our RFA analysis. We also note the recommendations for all
Commission rulemakings from the Office of the Advocate for Small
Business Capital Formation. See 2022 OASB Annual Report.
    \543\ Id.
    \544\ Proposing Release at 16617.
    \545\ See letter from Advocacy.
    \546\ Id.
    \547\ Id.
    \548\ Id.
---------------------------------------------------------------------------

    The comment letter from Advocacy also addressed the discussion of
alternatives within the IRFA and the Commission's explanation of why it
did not ultimately propose such alternatives. Advocacy stated that
``[t]he RFA requires that an IRFA provide significant, feasible
alternatives that accomplish an agency's objectives,'' and stated that
the IRFA did not satisfy this requirement because it listed ``broad
categories of potential alternatives to the proposed rules but [did]
not analyze any specific alternative that was considered by the SEC,''
and because it did not ``contain a description of significant
alternatives which accomplish the stated SEC objectives and which
minimize the significant economic impact of the proposal on small
entities.''
1. Estimate of Affected Small Entities and Impact to Those Entities
    With respect to the adequacy of the Proposing Release's estimate of
affected small entities, the RFA requires ``a description of and, where
feasible, an estimate of the number of small entities to which the
proposed rule will apply.'' \549\ Advocacy's published guidance
recommends agencies use NAICS classifications to help in ``identifying
the industry, governmental and nonprofit sectors they intend to
regulate.'' \550\ Here, given that the rulemaking applies to and
impacts all public company registrants, regardless of industry or
sector, we do not believe that further breakout of such registrants by
industry classification is necessary or would otherwise be helpful to
such entities understanding the impact of the

proposed or final rules. This is not a case in which small entities in
certain industries and sectors would be affected more than others, as
cybersecurity risks exist across industries.\551\ For the same reasons
we are not breaking down the affected entities into smaller size groups
(e.g., based on total assets) as recommended by Advocacy. Given the
nature of the final rules, we believe that our estimate of the number
of small entities to which the final rules will apply adequately
describes and estimates the small entities that will be affected.\552\
---------------------------------------------------------------------------

    \549\ 5 U.S.C. 603(b)(3).
    \550\ U.S. Small Business Administration Office of Advocacy, A
Guide for Government Agencies: How to Comply with the Regulatory
Flexibility Act (Aug. 2017), at 18, available at https://www.sba.gov/sites/default/files/advocacy/How-to-Comply-with-the-RFA-WEB.pdf.
    \551\ A breakout would be relevant where, for example, the
Commission finds that small entities generally would not be affected
by a rule but small entities in a particular industry would be
affected.
    \552\ See infra Section VI.C.
---------------------------------------------------------------------------

    With respect to Advocacy's suggestion that the proposed rule may be
``particularly problematic'' for EGCs, we have discussed in Section
IV.C.2 above the anticipated costs of the final rules, including their
impact on EGCs. We also note that the category of EGC is not the same
as the category of ``small entity'' for purposes of the RFA, and indeed
EGC status is not a reliable indicator of whether a registrant is a
small entity.\553\ While EGC status does include a revenue component,
it importantly considers whether the issuer is seasoned, meaning,
whether it is a new registrant (rather than a registrant with a longer
public reporting history). Accordingly, while many EGCs are small
entities, there are many that are not. Likewise, many small entities
are not EGCs. For purposes of the FRFA, our focus is on the impact on
small entities, regardless of whether or not they are EGCs.
---------------------------------------------------------------------------

    \553\ An EGC is defined as a company that has total annual gross
revenues of less than $1.235 billion during its most recently
completed fiscal year and, as of Dec. 8, 2011, had not sold common
equity securities under a registration statement. A company
continues to be an EGC for the first five fiscal years after it
completes an initial public offering, unless one of the following
occurs: its total annual gross revenues are $1.235 billion or more;
it has issued more than $1 billion in non-convertible debt in the
past three years; or it becomes a ``large accelerated filer,'' as
defined in Exchange Act Rule 12b-2.
---------------------------------------------------------------------------

    We disagree with the statement in the Advocacy comment letter that
``SEC expects that the costs associated with the proposed amendments to
be similar for large and small entities.'' The Commission explained in
the IRFA that the proposed amendments would apply to small entities to
the same extent as other entities, irrespective of size, and that
therefore, the Commission expected that ``the nature of any benefits
and costs associated with the proposed amendments to be similar for
large and small entities'' (emphasis added).\554\ The analysis with
respect to the nature of the costs (and benefits) of the proposed rules
detailed in the Economic Analysis of the Proposing Release was
referenced in the IRFA to help small entities understand such impacts,
not to imply that small entities face the same degree of costs as large
entities. Indeed, the Commission went on to state in both the IRFA and
the Economic Analysis of the Proposing Release that, while it was
unable to project the economic impacts on small entities with
precision, it recognized that ``the costs of the proposed amendments
borne by the affected entities could have a proportionally greater
effect on small entities, as they may be less able to bear such costs
relative to larger entities.'' \555\ Additionally, in Section IV,
above, we discuss the economic effects, including costs, of the final
amendments across all entities. We recognize that to the extent the
costs are generally uniform across all entities, they would have a
relatively greater burden on smaller entities. That said, as discussed
both above and below, to help mitigate that relatively greater burden
and to respond to comment letters including the letter from Advocacy,
we have extended the compliance date for smaller reporting companies so
as to provide additional transition time and allow them to benefit from
the experience of larger companies. Accordingly, we believe that both
this FRFA and our prior IRFA adequately describe and analyze the
relative impact of costs to small entities.
---------------------------------------------------------------------------

