on Efficiency, Competition, and Capital
Formation

    Overall, we believe the proposed rules could have positive effects
on market efficiency. As discussed above, the proposed rules could
improve the timeliness and informativeness of cybersecurity risk
disclosure. Investors and other market participants could better
understand the cybersecurity threats registrants are facing, their
potential impact, and registrants' ability to respond to and manage
risks under the proposed rules, and thereby better evaluate
registrants' securities and make more informed decisions. As a result,
the proposed disclosures could reduce information asymmetry and
mispricing in the market, improving liquidity and market efficiency.
However, we also recognize that, because registrants' disclosure about
the impact of a cybersecurity incident could be qualitative in nature
and lack the precision needed for investors and the market to properly
value the securities, the proposed incident disclosure might lead to
information uncertainty and investor overreaction. We believe such
effect should be reduced by more informative reporting from other
aspects of the proposed disclosure and subsequent updates in periodic
reports.
    A more efficient market as a result of the proposed rules could
promote competition among firms. Because the enhanced incident
reporting and cybersecurity risk management, strategy, and governance
disclosure could allow investors to better evaluate the relative
cybersecurity risks for different registrants, firms that disclose
robust cybersecurity risk management, strategy, and governance could
benefit from a competitive advantage relative to firms that do not.
This could have a secondary effect of further incentivizing firms that
to-date have invested less in cybersecurity preparation to invest more,
to the benefit of investors, in order to become more competitive.

    More efficient prices and more liquid markets could help allocate
capital to its most efficient uses. Enhanced disclosure of
cybersecurity incidents and cybersecurity risk management, strategy,
and governance could allow investors to make more informed investment
decisions. As a result, companies that disclose more robust
cybersecurity risk management, strategy, and governance and thus may be
less susceptible to cybersecurity incidents may receive more capital
allocation. By making information related to material incident
available to the public sooner, and reducing the information asymmetry,
the proposed amendments could increase public trust in markets, thereby
aiding in capital formation.

D. Reasonable Alternatives

1. Website Disclosure
    As an alternative to Form 8-K disclosure of material cybersecurity
incidents, we considered providing companies with the option of
disclosing this information through company websites, instead of
through filing a Form 8-K, when the company has disclosed its intention
to do so in its most recent annual report and subject to information
availability and retention requirements. While this approach may be
less costly for the registrant as it may involve fewer compliance costs
and less legal liability compared to a filing of a Form 8-K, the
website disclosure would not be located in the same place as other
companies' disclosures of material cybersecurity incidents. Also,
disclosures made on company websites would not be organized into the
standardized sections found in Form 8-K and could thus be less uniform.
    The lack of a central repository, such as the EDGAR system,\162\
and a lack of uniformity of website disclosures could increase the
costs for investors and other market participants to search for and
process the information to compare cybersecurity risks across
registrants. Additionally, such disclosure might not be preserved on
the company's website for as long as it would be when the disclosure is
filed with the Commission, because companies may not keep historical
information available on their websites indefinitely. They also may go
out of business, and thus, there could be information loss to investors
when disclosures are deleted from websites. Therefore, this approach
would be less beneficial to investors, other market participants, and
the overall efficiency of the market.
---------------------------------------------------------------------------

    \162\ EDGAR, the Electronic Data Gathering, Analysis, and
Retrieval system, is the primary system for companies and others
submitting documents under the Securities Act, the Exchange Act, the
Trust Indenture Act of 1939, and the Investment Company Act. EDGAR's
public database can be used to research a public company's financial
information and operations.
---------------------------------------------------------------------------

2. Disclosure Through Form 10-Q and Form 10-K
    We also considered requiring disclosure of material cybersecurity
incidents through Form 10-Q or Form 10-K instead of Form 8-K. Reporting
material cybersecurity incidents at the end of the quarter or year
would allow registrants more time to assess the financial impact of
such incidents. The resulting disclosure might be more specific or
informative for investors and other market participants to value the
securities and make more informed decisions. The compliance costs would
be less under this alternative, because registrants would not have an
obligation to file Form 8-K. With lower compliance costs under this
alternative, registrants could use the resources that would go towards
disclosure on Form 8-K to instead fill gaps in their cybersecurity
defenses exposed by the attack, potentially making it less likely that
malicious actors would be able to exploit such vulnerabilities.
    However, it would lead to less timely reporting on material
cybersecurity incidents. As a result, the market would not be able to
incorporate the information related to cybersecurity risk into the
security prices in as timely a manner, and investors and other market
participants would not be able to make as informed decisions as they
could under the proposed approach.
3. Exempt Smaller Reporting Companies
    We also considered exempting smaller reporting companies from
proposed Item 106 and Item 407, because smaller companies might incur a
cost that is disproportionally high, compared to larger companies under
the proposed rules. As discussed above, proposed disclosure might
expose registrants' cybersecurity weakness and increase their
vulnerability. To avoid the potential exposure, smaller companies might
increase spending related to cybersecurity risk management measures,
which could be disproportionately costly. Also, to the extent that they
do not have similar disclosure practices in place currently, it might
be relatively more costly for smaller companies to implement the
proposed disclosure requirements than larger companies, because they
may have fewer resources.
    However, evidence suggests that smaller companies may have an equal
or greater risk than larger companies of being attacked, making the
proposed disclosures particularly important for their investors.\163\
The financial impact from an attack could also be more detrimental for
smaller companies than for larger ones. To the extent that one indirect
effect of the proposed disclosure may be that companies take additional
steps to address potential vulnerabilities or enhance their
cybersecurity risk management, strategy, and governance, any resulting
reduction in vulnerability may be particularly beneficial for smaller
companies and their investors.
---------------------------------------------------------------------------

