[Federal Register Volume 87, Number 56 (Wednesday, March 23, 2022)]
[Proposed Rules]
[Pages 16590-16624]
[FR Doc No: 2022-05480]

Vol. 87

Wednesday,

No. 56

March 23, 2022

Part III

Securities and Exchange Commission

-----------------------------------------------------------------------

17 CFR Parts 229, 232, 239, et al.

Cybersecurity Risk Management, Strategy, Governance, and Incident
Disclosure; Proposed Rule

Federal Register / Vol. 87 , No. 56 / Wednesday, March 23, 2022 /
Proposed Rules

-----------------------------------------------------------------------

SECURITIES AND EXCHANGE COMMISSION

17 CFR Parts 229, 232, 239, 240, and 249

[Release Nos. 33-11038; 34-94382; IC-34529; File No. S7-09-22]
RIN 3235-AM89

Cybersecurity Risk Management, Strategy, Governance, and Incident
Disclosure

AGENCY: Securities and Exchange Commission.

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: The Securities and Exchange Commission (``Commission'') is
proposing rules to enhance and standardize disclosures regarding
cybersecurity risk management, strategy, governance, and cybersecurity
incident reporting by public companies that are subject to the
reporting requirements of the Securities Exchange Act of 1934.
Specifically, we are proposing amendments to require current reporting
about material cybersecurity incidents. We are also proposing to
require periodic disclosures about a registrant's policies and
procedures to identify and manage cybersecurity risks, management's
role in implementing cybersecurity policies and procedures, and the
board of directors' cybersecurity expertise, if any, and its oversight
of cybersecurity risk. Additionally, the proposed rules would require
registrants to provide updates about previously reported cybersecurity
incidents in their periodic reports. Further, the proposed rules would
require the cybersecurity disclosures to be presented in Inline
eXtensible Business Reporting Language (``Inline XBRL''). The proposed
amendments are intended to better inform investors about a registrant's
risk management, strategy, and governance and to provide timely
notification of material cybersecurity incidents.

DATES: Comments should be received on or before May 9, 2022.

ADDRESSES: Comments may be submitted by any of the following methods:

Electronic Comments

     Use the Commission's internet comment form (https://www.sec.gov/rules/submitcomments.htm).
     Send an email to [email protected]. Please include File
Number S7-09-22 on the subject line; or

Paper Comments

     Send paper comments to Vanessa A. Countryman, Secretary,
Securities and Exchange Commission, 100 F Street NE, Washington, DC
20549-1090.

All submissions should refer to File Number S7-09-22. This file number
should be included on the subject line if email is used. To help the
Commission process and review your comments more efficiently, please
use only one method of submission. The Commission will post all
comments on the Commission's website (https://www.sec.gov/rules/proposed.shtml). Comments also are available for website viewing and
printing in the Commission's Public Reference Room, 100 F Street NE,
Washington, DC 20549, on official business days between the hours of 10
a.m. and 3 p.m. Operating conditions may limit access to the
Commission's public reference room. All comments received will be
posted without change. Persons submitting comments are cautioned that
we do not redact or edit personal identifying information from comment
submissions. You should submit only information that you wish to make
available publicly.
    Studies, memoranda, or other substantive items may be added by the
Commission or staff to the comment file during this rulemaking. A
notification of the inclusion in the comment file of any such materials
will be made available on our website. To ensure direct electronic
receipt of such notifications, sign up through the ``Stay Connected''
option at www.sec.gov to receive notifications by email.

FOR FURTHER INFORMATION CONTACT: Ian Greber-Raines, Special Counsel,
Office of Rulemaking, at<PHONE_NUMBER>, Division of Corporation
Finance; and, with respect to the application of the proposal to
business development companies, David Joire, Senior Special Counsel, at
(202) 551-6825 or [email protected], Chief Counsel's Office, Division of
Investment Management, U.S. Securities and Exchange Commission, 100 F
Street NE, Washington, DC 20549.

SUPPLEMENTARY INFORMATION: We are proposing to amend or add the
following rules and forms:

----------------------------------------------------------------------------------------------------------------

----------------------------------------------------------------------------------------------------------------
Commission reference                                        CFR citation (17 CFR)
----------------------------------------------------------------------------------------------------------------
Regulation S-K.....................  .....................  17 CFR 229.10 through 229.1305.
                                     Items 106 and 407....  Sec.   229.106 and Sec.   229.407.
Regulation S-T.....................  .....................  17 CFR 232.10 through 232.903.
                                     Rule 405.............  Sec.   232.405.
Securities Act of 1933               Form S-3.............  Sec.   239.13.
 (``Securities Act'') \1\.
                                     Form SF-3............  Sec.   239.45.
Securities Exchange Act of 1934      Rule 13a-11..........  Sec.   240.13a-11.
 (``Exchange Act'') \2\.
                                     Rule 15d-11..........  Sec.   240.15d-11.
                                     Schedule 14A.........  Sec.   240.14a-101.
                                     Schedule 14C.........  Sec.   240.14c-101.
                                     Form 20-F............  Sec.   249.220f.
                                     Form 6-K.............  Sec.   249.306.
                                     Form 8-K.............  Sec.   249.308.
                                     Form 10-Q............  Sec.   249.308A.
                                     Form 10-K............  Sec.   249.310.
----------------------------------------------------------------------------------------------------------------

Table of Contents
---------------------------------------------------------------------------

    \1\ 15 U.S.C. 77a et seq.
    \2\ 15 U.S.C. 78a et seq.
---------------------------------------------------------------------------

I. Background
    A. Existing Regulatory Framework and Interpretive Guidance
Regarding Cybersecurity Disclosure
    B. Current Disclosure Practices
II. Proposed Amendments
    A. Overview
    B. Reporting of Cybersecurity Incidents on Form 8-K
    1. Overview of Proposed Item 1.05 of Form 8-K
    2. Examples of Cybersecurity Incidents that May Require
Disclosure Pursuant to Proposed Item 1.05 of Form 8-K

    3. Ongoing Investigations Regarding Cybersecurity Incidents
    4. Proposed Amendment to Form 6-K
    5. Proposed Amendments to the Eligibility Provisions of Form S-3
and Form SF-3 and Safe Harbor Provision in Exchange Act Rules 13a-11
and 15d-11
    C. Disclosure About Cybersecurity Incidents in Periodic Reports
    1. Updates to Previously Filed Form 8-K Disclosure
    2. Disclosure of Cybersecurity Incidents That Have Become
Material in the Aggregate
    D. Disclosure of a Registrant's Risk Management, Strategy and
Governance Regarding Cybersecurity Risks
    1. Risk Management and Strategy
    2. Governance
    3. Definitions
    E. Disclosure Regarding the Board of Directors' Cybersecurity
Expertise
    F. Periodic Disclosure by Foreign Private Issuers
    G. Structured Data Requirements
III. Economic Analysis
    A. Introduction
    B. Economic Baseline
    1. Current Regulatory Framework
    2. Affected Parties
    C. Potential Benefits and Costs of the Proposed Amendments
    1. Benefits
    a. Benefits to investors
    (i) More Informative and More Timely Disclosure
    (ii) Greater Uniformity and Comparability
    b. Benefits to registrants
    2. Costs
    3. Indirect Economic Effects
    D. Anticipated Effects on Efficiency, Competition, and Capital
Formation
    E. Reasonable Alternatives
    1. Website Disclosure
    2. Disclosure Through Form 10-Q and Form 10-K
    3. Exempt Smaller Reporting Companies
    4. Modify Scope of Inline XBRL Requirement
IV. Paperwork Reduction Act
    A. Summary of the Collection of Information
    B. Summary of the Estimated Burdens of the Proposed Amendments
on the Collections of Information
    C. Incremental and Aggregate Burden and Cost Estimates
V. Small Business Regulatory Enforcement Fairness Act
VI. Initial Regulatory Flexibility Act Analysis
    A. Reasons for, and Objectives of, the Proposed Action
    B. Legal Basis
    C. Small Entities Subject to the Proposed Rules
    D. Projected Reporting, Recordkeeping and Other Compliance
Requirements
    E. Duplicative, Overlapping, or Conflicting Federal Rules
    F. Significant Alternatives
Statutory Authority and Text of Proposed Rule and Form Amendments

I. Background

    Public company investors and other participants in the capital
markets depend on companies' use of secure and reliable information
systems to conduct their businesses. A significant and increasing
amount of the world's economic activities occurs through digital
technology and electronic communications.\3\ In today's digitally
connected world, cybersecurity threats and incidents pose an ongoing
and escalating risk to public companies, investors, and market
participants.\4\ Cybersecurity risks have increased for a variety of
reasons, including the digitalization of registrants' operations; \5\
the prevalence of remote work, which has become even more widespread
because of the COVID-19 pandemic; \6\ the ability of cyber-criminals to
monetize cybersecurity incidents, such as through ransomware, black
markets for stolen data, and the use of crypto-assets for such
transactions; \7\ the growth of digital payments; \8\ and increasing
company reliance on third party service providers for information
technology services, including cloud computing technology.\9\ In
particular, cybersecurity

incidents involving third party service provider vulnerabilities are
becoming more frequent.\10\ Additionally, cyber criminals are using
increasingly sophisticated methods to execute their attacks.\11\
---------------------------------------------------------------------------