    \554\ Proposing Release at 16617 (emphasis added).
    \555\ Proposing Release at 16617-16618. See also id. at 16613
(``smaller companies might incur a cost that is disproportionally
high, compared to larger companies under the proposed rules'').
---------------------------------------------------------------------------

2. Consideration of Alternatives
    The IRFA's discussion of significant alternatives, and our
discussion of alternatives below, satisfy the RFA. The relevant RFA
requirement provides that an IRFA ``shall also contain a description of
any significant alternatives to the proposed rule which accomplish the
stated objectives of applicable statutes and which minimize any
significant economic impact of the proposed rule on small entities.''
\556\ In the Proposing Release, the Commission discussed each of the
types of significant alternatives noted in Section 603 of the RFA and
concluded that none of these alternatives would accomplish the stated
objectives of the rulemaking while minimizing any significant impact on
small entities. In addition, Section III.E of the Proposing Release
discussed reasonable alternatives to the proposed rules and their
economic impacts. Similarly, in addition to the discussion in Section
VI.E below, in Section IV.E of this release we also discuss reasonable
alternatives of the final rules and their economic impacts.
---------------------------------------------------------------------------

    \556\ 5 U.S.C. 603(c).
---------------------------------------------------------------------------

    While not commenting on the alternatives raised in the IRFA
specifically, two commenters stated that the final rules should exempt
smaller businesses. One of these commenters stated that small companies
in the biotechnology industry ``do not have the capacity, nor the
business need, to have institutional structures related to the
management, planning, oversight, and maintenance of cybersecurity
related systems and suppliers. These companies should not have to hire
extra employees specifically for the purposes of implementing
cybersecurity related programs.'' \557\ The other commenter noted that,
with respect to the proposed requirement to require disclosure about
the cybersecurity expertise of board members, small companies ``have
limited resources to begin with, and may find it more difficult than
large companies to identify board members with requisite cyber
expertise given that there already is a lack of talent in this area.''
\558\
---------------------------------------------------------------------------

    \557\ See letter from BIO.
    \558\ See letter from NDIA.
---------------------------------------------------------------------------

    With respect to the first of these commenters, we note that neither
the proposed nor the final rules require any company to ``implement new
management structures'' or otherwise adopt or change ``institutional
structures related to the management, planning, oversight, and
maintenance of cybersecurity related systems and suppliers.'' \559\ The
final rules instead call for disclosure of a registrant's processes, if
any, for assessing, identifying, and managing material cybersecurity
risks. To the extent that a registrant does not have such processes,
the final rules do not impose any additional costs. With respect to the
second of these commenters, we note that, consistent with commenter
feedback and for the reasons discussed above, we have not adopted the
proposed requirement related to disclosure of board cybersecurity
expertise.
---------------------------------------------------------------------------

    \559\ The quoted language is from the BIO letter.
---------------------------------------------------------------------------

    Finally, we note that many commenters explicitly opposed exempting
smaller businesses from the proposed rules,\560\ in part because they
may face equal \561\ or greater \562\

cybersecurity risk than larger companies, or because investors'
relative share in a smaller company may be higher, such that small
companies' cybersecurity risk ``may actually embody the most pressing
cybersecurity risk to an investor.'' \563\ We agree with these
analyses,\564\ and accordingly are not exempting small entities from
the final rules. However, as discussed above, in response to concerns
about the impact of the rules on smaller companies and in order to
provide smaller reporting companies with additional time to prepare to
comply with the incident disclosure requirements, we are providing such
registrants with an additional 180 days from the non-smaller reporting
company compliance date before they must comply with the new Form 8-K
requirement.
---------------------------------------------------------------------------

    \560\ See letters from CSA; Cybersecurity Coalition; NASAA;
Prof. Perullo; Tenable.
    \561\ See letter from Cybersecurity Coalition.
    \562\ See letters from NASAA and Tenable.
    \563\ See letter from Prof. Perullo.
    \564\ We note that one commenter stated its conclusion that
``cyberattacks mainly affect larger companies.'' See letter from
BIO. The basis of the commenter's assertion is that mean market
capitalization of impacted companies in the relevant study cited in
the Proposing Release is $58.9 billion (Kamiya, et al. (2021)),
which it notes is much higher than the average for small companies,
and thus concludes that ``cyberattacks mainly affect large companies
and are not material for smaller companies.'' As noted in Section
IV, supra, an average market capitalization of $58.9 billion does
not preclude the existence of numerous companies much smaller (and
larger) than that amount. See supra note 478. The commenter
additionally notes that the relevant study states that ``firms are
more likely to experience cyberattacks when they are larger.'' To
the extent that smaller entities face fewer cyber incidents, that
would result in a less frequent need to analyze whether disclosure
of such incidents is required under the final rules. However, even
if smaller entities are less likely to experience a cyberattack,
this would not negate the analysis that such attacks, when they do
occur, are more likely to be material for the reasons discussed
above.
---------------------------------------------------------------------------