    \163\ See supra note 18.
---------------------------------------------------------------------------

4. Modify Scope of Inline XBRL Requirement
    We also considered changing the scope of the proposed tagging
requirements, such as by excluding certain subsets of registrants. For
example, the proposed tagging requirements could have excluded asset-
backed securities issuers, which are not currently required to tag any
filings in Inline XBRL.\164\ Under such an alternative, asset-backed
securities issuers would submit their cybersecurity disclosures in
unstructured HTML or ASCII, and thereby avoid the initial Inline XBRL
implementation costs (such as the cost of training in-house staff to
prepare filings in Inline XBRL, and the cost to license Inline XBRL
filing preparation software from vendors) and ongoing Inline XBRL
compliance burdens that would result from the proposed tagging
requirement.\165\ However, narrowing the scope of the proposed tagging
requirements, whether based on registrant type, size, or other
criteria, would diminish the extent of any informational benefits that
would accrue as a result of the proposed disclosure requirements by
making the excluded registrants' cybersecurity disclosures
comparatively costlier to process and analyze.
---------------------------------------------------------------------------

    \164\ See supra note 157.
    \165\ See infra section IV. The Commission's EDGAR electronic
filing system generally requires filers to use ASCII or HTML for
their document submissions, subject to certain exceptions. See EDGAR
Filer Manual (Volume II) version 60 (December 2021), at 5-1; 17 CFR
232.301 (incorporating EDGAR Filer Manual into Regulation S-T). See
also 17 CFR 232.101 (setting forth the obligation to file
electronically on EDGAR). To the extent asset-backed securities
issuers are affiliated with registrants that are subject to Inline
XBRL requirements, they may be able to leverage those registrants'
existing Inline XBRL tagging experience and software, which would
mitigate the initial Inline XBRL implementation costs that asset-
backed securities issuers would incur under the proposal.

---------------------------------------------------------------------------

Request for Comment
    We request comment on all aspects of our economic analysis,
including the potential costs and benefits of the proposed rules and
alternatives thereto, and whether the proposed rules, if adopted, would
promote efficiency, competition, and capital formation or have an
impact on investor protection. In addition, we also seek comment on
alternative approaches to the proposed rules and the associated costs
and benefits of these approaches. Commenters are requested to provide
empirical data, estimation methodologies, and other factual support for
their views, in particular, on costs and benefits estimates.
Specifically, we seek comment with respect to the following questions:
    41. What are the economic effects of the proposed cybersecurity
incident and cybersecurity risk management, strategy, and governance
disclosures? Would those disclosures provide informational benefits to
investors? Would registrants benefit from a potential decrease in cost
of capital because of the enhanced disclosure? Are there any other
benefits, costs, and indirect effects of the proposed disclosure that
we should also consider?
    42. Would the proposed cybersecurity incident disclosure provide
enough information for investors to assess the impact of a
cybersecurity incident in making an investment decision? Because the
proposed incident disclosure would not require quantification of an
incident's impact, would the lack of quantification create any
uncertainty for investors which may cause them to under or overreact to
the disclosure? Would investors benefit more if registrants were to
provide the disclosure after the incident's impact is quantified or can
be reasonably estimated? If so, what metrics should be disclose to help
investors understand the impact?
    43. Would both types of the proposed disclosure, cybersecurity
incident disclosure and cybersecurity risk management, strategy, and
governance disclosure, increase the vulnerability of registrants to
cybersecurity incidents? Would this effect be mitigated by any of the
other effects of the proposal, including indirect effects such as
registrants' potential strengthening of cybersecurity risk management
measures? What would be the impact of the proposed disclosure on the
likelihood of future incidents for registrants? Would that impact be
the same for both types of disclosure?
    44. Would the proposed incident disclosure increase registrants'
compliance costs to fulfill the proposed disclosure requirements
related to incident reporting? What would be the magnitude of those
costs? Would the proposed cybersecurity risk management, strategy, and
governance disclosure lead to indirect costs such as hiring a board
member or staff to their management team with cybersecurity expertise,
or costs to devise, implement or improve the processes and procedures
related to cybersecurity?
    45. Would both types of the proposed disclosure lead to indirect
economic effects for external stakeholders? Would the magnitude of the
indirect effects be greater or less than we have discussed? Are there
any other indirect effects that we should consider?
    46. Are there any specific data points that would be valuable for
assessing the economic effects of the proposed cybersecurity incident
and risk management, strategy, and governance that we should consider
in the baseline analysis or the analysis of the economic effects? If
so, please provide that data.
    47. Would any of the economic effects discussed above be more or
less significant than in our assessment? Are any of the costs or
benefits identified incorrectly for any of the proposed amendments? Are
there any other economic effects associated with these proposed rules
that we should consider? Are you aware of any data or methodology that
can help quantify the benefits or costs of the proposed amendments?
    48. Would any of the proposed amendments positively affect
efficiency, competition and capital formation as we have discussed? Are
there any other effects on efficiency, competition, and capital
formation that we should consider?
    49. Would any of the proposed amendments have disproportionate
costs for smaller reporting companies? Do smaller reporting companies
face a different set of cybersecurity risks than other companies?
    50. Are there any other alternative approaches to improve
disclosure of material cybersecurity incidents, cybersecurity risk
management, strategy, or governance that we should consider? If so,
what are they and what would be the associated costs or benefits of
these alternative approaches?
    51. Are there any other costs and benefits associated with
alternative approaches that are not identified or are misidentified in
the above analysis? Should we consider any of the alternative
approaches outlined above instead of the proposed rules? Which approach
and why?