    \3\ Bhaskar Chakravorti, Ajay Bhalla, & Ravi Shankar Chaturvedi,
Which Economies Showed the Most Digital Progress in 2020?, Harv.
Bus. Rev. (Dec. 18, 2020), available at https://hbr.org/2020/12/which-economies-showed-the-most-digital-progress-in-2020. See
Percentage of Business Conducted Online, IBISWORLD, https://www.ibisworld.com/us/bed/percentage-of-business-conducted-online/88090/ (last updated Jan. 13, 2022). See also U.S. Department of
Commerce, Bureau of Economic Analysis, Updated Digital Economy
Estimates--June 2021, available at https://www.bea.gov/system/files/2021-06/DE%20June%202021%20update%20for%20web%20v3.pdf (``The
digital economy accounted for 9.6 percent ($2,051.6 billion) of
current-dollar gross domestic product ($21,433.2 billion) in 2019,
according to new estimates from BEA. When compared with traditional
U.S. industries or sectors, the digital economy ranked just below
the manufacturing sector[.]'').
    \4\ See Steve Morgan, Cybercrime to Cost The World $10.5
Trillion Annually By 2025, Cybercrime Magazine, (Nov. 13, 2020),
available at https://cybersecurityventures.com/cybercrime-damage-costs-10-trillion-by-2025/; Matt Powell, 11 Eye Opening Cyber
Security Statistics for 2019, CPO Magazine (June 25, 2019) available
at https://www.cpomagazine.com/tech/11-eye-opening-cyber-security-statistics-for-2019/ (The largest cybersecurity incidents involving
public companies took place in the last ten years.); see Michael
Hill and Dan Swinhoe, cso, The 15 biggest data breaches of the 21st
century, available at https://www.csoonline.com/article/2130877/the-biggest-data-breaches-of-the-21st-century.html; see e.g., Commission
Statement and Guidance on Public Company Cybersecurity Disclosures
(``2018 Interpretive Release''), Release No. 33-10459 (Feb. 26,
2018) No. 33-10459 (Feb. 21, 2018) [83 FR 8166 Feb. 26, 2018],
available at https://www.sec.gov/rules/interp/2018/33-10459.pdf
(``Companies today rely on digital technology to conduct their
business operations and engage with their customers, business
partners, and other constituencies. In a digitally connected world,
cybersecurity presents ongoing risks and threats to our capital
markets and to companies operating in all industries, including
public companies regulated by the Commission.'').
    \5\ See The US Digital Trust Insights Snapshot, PwC Research
(June 2021), available at https://www.pwc.com/us/en/services/consulting/cybersecurity-risk-regulatory/library/2021-digital-trust-insights/cyber-threat-landscape.html.
    \6\ See Stephen Klemash and Jamie Smith, What companies are
disclosing about cybersecurity risk and oversight, EY (Aug. 10,
2020), available at https://www.ey.com/en_us/board-matters/what-companies-are-disclosing-about-cybersecurity-risk-and-oversight
(noting ``[w]ith the COVID-19-driven accelerated shift to digital
business and massive, potentially permanent shifts to remote
working, including virtual board and executive management meetings,
cybersecurity risks are exponentially greater.''). See Navigating
Cyber 2021, FS-ISAC, available at https://www.fsisac.com/navigatingcyber2021-report. See also Vikki Davis, Combating the
cybersecurity risks of working home, Cyber Magazine (Dec. 2, 2021),
available at https://cybermagazine.com/cyber-security/combating-cybersecurity-risks-working-home. See also Dave Burg, Mike Maddison,
& Richard Watson, Cybersecurity: How do you rise above the waves of
a perfect storm?, The EY Glob. Info. Sec. Survey (July 22, 2021),
available at https://www.ey.com/en_us/cybersecurity/cybersecurity-how-do-you-rise-above-the-waves-of-a-perfect-storm. (in a survey of
1,000 senior cybersecurity leaders, the results indicated that 81%
of those surveyed said that COVID-19 forced organizations to bypass
cybersecurity processes.).
    \7\ See Combating Ransomware: A Comprehensive Framework For
Action: Key Recommendations from the Ransomware Task Force, Inst.
for Sec. & Tech. (Apr. 2021), available at https://securityandtechnology.org/ransomwaretaskforce/report; (``The
explosion of ransomware as a lucrative criminal enterprise has been
closely tied to the rise of Bitcoin and other cryptocurrencies,
which use distributed ledgers, such as blockchain, to track
transactions.''); see James Lewis, Economic Impact of Cybercrime--No
Slowing Down, P. 4, CSIS (Feb. 2018) (``Monetization of stolen data,
which has always been a problem for cybercriminals, seems to have
become less difficult because of improvements in cybercrime black
markets and the use of digital currencies.''). But see Avivah Litan,
Gartner Predicts Criminal Cryptocurrency Transactions Will Drop by
30% by 2024, gartner (Jan. 14, 2022) available at https://www.gartner.com/en/articles/gartner-predicts-criminal-cryptocurrency-transactions-will-drop-by-30-by-2024 (predicting that
successful ransomware payments will drop in the near future because
of a number of developments including the transparency behind the
blockchain platforms that crypto tokens use). See also Jeff Benson,
Biden Administration Seeks to Expand Crypto Tracking to Fight
Ransomware, decrypt, available at https://decrypt.co/72582/biden-administration-seeks-expand-crypto-tracking-fight-ransomware (noting
that law enforcement agencies are putting additional resources into
crypto-asset tracking as ``the overwhelming majority of ransomware
attackers demand Bitcoin.'').
    \8\ Sumathi Bala, Rise in online payments spurs questions over
cybersecurity and privacy, CNBC (July 1, 2021), available at https://www.cnbc.com/2021/07/01/new-digital-payments-spur-questions-over-consumer-privacy-security-.html (``Threats over cyber security have
become a growing concern as more people turn to online payments.'').
See also Vaibhav Goel, Deepa Mahajan, Marie-Claude Nadeau, Owen
Sperling, & Stephanie Yeh, New trends in US consumer digital
payments, McKinsey & Company (Oct. 2021), available at https://www.mckinsey.com/industries/financial-services/our-insights/banking-matters/new-trends-in-us-consumer-digital-payments.
    \9\ See The Cost of Third-Party Cybersecurity Risk Management,
Ponemon Institute LLC (Mar. 2019), available at https://info.cybergrx.com/ponemon-report (``Third-party breaches remain a
dominant security challenge for organizations, with over 63% of
breaches linked to a third party.''); see Digital Transformation &
Cyber Risk: What You Need to Know Stay Safe, Ponemon Sullivan
Privacy Report (June 2020), available at https://ponemonsullivanreport.com/2020/07/digital-transformation-cyber-risk-what-you-need-to-know-to-stay-safe/ (although companies are
increasingly reliant on third parties, ``63% of respondents say
their organizations have difficulty ensuring there is a secure cloud
environment.''). See, e.g., Cost of Data Breach Report 2021, IBM
(July 2021), available at https://www.ibm.com/security/data-breach
(finding 15% of the initial cybersecurity attack vectors were caused
by cloud misconfiguration).
    \10\ See Data Risk in the Third-Party Ecosystem: Second Annual
Study, Ponemon Institute LLC (Sept. 2017) available at https://insidecybersecurity.com/sites/insidecybersecurity.com/files/documents/sep2017/cs2017_0340.pdf (noting that ``Data breaches
caused by third parties are on the rise.''). See e.g., The Cost of
Third Party Cybersecurity Risk Management, Ponemon Institute LLC
(Mar. 2019), available at https://www.cybergrx.com/resources/research-and-insights/ebooks-and-reports/the-cost-of-third-party-cybersecurity-risk-management (``Over 53% of respondents have
experienced a third-party data breach in the past 2 years at an
average cost of $7.5 million.'').
    \11\ See Cybersecurity: How do you rise above the waves of a
perfect storm?, supra note 6.
---------------------------------------------------------------------------

    With an increase in the prevalence of cybersecurity incidents,
there is an increased risk of the effect of cybersecurity incidents on
the economy and registrants. Large scale cybersecurity attacks can have
systemic effects on the economy as a whole, including serious effects
on critical infrastructure and national security.\12\ Public companies
of all sizes and operating in all industries are susceptible to
cybersecurity incidents that can stem from intentional or unintentional
acts.\13\ Additionally, senior management and boards of directors of
public companies have become increasingly concerned about cybersecurity
threats.\14\ In a 2019 survey, chief executive officers of the largest
200 global companies rated ```national and corporate cybersecurity' as
the number one threat to business growth and the international economy
in the next 5 or 10 years.'' \15\
---------------------------------------------------------------------------

    \12\ See Cyber-Risk Oversight 2020, Key Principles and Practical
Guidance for Corporate Boards (2020), nacd, available at http://isalliance.org/wp-content/uploads/2020/02/RD-3-2020_NACD_Cyber_Handbook__WEB_022020.pdf (``According to the Global
Risks Report 2019, business leaders in advanced economies rank
cyberattacks among their top concerns. A serious attack can destroy
not only a company's financial health but also have systemic effects
causing harm to the economy as a whole and even national
security.''). See also The Cost of Malicious Cyber Activity to the
U.S. Economy (Feb. 16, 2018), White H. Council of Econ. Advisers,
available at https://trumpwhitehouse.archives.gov/wp-content/uploads/2018/02/The-Cost-of-Malicious-Cyber-Activity-to-the-U.S.-Economy.pdf (``An attack have significant spillover effects to
corporate partners, customers, and suppliers.'') and Testimony of
Robert Kolasky, Director, National Risk Management Center,
Cybersecurity and Infrastructure Security Agency (CISA), Securing
U.S. Surface Transportation from Cyber Attacks, U.S. House of
Representatives, Committee on Homeland Security (Feb. 26, 2019),
available at https://www.congress.gov/116/meeting/house/108931/witnesses/HHRG-116-HM07-Wstate-KolaskyB-20190226.pdf. See also Exec.
Order No. 14028, Improving the Nation's Cybersecurity, (May 12,
2021), 86 FR 26633, available at https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/.
    \13\ See Economic Report of the President: Together with The
Annual Report of the Council of Economic Advisers, (Mar. 2019),
available at https://www.govinfo.gov/content/pkg/ERP-2019/pdf/ERP-2019.pdf (``Drawing on new data, we document that cyber
vulnerabilities are quite prevalent--even in Fortune 500 companies
with significant resources at their disposal.'').
    \14\ NACD, Cyber-Risk Oversight2020, Key Principles and
Practical Guidance for Corporate Boards, supra note 12.
    \15\ See EY CEO Imperative Study 2019, July 2019, available at
https://assets.ey.com/content/dam/ey-sites/ey-com/en_gl/topics/growth/ey-ceo-imperative-exec-summ-single-spread-final.pdf.
---------------------------------------------------------------------------

    The cost to companies and their investors of cybersecurity
incidents is rising and doing so at an increasing rate.\16\ The types
of costs and adverse consequences that companies may incur or
experience as a result of a cybersecurity incident include the
following:\17\
---------------------------------------------------------------------------

    \16\ See Cost of Data Breach Report 2021, IBM Security (July
2021), available at https://www.ibm.com/security/data-breach (``The
average total cost of a data breach increased by nearly 10% year
over year, the largest single year cost increase in the last seven
years.'').
    \17\ See e.g., 2018 Interpretive Release; and Shinichi Kamiya,
Jun-Koo Kang, Jungmin Kim, Andreas Milidonis, & Rene M. Stulz, Risk
management, firm reputation, and the impact of successful
cyberattacks on target firms, 139 J. of Fin. Econ. at 747, 749
(2021).
---------------------------------------------------------------------------

     Costs due to business interruption, decreases in
production, and delays in product launches;
     Payments to meet ransom and other extortion demands;
     Remediation costs, such as liability for stolen assets or
information, repairs of system damage, and incentives to customers or
business partners in an effort to maintain relationships after an
attack;
     Increased cybersecurity protection costs, which may
include increased insurance premiums and the costs of making
organizational changes, deploying additional personnel and protection
technologies, training employees, and engaging third-party experts and
consultants;
     Lost revenues resulting from intellectual property theft
and the unauthorized use of proprietary information or the failure to
retain or attract customers following an attack;
     Litigation and legal risks, including regulatory actions
by state and federal governmental authorities and non-U.S. authorities;
     Harm to employees and customers, violation of privacy
laws, and reputational damage that adversely affects customer or
investor confidence; and
     Damage to the company's competitiveness, stock price, and
long-term shareholder value.
    As indicated by the examples enumerated above, the potential costs
and damage that can stem from a material cybersecurity incident are
extensive. Many smaller companies have been targets of cybersecurity
attacks so severe that the companies have gone out of business as a
result.\18\ These direct and indirect financial costs can negatively
impact stock prices,\19\ as well as short-term and long-term
shareholder value. To mitigate the potential costs and damage that can
result from a material cybersecurity incident, management and boards of
directors may establish and maintain effective risk management
strategies to address cybersecurity risks.\20\
---------------------------------------------------------------------------

    \18\ See Testimony of Dr. Jane LeClair, Chief Operating Officer,
National Cybersecurity Institute at Excelsior College, before the
U.S. House of Representatives Committee on Small Business (Apr. 22,
2015), available at http://docs.house.gov/meetings/SM/SM00/20150422/103276/HHRG-114-SM00-20150422-SD003-U4.pdf (``Fifty percent of
[small businesses] SMB's have been the victims of cyber attack and
over 60 percent of those attacked go out of business. Often SMB's do
not even know they have been attacked until it is too late.'').
    \19\ See infra note 101, section III.A.
    \20\ See NACD, Cyber-Risk Oversight2020, Key Principles and
Practical Guidance for Corporate Boards, supra note 12.
---------------------------------------------------------------------------

    Recent research suggests that cybersecurity is among the most
critical governance-related issues for investors, especially U.S.
investors.\21\ Some

investors have been seeking information regarding registrants'
cybersecurity risk management, strategy, and governance practices,\22\
and there is evidence that the disclosure of cybersecurity incidents
can affect both a registrant's reputation and its share price.\23\
There may also be a positive correlation between a registrant's stock
price and investments in certain cybersecurity technology.\24\ Thus,
whether and how a registrant is managing cybersecurity risks could
impact an investor's return on investment and would be decision-useful
information in an investor's investment or considerations.
---------------------------------------------------------------------------

    \21\ 2019 Responsible Investing Survey Key Findings, RBC Glob.
Asset Mgmt. (2019), available at https://global.rbcgam.com/sitefiles/live/documents/pdf/rbc-gam-responsible-investing-survey-key-findings-2019.pdf. This was a study developed by RBC Global
Asset Management and BlueBay Asset Management LLP and distributed to
a range of constituencies including institutional asset owners,
consultants, clients, P&I Research Advisory Panel members, and
members of the Pensions & Investment database. Study participants
included individuals in Canada, Europe, Asia, and the United States.
Two thirds of all respondents identified cybersecurity as an issue
they were concerned about. The percentages were higher for the U.S.,
where out of all the environmental, social, and governance
(``ESG'')-issues, the highest percentage of respondents ranked
cybersecurity as the most concerning issue. See also J.P. Morgan
Global Research, Why is Cybersecurity Important to ESG Frameworks?,
J.P. Morgan Glob. Rsch. (Aug. 19, 2021), available at https://www.jpmorgan.com/insights/research/why-is-cybersecurity-important-to-esg. See also Cyber security: Don't report on ESG without it
(2021), kpmg, available at https://advisory.kpmg.us/articles/2021/cyber-security-report-on-esg.html.
    \22\ See Harvard Law School Forum on Corporate Governance Blog,
posted by Steve W. Klemash, Jamie C. Smith, and Chuck Seets, What
Companies are Disclosing About Cybersecurity Risk and Oversight,
(posted Aug. 25, 2020) available at https://corpgov.law.harvard.edu/2020/08/25/what-companies-are-disclosing-about-cybersecurity-risk-and-oversight (``Because the threat of a breach cannot be
eliminated, some investors stressed that they are particularly
interested in resiliency, including how (and how quickly) companies
are detecting and mitigating cybersecurity incidents. Some are
asking their portfolio companies about specific cybersecurity
practices, such as whether the company has had an independent
assessment of its cybersecurity program, and some are increasingly
focusing on data privacy and whether companies are adequately
identifying and addressing related consumer concerns and expanding
regulatory requirements.'').
    \23\ See Shinichi Kamiya, Jun-Koo Kang, Jungmin Kim, Andreas
Milidonis, & Rene M. Stulz, Risk management, firm reputation, and
the impact of successful cyberattacks on target firms, 139 J. of
Fin. Econ. at 747, 749 (2021); Georgios Spanos, and Lefteris
Angelis, The Impact of Information Security Events to the Stock
Market: A Systematic Literature Review, 58 Comput. & Sec. at 216,
226 (2016) (``Respectively, negative information security events, as
the security breaches, have a negative impact to the stock price of
the breached firms in the majority of the studies.'').
    \24\ Id.
---------------------------------------------------------------------------