C. Small Entities Subject to the Final Amendments

    The final amendments would apply to registrants that are small
entities. The RFA defines ``small entity'' to mean ``small business,''
``small organization,'' or ``small governmental jurisdiction.'' \565\
For purposes of the RFA, under our rules, a registrant, other than an
investment company, is a ``small business'' or ``small organization''
if it had total assets of $5 million or less on the last day of its
most recent fiscal year and is engaged or proposing to engage in an
offering of securities that does not exceed $5 million.\566\ An
investment company, including a business development company,\567\ is
considered to be a ``small business'' if it, together with other
investment companies in the same group of related investment companies,
has net assets of $50 million or less as of the end of its most recent
fiscal year.\568\ We estimate that, as of December 31, 2022, there were
approximately 800 issuers and 10 business development companies that
may be considered small entities that would be subject to the final
amendments.
---------------------------------------------------------------------------

    \565\ 5 U.S.C. 601(6).
    \566\ See 17 CFR 240.0-10(a) [Exchange Act Rule 0-10(a)].
    \567\ Business development companies are a category of closed-
end investment company that are not registered under the Investment
Company Act [15 U.S.C. 80a-2(a)(48) and 80a-53 through 64].
    \568\ 17 CFR 270.0-10(a).
---------------------------------------------------------------------------

D. Projected Reporting, Recordkeeping, and other Compliance
Requirements

    Per the final rules, registrants will be required to report
material cybersecurity incidents on Form 8-K and Form 6-K for FPIs, and
will be required to describe in their annual reports on Forms 10-K and
20-F certain aspects of their cybersecurity risk management, strategy,
and governance, if any. The final amendments are described in more
detail in Section II above. These requirements generally will apply to
small entities to the same extent as other entities, irrespective of
size or industry classification, although we are adopting a later
compliance date for smaller reporting companies in response to concerns
raised by commenters. We continue to expect that the nature of any
benefits and costs associated with the amendments to be similar for
large and small entities, and so we refer to the discussion of the
amendments' economic effects on all affected parties, including small
entities, in Section IV above. Also consistent with the discussion in
Sections II and IV above, we acknowledge that, in particular to the
extent that a smaller entity would be required to provide disclosure
under the final rules, it may face costs that are proportionally
greater as they may be less able to bear such costs relative to larger
entities. However, as discussed in in Section IV, we anticipate that
the economic benefits and costs likely could vary widely among small
entities based on a number of factors, such as the nature and conduct
of their businesses, including whether the company actively manages
material cybersecurity risks, which makes it difficult to project the
economic impact on small entities with precision. To the extent that
the disclosure requirements have a greater effect on small registrants
relative to large registrants, they could result in adverse effects on
competition. The fixed component of the legal costs of preparing the
disclosure would be a primary contributing factor. Compliance with
certain provisions of the final amendments may require the use of
professional skills, including legal, accounting, and technical skills.

E. Agency Action To Minimize Effect on Small Entities

    The RFA directs us to consider alternatives that would accomplish
our stated objectives, while minimizing any significant adverse impact
on small entities. Accordingly, we considered the following
alternatives:
     Exempting small entities from all or part of the
requirements;
     Establishing different compliance or reporting
requirements that take into account the resources available to small
entities;
     Using performance rather than design standards; and
     Clarifying, consolidating, or simplifying compliance and
reporting requirements under the rules for small entities.
    The rules are intended to better inform investors about
cybersecurity incidents and, if any, the cybersecurity risk management,
strategy, and governance of registrants of all types and sizes that are
subject to the Exchange Act reporting requirements. We explain above in
Sections II and IV that current requirements and guidance are not
yielding uniform, comparable disclosure sufficient to meet investors'
needs. The disclosure that does exist is scattered in various parts of
registrants' filings, making it difficult for investors to locate,
analyze, and compare across registrants. Staff has also observed that
smaller reporting companies generally provide less cybersecurity
disclosure as compared to larger registrants, and commenters agreed
that there is a need for cybersecurity disclosure from small
companies.\569\
---------------------------------------------------------------------------

    \569\ See supra notes 339 to 342 and accompanying text.
---------------------------------------------------------------------------

    Given the current disclosure landscape, exempting small entities or
otherwise clarifying, consolidating, or simplifying compliance and
reporting requirements under the rules for small entities would
frustrate the rulemaking's goal of providing investors with more
uniform and timely disclosure about material cybersecurity incidents
and about cybersecurity risk management, strategy, and governance
practices across all registrants. That said, as discussed in Section II
above, we have consolidated and simplified the disclosure requirements
for all entities, which should ease small entities' compliance as well.
Further, as noted above, smaller companies may face equal or greater
cybersecurity risk than