IV. Paperwork Reduction Act

A. Summary of the Collection of Information

    Certain provisions of our rules and forms that would be affected by
the proposed amendments contain ``collection of information''
requirements within the meaning of the Paperwork Reduction Act of 1995
(``PRA'').\166\ The Commission is submitting the proposed amendments to
the Office of Management and Budget (``OMB'') for review in accordance
with the PRA.\167\ The hours and costs associated with preparing and
filing the forms constitute reporting and cost burdens imposed by each
collection of information. An agency may not conduct or sponsor, and a
person is not required to comply with, a collection of information
unless it displays a currently valid OMB control number. Compliance
with the information collections is mandatory. Responses to the
information collections are not kept confidential and there is no
mandatory retention period for the information disclosed. The titles
for the affected collections of information are:
---------------------------------------------------------------------------

    \166\ See 44 U.S.C. 3501 et seq.
    \167\ 44 U.S.C. 3507(d) and 5 CFR 1320.11.
---------------------------------------------------------------------------

     ``Schedule 14C'' (OMB Control No. 3235-0057);
     ``Schedule 14A'' (OMB Control No. 3235-0059);
     ``Form 8-K'' (OMB Control No. 3235-0060);
     ``Form 10-K'' (OMB Control No. 3235-0063);
     ``Form 10-Q'' (OMB Control No. 3235-0070);
     ``Form 6-K'' (OMB Control No. 3235-0116); and
     ``Form 20-F'' (OMB Control No. 3235-0288).
    We adopted the existing forms, pursuant to the Exchange Act. The
forms set forth the disclosure requirements for periodic and current
reports as well as proxy and information statements filed by issuers to
help investors make informed investment and voting decisions. A
description of the proposed amendments, including the need for the
information and its proposed use, as well as a description of the
likely respondents, can be found in Section II above, and a discussion
of the economic effects of the proposed amendments can be found in
Section III above.

B. Summary of the Estimated Burdens of the Proposed Amendments on the
Collections of Information

Estimated Paperwork Burdens of the Proposed Amendments

    The following table summarizes the estimated paperwork burdens
associated with the proposed amendments to the affected forms.

         PRA Table 1--Estimated Paperwork Burden Associated With the Proposed New Rules and Amendments *
----------------------------------------------------------------------------------------------------------------
                                          Affected forms and      Estimated burden per     Number of estimated
  Proposed requirements and effects           schedules                 response            affected responses
----------------------------------------------------------------------------------------------------------------
Form 8-K, Item 1.05:
     Require disclosure        Form 8-K...............  10 Hours...............  200 Filings.
     regarding cybersecurity
     incidents.
Form 6-K:
     Require disclosure        Form 6-K...............  9 Hours................  20 Filings.
     regarding cybersecurity
     incidents.
Adding Item 106 Disclosures:
     Require disclosure         Form 10-K.....   Form 10-K: 15    Form 10-K:
     regarding policies and                                      Hours **.                8,292 Filings.
     procedures. (Item 106(b)).
     Require disclosure         Form 20-F        Form 20-F:       Form 20-F: 729
     regarding board and management                              16.5 Hours.              Filings.
     oversight of cybersecurity risk.
     (Item 106(c)).
     Require updated            Form 10-Q        Form 10-Q: 5     Form 10-Q: 600
     disclosure regarding               (Item 106(d)).           Hours.                   Filings.
     cybersecurity incidents (Item
     106(d)).
Adding Item 407(j) disclosures:
     Require disclosure on      Form 10-K.....   Form 10-K: 1.5   Form 10-K:
     the cybersecurity expertise of     Schedule 14A..   Hours.                   Filings: 5,464
     members of the board of            Schedule 14C..   Schedule: 14A:   Filings.
     directors of the registrant, if                             1.5 Hours..              Schedule 14A:
     any.                                                        Schedule 14C:    2,600 Filings.
                                                                 1.5 Hours  Schedule 14C:
                                                                 minus>..                 228 Filings.
----------------------------------------------------------------------------------------------------------------
* All of these burden estimates incorporate the proposed tagging requirements Rule 405 of Regulation S-T.
** We estimate that 600 of these filings will be increased by five hours due to the proposed Item 106(d)
  disclosure.
 The burden estimate for Form 10-K assumes that Schedules 14A and 14C would be the primary
  disclosure documents for the information provided in response to proposed Item 407(j) of Regulation S-K in
  connection with proxy and information statements involving the election of directors. In this case, we assume
  that the disclosure would be incorporated by reference in Form 10-K from the proxy or information statement.