    We believe investors would benefit from more timely and consistent
disclosure about material cybersecurity incidents, because of the
potential impact that such incidents can have on the financial
performance or position of a registrant. We also believe that investors
would benefit from greater availability and comparability of disclosure
by public companies across industries regarding their cybersecurity
risk management, strategy, and governance practices in order to better
assess whether and how companies are managing cybersecurity risks. The
proposal reflects these policy goals.
    Specifically, in this release, we are proposing to amend Form 8-K
to require current disclosure of material cybersecurity incidents. We
are also proposing to add new Item 106 of Regulation S-K that would
require a registrant to: (1) Provide updated disclosure in periodic
reports about previously reported cybersecurity incidents; (2) describe
its policies and procedures, if any, for the identification and
management of risks from cybersecurity threats, including whether the
registrant considers cybersecurity risks as part of its business
strategy, financial planning, and capital allocation; and (3) require
disclosure about the board's oversight of cybersecurity risk,
management's role in assessing and managing such risk, management's
cybersecurity expertise, and management's role in implementing the
registrant's cybersecurity policies, procedures, and strategies. We
also are proposing to amend Item 407 of Regulation S-K to require
disclosure of whether any member of the registrant's board has
expertise in cybersecurity, and if so, the nature of such
expertise.\25\
---------------------------------------------------------------------------

    \25\ Proposed Item 407(j) of Regulation S-K.
---------------------------------------------------------------------------

A. Existing Regulatory Framework and Interpretive Guidance Regarding
Cybersecurity Disclosure

    Although there are no disclosure requirements in Regulation S-K or
S-X that explicitly refer to cybersecurity risks or incidents, in light
of the increasing significance of cybersecurity incidents, over the
past decade the Commission and staff have issued interpretive guidance
concerning the application of existing disclosure and other
requirements under the federal securities laws to cybersecurity risks
and incidents. In 2011, the Division of Corporation Finance issued
interpretive guidance (``2011 Staff Guidance''), providing the
Division's views concerning operating companies' disclosure obligations
relating to cybersecurity risks and incidents.\26\
---------------------------------------------------------------------------

    \26\ See CF Disclosure Guidance: Topic No. 2--Cybersecurity
(Oct. 13, 2011), available at https://www.sec.gov/divisions/corpfin/guidance/cfguidance-topic2.htm.
---------------------------------------------------------------------------

    In 2018, recognizing the ``the frequency, magnitude and cost of
cybersecurity incidents,'' and the need for investors to be informed
about material cybersecurity risks and incidents in a timely manner,
the Commission issued interpretive guidance (``2018 Interpretive
Release'') to assist operating companies in determining when they may
be required to disclose information regarding cybersecurity risks and
incidents under existing disclosure rules.\27\ The 2018 Interpretive
Release reinforced and expanded upon the 2011 Staff Guidance and also
addressed the importance of cybersecurity policies and procedures, as
well as the application of insider trading prohibitions in the context
of cybersecurity.
---------------------------------------------------------------------------

    \27\ See Commission Statement and Guidance on Public Company
Cybersecurity Disclosures, Release No. 33-10459 (Feb. 26, 2018) No.
33-10459 (Feb. 21, 2018) [83 FR 8166], available at https://www.sec.gov/rules/interp/2018/33-10459.pdf. In 2018, the Commission
also issued a Report of Investigation pursuant to Section 21(a) of
the Exchange Act regarding certain cyber-related frauds perpetrated
against public companies and related internal accounting controls
requirements. The report cautioned that public companies subject to
the internal accounting controls requirements of Exchange Act
Section 13(b)(2)(B) should consider cyber threats when implementing
their internal accounting controls. The report is based on SEC
Enforcement Division investigations that focused on business email
compromises in which perpetrators posed as company executives or
vendors and used emails to dupe company personnel into sending large
sums to bank accounts controlled by the perpetrators. See Report of
Investigation Pursuant to 21(a) of the Securities Exchange Act of
1934 Regarding Certain Cyber-Related Frauds Perpetrated Against
Public Companies and Related Internal Accounting Controls
Requirements, SEC Release No. 34-84429 (Oct. 16, 2018).
---------------------------------------------------------------------------

    Specifically, the 2018 Interpretive Release stated that companies
should consider the materiality of cybersecurity risks and incidents
when preparing the disclosure required in registration statements under
the Securities Act and Exchange Act, as well as in periodic and current
reports under the Exchange Act. The 2018 Interpretive Release
identified the following existing provisions in Regulations S-K and S-X
that may require disclosure about cybersecurity risks, governance, and
incidents: \28\
---------------------------------------------------------------------------

    \28\ There are corresponding provisions in Form 20-F for foreign
private issuers.
---------------------------------------------------------------------------

     Item 105 of Regulation S-K (Risk Factors) \29\--the 2018
Interpretive Release sets forth issues for companies to consider in
evaluating the need for cybersecurity risk factor disclosure, including
risks arising in connection with acquisitions.
---------------------------------------------------------------------------

    \29\ See also Item 3.D of Form 20-F. Please note that Risk
Factors was designated as Regulation S-K Item 503 at the time the
2018 Interpretive Release was issued.
---------------------------------------------------------------------------

     Item 303 of Regulation S-K (Management's Discussion and
Analysis of Financial Condition and Results of Operations) \30\--the
2018 Interpretive Release discusses how the costs of ongoing
cybersecurity efforts, the costs and other consequences of
cybersecurity incidents, and the risks of potential cybersecurity
incidents, among other matters, can inform a company's management's
discussion and analysis. The 2018 Interpretive Release describes a wide
array of potential costs that may be associated with cybersecurity
issues and incidents such as loss of intellectual property and
reputational harm.
---------------------------------------------------------------------------

    \30\ See also Item 5 of Form 20-F.
---------------------------------------------------------------------------

     Item 101 of Regulation S-K (Description of Business)
\31\--the 2018 Interpretive Release notes that if cybersecurity
incidents or risks materially affect a company's products,

services, relationships with customers or suppliers, or competitive
conditions, the company must provide appropriate disclosure.
---------------------------------------------------------------------------

    \31\ See also Item 4.B of Form 20-F.
---------------------------------------------------------------------------

     Item 103 of Regulation S-K (Legal Proceedings)--the 2018
Interpretive Release explains that this item may require disclosure
about material pending legal proceedings that relate to cybersecurity
issues.
     Item 407 of Regulation S-K (Corporate Governance) \32\--
the 2018 Interpretive Release clarifies that a company must describe
how the board administers its risk oversight function to the extent
that cybersecurity risks are material to a company's business,
including a description of the nature of the board's role in overseeing
the management of such risks.
---------------------------------------------------------------------------

    \32\ This disclosure also is required by Item 7 of Schedule 14A.
---------------------------------------------------------------------------

     Regulation S-X Financial Disclosures--the 2018
Interpretive Release notes the Commission's expectation that a company
would design its financial reporting and control systems to provide
reasonable assurance that information about the range and magnitude of
the financial impacts of a cybersecurity incident would be incorporated
into its financial statements on a timely basis as that information
becomes available.
    The 2018 Interpretive Release also addresses the importance of a
company's adoption of disclosure controls and procedures that cause the
company to appropriately record, process, summarize, and report to
investors material information related to cybersecurity risks and
incidents.\33\ In addition, the 2018 Interpretive Release reminds
companies, their directors, officers, and other corporate insiders of
the need to comply with insider trading laws in connection with
information about cybersecurity risks and incidents, including
vulnerabilities and breaches. The 2018 Interpretive Release further
discusses disclosure obligations that companies may have under 17 CFR
243 (``Regulation FD'') in connection with cybersecurity matters. The
guidance set forth in both the 2011 Staff Guidance and the 2018
Interpretive Release would remain in place if the Commission adopts the
proposed rule amendments described in this release.
---------------------------------------------------------------------------

    \33\ See supra note 4, 2018 Interpretive Release at 8167
(``Crucial to a public company's ability to make any required
disclosure of cybersecurity risks and incidents in the appropriate
timeframe are disclosure controls and procedures that provide an
appropriate method of discerning the impact that such matters may
have on the company and its business, financial condition, and
results of operations, as well as a protocol to determine the
potential materiality of such risks and incidents.'').
---------------------------------------------------------------------------

B. Current Disclosure Practices

    The majority of registrants reporting material cybersecurity
incidents do so in a Form 8-K, press release, or periodic report.
Although we are unable to determine the number of material
cybersecurity incidents that either are not being disclosed or not
being disclosed in a timely manner, the staff has observed certain
cybersecurity incidents that were reported in the media but that were
not disclosed in a registrant's filings. Further, the staff in the
Division of Corporation Finance's review of Form 8-K filings, as well
as Form 10-K and Form 20-F filings, has shown that the nature of the
cybersecurity incident disclosure varies widely. In these filings,
companies provide different levels of specificity regarding the cause,
scope, impact, and materiality of cybersecurity incidents. For example,
some companies provide a materiality analysis, disclose the estimated
costs of an incident, discuss their engagement of cybersecurity
professionals, and/or explain the remedial steps they have taken or are
taking in response to a cybersecurity incident, while others do not
provide such disclosure or provide much less detail in their disclosure
on these topics.
    The staff has also observed that, while the majority of registrants
that are disclosing cybersecurity risks appear to be providing such
disclosures in the risk factor section of their annual reports on Form
10-K, the disclosures are sometimes blended with other unrelated
disclosures, which makes it more difficult for investors to locate,
interpret, and analyze the information provided. Further, the staff has
observed a divergence in these disclosures by industry and that,
smaller reporting companies generally provide less cybersecurity
disclosure as compared to larger registrants. One report noted a
disconnect in which the industries experiencing the most high profile
cybersecurity incidents provided disclosure with the ``least amount of
information.'' \34\ While cybersecurity risks and attacks may
disproportionately affect certain industries at different times and in
different ways, cybersecurity risks and threats may be dynamic; it is
foreseeable and perhaps even predictable that malicious actors will
adapt their strategies and target companies in any industry where there
are perceived vulnerabilities.
---------------------------------------------------------------------------

    \34\ Moody's Investors Service, Research Announcement,
``Cybersecurity disclosures vary greatly in high-risk industries,''
(Oct. 3, 2019), available at https://www.moodys.com/research/Moodys-Cybersecurity-disclosures-vary-greatly-in-high-risk-industries--PBC_1196854.
---------------------------------------------------------------------------

    Registrants' disclosures of both material cybersecurity incidents
and cybersecurity risk management and governance have improved since
the issuance of the 2011 Staff Guidance and the 2018 Interpretive
Release.\35\ Yet, current reporting may contain insufficient detail
\36\ and the staff has observed that such reporting is inconsistent,
may not be timely, and can be difficult to locate. We believe that
investors would benefit from enhanced disclosure about registrants'
cybersecurity incidents and cybersecurity risk management and
governance practices, including if the registrant's board of directors
has expertise in cybersecurity matters, and we are proposing rule
amendments to enhance disclosure in those areas.
---------------------------------------------------------------------------

    \35\ Stephen Klemash and Jamie Smith, What companies are
disclosing about cybersecurity risk and oversight, EY, supra note 6
(EY researchers looked at cybersecurity-related disclosures in the
proxy statements and Form 10-K filings for the 76 ``Fortune 100''
companies that filed those documents from 2018 through May 31, 2020.
Their finding indicated that, ``[m]any companies are enhancing their
cybersecurity disclosures, with modest increases across most of the
disclosures tracked.'').
    \36\ One report notes ``the average public company's cyber
disclosure contains insufficient detail for investors looking to
evaluate its risk profile and to understand which remediation
strategies, if any, it has implemented to control for the identified
risks.'' NACD et al., The State of Cyber-Risk Disclosures of Public
Companies at 3 (Mar. 2021) available at https://www.nacdonline.org/insights/publications.cfm?ItemNumber=71711. This same report
contends (and cites other sources that argue) that the 2018
Interpretive Release alone has not resulted in adequate disclosures
to investors. Id. at 4.
---------------------------------------------------------------------------

    We welcome feedback and encourage interested parties to submit
comments on any or all aspects of the proposed rule amendments. When
commenting, it would be most helpful if you include the reasoning
behind your position or recommendation.