larger companies, making the disclosures important for investors in
these companies.
    On the other hand, we believe the rulemaking's goals can be
achieved by providing smaller reporting companies with additional time
to come into compliance. Therefore, we are delaying smaller reporting
companies' required compliance date with the Form 8-K incident
disclosure requirement by an additional 180 days from the non-smaller
reporting company compliance date. This delay will benefit smaller
reporting companies both by giving them extra time to establish
disclosure controls and procedures and by allowing them to observe and
learn from best practices as they develop among larger registrants.
    Similarly, the final rules incorporate a combination of performance
and design standards with respect to all subject entities, including
small entities, in order to balance the objectives and compliance
burdens of the rules. While the final rules do use design standards to
promote uniform compliance requirements for all registrants and to
address the concerns underlying the amendments, which apply to entities
of all size, they also incorporate elements of performance standards to
give registrants sufficient flexibility to craft meaningful disclosure
that is tailored to their particular facts and circumstances. For
example, the final rules require a registrant to describe its
``processes, if any, for assessing, identifying, and managing material
risks from cybersecurity threats in sufficient detail for a reasonable
investor to understand those processes.'' The rule also provides a non-
exclusive list of disclosure items that a registrant should include in
providing responsive disclosure to this performance standard; this
design element provides registrants with additional guidance with
respect to the type of disclosure topics that could be covered and
promotes consistency.

Statutory Authority

    The amendments contained in this release are being adopted under
the authority set forth in Sections 7 and 19(a) of the Securities Act
and Sections 3(b), 12, 13, 15, and 23(a) of the Exchange Act.

List of Subjects in 17 CFR Parts 229, 232, 239, 240, and 249

    Reporting and record keeping requirements, Securities.

Text of Amendments

    For the reasons set forth in the preamble, the Commission amends
title 17, chapter II of the Code of Federal Regulations as follows:

PART 229--STANDARD INSTRUCTIONS FOR FILING FORMS UNDER SECURITIES
ACT OF 1933, SECURITIES EXCHANGE ACT OF 1934 AND ENERGY POLICY AND
CONSERVATION ACT OF 1975--REGULATION S-K

0
1. The authority citation for part 229 continues to read as follows:

    Authority: 15 U.S.C. 77e, 77f, 77g, 77h, 77j, 77k, 77s, 77z-2,
77z-3, 77aa(25), 77aa(26), 77ddd, 77eee, 77ggg, 77hhh, 77iii, 77jjj,
77nnn, 77sss, 78c, 78i, 78j, 78j-3, 78l, 78m, 78n, 78n-1, 78o, 78u-
5, 78w, 78ll, 78mm, 80a-8, 80a-9, 80a-20, 80a-29, 80a-30, 80a-31(c),
80a-37, 80a-38(a), 80a-39, 80b-11 and 7201 et seq.; 18 U.S.C. 1350;
sec. 953(b), Pub. L. 111-203, 124 Stat. 1904 (2010); and sec.
102(c), Pub. L. 112-106, 126 Stat. 310 (2012).

0
2. Add Sec.  229.106 to read as follows:

Sec.  229.106  (Item 106) Cybersecurity.

    (a) Definitions. For purposes of this section:
    Cybersecurity incident means an unauthorized occurrence, or a
series of related unauthorized occurrences, on or conducted through a
registrant's information systems that jeopardizes the confidentiality,
integrity, or availability of a registrant's information systems or any
information residing therein.
    Cybersecurity threat means any potential unauthorized occurrence on
or conducted through a registrant's information systems that may result
in adverse effects on the confidentiality, integrity, or availability
of a registrant's information systems or any information residing
therein.
    Information systems means electronic information resources, owned
or used by the registrant, including physical or virtual infrastructure
controlled by such information resources, or components thereof,
organized for the collection, processing, maintenance, use, sharing,
dissemination, or disposition of the registrant's information to
maintain or support the registrant's operations.
    (b) Risk management and strategy. (1) Describe the registrant's
processes, if any, for assessing, identifying, and managing material
risks from cybersecurity threats in sufficient detail for a reasonable
investor to understand those processes. In providing such disclosure, a
registrant should address, as applicable, the following non-exclusive
list of disclosure items:
    (i) Whether and how any such processes have been integrated into
the registrant's overall risk management system or processes;
    (ii) Whether the registrant engages assessors, consultants,
auditors, or other third parties in connection with any such processes;
and
    (iii) Whether the registrant has processes to oversee and identify
such risks from cybersecurity threats associated with its use of any
third-party service provider.
    (2) Describe whether any risks from cybersecurity threats,
including as a result of any previous cybersecurity incidents, have
materially affected or are reasonably likely to materially affect the
registrant, including its business strategy, results of operations, or
financial condition and if so, how.
    (c) Governance. (1) Describe the board of directors' oversight of
risks from cybersecurity threats. If applicable, identify any board
committee or subcommittee responsible for the oversight of risks from
cybersecurity threats and describe the processes by which the board or
such committee is informed about such risks.
    (2) Describe management's role in assessing and managing the
registrant's material risks from cybersecurity threats. In providing
such disclosure, a registrant should address, as applicable, the
following non-exclusive list of disclosure items:
    (i) Whether and which management positions or committees are
responsible for assessing and managing such risks, and the relevant
expertise of such persons or members in such detail as necessary to
fully describe the nature of the expertise;
    (ii) The processes by which such persons or committees are informed
about and monitor the prevention, detection, mitigation, and
remediation of cybersecurity incidents; and
    (iii) Whether such persons or committees report information about
such risks to the board of directors or a committee or subcommittee of
the board of directors.
    Instruction 1 to Item 106(c): In the case of a foreign private
issuer with a two-tier board of directors, for purposes of paragraph
(c) of this section, the term ``board of directors'' means the
supervisory or non-management board. In the case of a foreign private
issuer meeting the requirements of Sec.  240.10A-3(c)(3) of this
chapter, for purposes of paragraph (c) of this Item, the term ``board
of directors'' means the issuer's board of auditors (or similar body)
or statutory auditors, as applicable.
    Instruction 2 to Item 106(c): Relevant expertise of management in
Item 106(c)(2)(i) may include, for example: Prior work experience in
cybersecurity; any relevant degrees or certifications; any knowledge,
skills, or other background in cybersecurity.