    Not every filing on the affected current forms, Form 6-K and Form
8-K, would include cybersecurity disclosures. These disclosures would
be required only when a registrant has made the determination that it
has experienced a material cybersecurity incident. Further, in the case
of Form 6-K, the registrant would only have to provide the disclosure
if it is required to disclose such information elsewhere.
    The table below sets forth our estimates of the number of current
filings on the forms which will be affected by the proposed rules. We
used this data to extrapolate the effect of these changes on the
paperwork burden for the listed periodic reports.\168\
---------------------------------------------------------------------------

    \168\ The OMB PRA filing inventories represent a three-year
average. Averages may not align with the actual number of filings in
any given year.

            PRA Table 3--Estimated Number of Affected Filings
------------------------------------------------------------------------
                                                        Estimated number
                                      Current annual    of filings that
               Form                  responses in PRA    would include
                                        inventory        cybersecurity
                                                           disclosure
------------------------------------------------------------------------
Schedule 14A......................              6,369              2,600
Schedule 14C......................                569                228
10-K..............................              8,292              8,292
10-Q..............................             22,925                600
20-F..............................                729                729
8-K...............................            118,387                200
6-K...............................             34,794                 20
------------------------------------------------------------------------

C. Incremental and Aggregate Burden and Cost Estimates

    Below we estimate the incremental and aggregate changes in
paperwork burden as a result of the proposed amendments. These
estimates represent the average burden for all respondents, both large
and small. In deriving our estimates, we recognize that the burdens
will likely vary among individual respondents based on a number of
factors, including the nature of their business.
    We calculated the additional burden estimates by multiplying the
estimated additional burden per form by the estimated number of
responses per form. That additional burden is then added to the
existing burden per form. For purposes of the PRA, the burden is

to be allocated between internal burden hours and outside professional
costs. PRA Table 4 below sets forth the percentage estimates we
typically use for the burden allocation for each collection of
information and the estimated burden allocation for the proposed new
collection of information. We also estimate that the average cost of
retaining outside professionals is $400 per hour.\169\
---------------------------------------------------------------------------

    \169\ We recognize that the costs of retaining outside
professionals may vary depending on the nature of the professional
services, but for purposes of this PRA analysis, we estimate that
such costs would be an average of $400 per hour. This estimate is
based on consultations with several issuers, law firms, and other
persons who regularly assist issuers in preparing and filing reports
with the Commission.

PRA Table 4--Estimated Burden Allocation for the Affected Collections of
                               Information
------------------------------------------------------------------------
                                                            Outside
     Collection of information           Internal        professionals
                                        (percent)          (percent)
------------------------------------------------------------------------
Schedule 14A, Schedule 14C, Form                   75                 25
 10-Q, Form 10-K, Form 6-K, and
 Form 8-K.........................
Form 20-F.........................                 25                 75
------------------------------------------------------------------------

    PRA Table 5 below illustrates the incremental change to the total
annual compliance burden of affected forms, in hours and in costs, as a
result of the proposed amendments' estimated effect on the paperwork
burden per response.

           PRA Table 5--Calculation of the Incremental Change in Burden Estimates of Current Responses Resulting From the Proposed Amendments
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                          Number of
                                                          estimated      Burden hour      Change in       Change in        Change in        Change in
              Collection of information                   affected      increase per    burden hours    company hours     professional     professional
                                                          responses       response                                           hours            costs
                                                              (A) \a\             (B)     (C) = (A) x      (D) = (C) x      (E) = (C) x      (F) = (E) x
                                                                                (B)      0.75 or .25      0.25 or .75             $400
--------------------------------------------------------------------------------------------------------------------------------------------------------
Schedule 14A.........................................           2,600             1.5           3,900            2,925              975         $390,000
Schedule 14C.........................................             228             1.5             342           256.50            85.50           34,200
10-K.................................................           8,292              15         124,380           93,285           31,095       12,438,000
10-K.................................................           5,464             1.5           8,196            6,147            2,049          819,600
10-Q.................................................             600               5           3,000            2,250              750          300,000
20-F.................................................             729            16.5       12,028.50        3,007.125        9,021.375        3,608,550
8-K..................................................             200              10           2,000            1,500              500          200,000
6-K..................................................              20               9             180              135               45           18,000
--------------------------------------------------------------------------------------------------------------------------------------------------------

    The following tables summarize the requested paperwork burden,
including the estimated total reporting burdens and costs, under the
proposed amendments.