II. Proposed Amendments

A. Overview

    Cybersecurity risks and incidents can impact the financial
performance or position of a company. Consistent, comparable, and
decision-useful disclosures regarding a registrant's cybersecurity risk
management, strategy, and governance practices, as well as a
registrant's response to material cybersecurity incidents, would allow
investors to understand such risks and incidents, evaluate a
registrant's risk management and governance practices regarding those
risks, and better inform their investment and voting decisions.
    The proposed rules would require current and periodic reporting of

material cybersecurity incidents. Additionally, we are proposing
amendments that would require periodic disclosures about a registrant's
policies and procedures to identify and manage cybersecurity risk,
including the impact of cybersecurity risks on the registrant's
business strategy; management's role and expertise in implementing the
registrant's cybersecurity policies, procedures, and strategies; and
the board of directors' oversight role, and cybersecurity expertise, if
any.
    Specifically, we are proposing to:
     Amend Form 8-K to add Item 1.05 to require registrants to
disclose information about a cybersecurity incident within four
business days after the registrant determines that it has experienced a
material cybersecurity incident; \37\
---------------------------------------------------------------------------

    \37\ Proposed Item 1.05.
---------------------------------------------------------------------------

     Amend Forms 10-Q and 10-K to require registrants to
provide updated disclosure relating to previously disclosed
cybersecurity incidents, as specified in proposed Item 106(d) of
Regulation S-K. We also propose to amend these forms to require
disclosure, to the extent known to management, when a series of
previously undisclosed individually immaterial cybersecurity incidents
has become material in the aggregate.\38\
---------------------------------------------------------------------------

    \38\ Proposed Item 106(d) of Regulation S-K.
---------------------------------------------------------------------------

     Amend Form 10-K to require disclosure specified in
proposed Item 106 regarding:
    [cir] A registrant's policies and procedures, if any, for
identifying and managing cybersecurity risks; \39\
---------------------------------------------------------------------------

    \39\ Proposed Item 106(b) of Regulation S-K.
---------------------------------------------------------------------------

    [cir] A registrant's cybersecurity governance, including the board
of directors' oversight role regarding cybersecurity risks; \40\ and
---------------------------------------------------------------------------

    \40\ Proposed Item 106(c)(1) of Regulation S-K.
---------------------------------------------------------------------------

    [cir] Management's role, and relevant expertise, in assessing and
managing cybersecurity related risks and implementing related policies,
procedures, and strategies.\41\
---------------------------------------------------------------------------

    \41\ Proposed Item 106(c)(2) of Regulation S-K.
---------------------------------------------------------------------------

     Amend Item 407 of Regulation S-K to require disclosure
about if any member of the registrant's board of directors has
cybersecurity expertise.\42\
---------------------------------------------------------------------------

    \42\ Proposed Item 407(j).
---------------------------------------------------------------------------

     Amend Form 20-F to require foreign private issuers
(``FPIs'') \43\ to provide cybersecurity disclosures in their annual
reports filed on that form that are consistent with the disclosure that
we propose to require in the domestic forms;
---------------------------------------------------------------------------

    \43\ An FPI is any foreign issuer other than a foreign
government, except for an issuer that (1) has more than 50% of its
outstanding voting securities held of record by U.S. residents; and
(2) any of the following: (i) A majority of its officers or
directors are citizens or residents of the U.S.; (ii) more than 50%
of its assets are located in the U.S.; or (iii) its business is
principally administered in the U.S. See 17 CFR 230.405. See also 17
CFR 240.3b-4(c).
---------------------------------------------------------------------------

     Amend Form 6-K to add ``cybersecurity incidents'' as a
reporting topic; and
     Require that the proposed disclosures be provided in
Inline XBRL.\44\
---------------------------------------------------------------------------

    \44\ Proposed Rule 405 of Regulation S-T.
---------------------------------------------------------------------------

B. Reporting of Cybersecurity Incidents on Form 8-K

1. Overview of Proposed Item 1.05 of Form 8-K
    There is growing concern that material cybersecurity incidents \45\
are underreported \46\ and that existing reporting may not be
sufficiently timely.\47\ We are proposing to address these concerns by
requiring registrants to disclose material cybersecurity incidents in a
current report on Form 8-K within four business days after the
registrant determines that it has experienced a material cybersecurity
incident.\48\
---------------------------------------------------------------------------

    \45\ See infra Section II.D.3 for a discussion on the proposed
definition of ``cybersecurity incident.''
    \46\ See New Study Reveals Cybercrime May Be Widely
Underreported--Even When Laws Mandate Disclosure, ISACA Press
Release (June 3, 2019), available at https://www.isaca.org/why-isaca/about-us/newsroom/press-releases/2019/new-study-reveals-cybercrime-may-be-widely-underreported-even-when-laws-mandate-disclosure. See also Gerrit De Vynck, Many ransomware attacks go
unreported. The FBI and Congress want to change that. Wash. Post
(July 27, 2021), available at https://www.washingtonpost.com/technology/2021/07/27/fbi-congress-ransomware-laws/ (quoting Eric
Goldstein, executive assistant director at Cybersecurity &
Infrastructure Security Agency (CISA), a federal agency created in
2018 to protect the U.S. from cyberattacks, as stating, ``[w]e
believe that only about a quarter of ransomware intrusions are
actually reported[.]'').
    \47\ See also infra section III.C(1)(a).
    \48\ As will be discussed in Section II.D, we propose to define
the term ``cybersecurity incident'' as an unauthorized occurrence on
or conducted through a registrant's information systems that
jeopardizes the confidentiality, integrity, or availability of a
registrant's information systems or any information residing
therein. We also propose to define the term ``information systems''
as ``information resources, owned or used by the registrant,
including physical or virtual infrastructure controlled by such
information resources, or components thereof, organized for the
collection, processing, maintenance, use, sharing, dissemination, or
disposition of a registrant's information to maintain or support the
registrant's operations.'' The definitions of ``cybersecurity
incident'' and ``information systems'' as proposed in Item 106 of
Regulation S-K would also apply to such terms as used in proposed
Item 1.05 of Form 8-K.
---------------------------------------------------------------------------

    Specifically, we propose to amend Form 8-K by adding new Item 1.05
that would require a registrant to disclose the following information
about a material cybersecurity incident, to the extent the information
is known at the time of the Form 8-K filing:
     When the incident was discovered and whether it is
ongoing;
     A brief description of the nature and scope of the
incident;
     Whether any data was stolen, altered, accessed, or used
for any other unauthorized purpose;
     The effect of the incident on the registrant's operations;
and
     Whether the registrant has remediated or is currently
remediating the incident.
    We believe that this information would provide timely and relevant
disclosure to investors and other market participants (such as
financial analysts, investment advisers, and portfolio managers) and
enable them to assess the possible effects of a material cybersecurity
incident on the registrant, including any long-term and short-term
financial effects or operational effects. While registrants should
provide disclosure responsive to the enumerated items to the extent
known at the time of filing of the Form 8-K, we would not expect a
registrant to publicly disclose specific, technical information about
its planned response to the incident or its cybersecurity systems,
related networks and devices, or potential system vulnerabilities in
such detail as would impede the registrant's response or remediation of
the incident.\49\
---------------------------------------------------------------------------

    \49\ See also 2018 Interpretive Release at Section II.A.1. Any
material information not known or disclosable at the time of the
Form 8-K filing would need to be updated in future periodic reports
in response to proposed Item 106(d) of Regulation S-K. See
discussion infra at Section II.C.1.
---------------------------------------------------------------------------

    We believe that the proposed requirement to file an Item 1.05 Form
8-K within four business days after the registrant determines that it
has experienced a material cybersecurity incident would significantly
improve the timeliness of cybersecurity incident disclosures, as well
as provide investors with more standardized and comparable
disclosures.\50\
---------------------------------------------------------------------------

    \50\ If a triggering determination occurs within four business
days before a registrant's filing of a Form 10-Q or Form 10-K, the
Commission staff generally has not objected to the registrant
satisfying its Form 8-K reporting obligation by including the
disclosure in Item 5 (Other Information) of Part II of its Form 10-Q
or Item 9B (Other Information) of its Form 10-K. See SEC Division of
Corporation Finance, Exchange Act Form 8-K Compliance and Disclosure
Interpretations (updated Dec. 22, 2017), Question 1, available at
https://www.sec.gov/divisions/corpfin/form8kfaq.htm.
---------------------------------------------------------------------------

    We are proposing that the trigger for an Item 1.05 Form 8-K is the
date on which a registrant determines that a cybersecurity incident it
has experienced is material, rather than the date of discovery of the
incident, so as to focus the Form 8-K disclosure on

incidents that are material to investors. In some cases, the date of
the registrant's materiality determination may coincide with the date
of discovery of an incident, but in other cases the materiality
determination will come after the discovery date. If we adopt the date
of the materiality determination as the Form 8-K reporting trigger, as
proposed, we expect registrants to be diligent in making a materiality
determination in as prompt a manner as feasible. To address any concern
that some registrants may delay making such a determination to avoid a
disclosure obligation, Instruction 1 to proposed Item 1.05 states: ``a
registrant shall make a materiality determination regarding a
cybersecurity incident as soon as reasonably practicable after
discovery of the incident.''
    What constitutes ``materiality'' for purposes of the proposed
cybersecurity incidents disclosure would be consistent with that set
out in the numerous cases addressing materiality in the securities
laws, including: TSC Industries, Inc. v. Northway, Inc.,\51\ Basic,
Inc. v. Levinson,\52\ and Matrixx Initiatives, Inc. v. Siracusano.\53\
Information is material if ``there is a substantial likelihood that a
reasonable shareholder would consider it important'' \54\ in making an
investment decision, or if it would have ``significantly altered the
`total mix' of information made available.'' \55\ In articulating this
materiality standard, the Supreme Court recognized that ``[d]oubts as
to the critical nature'' of the relevant information ``will be
commonplace.'' But ``particularly in view of the prophylactic purpose''
of the securities laws, and ``the fact that the content'' of the
disclosure ``is within management's control, it is appropriate that
these doubts be resolved in favor of those the statute is designed to
protect,'' namely investors.\56\
---------------------------------------------------------------------------

    \51\ TSC Indus. v. Northway, 426 U.S. 438, 449 (1976).
    \52\ Basic Inc. v. Levinson, 485 U.S. 224, 232 (1988).
    \53\ 563 U.S. 27 (2011).
    \54\ TSC Indus. v. Northway, 426 U.S. at 449.
    \55\ Id. See also the definition of ``material'' in Securities
Act Rule 405, 17 CFR 230.405; Exchange Act Rule 12b-2, 17 CFR
240.12b-2.
    \56\ TSC Indus. v. Northway, 426 U.S. at 448.
---------------------------------------------------------------------------

    A materiality analysis is not a mechanical exercise, nor should it
be based solely on a quantitative analysis of a cybersecurity incident.
Rather, registrants would need to thoroughly and objectively evaluate
the total mix of information, taking into consideration all relevant
facts and circumstances surrounding the cybersecurity incident,
including both quantitative and qualitative factors, to determine
whether the incident is material. Even if the probability of an adverse
consequence is relatively low, if the magnitude of the loss or
liability is high, the incident may still be material; materiality
``depends on the significance the reasonable investor would place on''
the information.\57\ Thus, under the proposed rules, when a
cybersecurity incident occurs, registrants would need to carefully
assess whether the incident is material in light of the specific
circumstances presented by applying a well-reasoned, objective approach
from a reasonable investor's perspective based on the total mix of
information.
---------------------------------------------------------------------------

    \57\ Basic Inc. v. Levinson, 485 U.S. at 240.
---------------------------------------------------------------------------

2. Examples of Cybersecurity Incidents That May Require Disclosure
Pursuant to Proposed Item 1.05 of Form 8-K
    The following is a non-exclusive list of examples of cybersecurity
incidents \58\ that may, if determined by the registrant to be
material, trigger the proposed Item 1.05 disclosure requirement:
---------------------------------------------------------------------------

    \58\ As discussed infra in Section II.D, we propose to define
cybersecurity incident as ``an unauthorized occurrence on or
conducted through a registrant's information systems that
jeopardizes the confidentiality, integrity, or availability of a
registrant's information systems or any information residing
therein.'' We believe this term is sufficiently understood and broad
enough to encompass incidents that could adversely affect a
registrant's information systems or information residing therein,
such as gaining access without authorization or by exceeding
authorized access to such systems and information that could lead,
for example, to the modification or destruction of systems and
information. We also propose to define information systems as
``information resources, owned or used by the registrant, including
physical or virtual infrastructure controlled by such information
resources, or components thereof, organized for the collection,
processing, maintenance, use, sharing, dissemination, or disposition
of a registrant's information to maintain or support the
registrant's operations.'' The definitions of ``cybersecurity
incident'' and ``information systems'' as proposed in Item 106 of
Regulation S-K would also apply to such terms as used in proposed
Item 1.05 of Form 8-K. See infra note 80.
---------------------------------------------------------------------------