    (d) Structured Data Requirement. Provide the information required
by this Item in an Interactive Data File in accordance with Rule 405 of
Regulation S-T and the EDGAR Filer Manual.

0
3. Amend Sec.  229.601 by revising paragraph (b)(101)(i)(C)(1) as
follows:

Sec.  229.601  (Item 601) Exhibits.

* * * * *
    (b) * * *
    (101) * * *
    (i) * * *
    (C) * * *
    (1) Only when:
    (i) The Form 8-K contains audited annual financial statements that
are a revised version of financial statements that previously were
filed with the Commission and that have been revised pursuant to
applicable accounting standards to reflect the effects of certain
subsequent events, including a discontinued operation, a change in
reportable segments or a change in accounting principle. In such case,
the Interactive Data File will be required only as to such revised
financial statements regardless of whether the Form 8-K contains other
financial statements; or
    (ii) The Form 8-K includes disclosure required to be provided in an
Interactive Data File pursuant to Item 1.05(b) of Form 8-K; and
* * * * *

PART 232--REGULATION S-T--GENERAL RULES AND REGULATIONS FOR
ELECTRONIC FILINGS

0
4. The general authority citation for part 232 continues to read as
follows:

    Authority: 15 U.S.C. 77c, 77f, 77g, 77h, 77j, 77s(a), 77z-3,
77sss(a), 78c(b), 78l, 78m, 78n, 78o(d), 78w(a), 78ll, 80a-6(c),
80a-8, 80a-29, 80a-30, 80a-37, 80b-4, 80b-6a, 80b-10, 80b-11, 7201
et seq.; and 18 U.S.C. 1350, unless otherwise noted.
* * * * *

0
5. Amend Sec.  232.405 by adding paragraph (b)(4)(v) to read as
follows:

Sec.  232.405  Interactive Data File submissions.

* * * * *
    (b) * * *
    (4) * * *
    (v) Any disclosure provided in response to: Sec.  229.106 of this
chapter (Item 106 of Regulation S-K); Item 1.05 of Sec.  249.308 of
this chapter (Item 1.05 of Form 8-K); and Item 16K of Sec.  249.220f of
this chapter (Item 16K of Form 20-F).
* * * * *

PART 239--FORMS PRESCRIBED UNDER THE SECURITIES ACT OF 1933

0
6. The general authority citation for part 239 continues to read as
follows:

    Authority: 15 U.S.C. 77c, 77f, 77g, 77h, 77j, 77s, 77z-2, 77z-3,
77sss, 78c, 78l, 78m, 78n, 78o(d), 78o-7 note, 78u-5, 78w(a), 78ll,
78mm, 80a-2(a), 80a-3, 80a-8, 80a-9, 80a-10, 80a-13, 80a-24, 80a-26,
80a-29, 80a-30, 80a-37, and sec. 71003 and sec. 84001, Pub. L. 114-
94, 129 Stat. 1321, unless otherwise noted.
* * * * *

0
7. Amend Sec.  239.13 by revising paragraph (a)(3)(ii) to read as
follows:

Sec.  239.13  Form S-3, for registration under the Securities Act of
1933 of securities of certain issuers offered pursuant to certain types
of transactions.

* * * * *
    (a) * * *
    (3) * * *
    (ii) Has filed in a timely manner all reports required to be filed
during the twelve calendar months and any portion of a month
immediately preceding the filing of the registration statement, other
than a report that is required solely pursuant to Item 1.01, 1.02,
1.05, 2.03, 2.04, 2.05, 2.06, 4.02(a), 6.01, 6.03, or 6.05 of Form 8-K
(Sec.  249.308 of this chapter). If the registrant has used (during the
twelve calendar months and any portion of a month immediately preceding
the filing of the registration statement) Sec.  240.12b-25(b) of this
chapter with respect to a report or a portion of a report, that report
or portion thereof has actually been filed within the time period
prescribed by that section; and
* * * * *

0
8. Amend Form S-3 (referenced in Sec.  239.13) by adding General
Instruction I.A.3(b).

    Note: Form S-3 is attached as Appendix A to this document. Form
S-3 will not appear in the Code of Federal Regulations.

