[Federal Register Volume 88, Number 149 (Friday, August 4, 2023)]
[Rules and Regulations]
[Pages 51896-51945]
[FR Doc No: 2023-16194]

Vol. 88

Friday,

No. 149

August 4, 2023

Part II

Securities and Exchange Commission

-----------------------------------------------------------------------

17 CFR Parts 229, 232, 239, et al.

Cybersecurity Risk Management, Strategy, Governance, and Incident
Disclosure; Final Rule

Federal Register / Vol. 88 , No. 149 / Friday, August 4, 2023 / Rules
and Regulations

-----------------------------------------------------------------------

SECURITIES AND EXCHANGE COMMISSION

17 CFR Parts 229, 232, 239, 240, and 249

[Release Nos. 33-11216; 34-97989; File No. S7-09-22]
RIN 3235-AM89

Cybersecurity Risk Management, Strategy, Governance, and Incident
Disclosure

AGENCY: Securities and Exchange Commission.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Securities and Exchange Commission (``Commission'') is
adopting new rules to enhance and standardize disclosures regarding
cybersecurity risk management, strategy, governance, and incidents by
public companies that are subject to the reporting requirements of the
Securities Exchange Act of 1934. Specifically, we are adopting
amendments to require current disclosure about material cybersecurity
incidents. We are also adopting rules requiring periodic disclosures
about a registrant's processes to assess, identify, and manage material
cybersecurity risks, management's role in assessing and managing
material cybersecurity risks, and the board of directors' oversight of
cybersecurity risks. Lastly, the final rules require the cybersecurity
disclosures to be presented in Inline eXtensible Business Reporting
Language (``Inline XBRL'').

DATES:
    Effective date: The amendments are effective September 5, 2023.
    Compliance dates: See Section II.I (Compliance Dates).

FOR FURTHER INFORMATION CONTACT: Nabeel Cheema, Special Counsel, at
(202) 551-3430, in the Office of Rulemaking, Division of Corporation
Finance; and, with respect to the application of the rules to business
development companies, David Joire, Senior Special Counsel, at (202)
551-6825 or [email protected], Chief Counsel's Office, Division of
Investment Management, U.S. Securities and Exchange Commission, 100 F
Street NE, Washington, DC 20549.

SUPPLEMENTARY INFORMATION: We are adopting amendments to:

----------------------------------------------------------------------------------------------------------------

----------------------------------------------------------------------------------------------------------------
Commission reference                                        CFR citation (17 CFR)
----------------------------------------------------------------------------------------------------------------
Regulation S-K.....................  .....................  Sec.  Sec.   229.10 through 229.1305.
                                     Items 106 and 601....  Sec.  Sec.   229.106 and 229.601.
Regulation S-T.....................  .....................  Sec.  Sec.   232.10 through 232.903.
                                     Rule 405.............  Sec.   232.405.
Securities Act of 1933               Form S-3.............  Sec.   239.13.
 (``Securities Act'') \1\.
Securities Exchange Act of 1934      Rule 13a-11..........  Sec.   240.13a-11.
 (``Exchange Act'') \2\.
                                     Rule 15d-11..........  Sec.   240.15d-11.
                                     Form 20-F............  Sec.   249.220f.
                                     Form 6-K.............  Sec.   249.306.
                                     Form 8-K.............  Sec.   249.308.
                                     Form 10-K............  Sec.   249.310.
----------------------------------------------------------------------------------------------------------------

Table of Contents
---------------------------------------------------------------------------

    \1\ 15 U.S.C. 77a et seq.
    \2\ 15 U.S.C. 78a et seq.
---------------------------------------------------------------------------

I. Introduction and Background
II. Discussion of Final Amendments
    A. Disclosure of Cybersecurity Incidents on Current Reports
    1. Proposed Amendments
    2. Comments
    3. Final Amendments
    B. Disclosures About Cybersecurity Incidents in Periodic Reports
    1. Proposed Amendments
    2. Comments
    3. Final Amendments
    C. Disclosure of a Registrant's Risk Management, Strategy and
Governance Regarding Cybersecurity Risks
    1. Risk Management and Strategy
    a. Proposed Amendments
    b. Comments
    c. Final Amendments
    2. Governance
    a. Proposed Amendments
    b. Comments
    c. Final Amendments
    3. Definitions
    a. Proposed Definitions
    b. Comments
    c. Final Definitions
    D. Disclosure Regarding the Board of Directors' Cybersecurity
Expertise
    1. Proposed Amendments
    2. Comments
    3. Final Amendments
    E. Disclosure by Foreign Private Issuers
    1. Proposed Amendments
    2. Comments
    3. Final Amendments
    F. Structured Data Requirements
    1. Proposed Amendments
    2. Comments
    3. Final Amendments
    G. Applicability to Certain Issuers
    1. Asset-Backed Issuers
    2. Smaller Reporting Companies
    H. Need for New Rules and Commission Authority
    I. Compliance Dates
III. Other Matters
IV. Economic Analysis
    A. Introduction
    B. Economic Baseline
    1. Current Regulatory Framework
    2. Affected Parties
    C. Benefits and Costs of the Final Rules
    1. Benefits
    a. More Timely and Informative Disclosure
    b. Greater Uniformity and Comparability
    2. Costs
    3. Indirect Economic Effects
    D. Effects on Efficiency, Competition, and Capital Formation
    E. Reasonable Alternatives
    1. Website Disclosure
    2. Disclosure Through Periodic Reports
    3. Exempt Smaller Reporting Companies
V. Paperwork Reduction Act
    A. Summary of the Collections of Information
    B. Summary of Comment Letters and Revisions to PRA Estimates
    C. Effects of the Amendments on the Collections of Information
    D. Incremental and Aggregate Burden and Cost Estimates for the
Final Amendments
VI. Final Regulatory Flexibility Analysis
    A. Need for, and Objectives of, the Final Amendments
    B. Significant Issues Raised by Public Comments
    1. Estimate of Affected Small Entities and Impact to Those
Entities
    2. Consideration of Alternatives
    C. Small Entities Subject to the Final Amendments
    D. Projected Reporting, Recordkeeping, and other Compliance
Requirements
    E. Agency Action To Minimize Effect on Small Entities
    Statutory Authority