     An unauthorized incident that has compromised the
confidentiality, integrity, or availability of an information asset
(data, system, or network); or violated the registrant's security
policies or procedures. Incidents may stem from the accidental exposure
of data or from a deliberate attack to steal or alter data;
     An unauthorized incident that caused degradation,
interruption, loss of control, damage to, or loss of operational
technology systems;
     An incident in which an unauthorized party accessed, or a
party exceeded authorized access, and altered, or has stolen sensitive
business information, personally identifiable information, intellectual
property, or information that has resulted, or may result, in a loss or
liability for the registrant;
     An incident in which a malicious actor has offered to sell
or has threatened to publicly disclose sensitive company data; or
     An incident in which a malicious actor has demanded
payment to restore company data that was stolen or altered.
3. Ongoing Investigations Regarding Cybersecurity Incidents
    Proposed Item 1.05 would not provide for a reporting delay when
there is an ongoing internal or external investigation related to the
cybersecurity incident. As the Commission stated in the 2018
Interpretive Release, while an ongoing investigation might affect the
specifics in the registrant's disclosure, ``an ongoing internal or
external investigation--which often can be lengthy--would not on its
own provide a basis for avoiding disclosures of a material
cybersecurity incident.'' \59\ Additionally, any such delay provision
could undermine the purpose of proposed Item 1.05 of providing timely
and consistent disclosure of cybersecurity incidents given that
investigations and resolutions of cybersecurity incidents may occur
over an extended period of time and may vary widely in timing and
scope. At the same time, we recognize that a delay in reporting may
facilitate law enforcement investigations aimed at apprehending the
perpetrators of the cybersecurity incident and preventing future
cybersecurity incidents. On balance, it is our current view that the
importance of timely disclosure of cybersecurity incidents for
investors would justify not providing for a reporting delay.
---------------------------------------------------------------------------

    \59\ See supra note 33, 2018 Interpretive Release.
---------------------------------------------------------------------------

    Many states have laws that allow companies to delay providing
public notice about a data breach incident or notifying certain
constituencies of such an incident if law enforcement determines that
notification will impede a civil or criminal investigation. A
registrant may have obligations to report incidents at the state or
federal level (to customers, consumer credit reporting entities, state
or federal regulators and law enforcement agencies, etc.); those
obligations are distinct from its obligations to disclose material
information to its shareholders under the federal securities laws. To
the extent that proposed Item 1.05 of Form 8-K would require disclosure
in a situation in which a state law delay provision

would excuse notification, there is a possibility a registrant would be
required to disclose the incident on Form 8-K even though it could
delay incident reporting under a particular state law. The proposed
Form 8-K requirement would advance the objective of timely reporting of
material cybersecurity incidents without the uncertainties of delay. It
is critical to investor protection and well-functioning, orderly, and
efficient markets that investors promptly receive information regarding
material cybersecurity incidents.
4. Proposed Amendment to Form 6-K
    FPIs are not required to file current reports on Form 8-K.\60\
Instead, they are required to furnish on Form 6-K \61\ copies of all
information that the FPI: (i) Makes or is required to make public under
the laws of its jurisdiction of incorporation, (ii) files, or is
required to file under the rules of any stock exchange, or (iii)
otherwise distributes to its security holders. We are proposing to
amend General Instruction B of Form 6-K to reference material
cybersecurity incidents among the items that may trigger a current
report on Form 6-K. As with proposed Item 1.05 of Form 8-K, the
proposed change to Form 6-K is intended to provide timely cybersecurity
incident disclosure in a manner that is consistent with the general
purpose and use of Form 6-K.
---------------------------------------------------------------------------

    \60\ See Exchange Act Rules 13a-11 and 15d-11 [17 CFR 240.13a-11
and 15d-11].
    \61\ 17 CFR 249.306.
---------------------------------------------------------------------------

5. Proposed Amendments to the Eligibility Provisions of Form S-3 and
Form SF-3 and Safe Harbor Provision in Exchange Act Rules 13a-11 and
15d-11
    We are proposing to amend General Instruction I.A.3.(b) of Form S-3
and General Instruction I.A.2 of Form SF-3 to provide that an untimely
filing on Form 8-K regarding new Item 1.05 would not result in loss of
Form S-3 or Form SF-3 eligibility. Under our existing rules, the
untimely filing on Form 8-K of certain specified items does not result
in loss of Form S-3 or Form SF-3 eligibility, so long as Form 8-K
reporting is current at the time the Form S-3 or SF-3 is filed. In the
past, when we have adopted new disclosure requirements that differed
from the traditional periodic reporting obligations of companies, we
have acknowledged concerns about the potentially harsh consequences of
the loss of Form S-3 or Form SF-3 eligibility, and addressed such
concerns by specifying that untimely filing of Forms 8-K relating to
certain topics would not result in the loss of Form S-3 or Form SF-3
eligibility.\62\ For the same reason, we believe that it is appropriate
to add proposed Item 1.05 to the list of Form 8-K items in General
Instruction I.A.3.(b) of Form S-3 and General Instruction I.A.2 of Form
SF-3.\63\
---------------------------------------------------------------------------

    \62\ See Selective Disclosure and Insider Trading, Release No.
33-7881 (Aug. 15, 2000) [65 FR 51715 (Aug. 24, 2000)]; see also
Additional Form 8-K Disclosure Requirements and Acceleration of
Filing Date, Release No. 33-8400 (Mar. 16, 2004) [69 FR 15593 (Mar.
25, 2004)] (the ``Additional Form 8-K Disclosure Release'').
    \63\ See Selective Disclosure and Insider Trading, Release No.
33-7881 (Aug. 15, 2000) [65 FR 51715]; Additional Form 8-K
Disclosure Release.
---------------------------------------------------------------------------

    We are also proposing to amend Rules 13a-11(c) and 15d-11(c) under
the Exchange Act to include new Item 1.05 in the list of Form 8-K items
eligible for a limited safe harbor from liability under Section 10(b)
or Rule 10b-5 under the Exchange Act.\64\ In 2004, when the Commission
adopted the limited safe harbor, the Commission noted its view that the
safe harbor is appropriate if the triggering event for the Form 8-K
requires management to make a rapid materiality determination.\65\
While the registrant would need to file an Item 1.05 Form 8-K within
four business days after the registrant determines that it has
experienced a material cybersecurity incident, rather than within four
business days after its discovery of the incident, we expect management
to make a materiality determination about the incident as soon as
reasonably practicable after its discovery of the incident.\66\ In some
cases, we expect that management would make a materiality determination
coincident with discovering a cybersecurity incident and therefore file
a Form 8-K very soon after the registrant experiences or discovers a
cybersecurity incident. Therefore, we believe that it is appropriate to
extend the safe harbor to this proposed new item.
---------------------------------------------------------------------------

    \64\ Rules 13a-11(c) and 15d-11(c) each provides that ``[n]o
failure to file a report on Form 8-K that is required solely
pursuant to Item 1.01, 1.02, 2.03, 2.04, 2.05, 2.06, 4.02(a),
5.02(e), or 6.03 of Form 8-K shall be deemed a violation of''
Section 10(b) of the Exchange Act or Rule 10b-5 thereunder.
    \65\ Additional Form 8-K Disclosure Release at 69 FR 15607.
    \66\ Instruction 1 to proposed Item 1.05 of Form 8-K.
---------------------------------------------------------------------------

Request for Comment

    1. Would investors benefit from current reporting about material
cybersecurity incidents on Form 8-K? Does the proposed Form 8-K
disclosure requirement appropriately balance the informational needs of
investors and the reporting burdens on registrants?
    2. Would proposed Item 1.05 require an appropriate level of
disclosure about a material cybersecurity incident? Would the proposed
disclosures allow investors to understand the nature of the incident
and its potential impact on the registrant, and make an informed
investment decision? Should we modify or eliminate any of the specified
disclosure items in proposed Item 1.05? Is there any additional
information about a material cybersecurity incident that Item 1.05
should require?
    3. Could any of the proposed Item 1.05 disclosures or the proposed
timing of the disclosures have the unintentional effect of putting
registrants at additional risk of future cybersecurity incidents? If
so, how could we modify the proposal to avoid this effect? For example,
should registrants instead provide some of the disclosures in proposed
Item 1.05 in the registrant's next periodic report? If so, which
disclosures?
    4. We are proposing to require registrants to file an Item 1.05
Form 8-K within four business days after the registrant determines that
it has experienced a material cybersecurity incident. Would the
proposed four-business day filing deadline provide sufficient time for
registrants to prepare the disclosures that would be required under
proposed Item 1.05? Should we modify the timeframe in which a
registrant must file a Form 8-K under proposed Item 1.05? If so, what
timeframe would be more appropriate for making these disclosures?
    5. Should there be a different triggering event for the Item 1.05
disclosure, such as the registrant's discovery that it has experienced
a cybersecurity incident, even if the registrant has not yet been able
to determine the materiality of the incident? If so, which information
should be disclosed in Form 8-K based on a revised triggering event?
Should we instead require disclosure only if the expected costs arising
from a cybersecurity incident exceed a certain quantifiable threshold,
e.g., a percentage of the company's assets, equity, revenues or net
income or alternatively a precise number? If so, what would be an
appropriate threshold?
    6. To what extent, if any, would the proposed Form 8-K incident
reporting obligation create conflicts for a registrant with respect to
other obligations of the registrant under federal or state law? How
would any such conflicting obligations arise, and what mechanisms could
the Commission use to ensure that registrants can comply with other
laws and regulations while providing these

timely disclosures to investors? What costs would registrants face in
determining the extent of a potential conflict?
    7. Should any rule provide that the Commission shall allow
registrants to delay reporting of a cybersecurity incident where the
Attorney General requests such a delay from the Commission based on the
Attorney General's written determination that the delay is in the
interest of national security?
    8. We are proposing to include an instruction that ``a registrant
shall make a materiality determination regarding a cybersecurity
incident as soon as reasonably practicable after discovery of the
incident.'' Is this instruction sufficient to mitigate the risk of a
registrant delaying a materiality determination? Should we consider
further guidance regarding the timing of a materiality determination?
Should we, for example, suggest examples of timeframes that would (or
would not), in most circumstances, be considered prompt?
    9. Should certain registrants that would be within the scope of the
proposed requirements, but that are subject to other cybersecurity-
related regulations, or that would be included in the scope of the
Commission's recently-proposed cybersecurity rules \67\ for advisers
and funds, if adopted, be excluded from the proposed requirements? For
example, should the proposed Form 8-K reporting requirements or the
other disclosure requirements described in this release, as applicable,
exclude business development companies (``BDCs''),\68\ or the publicly
traded parent of an adviser?
---------------------------------------------------------------------------

    \67\ See Cybersecurity Risk Management for Investment Advisers,
Registered Investment Companies, and Business Development Companies,
Release No. 34-94197 (Feb. 9, 2022) [87 FR 13524 (Mar. 9, 2022)]
(``Investment Management Cybersecurity Proposing Release''). In this
release, the Commission proposed new rules and rule amendments that
would require: (i) Registered investment advisers (``advisers'') and
investment companies (``funds'') to adopt and implement written
cybersecurity policies and procedures reasonably designed to address
cybersecurity risks; (ii) advisers to report significant
cybersecurity incidents affecting the adviser, or its fund or
private fund clients, to the Commission; (iii) advisers and funds to
provide cyber-related disclosures to clients and investors; and (iv)
advisers and funds to maintain certain records related to the
proposed cybersecurity risk management obligations and the
occurrence of cybersecurity incidents.
    \68\ For purposes of this release, the terms ``public
companies,'' ``companies,'' and ``registrants,'' include issuers
that are business development companies as defined in section
2(a)(48) of the Investment Company Act of 1940 (``Investment Company
Act''), but not those investment companies registered under that
Act.
---------------------------------------------------------------------------

    10. As described further below, we are proposing to define
cybersecurity incident to include an unauthorized occurrence on or
through a registrant's ``information systems,'' which is proposed to
include ``information resources owned or used by the registrant.''
Would registrants be reasonably able to obtain information to make a
materiality determination about cybersecurity incidents affecting
information resources that are used but not owned by them? Would a safe
harbor for information about cybersecurity incidents affecting
information resources that are used but not owned by a registrant be
appropriate? If so, why, and what would be the appropriate scope of a
safe harbor? What alternative disclosure requirements would provide
investors with information about cybersecurity incidents and risks that
affect registrants via information systems owned by third parties?
    11. We are proposing that registrants be required to file rather
than permitted to furnish an Item 1.05 Form 8-K. Should we instead
permit registrants to furnish an Item 1.05 Form 8-K, such that the Form
8-K would not be subject to liability under Section 18 of the Exchange
Act unless the registrant specifically states that the information is
to be considered ``filed'' or incorporates it by reference into a
filing under the Securities Act or Exchange Act?
    12. We note above a non-exclusive list of examples that would merit
disclosure under Item 1.05 of Form 8-K covers some, but not all, types
of material cybersecurity incidents. Are there additional examples we
should address? Should we include a non-exclusive list of examples in
Item 1.05 of Form 8-K?
    13. Should we include Item 1.05 in the Exchange Act Rules 13a-11
and 15d-11 safe harbors from public and private claims under Exchange
Act Section 10(b) and Rule 10b-5 for failure to timely file a Form 8-K,
as proposed?
    14. Should we include Item 1.05, as proposed, in the list of Form
8-K items where failure to timely file a Form 8-K will not result in
the loss of a registrant's eligibility to file a registration statement
on Form S-3 and Form SF-3?