PART 240--GENERAL RULES AND REGULATIONS, SECURITIES EXCHANGE ACT OF
1934

0
9. The authority citation for part 240 continues to read, in part, as
follows:

    Authority: 15 U.S.C. 77c, 77d, 77g, 77j, 77s, 77z-2, 77z-3,
77eee, 77ggg, 77nnn, 77sss, 77ttt, 78c, 78c-3, 78c-5, 78d, 78e, 78f,
78g, 78i, 78j, 78j-1, 78j-4, 78k, 78k-1, 78l, 78m, 78n, 78n-1, 78o,
78o-4, 78o-10, 78p, 78q, 78q-1, 78s, 78u-5, 78w, 78x, 78dd, 78ll,
78mm, 80a-20, 80a-23, 80a-29, 80a-37, 80b-3, 80b-4, 80b-11, 7201 et
seq., and 8302; 7 U.S.C. 2(c)(2)(E); 12 U.S.C. 5221(e)(3); 18 U.S.C.
1350; and Pub. L. 111-203, 939A, 124 Stat. 1376 (2010); and Pub. L.
112-106, sec. 503 and 602, 126 Stat. 326 (2012), unless otherwise
noted.
* * * * *

    Section 240.15d-11 is also issued under secs. 3(a) and 306(a),
Pub. L. 107-204, 116 Stat. 745.
* * * * *

0
10. Amend Sec.  240.13a-11 by revising paragraph (c) to read as
follows:

Sec.  240.13a-11  Current reports on Form 8-K (Sec.  249.308 of this
chapter).

* * * * *
    (c) No failure to file a report on Form 8-K that is required solely
pursuant to Item 1.01, 1.02, 1.05, 2.03, 2.04, 2.05, 2.06, 4.02(a),
5.02(e), or 6.03 of Form 8-K shall be deemed to be a violation of 15
U.S.C. 78j(b) and Sec.  240.10b-5.

0
11. Amend Sec.  240.15d-11 by revising paragraph (c) to read as
follows:

Sec.  240.15d-11  Current reports on Form 8-K (Sec.  249.308 of this
chapter).

* * * * *
    (c) No failure to file a report on Form 8-K that is required solely
pursuant to Item 1.01, 1.02, 1.05, 2.03, 2.04, 2.05, 2.06, 4.02(a),
5.02(e), or 6.03 of Form 8-K shall be deemed to be a violation of 15
U.S.C. 78j(b) and Sec.  240.10b-5.

PART 249--FORMS, SECURITIES EXCHANGE ACT OF 1934

0
12. The authority citation for part 249 continues to read, in part, as
follows:

    Authority: 15 U.S.C. 78a et seq. and 7201 et seq.; 12 U.S.C.
5461 et seq.; 18 U.S.C. 1350; Sec. 953(b) Pub. L. 111-203, 124 Stat.
1904; Sec. 102(a)(3) Pub. L. 112-106, 126 Stat. 309 (2012), Sec. 107
Pub. L. 112-106, 126 Stat. 313 (2012), Sec. 72001 Pub. L. 114-94,
129 Stat. 1312 (2015), and secs. 2 and 3 Pub. L. 116-222, 134 Stat.
1063 (2020), unless otherwise noted.

    Section 249.220f is also issued under secs. 3(a), 202, 208, 302,
306(a), 401(a), 401(b), 406 and 407, Pub. L. 107-204, 116 Stat. 745,
and secs. 2 and 3, Pub. L. 116-222, 134 Stat. 1063.
* * * * *
    Section 249.308 is also issued under 15 U.S.C. 80a-29 and 80a-
37.
* * * * *
    Section 249.310 is also issued under secs. 3(a), 202, 208, 302,
406 and 407, Public Law 107-204, 116 Stat. 745.
* * * * *

0
13. Revise Form 20-F (referenced in Sec.  249.220f) by adding Item 16K.

    Note: Form 20-F is attached as Appendix B to this document. Form
20-F will not appear in the Code of Federal Regulations.

0
14. Amend Form 6-K (referenced in Sec.  249.306) by adding, in the
second paragraph of General Instruction B, the phrase ``material
cybersecurity incident;'' before the phrase ``and any

other information which the registrant deems of material importance to
security holders.''

0
15. Revise Form 8-K (referenced in Sec.  249.308) by:
0
a. Revising General Instruction B.1.;
0
b. Revising General Instruction G.1.; and
0
c. Adding Item 1.05.

    Note: Form 8-K is attached as Appendix C to this document. Form
8-K will not appear in the Code of Federal Regulations.

0
16. Revise Form 10-K (referenced in Sec.  249.310) by:
0
a. Revising General Instruction J(1)(b); and
0
b. Adding Item 1C to Part I.

    Note: Form 10-K is attached as Appendix D to this document. Form
10-K will not appear in the Code of Federal Regulations.

* * * * *

    By the Commission.

    Dated: July 26, 2023.
Vanessa A. Countryman,
Secretary.

    Note: The following appendices will not appear in the Code of
Federal Regulations.