I. Introduction and Background

    On March 9, 2022, the Commission proposed new rules, and rule and
form amendments, to enhance and standardize disclosures regarding
cybersecurity risk management, strategy, governance, and cybersecurity
incidents by public companies that are subject to the reporting
requirements of the

Exchange Act.\3\ The proposal followed on interpretive guidance on the
application of existing disclosure requirements to cybersecurity risk
and incidents that the Commission and staff had issued in prior years.
---------------------------------------------------------------------------

    \3\ See Cybersecurity Risk Management, Strategy, Governance, and
Incident Disclosure, Release No. 33-11038 (Mar. 9, 2022) [87 FR
16590 (Mar. 23, 2022)] (``Proposing Release'').
---------------------------------------------------------------------------

    In particular, in 2011, the Division of Corporation Finance issued
interpretive guidance providing the Division's views concerning
operating companies' disclosure obligations relating to cybersecurity
(``2011 Staff Guidance'').\4\ In that guidance, the staff observed that
``[a]lthough no existing disclosure requirement explicitly refers to
cybersecurity risks and cyber incidents, a number of disclosure
requirements may impose an obligation on registrants to disclose such
risks and incidents,'' and further that ``material information
regarding cybersecurity risks and cyber incidents is required to be
disclosed when necessary in order to make other required disclosures,
in light of the circumstances under which they are made, not
misleading.'' \5\ The guidance pointed specifically to disclosure
obligations under 17 CFR 229.503 (Regulation S-K ``Item 503(c)'') (Risk
factors) (since moved to 17 CFR 229.105 (Regulation S-K ``Item 105'')),
17 CFR 229.303 (Regulation S-K ``Item 303'') (Management's discussion
and analysis of financial condition and results of operations), 17 CFR
229.101 (Regulation S-K ``Item 101'') (Description of business), 17 CFR
229.103 (Regulation S-K ``Item 103'') (Legal proceedings), and 17 CFR
229.307 (Disclosure controls and procedures), as well as to Accounting
Standards Codifications 350-40 (Internal-Use Software), 605-50
(Customer Payments and Incentives), 450-20 (Loss Contingencies), 275-10
(Risks and Uncertainties), and 855-10 (Subsequent Events).\6\
---------------------------------------------------------------------------

    \4\ See CF Disclosure Guidance: Topic No. 2--Cybersecurity (Oct.
13, 2011), available at https://www.sec.gov/divisions/corpfin/guidance/cfguidance-topic2.htm.
    \5\ Id.
    \6\ Id.
---------------------------------------------------------------------------

    In 2018, ``[i]n light of the increasing significance of
cybersecurity incidents,'' the Commission issued interpretive guidance
to reinforce and expand upon the 2011 Staff Guidance and also address
the importance of cybersecurity policies and procedures, as well as the
application of insider trading prohibitions in the context of
cybersecurity (``2018 Interpretive Release'').\7\ In addition to
discussing the provisions previously covered in the 2011 Staff
Guidance, the new guidance addressed 17 CFR 229.407 (Regulation S-K
``Item 407'') (Corporate Governance), 17 CFR part 210 (``Regulation S-
X''), and 17 CFR part 243 (``Regulation FD'').\8\ The 2018 Interpretive
Release noted that companies can provide current reports on Form 8-K
and Form 6-K to maintain the accuracy and completeness of effective
shelf registration statements, and it also advised companies to
consider whether it may be appropriate to implement restrictions on
insider trading during the period following an incident and prior to
disclosure.\9\
---------------------------------------------------------------------------

    \7\ See Commission Statement and Guidance on Public Company
Cybersecurity Disclosures, Release No. 33-10459 (Feb. 21, 2018) [83
FR 8166 (Feb. 26, 2018)], at 8167.
    \8\ Id.
    \9\ Id.
---------------------------------------------------------------------------