                                                             PRA Table 6--Requested Paperwork Burden Under the Proposed Amendments *
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
                                                  Current burden                                          Program change                                      Requested change in burden
                                     -----------------------------------------------------------------------------------------------------------------------------------------------------------
                Form                    Current     Current
                                        annual      burden     Current cost     Number of affected       Change in company    Change in professional    Annual     Burden hours     Cost burden
                                       responses     hours        burden             responses                 hours                   costs           responses
                                             (A)         (B)             (C)  (D)...................  (E)...................  (F)...................   (G) = (A)     (H) = (B) +     (I) = (C) +
                                                                                (E)             (F)
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Schedule 14A........................       6,369     777,590    $103,678,712  2,600.................  2,925.................  $390,000..............       6,369         780,515    $104,068,712
Schedule 14C........................         569      56,356       7,514,944  228...................  256.50................  34,200................         569          56,613       7,529,144
Form 10-K...........................       8,292  14,188,040   1,893,793,119  8,292 (Item 106)......  99,432................  13,257,600............       8,292      14,287,432   1,907,050,719
                                                                              5,464 (407(j))........  93,285 (Item 106).....  (12,438,000 + 819,600)
                                                                                6,147 (407(j))
Form 10-Q...........................      22,925   3,182,333     421,490,754  600...................  2,250.................  300,000...............      22,925       3,184,583     421,790,754
Form 20-F...........................         729     479,261     576,824,025  729...................  3,007.125.............  3,608,550.............         729         482,268     580,432,575
Form 8-K............................     118,387     818,158     108,674,430  200...................  1,500.................  200,000...............     118,387         819,658     108,847,430
Form 6-K............................      34,794     227,031      30,270,780  20....................  135...................  18,000................      34,794         227,166      30,288,780
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
* For purposes of the PRA, the requested change in burden hours (column H) is rounded to the nearest whole number.

Request for Comment
    Pursuant to 44 U.S.C. 3506(c)(2)(B), we request comment in order
to:
     Evaluate whether the proposed collections of information
are necessary for the proper performance of the functions of the
Commission, including whether the information will have practical
utility;
     Evaluate whether the Commission's estimates of the burden
of the proposed collection of information are accurate;
     Determine whether there are ways to enhance the quality,
utility, and

clarity of the information to be collected;
     Evaluate whether there are ways to minimize the burden of
the collection of information on those who respond, including through
the use of automated collection techniques or other forms of
information technology; and
     Evaluate whether the proposed amendments would have any
effects on any other collection of information not previously
identified in this section.
    Any member of the public may direct to us any comments concerning
the accuracy of these burden estimates and any suggestions for reducing
these burdens. Persons submitting comments on the collection of
information requirements should direct their comments to the Office of
Management and Budget, Attention: Desk Officer for the U.S. Securities
and Exchange Commission, Office of Information and Regulatory Affairs,
Washington, DC 20503, and send a copy to Vanessa A. Countryman,
Secretary, U.S. Securities and Exchange Commission, 100 F Street NE,
Washington, DC 20549, with reference to File No. S7-09-22 Requests for
materials submitted to OMB by the Commission with regard to the
collection of information requirements should be in writing, refer to
File No. S7-09-22 and be submitted to the U.S. Securities and Exchange
Commission, Office of FOIA Services, 100 F Street NE, Washington DC
20549. OMB is required to make a decision concerning the collection of
information requirements between 30 and 60 days after publication of
the proposed amendments. Consequently, a comment to OMB is best assured
of having its full effect if the OMB receives it within 30 days of
publication.

V. Small Business Regulatory Enforcement Fairness Act

    For purposes of the Small Business Regulatory Enforcement Fairness
Act of 1996 (``SBREFA''),\170\ the Commission must advise OMB as to
whether the proposed amendments constitute a ``major'' rule. Under
SBREFA, a rule is considered ``major'' where, if adopted, it results or
is likely to result in:
---------------------------------------------------------------------------

    \170\ 5 U.S.C. 801 et seq.
---------------------------------------------------------------------------

     An annual effect on the U.S. economy of $100 million or
more (either in the form of an increase or a decrease);
     A major increase in costs or prices for consumers or
individuals industries; or
     Significant adverse effects on competition, investment, or
innovation.
    We request comment on whether the proposed amendments would be a
``major rule'' for purposes of SBREFA. In particular, we request
comment on the potential effect of the proposed amendments on the U.S.
economy on an annual basis; any potential increase in costs or prices
for consumers or individual industries; and any potential effect on
competition, investment or innovation. Commenters are requested to
provide empirical data and other factual support for their views to the
extent possible.

VI. Initial Regulatory Flexibility Act Analysis

    When an agency issues a rulemaking proposal, the Regulatory
Flexibility Act (``RFA'') \171\ requires the agency to prepare and make
available for public comment an Initial Regulatory Flexibility Analysis
(``IRFA'') that will describe the impact of the proposed rule on small
entities.\172\ This IRFA relates to proposed amendments and/or
additions to the rules and forms described in Section II above.
---------------------------------------------------------------------------

    \171\ 5 U.S.C. 601 et seq.
    \172\ 5 U.S.C. 603(a).
---------------------------------------------------------------------------

A. Reasons for, and Objectives of, the Proposed Action

    The proposed amendments are intended to provide enhanced
disclosures regarding registrants' cybersecurity risk governance and
cybersecurity incident reporting. They are designed to better inform
investors about material cybersecurity risks and incidents on a timely
basis and a registrant's assessment, governance, and management of
those risks. The proposed amendments are discussed in more detail in
Section II above. We discuss the economic impact and potential
alternatives to the amendments in Section III, and the estimated
compliance costs and burdens of the amendments under the PRA in Section
IV above.