Appendix A--Form S-3

FORM S-3

* * * * *

INFORMATION TO BE INCLUDED IN THE REPORT

* * * * *

General Instructions

I. Eligibility Requirements for Use of Form S-3

* * * * *

A. Registrant Requirements

* * * * *
    3. * * *
    (b) has filed in a timely manner all reports required to be
filed during the twelve calendar months and any portion of a month
immediately preceding the filing of the registration statement,
other than a report that is required solely pursuant to Item 1.01,
1.02, 1.04, 1.05, 2.03, 2.04, 2.05, 2.06, 4.02(a) or 5.02(e) of Form
8-K (Sec.  249.308 of this chapter). If the registrant has used
(during the twelve calendar months and any portion of a month
immediately preceding the filing of the registration statement) Rule
12b-25(b) (Sec.  240.12b-25(b) of this chapter) under the Exchange
Act with respect to a report or a portion of a report, that report
or portion thereof has actually been filed within the time period
prescribed by that rule.
* * * * *

Appendix B--Form 20-F

FORM 20-F

* * * * *

PART II

* * * * *

Item 16K. Cybersecurity

    (a) Definitions. For purposes of this section:
    (1) Cybersecurity incident means an unauthorized occurrence, or
a series of related unauthorized occurrences, on or conducted
through a registrant's information systems that jeopardizes the
confidentiality, integrity, or availability of a registrant's
information systems or any information residing therein.
    (2) Cybersecurity threat means any potential unauthorized
occurrence on or conducted through a registrant's information
systems that may result in adverse effects on the confidentiality,
integrity, or availability of a registrant's information systems or
any information residing therein.
    (3) Information systems means electronic information resources,
owned or used by the registrant, including physical or virtual
infrastructure controlled by such information resources, or
components thereof, organized for the collection, processing,
maintenance, use, sharing, dissemination, or disposition of the
registrant's information to maintain or support the registrant's
operations.
    (b) Risk management and strategy. (1) Describe the registrant's
processes, if any, for assessing, identifying, and managing material
risks from cybersecurity threats in sufficient detail for a
reasonable investor to understand those processes. In providing such
disclosure, a registrant should address, as applicable, the
following non-exclusive list of disclosure items:
    (i) Whether and how any such processes have been integrated into
the registrant's overall risk management system or processes;
    (ii) Whether the registrant engages assessors, consultants,
auditors, or other third parties in connection with any such
processes; and
    (iii) Whether the registrant has processes to oversee and
identify such risks from cybersecurity threats associated with its
use of any third-party service provider.
    (2) Describe whether any risks from cybersecurity threats,
including as a result of any previous cybersecurity incidents, have
materially affected or are reasonably likely to materially affect
the registrant, including its business strategy, results of
operations, or financial condition and if so, how.
    (c) Governance. (1) Describe the board of directors' oversight
of risks from cybersecurity threats. If applicable, identify any
board committee or subcommittee responsible for the oversight of
risks from cybersecurity threats and describe the processes by which
the board or such committee is informed about such risks.
    (2) Describe management's role in assessing and managing the
registrant's material risks from cybersecurity threats. In providing
such disclosure, a registrant should address, as applicable, the
following non-exclusive list of disclosure items:
    (i) Whether and which management positions or committees are
responsible for assessing and managing such risks, and the relevant
expertise of such persons or members in such detail as necessary to
fully describe the nature of the expertise;
    (ii) The processes by which such persons or committees are
informed about and monitor the prevention, detection, mitigation,
and remediation of cybersecurity incidents; and
    (iii) Whether such persons or committees report information
about such risks to the board of directors or a committee or
subcommittee of the board of directors.

Instructions to Item 16K(c)

    1. In the case of a foreign private issuer with a two-tier board
of directors, for purposes of paragraph (c) of this Item, the term
``board of directors'' means the supervisory or non-management
board. In the case of a foreign private issuer meeting the
requirements of Sec.  240.10A-3(c)(3) of this chapter, for purposes
of paragraph (c) of this Item, the term ``board of directors'' means
the issuer's board of auditors (or similar body) or statutory
auditors, as applicable.
    2. Relevant expertise of management in paragraph (c)(2)(i) of
this Item may include, for example: Prior work experience in
cybersecurity; any relevant degrees or certifications; any
knowledge, skills, or other background in cybersecurity.
    (d) Structured Data Requirement. Provide the information
required by this Item in an Interactive Data File in accordance with
Rule 405 of Regulation S-T and the EDGAR Filer Manual.
    Instruction to Item 16K. Item 16K applies only to annual
reports, and does not apply to registration statements on Form 20-F.
* * * * *

Appendix C--Form 8-K

FORM 8-K

* * * * *

GENERAL INSTRUCTIONS

* * * * *

B. Events To Be Reported and Time for Filing of Reports

    1. A report on this form is required to be filed or furnished,
as applicable, upon the occurrence of any one or more of the events
specified in the items in Sections 1 through 6 and 9 of this form.
Unless otherwise specified, a report is to be filed or furnished
within four business days after occurrence of the event. If the
event occurs on a Saturday, Sunday or holiday on which the
Commission is not open for business, then the four business day
period shall begin to run on, and include, the first business day
thereafter. A registrant either furnishing a report on this form
under Item 7.01 (Regulation FD Disclosure) or electing to file a
report on this form under Item 8.01 (Other Events) solely to satisfy
its obligations under Regulation FD (17 CFR 243.100 and 243.101)
must furnish such report or make such filing, as applicable, in
accordance with the requirements of Rule 100(a) of Regulation FD (17
CFR 243.100(a)), including the deadline for furnishing or filing
such report. A report pursuant to Item 5.08 is to be filed within
four business days after the registrant determines the anticipated
meeting date. A report pursuant to Item 1.05 is to be filed within
four business days after the registrant determines that it has
experienced a material cybersecurity incident.
* * * * *