    As noted in the Proposing Release, current disclosure practices are
varied. For example, while some registrants do report material
cybersecurity incidents, most typically on Form 10-K, review of Form 8-
K, Form 10-K, and Form 20-F filings by staff in the Division of
Corporation Finance has shown that companies provide different levels
of specificity regarding the cause, scope, impact, and materiality of
cybersecurity incidents. Likewise, staff has also observed that, while
the majority of registrants that are disclosing cybersecurity risks
appear to be providing such disclosures in the risk factor section of
their annual reports on Form 10-K, the disclosures are sometimes
included with other unrelated disclosures, which makes it more
difficult for investors to locate, interpret, and analyze the
information provided.\10\
---------------------------------------------------------------------------

    \10\ See infra Section IV.A (noting that current cybersecurity
disclosures appear in varying sections of companies' periodic and
current reports and are sometimes included with other unrelated
disclosures).
---------------------------------------------------------------------------

    In the Proposing Release, the Commission explained that a number of
trends underpinned investors' and other capital markets participants'
need for more timely and reliable information related to registrants'
cybersecurity than was produced following the 2011 Staff Guidance and
the 2018 Interpretive Release. First, an ever-increasing share of
economic activity is dependent on electronic systems, such that
disruptions to those systems can have significant effects on
registrants and, in the case of large-scale attacks, systemic effects
on the economy as a whole.\11\ Second, there has been a substantial
rise in the prevalence of cybersecurity incidents, propelled by several
factors: the increase in remote work spurred by the COVID-19 pandemic;
the increasing reliance on third-party service providers for
information technology services; and the rapid monetization of
cyberattacks facilitated by ransomware, black markets for stolen data,
and crypto-asset technology.\12\ Third, the costs and adverse
consequences of cybersecurity incidents to companies are increasing;
such costs include business interruption, lost revenue, ransom
payments, remediation costs, liabilities to affected parties,
cybersecurity protection costs, lost assets, litigation risks, and
reputational damage.\13\
---------------------------------------------------------------------------

    \11\ Proposing Release at 16591-16592. See also U.S. Financial
Stability Oversight Council, Annual Report (2021), at 168, available
at https://home.treasury.gov/system/files/261/FSOC2021AnnualReport.pdf (finding that ``a destabilizing
cybersecurity incident could potentially threaten the stability of
the U.S. financial system'').
    \12\ Proposing Release at 16591-16592.
    \13\ Id.
---------------------------------------------------------------------------

    Since publication of the Proposing Release, these trends have
continued apace, with significant cybersecurity incidents occurring
across companies and industries. For example, threat actors repeatedly
and successfully executed attacks on high-profile companies across
multiple critical industries over the course of 2022 and the first
quarter of 2023, causing the Department of Homeland Security's Cyber
Safety Review Board to initiate multiple reviews.\14\ Likewise, state
actors have perpetrated multiple high-profile attacks, and recent
geopolitical instability has elevated such threats.\15\ A recent study
by two cybersecurity firms found that 98 percent of organizations use
at least one third-party vendor that

has experienced a breach in the last two years.\16\ In addition, recent
developments in artificial intelligence may exacerbate cybersecurity
threats, as researchers have shown that artificial intelligence systems
can be leveraged to create code used in cyberattacks, including by
actors not versed in programming.\17\ Overall, evidence suggests
companies may be underreporting cybersecurity incidents.\18\
---------------------------------------------------------------------------

    \14\ See Department of Homeland Security, Cyber Safety Review
Board to Conduct Second Review on Lapsus$ (Dec. 2, 2022), available
at https://www.dhs.gov/news/2022/12/02/cyber-safety-review-board-conduct-second-review-lapsus; see also Tim Starks, The Latest Mass
Ransomware Attack Has Been Unfolding For Nearly Two Months, Wash.
Post (Mar. 27, 2023), available at https://www.washingtonpost.com/politics/2023/03/27/latest-mass-ransomware-attack-has-been-unfolding-nearly-two-months/.
    \15\ See, e.g., Press Release, Federal Bureau of Investigation,
FBI Confirms Lazarus Group Cyber Actors Responsible for Harmony's
Horizon Bridge Currency Theft (Jan. 23, 2023), available at https://www.fbi.gov/news/press-releases/fbi-confirms-lazarus-group-cyber-actors-responsible-for-harmonys-horizon-bridge-currency-theft; Alert
(AA22-257A), Cybersecurity & Infrastructure Security Agency, Iranian
Islamic Revolutionary Guard Corps-Affiliated Cyber Actors Exploiting
Vulnerabilities for Data Extortion and Disk Encryption for Ransom
Operations (Sep. 14, 2022), available at https://www.cisa.gov/uscert/ncas/alerts/aa22-257a; National Security Agency et al., Joint
Cybersecurity Advisory: Russian State-Sponsored and Criminal Cyber
Threats to Critical Infrastructure (Apr. 20, 2022), available at
https://media.defense.gov/2022/Apr/20/2002980529/-1/-1/1/joint_csa_russian_state-sponsored_and_criminal_cyber_threats_to_critical_infrastructure_20220420.pdf.
    \16\ SecurityScorecard, Cyentia Institute and SecurityScorecard
Research Report: Close Encounters of the Third (and Fourth) Party
Kind (Feb 1, 2023), available at https://securityscorecard.com/research/cyentia-close-encounters-of-the-third-and-fourth-party-kind/.
    \17\ Check Point Research, OPWNAI: AI that Can Save the Day or
Hack it Away (Dec. 19, 2022), available at https://research.checkpoint.com/2022/opwnai-ai-that-can-save-the-day-or-hack-it-away.
    \18\ Bitdefender, Whitepaper: Bitdefender 2023 Cybersecurity
Assessment (Apr. 2023), available at https://businessresources.bitdefender.com/bitdefender-2023-cybersecurity-assessment.
---------------------------------------------------------------------------