B. Legal Basis

    The amendments contained in this release are being proposed under
the authority set forth in Securities Act Sections 7 and 19(a) and
Exchange Act Sections 3(b), 12, 13, 14, 15, and 23(a).

C. Small Entities Subject to the Proposed Rules

    The proposed amendments would apply to registrants that are small
entities. The Regulatory Flexibility Act defines ``small entity'' to
mean ``small business,'' ``small organization,'' or ``small
governmental jurisdiction.'' \173\ For purposes of the Regulatory
Flexibility Act, under our rules, a registrant, other than an
investment company, is a ``small business'' or ``small organization''
if it had total assets of $5 million or less on the last day of its
most recent fiscal year and is engaged or proposing to engage in an
offering of securities that does not exceed $5 million.\174\ Under 17
CFR 270.0-10, an investment company, including a BDC, is considered to
be a small entity if it, together with other investment companies in
the same group of related investment companies, has net assets of $50
million or less as of the end of its most recent fiscal year.\175\ An
investment company, including a BDC,\176\ is considered to be a ``small
business'' if it, together with other investment companies in the same
group of related investment companies, has net assets of $50 million or
less as of the end of its most recent fiscal year.\177\ Commission
staff estimates that, as of June 2021, there were 660 issuers,\178\ and
9 BDCs \179\ that may be considered small entities that would be
subject to the proposed amendments.
---------------------------------------------------------------------------

    \173\ 5 U.S.C. 601(6).
    \174\ See 17 CFR 240.0-10(a).
    \175\ 17 CFR 270.0-10(a).
    \176\ BDCs are a category of closed-end investment company that
are not registered under the Investment Company Act [15 U.S.C. 80a-
2(a)(48) and 80a-53-64].
    \177\ 17 CFR 270.0-10(a).
    \178\ This estimate is based on staff analysis of Form 10-K
filings on EDGAR, or amendments thereto, filed during the calendar
year of Jan. 1, 2020 to Dec. 31, 2020, or filed by Sept. 1, 2021,
and on data from XBRL filings, Compustat, and Ives Group Audit
Analytics.
    \179\ These estimates are based on staff analysis of Morningstar
data and data submitted by investment company registrants in forms
filed on EDGAR as of June 30, 2021.
---------------------------------------------------------------------------

D. Projected Reporting, Recordkeeping and Other Compliance Requirements

    If adopted, the proposed amendments would apply to small entities
to the same extent as other entities, irrespective of size. Therefore,
we expect that the nature of any benefits and costs associated with the
proposed amendments to be similar for large and small entities.
Accordingly, we refer to the discussion of the proposed amendments'
economic effects on all affected parties, including small entities, in
Section III above. Consistent with that discussion, we anticipate that
the economic benefits and costs likely could vary widely among small
entities based on a number of factors, such as the nature and conduct
of their businesses, which makes it difficult to project the economic
impact on small entities with precision. As a general matter, however,
we recognize that the costs of the proposed amendments borne by the
affected entities could have a proportionally greater effect on small

entities, as they may be less able to bear such costs relative to
larger entities.
    Compliance with the proposed amendments may require the use of
professional skills, including legal skills. We request comment on how
the proposed disclosure amendments would affect small entities.

E. Duplicative, Overlapping, or Conflicting Federal Rules

    The Commission has also proposed cybersecurity risk management
rules and related rule amendments for advisers and funds, including
BDCs. To the extent that the proposed rules and rule amendments in the
Investment Management Cybersecurity Proposing Release are adopted, BDCs
may be subject both to those proposed rules and rule amendments and to
certain of the rules proposed in this rulemaking. To the extent that
there could be overlap if these proposals are adopted, we would not
expect the overlap to result in significant burdens for BDCs (including
small BDCs) since they should be able to use their Form 8-K disclosure
to more efficiently prepare the corresponding disclosure that would be
required by the Investment Management Cybersecurity Proposing Release
or, in the alternative, use that corresponding disclosure (if adopted)
to prepare their Form 8-K disclosure.

F. Significant Alternatives

    The RFA directs us to consider alternatives that would accomplish
our stated objectives, while minimizing any significant adverse impact
on small entities. In connection with the proposed amendments, we
considered the following alternatives:
     Establishing different compliance or reporting
requirements that take into account the resources available to small
entities;
     Exempting small entities from all or part of the
requirements;
     Using performance rather than design standards; and
     Clarifying, consolidating, or simplifying compliance and
reporting requirements under the rules for small entities.
    The proposed amendments are intended to better inform investors
about cybersecurity incidents and the cybersecurity risk management,
strategy, and governance of registrants of all types and sizes which
are subject to the Exchange Act reporting requirements. Under current
requirements, the nature of registrants' cybersecurity disclosure
varies widely, with registrants providing different levels of
specificity regarding the cause, scope, impact and materiality of
cybersecurity incidents. The timing of disclosure about material
cybersecurity incidents also varies in the absence of a specific
requirement regarding timely disclosure of such incidents. Further,
while registrants generally discuss cybersecurity risks in the risk
factor section of their annual reports, the disclosures are sometimes
blended with other unrelated disclosures, which makes it more difficult
for investors to locate, interpret, and analyze the information
provided. The staff also has observed a divergence in these disclosures
by industry and that smaller reporting companies generally provide less
cybersecurity disclosure as compared to larger registrants.
    Exempting small entities from the proposed amendments or
establishing different compliance or reporting requirements for small
entities could frustrate the goal of providing investors in these
companies with more uniform and timely disclosure about material
cybersecurity incidents and disclosure about their risk management and
governance practices that is comparable to the disclosure provided by
other registrants. Further, as stated in Sections II and III of this
release, evidence suggests that smaller companies may have an equal or
greater risk than larger companies of being attacked, making the
proposed disclosures particularly important for investors in these
companies.\180\ Therefore, our objectives would not be served by
establishing different compliance or reporting requirements for small
entities or clarifying, consolidating or simplifying compliance and
reporting requirements for small entities.
---------------------------------------------------------------------------