C. Disclosure About Cybersecurity Incidents in Periodic Reports

1. Updates to Previously Filed Form 8-K Disclosure
    Proposed Item 106(d)(1) of Regulation S-K would require registrants
to disclose any material changes, additions, or updates to information
required to be disclosed pursuant to Item 1.05 of Form 8-K in the
registrant's quarterly report filed with the Commission on Form 10-Q or
annual report filed with the Commission on Form 10-K for the period
(the registrant's fourth fiscal quarter in the case of an annual
report) in which the material change, addition, or update occurred.
    We are proposing this requirement to balance the need for prompt
and timely disclosure regarding material cybersecurity incidents with
the fact that a registrant may not have complete information about a
material cybersecurity incident at the time it determines the incident
to be material. Proposed Item 106(d)(1) provides a means for investors
to receive regular updates regarding the previously reported incident
when and for so long as there are material changes, additions, or
updates during a given reporting period. For example, after filing the
initial Form 8-K disclosure, the registrant may become aware of
additional material information about the scope of the incident and
whether any data was stolen or altered; the proposed Item 106(d)(1)
disclosure requirements would allow investors to stay informed of such
developments.
    The registrant also may be able to provide information about the
effect of the previously reported cybersecurity incident on its
operations as well as a description of remedial steps it has taken, or
plans to take, in response to the incident that was not available at
the time of the initial Form 8-K filing.\69\ In order to assist
registrants in developing updated incident disclosure in its periodic
reports, proposed Item 106(d)(1) provides the following non-exclusive
examples of the type of disclosure that should be provided, if
applicable:
---------------------------------------------------------------------------

    \69\ Notwithstanding proposed Item 106(d)(1), there may be
situations where a registrant would need to file an amended Form 8-K
to correct disclosure from the initial Item 1.05 Form 8-K, such as
where that disclosure becomes inaccurate or materially misleading as
a result of subsequent developments regarding the incident. For
example, if the impact of the incident is determined after the
initial Item 1.05 Form 8-K filing to be significantly more severe
than previously disclosed, an amended Form 8-K may be required.
---------------------------------------------------------------------------

     Any material impact of the incident on the registrant's
operations and financial condition;
     Any potential material future impacts on the registrant's
operations and financial condition;
     Whether the registrant has remediated or is currently
remediating the incident; and
     Any changes in the registrant's policies and procedures as
a result of the cybersecurity incident, and how the incident may have
informed such changes.

2. Disclosure of Cybersecurity Incidents That Have Become Material in
the Aggregate
    Proposed Item 106(d)(2) would require disclosure when a series of
previously undisclosed individually immaterial cybersecurity incidents
become material in the aggregate. Thus, registrants would need to
analyze related cybersecurity incidents for materiality, both
individually and in the aggregate. If such incidents become material in
the aggregate, registrants would need to disclose: When the incidents
were discovered and whether they are ongoing; a brief description of
the nature and scope of such incidents; whether any data was stolen or
altered; the impact of such incidents on the registrant's operations
and the registrant's actions; and whether the registrant has remediated
or is currently remediating the incidents.
    While such incidents conceptually could take a variety of forms, an
example would be where one malicious actor engages in a number of
smaller but continuous cyber-attacks related in time and form against
the same company and collectively, they are either quantitatively or
qualitatively material, or both. Such incidents would need to be
disclosed in the periodic report for the period in which a registrant
has made a determination that they are material in the aggregate.
Request for Comment
    15. Should we require registrants to disclose any material changes
or updates to information that would be disclosed pursuant to proposed
Item 1.05 of Form 8-K in the registrant's quarterly or annual report,
as proposed? Are there instances, other than to correct inaccurate or
materially misleading prior disclosures, when a registrant should be
required to update its report on Form 8-K or file another Form 8-K
instead of providing disclosure of material changes, additions, or
updates in a subsequent Form 10-Q or Form 10-K?
    16. Should we require a registrant to provide disclosure on Form
10-Q or Form 10-K when a series of previously undisclosed and
individually immaterial cybersecurity incidents becomes material in the
aggregate, as proposed? Alternatively, should we require a registrant
to provide disclosure in Form 8-K, rather than in a periodic report, as
proposed, when a series of previously undisclosed and individually
immaterial cybersecurity incidents becomes material in the aggregate?

D. Disclosure of a Registrant's Risk Management, Strategy and
Governance Regarding Cybersecurity Risks

1. Risk Management and Strategy
    Companies typically address significant risks to their businesses
by developing risk management systems, which may include policies and
procedures for identifying, assessing, and managing the risks. These
policies and procedures may then be subject to oversight by a company's
management and board.\70\ Policies and procedures reasonably designed
to provide oversight, risk assessments, and incident responses may be
adopted to help prevent or mitigate cyber-attacks and potentially
prevent future attacks. Staff in the Division of Corporation Finance
has observed that most of the registrants that disclosed a
cybersecurity incident in 2021 did not describe their cybersecurity
risk oversight and related policies and procedures. Some of these
registrants provided only general disclosures, such as a reference to
cybersecurity as one of the risks overseen by the board or a board
committee.
---------------------------------------------------------------------------

    \70\ See Martin Lipton, Wachtell, Lipton, Rosen & Katz,
Spotlight on Boards 2018, Harv. L. Sch. F. on Corp. Governance (May
31, 2018), available at https://corpgov.law.harvard.edu/2018/05/31/spotlight-on-boards-2018 (one of the board's responsibilities is to,
``[o]versee and understand the corporation's risk management and
compliance efforts and how risk is taken into account in the
corporation's business decision-making; respond to red flags if and
when they arise.'').
---------------------------------------------------------------------------

    We are proposing Item 106(b) of Regulation S-K to require
registrants to provide more consistent and informative disclosure
regarding their cybersecurity risk management and strategy. We believe
that disclosure of the relevant policies and procedures, to the extent
a registrant has established any, would benefit investors by providing
greater transparency as to the registrant's strategies and actions to
manage cybersecurity risks. For example, proposed disclosure about
whether the registrant has a cybersecurity risk assessment program and
undertakes activities designed to prevent, detect, and minimize effects
of cybersecurity incidents can improve an investor's understanding of
the registrant's cybersecurity risk profile. Given that a significant
number of cybersecurity incidents pertain to third party service
providers, the proposed rules would require disclosure concerning a
registrant's selection and oversight of third-party entities as
well.\71\
---------------------------------------------------------------------------

    \71\ See Stephen Klemash and Jamie Smith, What companies are
disclosing about cybersecurity risk and oversight, EY, supra note 6
(``Around a third of the disclosed data breaches related to cyber
attacks of third-party service providers.'').
---------------------------------------------------------------------------

    Additionally, cybersecurity risks may have an impact on a
registrant's business strategy, financial outlook, or financial
planning. Across industries, companies increasingly rely on information
technology, collection of data, and use of digital payments as critical
components of their business model and strategy. Their exposure to
cybersecurity risks and previous cybersecurity incidents may affect
these critical components, informing changes in their business model,
financial condition, financial planning, and allocation of capital. For
example, a company with a business model that relies highly on
collecting and safeguarding sensitive and personally identifiable
information from its customers may consider raising additional capital
to invest in enhanced cybersecurity protection, improvements in its
information security infrastructure, or employee cybersecurity
training. Another company may examine the risks and decide that its
business model should be adapted to minimize its collection of
sensitive and personally identifiable information in order to reduce
its risk exposure. These strategic decisions have implications for the
company's financial planning and future financial performance.
Disclosure about the impact of cybersecurity risks on business strategy
would enable investors to assess whether companies will become more
resilient or conversely, more vulnerable to cybersecurity risks in the
future.
    We also propose requiring disclosure of whether cybersecurity
related risk and previous incidents have affected or are reasonably
likely to affect the registrant's results of operations or financial
condition. Investors would likely want to understand the financial
impacts of cybersecurity risks and previous cybersecurity incidents in
order to understand how these risks and incidents affect the company's
financial performance or position, and thus the return on their
investment. For example, a company that has previously experienced a
cybersecurity incident may plan to provide compensation to consumers or
it may anticipate regulatory fines or legal judgments as a result of
the incident. These financial impacts would help investors understand
the degree to which cybersecurity risks and incidents could affect the
company's financial performance or position.
    Proposed Item 106(b) would therefore require registrants to
disclose its

policies and procedures, if it has any, to identify and manage
cybersecurity risks and threats, including: Operational risk;
intellectual property theft; fraud; extortion; harm to employees or
customers; violation of privacy laws and other litigation and legal
risk; and reputational risk. Specifically, proposed Item 106(b) of
Regulation S-K would require disclosure, as applicable, of whether:
\72\
---------------------------------------------------------------------------

    \72\ See proposed Item 106(b).
---------------------------------------------------------------------------

     The registrant has a cybersecurity risk assessment program
and if so, provide a description of such program;
     The registrant engages assessors, consultants, auditors,
or other third parties in connection with any cybersecurity risk
assessment program;
     The registrant has policies and procedures to oversee and
identify the cybersecurity risks associated with its use of any third-
party service provider (including, but not limited to, those providers
that have access to the registrant's customer and employee data),
including whether and how cybersecurity considerations affect the
selection and oversight of these providers and contractual and other
mechanisms the company uses to mitigate cybersecurity risks related to
these providers;
     The registrant undertakes activities to prevent, detect,
and minimize effects of cybersecurity incidents;
     The registrant has business continuity, contingency, and
recovery plans in the event of a cybersecurity incident;
     Previous cybersecurity incidents have informed changes in
the registrant's governance, policies and procedures, or technologies;
     Cybersecurity related risk and incidents have affected or
are reasonably likely to affect the registrant's results of operations
or financial condition and if so, how; and
     Cybersecurity risks are considered as part of the
registrant's business strategy, financial planning, and capital
allocation and if so, how.
2. Governance
    Disclosure regarding board oversight of a registrant's
cybersecurity risk and the inclusion or exclusion of management from
the oversight of cybersecurity risks and the implementation of related
policies, procedures, and strategies impacts an investor's ability to
understand how a registrant prepares for, prevents, or responds to
cybersecurity incidents.\73\ Accordingly, proposed Item 106(c) would
require disclosure of a registrant's cybersecurity governance,
including the board's oversight of cybersecurity risk and a description
of management's role in assessing and managing cybersecurity risks, the
relevant expertise of such management, and its role in implementing the
registrant's cybersecurity policies, procedures, and strategies.\74\
---------------------------------------------------------------------------

    \73\ See John F. Saverese et al., Cybersecurity Oversight and
Defense--A Board and Management Imperative, Harv. L.Sch. F. on Corp.
Governance (May 14, 2021), available at https://corpgov.law.harvard.edu/2021/05/14/cybersecurity-oversight-and-defense-a-board-and-management-imperative/.
    \74\ Proposed amendments to Form 10-K clarify that an asset-
backed issuer (as defined in Item 1101 of Regulation AB) that does
not have any executive officers or directors may omit the
information required by 17 CFR 229.106(c) (Item 106(c) of Regulation
S-K).
---------------------------------------------------------------------------

    Specifically, as it pertains to the board's oversight of
cybersecurity risk, disclosure required by proposed Item 106(c)(1)
would include a discussion, as applicable, of the following: \75\
---------------------------------------------------------------------------

    \75\ See proposed Item 106(c)(1). In the case of a FPI with a
two-tier board of directors, proposed Instruction 1 to Item 106(c)
clarifies that the term ``board of directors'' means the supervisory
or non-management board. In the case of a FPI meeting the
requirements of 17 CFR 240.10A-3(c)(3), for purposes of proposed
Item 106(c), the term, ``board of directors'' means the registrant's
board of auditors (or similar body) or statutory auditors, as
applicable.
---------------------------------------------------------------------------

     Whether the entire board, specific board members or a
board committee is responsible for the oversight of cybersecurity
risks;
     The processes by which the board is informed about
cybersecurity risks, and the frequency of its discussions on this
topic; and
     Whether and how the board or board committee considers
cybersecurity risks as part of its business strategy, risk management,
and financial oversight.
    This proposed disclosure about the board's oversight would inform
investors about the role of the board in cybersecurity risk management,
which may help inform their investment and voting decisions. Proposed
Item 106(c)(1) would also reinforce the 2018 Interpretive Release,
which states that the board's role in overseeing cybersecurity risks
should be disclosed if ``cybersecurity risks are material to a
company's business'' and that such disclosures should address how a
board ``engages with management on cybersecurity issues'' and
``discharg[es] its [cybersecurity] risk oversight responsibility.''
\76\
---------------------------------------------------------------------------

    \76\ See 2018 Interpretive Release.
---------------------------------------------------------------------------

    Proposed Item 106(c)(2) would require a description of management's
role in assessing and managing cybersecurity-related risks and in
implementing the registrant's cybersecurity policies, procedures, and
strategies. This description would include, but not be limited to, the
following information: \77\
---------------------------------------------------------------------------

    \77\ See proposed Item 106(c)(2).
---------------------------------------------------------------------------