    Legislatively, we note two significant developments occurred
following publication of the Proposing Release. First, the President
signed into law the Cyber Incident Reporting for Critical
Infrastructure Act of 2022 (``CIRCIA'') \19\ on March 15, 2022, as part
of the Consolidated Appropriations Act of 2022.\20\ The centerpiece of
CIRCIA is the reporting obligation placed on companies in defined
critical infrastructure sectors.\21\ Once rules are adopted by the
Cybersecurity & Infrastructure Security Agency (``CISA''), these
companies will be required to report covered cyber incidents to CISA
within 72 hours of discovery, and report ransom payments within 24
hours.\22\ Importantly, reports made to CISA pursuant to CIRCIA will
remain confidential; while the information contained therein may be
shared across Federal agencies for cybersecurity, investigatory, and
law enforcement purposes, the information may not be disclosed
publicly, except in anonymized form.\23\ We note that CIRCIA also
mandated the creation of a ``Cyber Incident Reporting Council . . . to
coordinate, deconflict, and harmonize Federal incident reporting
requirements'' (the ``CIRC''), of which the Commission is a member.\24\
Second, on December 21, 2022, the President signed into law the Quantum
Computing Cybersecurity Preparedness Act, which directs the Federal
Government to adopt technology that is protected from decryption by
quantum computing, a developing technology that may increase computer
processing capacity considerably and thereby render existing computer
encryption vulnerable to decryption.\25\
---------------------------------------------------------------------------

    \19\ Cyber Incident Reporting for Critical Infrastructure Act of
2022, Public Law 117-103, 136 Stat. 1038 (2022).
    \20\ Consolidated Appropriations Act of 2022, H.R. 2471, 117th
Cong. (2022).
    \21\ The sectors are defined in Presidential Policy Directive/
PPD-21, Critical Infrastructure Security and Resilience (Feb. 12,
2013), as: Chemical; Commercial Facilities; Communications; Critical
Manufacturing; Dams; Defense Industrial Base; Emergency Services;
Energy; Financial Services; Food and Agriculture; Government
Facilities; Healthcare and Public Health; Information Technology;
Nuclear Reactors, Materials, and Waste; Transportation Systems;
Water and Wastewater Systems. Because these sectors encompass some
private companies and do not encompass all public companies,
CIRCIA's reach is both broader and narrower than the set of
companies subject to the rules we are adopting.
    \22\ 6 U.S.C. 681b(a)(1).
    \23\ 6 U.S.C. 681e. See infra Section II.A.3 for a discussion of
why our final rules serve a different purpose and are not at odds
with the goals of CIRCIA.
    \24\ 6 U.S.C. 681f.
    \25\ Quantum Computing Cybersecurity Preparedness Act, H.R.
7535, 117th Cong. (2022). More recently, the White House released a
National Cybersecurity Strategy to combat the ongoing risks
associated with cyberattacks. The National Cybersecurity Strategy
seeks to rebalance the responsibility for defending against cyber
threats toward companies instead of the general public, and looks to
realign incentives to favor long-term investments in cybersecurity.
See Press Release, White House, FACT SHEET: Biden-Harris
Administration Announces National Cybersecurity Strategy (Mar. 2,
2023), available at https://www.whitehouse.gov/briefing-room/statements-releases/2023/03/02/fact-sheet-biden-harris-administration-announces-national-cybersecurity-strategy/.
---------------------------------------------------------------------------

    We received over 150 comment letters in response to the Proposing
Release.\26\ The majority of comments focused on the proposed incident
disclosure requirement, although we also received substantial comment
on the proposed risk management, strategy, governance, and board
expertise requirements. In addition, the Commission's Investor Advisory
Committee adopted recommendations (``IAC Recommendation'') with respect
to the proposal, stating that it: supports the proposed incident
disclosure requirement; supports the proposed risk management,
strategy, and governance disclosure requirements; recommends the
Commission reconsider the proposed board of directors' cybersecurity
expertise disclosure requirement; suggests requiring companies to
disclose the key factors they used to determine the materiality of a
reported cybersecurity incident; and suggests extending the proposed 17
CFR 229.106 (Regulation S-K ``Item 106'') disclosure requirements to
registration statements.\27\
---------------------------------------------------------------------------