G. Use of This Form by Asset-Backed Issuers

* * * * *
    1. * * *
    (a) Item 1.05, Cybersecurity Incidents;
    (b) Item 2.01, Completion of Acquisition or Disposition of
Assets;
    (c) Item 2.02, Results of Operations and Financial Condition;
    (d) Item 2.03, Creation of a Direct Financial Obligation or an
Obligation under an Off-Balance Sheet Arrangement of a Registrant;
    (e) Item 2.05, Costs Associated with Exit or Disposal
Activities;
    (f) Item 2.06, Material Impairments;
    (g) Item 3.01, Notice of Delisting or Failure to Satisfy a
Continued Listing Rule or Standard; Transfer of Listing;
    (h) Item 3.02, Unregistered Sales of Equity Securities;
    (i) Item 4.01, Changes in Registrant's Certifying Accountant;
    (j) Item 4.02, Non-Reliance on Previously Issued Financial
Statements or a Related Audit Report or Completed Interim Review;
    (k) Item 5.01, Changes in Control of Registrant;
    (l) Item 5.02, Departure of Directors or Principal Officers;
Election of Directors; Appointment of Principal Officers;
    (m) Item 5.04, Temporary Suspension of Trading Under
Registrant's Employee Benefit Plans; and
    (n) Item 5.05, Amendments to the Registrant's Code of Ethics, or
Waiver of a Provision of the Code of Ethics.
* * * * *

INFORMATION TO BE INCLUDED IN THE REPORT

Section 1--Registrant's Business and Operations

* * * * *

Item 1.05 Material Cybersecurity Incidents

    (a) If the registrant experiences a cybersecurity incident that
is determined by the registrant to be material, describe the
material aspects of the nature, scope, and timing of the incident,
and the material impact or reasonably likely material impact on the
registrant, including its financial condition and results of
operations.
    (b) A registrant shall provide the information required by this
Item in an Interactive Data File in accordance with Rule 405 of
Regulation S-T and the EDGAR Filer Manual.
    (c) Notwithstanding General Instruction B.1. to Form 8-K, if the
United States Attorney General determines that disclosure required
by paragraph (a) of this Item 1.05 poses a substantial risk to
national security or public safety, and notifies the Commission of
such determination in writing, the registrant may delay providing
the disclosure required by this Item 1.05 for a time period
specified by the Attorney General, up to 30 days following the date
when the disclosure required by this Item 1.05 was otherwise
required to be provided. Disclosure may be delayed for an additional
period of up to 30 days if the Attorney General determines that
disclosure continues to pose a substantial risk to national security
or public safety and notifies the Commission of such determination
in writing. In extraordinary circumstances, disclosure may be
delayed for a final additional period of up to 60 days if the
Attorney General determines that disclosure continues to pose a
substantial risk to national security and notifies the Commission of
such determination in writing. Beyond the final 60-day delay under
this paragraph, if the Attorney General indicates that further delay
is necessary, the Commission will consider additional requests for
delay and may grant such relief through Commission exemptive order.
    (d) Notwithstanding General Instruction B.1. to Form 8-K, if a
registrant that is subject to 47 CFR 64.2011 is required to delay
disclosing a data breach pursuant to such rule, it may delay
providing the disclosure required by this Item 1.05 for such period
that is applicable under 47 CFR 64.2011(b)(1) and in no event for
more than seven business days after notification required under such
provision has been made, so long as the registrant notifies the
Commission in correspondence submitted to the EDGAR system no later
than the date when the disclosure required by this Item 1.05 was
otherwise required to be provided.

Instructions to Item 1.05

    1. A registrant's materiality determination regarding a
cybersecurity incident must be made without unreasonable delay after
discovery of the incident.
    2. To the extent that the information called for in Item 1.05(a)
is not determined or is unavailable at the time of the required
filing, the registrant shall include a statement to this effect in
the filing and then must file an amendment to its Form 8-K filing
under this Item 1.05 containing such information within four
business days after the registrant, without unreasonable delay,
determines such information or within four business days after such
information becomes available.
    3. The definition of the term ``cybersecurity incident'' in
229.106(a) [Item 106(a) of Regulation S-K] applies to this Item.
    4. A registrant need not disclose specific or technical
information about its planned response to the incident or its
cybersecurity systems, related networks and devices, or potential
system vulnerabilities in such detail as would impede the
registrant's response or remediation of the incident.
* * * * *

Appendix D--Form 10-K

FORM 10-K

* * * * *

GENERAL INSTRUCTIONS

* * * * *

J. Use of This Form by Asset-Backed Issuers

* * * * *
    (1) * * *
    (b) Item 1A, Risk Factors and Item 1C, Cybersecurity;
* * * * *

Part I

* * * * *

Item 1C Cybersecurity

    (a) Furnish the information required by Item 106 of Regulation
S-K (229.106 of this chapter).
* * * * *
[FR Doc. 2023-16194 Filed 8-3-23; 8:45 am]
BILLING CODE 8011-01-P