    \180\ See supra note 18. See Section III.E.3.
---------------------------------------------------------------------------

    With respect to using performance rather than design standards, the
proposed amendments use primarily use design rather than performance
standards to promote more consistent and comparable disclosures by all
registrants.
    Section II of this release includes specific requests for comment
on whether certain categories of registrants, including smaller
reporting companies, should be exempted from the proposed Regulation S-
K Item 106 disclosure regarding cybersecurity risk management, strategy
and governance. The release also requests comment on how any exemption
would impact investor assessments and comparisons of the cybersecurity
risks of registrants. In addition, comment is solicited on whether
smaller reporting companies should be exempted from the board expertise
disclosure requirement in proposed Item 407(j) and from the
requirements to present the proposed disclosure in Inline XBRL.
Request for Comment
    We encourage the submission of comments with respect to any aspect
of this IRFA. In particular, we request comments regarding:
     The number of small entities that may be affected by the
proposed amendments;
     The existence or nature of the potential impact of the
proposed amendments on small entities discussed in the analysis;
     How the proposed amendments could further lower the burden
on small entities; and
     How to quantify the impact of the proposed amendments.
    Commenters are asked to describe the nature of any impact and
provide empirical data supporting the extent of the impact. Comments
will be considered in the preparation of the Final Regulatory
Flexibility Analysis, if the proposed amendments are adopted, and will
be placed in the same public file as comments on the proposed
amendments themselves.

Statutory Authority and Text of Proposed Rule and Form Amendments

    We are proposing the rule and form amendments contained in this
document under the authority set forth in Sections 7 and 19(a) of the
Securities Act and Sections 3(b), 12, 13, 14, 15, and 23(a) of the
Exchange Act.

List of Subjects in 17 CFR Parts 229, 232, 239, 240, and 249

    Reporting and record keeping requirements, Securities.

    For the reasons set forth in the preamble, the Commission is
proposing to amend title 17, chapter II of the Code of Federal
Regulations as follows:

PART 229--STANDARD INSTRUCTIONS FOR FILING FORMS UNDER SECURITIES
ACT OF 1933, SECURITIES EXCHANGE ACT OF 1934 AND ENERGY POLICY AND
CONSERVATION ACT OF 1975--REGULATION S-K

0
1. The authority citation for part 229 continues to read as follows:

    Authority:  15 U.S.C. 77e, 77f, 77g, 77h, 77j, 77k, 77s, 77z-2,
77z-3, 77aa(25), 77aa(26), 77ddd, 77eee, 77ggg, 77hhh, 77iii, 77jjj,
77nnn, 77sss, 78c, 78i, 78j, 78j-3, 78l, 78m, 78n, 78n-1, 78o, 78u-
5, 78w, 78ll, 78mm, 80a-8, 80a-9, 80a-20, 80a-29, 80a-30, 80a-31(c),
80a-37, 80a-38(a), 80a-39, 80b-11 and 7201 et seq.; 18 U.S.C. 1350;
sec. 953(b), Pub. L. 111-203, 124 Stat. 1904 (2010); and sec.
102(c), Pub. L. 112-106, 126 Stat. 310 (2012).

0
2. Add Sec.  229.106 to read as follows:

Sec.  229.106  (Item 106) Cybersecurity.