    \26\ The public comments we received are available at https://www.sec.gov/comments/s7-09-22/s70922.htm. On Mar. 9, 2022, the
Commission published the Proposing Release on its website. The
comment period for the Proposing Release was open for 60 days from
issuance and publication on SEC.gov and ended on May 9, 2022. One
commenter asserted that the comment period was not sufficient and
asked the Commission to extend it by 30 days. See letter from
American Chemistry Council (``ACC''). In Oct. 2022, the Commission
reopened the comment period for the Proposing Release and other
rulemakings because certain comments on the Proposing Release and
other rulemakings were potentially affected by a technological error
in the Commission's internet comment form. See Resubmission of
Comments and Reopening of Comment Periods for Several Rulemaking
Releases Due to a Technological Error in Receiving Certain Comments,
Release No. 33-11117 (Oct. 7, 2022) [87 FR 63016 (Oct. 18, 2022)]
(``Reopening Release''). The Reopening Release was published on the
Commission's website on Oct. 7, 2022 and in the Federal Register on
Oct. 18, 2022, and the comment period ended on Nov. 1, 2022. A few
commenters asserted that the comment period for the reopened
rulemakings was not sufficient and asked the Commission to extend
the comment period for those rulemakings. See, e.g., letters from
Attorneys General of the states of Montana et al. (Oct. 24, 2022)
and U.S. Chamber of Commerce (Nov. 1, 2022). We have considered all
comments received since Mar. 9, 2022 and do not believe an
additional extension of the comment period is necessary.
    \27\ See U.S. Securities and Exchange Commission Investor
Advisory Committee, Recommendation of the Investor as Owner
Subcommittee and Disclosure Subcommittee of the SEC Investor
Advisory Committee Regarding Cybersecurity Risk Management,
Strategy, Governance, and Incident Disclosure (Sept. 21, 2022),
available at https://www.sec.gov/spotlight/investor-advisory-committee-2012/20220921-cybersecurity-disclosure-recommendation.pdf.
The Investor Advisory Committee also held a panel discussion on
cybersecurity at its Mar. 10, 2022 meeting. See U.S. Securities and
Exchange Commission Investor Advisory Committee, Meeting Agenda
(Mar. 10, 2022), available at https://www.sec.gov/spotlight/investor-advisory-committee/iac031022-agenda.htm.
---------------------------------------------------------------------------

    We are making a number of important changes from the Proposing
Release in response to comments received. With respect to incident
disclosure, we are narrowing the scope of disclosure, adding a limited
delay for disclosures that would pose a substantial risk to national
security or public safety, requiring certain updated incident
disclosure on an amended Form 8-K instead of Forms 10-Q and 10-K for
domestic registrants, and on Form 6-K instead of Form 20-F for foreign
private issuers (``FPIs''),\28\ and omitting the proposed aggregation
of immaterial incidents for materiality analyses. We are streamlining
the proposed disclosure elements related to risk management, strategy,
and governance, and we are not adopting the proposed requirement to
disclose board cybersecurity expertise. The following

table summarizes the requirements we are adopting, including changes
from the Proposing Release, as described more fully in Section II
below: \29\
---------------------------------------------------------------------------

    \28\ An FPI is any foreign issuer other than a foreign
government, except for an issuer that (1) has more than 50 percent
of its outstanding voting securities held of record by U.S.
residents; and (2) any of the following: (i) a majority of its
executive officers or directors are citizens or residents of the
United States; (ii) more than 50 percent of its assets are located
in the United States; or (iii) its business is principally
administered in the United States. 17 CFR 230.405. See also 17 CFR
240.3b-4(c).
    \29\ The information in this table is not comprehensive and is
intended only to highlight some of the more significant aspects of
the final amendments. It does not reflect all of the amendments or
all of the rules and forms that are affected by the final
amendments, which are discussed in detail below. As such, this table
should be read together with the entire release, including the
regulatory text.

------------------------------------------------------------------------
                                 Summary description of the disclosure
             Item                           requirement \30\
------------------------------------------------------------------------
Regulation S-K Item 106(b)--   Registrants must describe their
 Risk management and strategy.  processes, if any, for the assessment,
                                identification, and management of
                                material risks from cybersecurity
                                threats, and describe whether any risks
                                from cybersecurity threats have
                                materially affected or are reasonably
                                likely to materially affect their
                                business strategy, results of
                                operations, or financial condition.
Regulation S-K Item 106(c)--   Registrants must:
 Governance.                   --Describe the board's oversight of risks
                                from cybersecurity threats.
                               --Describe management's role in assessing
                                and managing material risks from
                                cybersecurity threats.
Form 8-K Item 1.05--Material   Registrants must disclose any
 Cybersecurity Incidents.       cybersecurity incident they experience
                                that is determined to be material, and
                                describe the material aspects of its:
                               --Nature, scope, and timing; and
                               --Impact or reasonably likely impact.
                               An Item 1.05 Form 8-K must be filed
                                within four business days of determining
                                an incident was material. A registrant
                                may delay filing as described below, if
                                the United States Attorney General
                                (``Attorney General'') determines
                                immediate disclosure would pose a
                                substantial risk to national security or
                                public safety.
                               Registrants must amend a prior Item 1.05
                                Form 8-K to disclose any information
                                called for in Item 1.05(a) that was not
                                determined or was unavailable at the
                                time of the initial Form 8-K filing.
Form 20-F....................  FPIs must:
                               --Describe the board's oversight of risks
                                from cybersecurity threats.
                               --Describe management's role in assessing
                                and managing material risks from
                                cybersecurity threats.
Form 6-K.....................  FPIs must furnish on Form 6-K information
                                on material cybersecurity incidents that
                                they disclose or otherwise publicize in
                                a foreign jurisdiction, to any stock
                                exchange, or to security holders.
------------------------------------------------------------------------