     Whether certain management positions or committees are
responsible for measuring and managing cybersecurity risk, specifically
the prevention, mitigation, detection, and remediation of cybersecurity
incidents, and the relevant expertise of such persons or members;
     Whether the registrant has a designated chief information
security officer,\78\ or someone in a comparable position, and if so,
to whom that individual reports within the registrant's organizational
chart, and the relevant expertise \79\ of any such persons;
---------------------------------------------------------------------------

    \78\ The chief information security officer may be responsible
for identifying and monitoring cybersecurity risks, communicating
with senior management and the registrant's business units about
acceptable risk levels, developing risk mitigation strategies, and
implementing a security framework that protects the registrant's
digital assets. The Role of the CISO and the Digital Security
Landscape, isaca j. vol. 2, at 22, 23-29 (2019) available at https://www.isaca.org/resources/isaca-journal/issues/2019/volume-2/the-role-of-the-ciso-and-the-digital-security-landscape.
    \79\ Proposed Instruction 2 to Item 106(c) provides guidance
that ``expertise'' in Item 106(c)(2)(i) and (ii) may include, for
example: Prior work experience in cybersecurity; any relevant
degrees or certifications; any knowledge, skills, or other
background in cybersecurity.
---------------------------------------------------------------------------

     The processes by which such persons or committees are
informed about and monitor the prevention, mitigation, detection, and
remediation of cybersecurity incidents; and
     Whether and how frequently such persons or committees
report to the board of directors or a committee of the board of
directors on cybersecurity risk.
    This proposed disclosure of how a registrant's management assesses
and implements policies, procedures, and strategies to mitigate
cybersecurity risks would be of importance to investors both as they
understand how registrants are planning for cybersecurity risks and as
they make decisions as to how best to allocate their capital.
3. Definitions
    Proposed Item 106(a) defines the terms ``cybersecurity incident,''
``cybersecurity threat,'' and ``information systems,'' as used in
proposed Item 106 and proposed Form 8-K Item 1.05 as follows: \80\
---------------------------------------------------------------------------

    \80\ See proposed Item 106(a). These three terms are derived
from a number of established sources. See Presidential Policy
Directive--United States Cyber Incident Coordination (July 26, 2016)
(``PPD-41''); 6 U.S.C. 1501 (2021); 44 U.S.C. 3502 (2021); 44 U.S.C.
3552 (2021); see also National Institute of Standards and Technology
(NIST), Computer Security Resource Center Glossary (last visited
Feb. 6, 2022), available at https://csrc.nist.gov/glossary (``NIST
Glossary''). The proposed definitions also are consistent with
proposed definitions in the Investment Management Cybersecurity
Proposing Release. See Investment Management Cybersecurity Proposing
Release at notes 27, 28, and 30. We believe the proposed terms are
sufficiently precise for registrants to understand and use in
connection with the proposed rules. Use of common terms is intended
to facilitate compliance and reduce regulatory burdens. Using common
terms and similar definitions with the Investment Management
Cybersecurity Proposing Release along with other federal
cybersecurity rulemakings is intended to facilitate compliance and
reduce regulatory burdens.

---------------------------------------------------------------------------

     Cybersecurity incident means an unauthorized occurrence on
or conducted through a registrant's information systems that
jeopardizes the confidentiality, integrity, or availability of a
registrant's information systems or any information residing therein.
     Cybersecurity threat means any potential occurrence that
may result in, an unauthorized effort to adversely affect the
confidentiality, integrity or availability of a registrant's
information systems or any information residing therein.
     Information systems means information resources, owned or
used by the registrant, including physical or virtual infrastructure
controlled by such information resources, or components thereof,
organized for the collection, processing, maintenance, use, sharing,
dissemination, or disposition of the registrant's information to
maintain or support the registrant's operations.
    What constitutes a ``cybersecurity incident'' for purposes of our
proposal should be construed broadly and may result from any one or
more of the following: An accidental exposure of data, a deliberate
action or activity to gain unauthorized access to systems or to steal
or alter data, or other system compromises or data breaches.\81\
---------------------------------------------------------------------------

    \81\ See supra Section II.B.2, for examples of cybersecurity
incidents that may require disclosure pursuant to proposed Item 1.05
of Form 8-K.
---------------------------------------------------------------------------

Request for Comment
    17. Should we adopt Item 106(b) and (c) as proposed? Are there
other aspects of a registrant's cybersecurity policies and procedures
or governance that should be required to be disclosed under Item 106,
to the extent that a registrant has any policies and procedures or
governance? Conversely, should we exclude any of the proposed Item 106
disclosure requirements?
    18. Are the proposed definitions of the terms ``cybersecurity
incident,'' ``cybersecurity threat,'' and ``information systems,'' in
Item 106(a) appropriate or should they be revised? Are there other
terms used in the proposed amendments that we should define?
    19. The proposed rule does not define ``cybersecurity.'' We could
define the term to mean, for example: ``any action, step, or measure to
detect, prevent, deter, mitigate, or address any cybersecurity threat
or any potential cybersecurity threat.'' Would defining
``cybersecurity'' in proposed Item 106(a) be helpful? Why or why not?
If defining this term would be helpful, is the definition provided
above appropriate, or is there another definition that would better
define ``cybersecurity''?
    20. Should we require the registrant to specify whether any
cybersecurity assessor, consultant, auditor, or other service that it
relies on is through an internal function or through an external third-
party service provider? Would such a disclosure be useful for
investors?
    21. As proposed, a registrant that has not established any
cybersecurity policies or procedures would not have to explicitly state
that this is the case. If applicable, should a registrant have to
explicitly state that it has not established any cybersecurity policies
and procedures?
    22. Are there concerns that certain disclosures required under Item
106 would have the potential effect of undermining a registrant's
cybersecurity defense efforts or have other potentially adverse effects
by highlighting a registrant's lack of policies and procedures related
to cybersecurity? If so, how should we address these concerns while
balancing investor need for a sufficient description of a registrant's
policies and procedures for purposes of their investment decisions?
    23. Should we exempt certain categories of registrants from
proposed Item 106, such as smaller reporting companies, emerging growth
companies, or FPIs? If so, which ones and why? How would any exemption
impact investor assessments and comparisons of the cybersecurity risks
of registrants? Alternatively, should we provide for scaled disclosure
requirements by any of these categories of registrants, and if so, how?
    24. Should we provide for delayed compliance or other transition
provisions for proposed Item 106 for certain categories of registrants,
such as smaller reporting companies, emerging growth companies, FPIs,
or asset-backed securities issuers? Proposed Item 106(b), which would
require companies to provide disclosures regarding existing policies
and procedures for the identification and management of cybersecurity
incidents, would be required in annual reports. Should the proposed
Item 106(b) disclosures also be required in registration statements
under the Securities Act and the Exchange Act?
    25. To what extent would disclosure under proposed Item 106 overlap
with disclosure required under Item 407(h) of Regulation S-K (``Board
leadership structure and role in oversight'') with respect to board
oversight of cybersecurity risks? To the extent there is significant
overlap, should we expressly provide for the use of hyperlinks or
cross-references in Item 106? Are there other approaches that would
effectively decrease duplicative disclosure without being cumbersome
for investors?

E. Disclosure Regarding the Board of Directors' Cybersecurity Expertise

    Cybersecurity is already among the top priorities of many boards of
directors \82\ and cybersecurity incidents and other risks are
considered one of the largest threats to companies.\83\ Accordingly,
investors may find disclosure of whether any board members have
cybersecurity expertise to be important as they consider their
investment in the registrant as well as their votes on the election of
directors of the registrant.
---------------------------------------------------------------------------

    \82\ NACD, 2019-2020 NACD Public Company Governance Survey,
available at https://corpgov.law.harvard.edu/wp-content/uploads/2020/01/2019-2020-Public-Company-Survey.pdf.
    \83\ See id.
---------------------------------------------------------------------------

    We propose to amend Item 407 of Regulation S-K by adding paragraph
(j) to require disclosure about the cybersecurity expertise of members
of the board of directors of the registrant, if any. If any member of
the board has cybersecurity expertise, the registrant would have to
disclose the name(s) of any such director(s), and provide such detail
as necessary to fully describe the nature of the expertise.\84\
---------------------------------------------------------------------------

    \84\ Consistent with proposed Instruction 1 to Item 106(c), we
are proposing an instruction to Item 407(j) to clarify that in the
case of a FPI with a two-tier board of directors the term ``board of
directors'' means the supervisory or non-management board. In the
case of a FPI meeting the requirements of 17 CFR 240.10A-3(c)(3),
for purposes of 407(j), the term, ``board of directors'' means the
registrant's board of auditors (or similar body) or statutory
auditors, as applicable. See proposed Instruction 2 to Item 407(j).
Likewise, proposed General Instruction J to Form 10-K permits an
asset-backed issuer that does not have any executive officers or
directors to omit the Item 407 disclosure required by Form 10-K as
these entities are generally passive pools of assets and are subject
to substantially different reporting requirements than operating
companies. Similarly, such entities would be permitted to omit the
proposed Item 407(j) disclosure from Form 10-K under General
Instruction J for the same reason.
---------------------------------------------------------------------------

    The proposed requirements would build upon the existing disclosure
requirements in Item 401(e) of Regulation S-K (business experience of
directors) and Item 407(h) of Regulation

S-K (board risk oversight). The proposed Item 407(j) disclosure would
be required in a registrant's proxy or information statement when
action is to be taken with respect to the election of directors, and in
its Form 10-K.
    Proposed Item 407(j) would not define what constitutes
``cybersecurity expertise,'' given that such expertise may cover
different experiences, skills, and tasks. Proposed Item 407(j)(1)(ii)
does, however, include the following non-exclusive list of criteria
that a registrant should consider in reaching a determination on
whether a director has expertise in cybersecurity:
     Whether the director has prior work experience in
cybersecurity, including, for example, prior experience as an
information security officer, security policy analyst, security
auditor, security architect or engineer, security operations or
incident response manager, or business continuity planner;
     Whether the director has obtained a certification or
degree in cybersecurity; and
     Whether the director has knowledge, skills, or other
background in cybersecurity, including, for example, in the areas of
security policy and governance, risk management, security assessment,
control evaluation, security architecture and engineering, security
operations, incident handling, or business continuity planning.
    Proposed Item 407(j)(2) would state that a person who is determined
to have expertise in cybersecurity will not be deemed an expert for any
purpose, including, without limitation, for purposes of Section 11 of
the Securities Act (15 U.S.C. 77k),\85\ as a result of being designated
or identified as a director with expertise in cybersecurity pursuant to
proposed Item 407(j).\86\ This proposed safe harbor is intended to
clarify that Item 407(j) would not impose on such person any duties,
obligations, or liability that are greater than the duties,
obligations, and liability imposed on such person as a member of the
board of directors in the absence of such designation or
identification.\87\ This provision should alleviate such concerns for
cybersecurity experts considering board service. Conversely, we do not
intend for the identification of a cybersecurity expert on the board to
decrease the duties and obligations or liability of other board
members.\88\
---------------------------------------------------------------------------

    \85\ 15 U.S.C. 77k.
    \86\ See proposed Item 407(j)(3)(i).
    \87\ See proposed Item 407(j)(3)(ii).
    \88\ See proposed Item 407(j)(3)(iii).
---------------------------------------------------------------------------

Request for Comment
    26. Would proposed Item 407(j) disclosure provide information that
investors would find useful? Should it be modified in any way?
    27. Should we require disclosure of the names of persons with
cybersecurity expertise on the board of directors, as currently
proposed in Item 407(j)(1)? Would a requirement to name such persons
have the unintended effect of deterring persons with this expertise
from serving on a board of directors?
    28. When a registrant does not have a person with cybersecurity
expertise on its board of directors, should the registrant be required
to state expressly that this is the case under proposed Item 407(j)(1)?
As proposed, we would not require a registrant to make such an explicit
statement.
    29. Proposed Item 407(j) would require registrants to describe
fully the nature of a board member's expertise in cybersecurity without
mandating specific disclosures. Is there particular information that we
should instead require a registrant to disclose with respect to a board
member's expertise in cybersecurity?
    30. As proposed, Item 407(j)(1) includes a non-exclusive list of
criteria that a company should consider in determining whether a
director has expertise in cybersecurity. Are these factors for
registrants to consider useful in determining cybersecurity expertise?
Should the list be revised, eliminated, or supplemented?
    31. Would the Item 407(j) disclosure requirements have the
unintended effect of undermining a registrant's cybersecurity defense
efforts or otherwise impose undue burdens on registrants? If so, how?
    32. Should 407(j) disclosure of board expertise be required in an
annual report and proxy or information statement, as proposed?
    33. To what extent would disclosure under proposed Item 407(j)
overlap with disclosure required under Item 401(e) of Regulation S-K
with respect to the business experience of directors? Are there
alternative approaches that would avoid duplicative disclosure without
being cumbersome for investors?
    34. As proposed, Item 407(j) does not include a definition of the
term ``expertise'' in the context of cybersecurity? Should Item 407(j)
define the term ``expertise''? If so, how should we define the term?
    35. Should certain categories of registrants, such as smaller
reporting companies, emerging growth companies, or FPIs, be excluded
from the proposed Item 407(j) disclosure requirement? How would any
exclusion affect the ability of investors to assess the cybersecurity
risk of a registrant or compare such risk among registrants?
    36. Should we adopt the proposed Item 407(j)(2) safe harbor to
clarify that a director identified as having expertise in cybersecurity
would not have any increased level of liability under the federal
securities laws as a result of such identification? Are there
alternatives we should consider?
    37. As proposed, disclosure under Item 407(j) would be required in
a proxy or information statement. Should we require the disclosure
under Item 407(j) to appear in a registrant's proxy or information
statement regardless of whether the registrant is relying on General
Instruction G(3)? Is this information relevant to a security holder's
decision to vote for a particular director?