    (a) Definitions. For purposes of this section:
    Cybersecurity incident means an unauthorized occurrence on or
conducted through a registrant's information systems that jeopardizes
the confidentiality, integrity, or availability of a registrant's
information systems or any information residing therein.
    Cybersecurity threat means any potential occurrence that may result
in, an unauthorized effort to adversely affect the confidentiality,
integrity or availability of a registrant's information systems or any
information residing therein.
    Information systems means information resources, owned or used by
the registrant, including physical or virtual infrastructure controlled
by such information resources, or components thereof, organized for the
collection, processing, maintenance, use, sharing, dissemination, or
disposition of the registrant's information to maintain or support the
registrant's operations.
    (b) Risk management and strategy. Disclose in such detail as
necessary to adequately describe the registrant's policies and
procedures, if it has any, for the identification and management of
risks from cybersecurity threats, including, but not limited to:
Operational risk (i.e., disruption of business operations);
intellectual property theft; fraud; extortion; harm to employees or
customers; violation of privacy laws and other litigation and legal
risk; and reputational risk. Disclosure under this section should
include, as applicable, a discussion of whether:
    (1) The registrant has a cybersecurity risk assessment program, and
if so, provide a description of such program;
    (2) The registrant engages assessors, consultants, auditors, or
other third parties in connection with any cybersecurity risk
assessment program;
    (3) The registrant has policies and procedures to oversee and
identify the cybersecurity risks associated with its use of any third-
party service provider, including, but not limited to, those providers
that have access to the registrant's customer and employee data. If so,
the registrant shall describe these policies and procedures, including
whether and how cybersecurity considerations affect the selection and
oversight of these providers and contractual and other mechanisms the
company uses to mitigate cybersecurity risks related to these
providers;
    (4) The registrant undertakes activities to prevent, detect, and
minimize effects of cybersecurity incidents, and if so, provide a
description of the types of activities undertaken;
    (5) The registrant has business continuity, contingency, and
recovery plans in the event of a cybersecurity incident;
    (6) Previous cybersecurity incidents informed changes in the
registrant's governance, policies and procedures, or technologies;
    (7) Cybersecurity-related risks and previous cybersecurity-related
incidents have affected or are reasonably likely to affect the
registrant's strategy, business model, results of operations, or
financial condition and if so, how; and
    (8) Cybersecurity risks are considered as part of the registrant's
business strategy, financial planning, and capital allocation, and if
so, how.
    (c) Governance. (1) Describe the board's oversight of cybersecurity
risk, including the following as applicable:
    (i) Whether the entire board, specific board members, or a board
committee is responsible for the oversight of cybersecurity risks;
    (ii) The processes by which the board is informed about
cybersecurity risks, and the frequency of its discussions on this
topic; and
    (iii) Whether and how the board or board committee considers
cybersecurity risks as part of its business strategy, risk management,
and financial oversight.
    (2) Describe management's role in assessing and managing
cybersecurity-related risks, as well as its role in implementing the
registrant's cybersecurity policies, procedures, and strategies. The
description should include, but not be limited to, the following
information:
    (i) Whether certain management positions or committees are
responsible for measuring and managing cybersecurity risk, specifically
the prevention, mitigation, detection, and remediation of cybersecurity
incidents, and the relevant expertise of such persons or members in
such detail as necessary to fully describe the nature of the expertise;
    (ii) Whether the registrant has a designated chief information
security officer, or someone in a comparable position, and if so, to
whom that individual reports within the registrant's organizational
chart, and the relevant expertise of any such persons in such detail as
necessary to fully describe the nature of the expertise;
    (iii) The processes by which such persons or committees are
informed about and monitor the prevention, mitigation, detection, and
remediation of cybersecurity incidents; and
    (iv) Whether and how frequently such persons or committees report
to the board of directors or a committee of the board of directors on
cybersecurity risk.
    Instructions to Item 106(c): 1. In the case of a foreign private
issuer with a two-tier board of directors, for purposes of paragraph
(c) of this section, the term board of directors means the supervisory
or non-management board. In the case of a foreign private issuer
meeting the requirements of Sec.  240.10A-3(c)(3) of this chapter, for
purposes of paragraph (c) of this Item, the term board of directors
means the issuer's board of auditors (or similar body) or statutory
auditors, as applicable.
    2. Relevant experience of management in Item 106(c)(2)(i) and (ii)
may include, for example: Prior work experience in cybersecurity; any
relevant degrees or certifications; any knowledge, skills, or other
background in cybersecurity.
    (d) Updated incident disclosure. (1) If the registrant has
previously provided disclosure regarding one or more cybersecurity
incidents pursuant to Item 1.05 of Form 8-K, the registrant must
disclose any material changes, additions, or updates regarding such
incident in the registrant's quarterly report filed with the Commission
on Form 10-Q (17 CFR 249.308a) or annual report filed with the
Commission on Form 10-K (17 CFR 249.310) for the period (the
registrant's fourth fiscal quarter in the case of an annual report) in
which the change, addition, or update occurred. The description should
also include, as applicable, but not be limited to, the following
information:
    (i) Any material effect of the incident on the registrant's
operations and financial condition;
    (ii) Any potential material future impacts on the registrant's
operations and financial condition;
    (iii) Whether the registrant has remediated or is currently
remediating the incident; and
    (iv) Any changes in the registrant's policies and procedures as a
result of the cybersecurity incident, and how the incident may have
informed such changes.
    (2) The registrant should provide the following disclosure to the
extent known to management when a series of previously undisclosed
individually immaterial cybersecurity incidents has become material in
the aggregate:
    (i) A general description of when the incidents were discovered and
whether they are ongoing;
    (ii) A brief description of the nature and scope of the incidents;

    (iii) Whether any data was stolen or altered in connection with the
incidents;
    (iv) The effect of the incidents on the registrant's operations;
and
    (v) Whether the registrant has remediated or is currently
remediating the incidents.
    (e) Structured Data Requirement. Provide the information required
by this Item in an Interactive Data File in accordance with Rule 405 of
Regulation S-T and the EDGAR Filer Manual.
0
3. Amend Sec.  229.407 by adding paragraph (j) to read as follows:

Sec.  229.407  (Item 407) Corporate Governance.

* * * * *
    (j) Cybersecurity expertise. (1) If any member of the registrant's
board of directors has expertise in cybersecurity, disclose the name(s)
of any such director(s), and provide such detail as necessary to fully