    Overall, we remain persuaded that, as detailed in the Proposing
Release: under-disclosure regarding cybersecurity persists despite the
Commission's prior guidance; investors need more timely and consistent
cybersecurity disclosure to make informed investment decisions; and
recent legislative and regulatory developments elsewhere in the Federal
Government, including those developments subsequent to the issuance of
the Proposing Release such as CIRCIA \31\ and the Quantum Computing
Cybersecurity Preparedness Act,32 while serving related purposes, will
not effectuate the level of public cybersecurity disclosure needed by
investors in public companies.
---------------------------------------------------------------------------

    \30\ For purposes of this release, the terms ``public
companies,'' ``companies,'' and ``registrants'' include issuers that
are business development companies as defined in section 2(a)(48) of
the Investment Company Act of 1940, which are a type of closed-end
investment company that is not registered under the Investment
Company Act, but do not include investment companies registered
under that Act.
    \31\ Supra note 19.
---------------------------------------------------------------------------

II. Discussion of Final Amendments

A. Disclosure of Cybersecurity Incidents on Current Reports

1. Proposed Amendments
    The Commission proposed to amend Form 8-K by adding new Item 1.05
that would require a registrant to disclose the following information
regarding a material cybersecurity incident, to the extent known at the
time of filing:
     When the incident was discovered and whether it is
ongoing;
     A brief description of the nature and scope of the
incident;
     Whether any data were stolen, altered, accessed, or used
for any other unauthorized purpose;
     The effect of the incident on the registrant's operations;
and
     Whether the registrant has remediated or is currently
remediating the incident.\33\
---------------------------------------------------------------------------

    \33\ Proposing Release at 16595.
---------------------------------------------------------------------------

    The Commission clarified in the Proposing Release that this
requirement would not extend to specific, technical information about
the registrant's planned response to the incident or its cybersecurity
systems, related networks and devices, or potential system
vulnerabilities in such detail as would impede the registrant's
response or remediation of the incident.\34\
---------------------------------------------------------------------------

    \34\ Id.
---------------------------------------------------------------------------

    The Commission proposed to set the filing trigger for Item 1.05 as
the date the registrant determines that a cybersecurity incident is
material; as with all other Form 8-K items, the proposed filing
deadline would be four business days after the trigger.\35\ To protect
against any inclination on the part of a registrant to delay making a
materiality determination with a view toward prolonging the filing
deadline, the Commission proposed adding Instruction 1 to Item 1.05
requiring that ``a registrant shall make a materiality determination
regarding a cybersecurity incident as soon as reasonably practicable
after discovery of the incident.'' \36\
---------------------------------------------------------------------------

    \35\ Id.
    \36\ Id. at 16596.
---------------------------------------------------------------------------

    The Commission affirmed in the Proposing Release that the
materiality standard registrants should apply in evaluating whether a
Form 8-K would be triggered under proposed Item 1.05 would be
consistent with that set out in the numerous cases addressing
materiality in the securities laws, including TSC Industries, Inc. v.
Northway, Inc.,\37\ Basic, Inc. v. Levinson,\38\ and Matrixx
Initiatives, Inc. v. Siracusano,\39\ and likewise with that set forth
in 17 CFR 230.405 (``Securities

Act Rule 405'') and 17 CFR 240.12b-2 (``Exchange Act Rule 12b-2'').
That is, information is material if ``there is a substantial likelihood
that a reasonable shareholder would consider it important'' \40\ in
making an investment decision, or if it would have ``significantly
altered the `total mix' of information made available.'' \41\ ``Doubts
as to the critical nature'' of the relevant information should be
``resolved in favor of those the statute is designed to protect,''
namely investors.\42\
---------------------------------------------------------------------------

    \37\ TSC Indus. v. Northway, 426 U.S. 438, 449 (1976).
    \38\ Basic Inc. v. Levinson, 485 U.S. 224, 232 (1988).
    \39\ Matrixx Initiatives v. Siracusano, 563 U.S. 27 (2011).
    \40\ TSC Indus., 426 U.S. at 449.
    \41\ Id.
    \42\ Id. at 448.
---------------------------------------------------------------------------