F. Periodic Disclosure by Foreign Private Issuers

    We propose to amend Form 20-F to add Item 16J that would require an
FPI to include in its annual report on Form 20-F the same type of
disclosure that we propose in Items 106 and 407(j) of Regulation S-K
and that would be required in periodic reports filed by domestic
registrants. One difference is that while domestic registrants would be
required to include the proposed Item 407(j) disclosure about board
expertise in both their annual reports and proxy or information
statements, FPIs are not subject to Commission rules for proxy or
information statement filings and thus, would only be required to
include this disclosure in their annual reports.\89\
---------------------------------------------------------------------------

    \89\ Exchange Act Rule 3a12-3(b) [17 CFR 240.3a12-3(b)].
---------------------------------------------------------------------------

    With respect to incident disclosure, where an FPI has previously
reported an incident on Form 6-K, the proposed amendments would require
an update regarding such incidents, consistent with proposed Item
106(d)(1) of Regulation S-K.\90\ We are also proposing to amend Form
20-F to require FPIs to disclose on an annual basis information
regarding any previously undisclosed material cybersecurity incidents
that have occurred during the reporting period, including a series of
previously undisclosed individually immaterial cybersecurity incidents
that has become material in the aggregate.\91\
---------------------------------------------------------------------------

    \90\ See proposed Item 16J(d)(1).
    \91\ See proposed Item 16J(d)(2).
---------------------------------------------------------------------------

    The Commission created Form 40-F in connection with its
establishment of a multijurisdictional disclosure system (``MJDS'').
This system generally

permits eligible Canadian FPIs to use Canadian disclosure standards and
documents to satisfy the Commission's registration and disclosure
requirements. Accordingly, we are not proposing prescriptive
cybersecurity disclosure requirements for Form 40-F filers.
Request for Comment
    38. Should we amend Form 20-F, as proposed to require disclosure
regarding cybersecurity risk management and strategy, governance, and
incidents? Additionally, should we amend Form 6-K, as proposed, to add
``cybersecurity incidents'' as a reporting topic? Are there unique
considerations with respect to FPIs in these contexts?
    39. We are not proposing any changes to Form 40-F. Should we
instead require an MJDS issuer filing an annual report on Form 40-F to
comply with the Commission's specific proposed cybersecurity-related
disclosure requirements in the same manner as Form 10-K or Form 20-F
filers?

G. Structured Data Requirements

    We are proposing to require registrants to tag the information
specified by Item 1.05 of Form 8-K and Items 106 and 407(j) of
Regulation S-K in Inline XBRL in accordance with Rule 405 of Regulation
S-T (17 CFR 232.405) and the EDGAR Filer Manual.\92\ The proposed
requirements would include block text tagging of narrative disclosures,
as well as detail tagging of quantitative amounts disclosed within the
narrative disclosures. Inline XBRL is both machine-readable and human-
readable, which improves the quality and usability of XBRL data for
investors.\93\
---------------------------------------------------------------------------

    \92\ This tagging requirement would be implemented by including
a cross-reference to Rule 405 of Regulation S-T in proposed Item
1.05 of Form 8-K and Items 106 and 407(j) of Regulation S-K, and by
revising Rule 405(b) of Regulation S-T [17 CFR 232.405(b)] to
include the listed disclosure Items. In conjunction with the EDGAR
Filer Manual, Regulation S-T governs the electronic submission of
documents filed with the Commission. Rule 405 of Regulation S-T
specifically governs the scope and manner of disclosure tagging
requirements for operating companies and investment companies,
including the requirement in Rule 405(a)(3) to use Inline XBRL as
the specific structured data language to use for tagging the
disclosures.
    \93\ See Inline XBRL Filing of Tagged Data, Securities Act
Release No. 10514 (June 28, 2018) [83 FR 40846 (Aug. 16, 2018)].
Inline XBRL allows filers to embed XBRL data directly into an HTML
document, eliminating the need to tag a copy of the information in a
separate XBRL exhibit. Inline XBRL is both human-readable and
machine-readable for purposes of validation, aggregation, and
analysis. Id. at 40851.
---------------------------------------------------------------------------

    Requiring Inline XBRL tagging of the disclosures provided pursuant
to these disclosure items would benefit investors by making the
disclosures more readily available and easily accessible to investors,
market participants, and others for aggregation, comparison, filtering,
and other analysis, as compared to requiring a non-machine readable
data language such as ASCII or HTML. This Inline XBRL tagging would
enable automated extraction and analysis of the granular data required
by the proposed rules, allowing investors and other market participants
to more efficiently perform large-scale analysis and comparison of this
information across registrants and time periods. For narrative
disclosures, an Inline XBRL requirement would allow investors to
extract and search for disclosures about cybersecurity incidents
reported on Form 8-K, updated information about cybersecurity incidents
reported in a registrant's periodic reports, a registrant's
cybersecurity policies and procedures, management's role in assessing
and managing cybersecurity risks, and the board of directors' oversight
of cybersecurity risk and cybersecurity expertise rather than having to
manually run searches for these disclosures through entire documents.
The Inline XBRL requirement would also enable automatic comparison of
these disclosures against prior periods, and targeted artificial
intelligence/machine learning assessments of specific narrative
disclosures rather than the entire unstructured document. At the same
time, we do not expect the incremental compliance burden associated
with tagging the proposed additional information to be unduly
burdensome because registrants subject to the proposed tagging
requirements are for the most part subject to similar Inline XBRL
requirements in other Commission filings.
Request for Comment
    40. Should we require registrants to tag the disclosures required
by proposed Item 1.05 of Form 8-K and Items 106 and 407(j) of
Regulation S-K in Inline XBRL, as proposed? Are there any changes we
should make to ensure accurate and consistent tagging? If so, what
changes should we make? Should we require registrants to use a
different structured data language to tag these disclosures? If so,
what structured data language should we require? Are there any
registrants, such as smaller reporting companies, emerging growth
companies, or FPIs that we should exempt from the tagging requirement?

General Request for Comment

    We request and encourage any interested person to submit comments
regarding the proposed rule amendments, specific issues discussed in
this release, and other matters that may have an effect on the proposed
rule amendments. With regard to any comments, we note that such
comments are of particular assistance to our rulemaking initiative if
accompanied by supporting data and analysis of the issues addressed in
those comments.

III. Economic Analysis

A. Introduction

    Cybersecurity threats and incidents continue to increase in
prevalence and seriousness, posing an ongoing and escalating risk to
public companies, investors, and other market participants.\94\ The
number of reported breaches disclosed by public companies has increased
over the last decade, from 28 in 2011 to 144 in 2019 and 117 in
2020.\95\ Although estimating the total cost of cybersecurity incidents
is difficult, as many events may be unreported, some estimates put the
total costs in the trillions of dollars per year in the U.S. alone.\96\
The Council of Economic Advisers estimated that in 2016 the total cost
of cybersecurity incidents was between $57 billion and $109 billion, or
between 0.31 and 0.58 percent of U.S. GDP in that year.\97\
---------------------------------------------------------------------------

    \94\ Unless otherwise noted, when we discuss the economic
effects of the proposed amendments on ``other market participants,''
we mean those market participants that typically provide services
for investors and who rely on the information in registrant's
filings (such as financial analysts, investment advisers, and
portfolio managers).
    \95\ Audit Analytics, Trends in Cybersecurity Breaches (Mar.
2021) (stating that: ``[c]ybersecurity breaches can result in a
litany of costs, such as investigations, legal fees, and
remediation. There is also the risk of economic costs that directly
impact financial performance, such as a reduction in revenue due to
lost sales.'').
    \96\ See Cybersecurity and Infrastructure Security Agency, Cost
of a Cyber Incident: Systemic Review and Cross-Validation (Oct. 26,
2020), available at https://www.cisa.gov/sites/default/files/publications/CISA-OCE_Cost_of_Cyber_Incidents_Study-FINAL_508.pdf.
    \97\ See supra note 12, The Council of Economic Advisers, The
Cost of Malicious Cyber Activity to the U.S. Economy (Feb. 2018).
---------------------------------------------------------------------------

    As described earlier, while cybersecurity incident disclosure has
become more frequent since the issuance of the 2011 Staff Guidance and
2018 Interpretive Release, there is concern that material cybersecurity
incidents are underreported.\98\ For instance, the staff has observed
that certain cybersecurity incidents were reported in the media but not
disclosed in a registrant's filings.\99\ Even when

disclosures about cybersecurity breaches are made, they may not be
timely. According to Audit Analytics data, in 2020, it took on average
44 days for companies to discover breaches, and then in addition, it
took an average of 53 days and a median of 37 days for companies to
disclose a breach after its discovery.\100\ Additionally, incident
disclosure practices currently vary widely across registrants--some
registrants disclose incidents through Form 8-K and some may disclose
on a company website or in a press release. Because cybersecurity
incidents can significantly impact companies' stock prices, delayed
reporting results in mispricing of registrants' securities, harming
investors.\101\ Therefore, more timely and informative disclosure of a
cybersecurity incident is needed for investors to assess an incident's
impact and a registrant's ability to respond to the incident and to
make more informed decisions.
---------------------------------------------------------------------------

    \98\ See supra section II.B and note 46. See also infra note
146, Amir et al. (2018) (providing evidence that companies
underreport cyber-attacks).
    \99\ See supra section I.B.
    \100\ See supra note 95 (``Audit Analytics'').
    \101\ See infra note 133.
---------------------------------------------------------------------------

    Investors also need to better understand the growing cybersecurity
risks registrants are facing and their ability to manage such risks in
order to better value their securities. Executives, boards of
directors, and investors are focused on this emerging risk. A 2019
survey of CEOs, boards of directors, and institutional investors found
that they identified cybersecurity as the top global challenge for
CEOs.\102\ In 2021, a survey of audit committee members identified
cybersecurity as the second highest risk that their audit committee
would focus on in 2022, second only to financial reporting and internal
controls.\103\
---------------------------------------------------------------------------

    \102\ See supra note 15, EY CEO Imperative Study (2019). The
Ernst & Young survey consisted of interviewing 200 global CEOs
amongst the Forbes Global 2000 and Forbes largest private companies
as well as interviewing 100 senior investors from global firms that
had managed at least $100 billion in assets.
    \103\ See Center for Audit Quality, Audit Committee Practices
Report: Common Threads Across Audit Committees (Jan. 2022),
available at https://www.thecaq.org/2022-ac-practices-report/.
---------------------------------------------------------------------------

    Disclosures about cybersecurity risk management, strategy, and
governance are increasing, although they are not currently provided by
all registrants. An analysis of disclosures by Fortune 100 companies
found that disclosures of cybersecurity risk in proxy statements were
found in 89 percent of filings in 2020, up from 79 percent in 2018, and
disclosures of efforts to mitigate cybersecurity risk were found in 92
percent of proxy statements or 10-K Forms, up from 83 percent in
2018.\104\
---------------------------------------------------------------------------

    \104\ See Jamie Smith, How Cybersecurity Risk Disclosures and
Oversight are Evolving in 2021, EY Center for Board Matters (Oct. 5,
2021), available at https://www.ey.com/en_us/board-matters/cybersecurity-risk-disclosures-and-oversight.
---------------------------------------------------------------------------

    As with incident reporting, there is a lack of uniformity in
current reporting practice for cybersecurity risk management, strategy,
and governance disclosure.\105\ The relevant disclosures currently are
made in varying sections of a registrant's periodic and current
reports, such as in risk factors, in management's discussion and
analysis, in a description of business and legal proceedings, or in
financial statement disclosures, and are sometimes blended with other
unrelated disclosures. The varied disclosure about both cybersecurity
incidents and cybersecurity risk management, strategy, and governance
makes it difficult for investors and other market participants to
understand the cybersecurity risks that companies face and their
preparedness for an attack, and to make comparisons across registrants.
---------------------------------------------------------------------------

    \105\ See supra section I.
---------------------------------------------------------------------------

    To provide investors and other market participants with more
timely, informative, and consistent disclosure about cybersecurity
incidents, and cybersecurity risk management, strategy, and governance,
we are proposing the following amendments.\106\ Regarding incident
reporting, we propose to: (1) Amend Form 8-K to add Item 1.05 to
require registrants to disclose information about a cybersecurity
incident within four business days following the registrant's
determination that such an incident is material to the registrant; and