    The Commission explained that the timely disclosure of the
information required by proposed Item 1.05 would enable investors and
other market participants to assess the possible effects of a material
cybersecurity incident on the registrant, including any short- and
long-term financial effects or operational effects, resulting in
information useful for their investment decisions.\43\ Aligning the
deadline for Item 1.05 with that of the other Form 8-K items would, the
Commission maintained, significantly improve the timeliness of
cybersecurity incident disclosures as well as standardize those
disclosures.\44\ The Commission did not propose to provide a reporting
delay in cases of ongoing internal or external investigations of
cybersecurity incidents.\45\ Nevertheless, the Proposing Release
requested comment on whether to allow a delay in reporting where the
Attorney General determines that a delay is in the interest of national
security.\46\
---------------------------------------------------------------------------

    \43\ Proposing Release at 16595.
    \44\ Id.
    \45\ Id. at 16596.
    \46\ Id. at 16598.
---------------------------------------------------------------------------

2. Comments
    Proposed Item 1.05 received a significant amount of feedback from
commenters. Some commenters supported Item 1.05 as proposed,\47\ saying
that the current level of disclosure on cybersecurity incidents is
inadequate to meet investor needs, and Item 1.05 would remedy this
inadequacy by effectuating the disclosure of decision-useful
information.\48\ One commenter also anticipated that Item 1.05 would
reduce the risk of insider trading by shortening the time between
discovery of an incident and public disclosure.\49\
---------------------------------------------------------------------------

    \47\ See letters from American Institute of CPAs (``AICPA'');
Better Markets (``Better Markets''); BitSight Technologies, Inc.
(``BitSight''); California Public Employees' Retirement System
(``CalPERS''); Crindata, LLC (``Crindata''); Council of
Institutional Investors (``CII''); Information Technology and
Innovation Foundation (``ITIF''); North American Securities
Administrators Association Inc. (``NASAA''); Professor Jerry Perullo
(``Prof. Perullo''); Professor Preeti Choudhary (``Prof.
Choudhary''); Tessa Mishoe (``T. Mishoe''). See also IAC
Recommendation.
    \48\ Id.
    \49\ See letter from Better Markets.
---------------------------------------------------------------------------

    Other commenters opposed proposed Item 1.05, for several reasons.
Some commenters said that if proposed Item 1.05 were to result in
disclosure while an incident is still ongoing, it would tip off the
threat actor and thus make successful neutralization of the incident
more difficult.\50\ Commenters also expressed concern that public
notice of a vulnerability could draw attacks from other threat actors
who were previously unaware of the vulnerability; and such attacks
could target the disclosing registrant or other companies with the same
vulnerability, particularly if the vulnerability is with a third-party
service provider used by multiple companies.\51\ Some of these
commenters objected specifically to the requirement in Item 1.05 to
disclose whether remediation has occurred, stating that this
information could assist threat actors in their targeting or invite
further targeted attacks,\52\ while others more generally stated that
the Item 1.05 disclosure would be overly detailed, such that it would
give a road map to threat actors for planning attacks.\53\ One
commenter argued that the prospect of possibly having to file an Item
1.05 Form 8-K could chill threat information sharing within industries,
because companies would fear that any cybersecurity risk information
they share could later be used to question their disclosure
decisions.\54\
---------------------------------------------------------------------------

    \50\ See letters from ACC; American Gas Association and
Interstate Natural Gas Association of America (``AGA/INGAA'');
BioTechnology Innovation Organization (``BIO''); Bank Policy
Institute, American Bankers Association, and Mid-Size Bank Coalition
of America (``BPI et al.''); BSA/The Software Alliance (``BSA'');
Business Roundtable (``Business Roundtable''); Canadian Bankers
Association (``CBA''); Edison Electric Institute (``EEI''); Energy
Infrastructure Council (``EIC''); Federation of American Hospitals
(``FAH''); Financial Services Sector Coordinating Council
(``FSSCC''); Information Technology Industry Council (``ITI''); LTSE
Services, Inc. (``LTSE''); National Association of Manufacturers
(``NAM''); National Defense Industrial Association (``NDIA''); Quest
Diagnostics Incorporated (``Quest''); Rapid7, Inc. (``Rapid7'');
Society for Corporate Governance (``SCG''); Securities Industry and
Financial Markets Association (``SIFMA''); TransUnion; R Street
Institute (``R Street''); U.S. Chamber of Commerce (``Chamber'').
    \51\ See letters from ABA Committee on Federal Regulation of
Securities (``ABA''); Aerospace Industries Association of America
(``AIA''); Alliance for Automotive Innovation (``Auto Innovators'');
AGA/INGAA; American Property Casualty Insurance Association
(``APCIA''); BPI et al.; BSA; Business Roundtable; CBA; Chamber;
Cellular Telecommunications and internet Assoc. (``CTIA'');
Cybersecurity Coalition; EEI; EIC; Empire State Realty Trust, Inc.
(``Empire''); Enbridge Inc. (``Enbridge''); FSSCC; internet Security
Alliance; ITI; Microsoft Corporation (``Microsoft''); NDIA; PPG
Industries, Inc. (``PPG''); PricewaterhouseCoopers LLP (``PWC'');
Rapid7; R Street; SCG; SIFMA; U.S. Senator Rob Portman (``Sen.
Portman''); Virtu Financial (``Virtu'').
    \52\ See letters from ABA; AGA/INGAA; BPI et al.; Cybersecurity
Coalition; Empire; Enbridge; PWC; SIFMA; SCG; Virtu.
    \53\ See letters from AGA/INGAA; BSA; EIC; ITI; PPG.
    \54\ See letter from Consumer Technology Association (``CTA'').
---------------------------------------------------------------------------

    Some of the commenters that disagreed with the level of disclosure
required by proposed Item 1.05 recommended that the Commission narrow
the disclosure requirements of the rule. For example, one such
commenter advised dropping the proposed requirement to disclose ``when
the incident was discovered,'' arguing that this detail may cause
confusion, particularly where an incident was detected some time ago
but a significant aspect rendering it material surfaced only
recently.\55\ Another commenter opined that ``whether the registrant
has remediated or is currently remediating the incident'' is
duplicative of ``whether it is ongoing,'' so either of the two could be
eliminated.\56\ One commenter contended that a materiality filter
should be added to the details required by Item 1.05, such that
companies would have to disclose only details that themselves are
material, rather than immaterial details of a material incident.\57\
---------------------------------------------------------------------------

    \55\ See letter from Prof. Perullo.
    \56\ See letter from ABA.
    \57\ See letter from ITI.
---------------------------------------------------------------------------

    By contrast, there were also commenters that recommended expanding
the disclosure requirements in the proposed rule. In this regard, some
commenters recommended requiring that registrants disclose asset
losses, intellectual property losses, and the value of business lost
due to the incident.\58\ Other suggestions included requiring that
incidents be quantified as to their severity and impact via
standardized rating systems, and that registrants disclose how they
became aware of the incident, as this may shed light on the
effectiveness of a company's cybersecurity policies and procedures.\59\
Additionally, commenters suggested banning trading by insiders during
the time between the materiality determination and disclosure of the
incident.\60\
---------------------------------------------------------------------------

    \58\ See letters from Profs. Rajgopal & Sharpe; PWC.
    \59\ See letters from BitSight; Cloud Security Alliance
(``CSA'').
    \60\ See letter from Prof. Mitts.
---------------------------------------------------------------------------

    Commenters provided reactions to the application of Item 1.05 to
incidents

connected with third-party systems. A number of commenters contended
that registrants should be exempt from having to disclose cybersecurity
incidents in third-party systems they use because of their reduced
control over such systems.\61\ Similarly, several commenters advocated
for a safe harbor for information disclosed about third-party systems,
given registrants' reduced visibility into such systems.\62\ A few
commenters suggested a longer reporting timeframe for third-party
incidents, because the registrant may be dependent on the third party
for information (which may not be provided in a timely manner), and to
avoid harm to other companies reliant on the same third party.\63\
Commenters also recommended that Item 1.05 be phased in over a longer
period of time with respect to third-party incidents, to give
registrants time to develop information sharing processes with their
third-party service providers.\64\
---------------------------------------------------------------------------

    \61\ See letters from ABA; AIA; APCIA; Business Roundtable;
Cybersecurity Coalition; Chamber; EIC; FAH; ISA; ITI; NAM; NDIA;
National Multifamily Housing Council and National Apartment
Association (``NMHC''); Paylocity; SIFMA.
    \62\ See letters from Chevron Corporation (``Chevron''); APCIA;
BPI et al.; BIO; CSA; Financial Executive International's Committee
on Corporate Reporting (``FEI''); ITI; ISA; NMHC; SIFMA.
    \63\ See letters from ABA; R Street.
    \64\ See letters from Business Roundtable; Deloitte & Touche LLP
(``Deloitte'').
---------------------------------------------------------------------------

    Commenters also requested guidance or otherwise raised concerns
where the proposed requirements might trigger disclosures by third-
party service providers. A commenter requested clarity on whether an
incident should be disclosed by the third-party service provider
registrant that owns the affected system or the customer registrant
that owns the affected information, or both.\65\ And two commenters
argued that third-party service providers should simply pass along
information to their end customers, who would then make their own
materiality determination and disclose accordingly; this should
particularly be the case, a commenter said, where an attack on a third-
party data center results in a data breach for an end customer but does
not affect the services the data center provides.\66\
---------------------------------------------------------------------------

    \65\ See letter from Business Roundtable.
    \66\ See letters from BSA; ITI.
---------------------------------------------------------------------------

    The proposed timing of incident disclosure also received a
significant level of public comment. For example, a few commenters said
the level of detail required by Item 1.05 is impractical to produce in
the allotted time.\67\ Other commenters said that the proposed deadline
would lead to the disclosure of tentative, unclear, or potentially
inaccurate information that is not decision-useful to investors,\68\
resulting in the market mispricing the underlying securities.\69\
Commenters also argued that Item 1.05 is qualitatively different from
all other Form 8-K items in that the trigger for Item 1.05 is largely
outside the company's control.\70\ Some commenters worried the proposed
deadline would lead to disclosure of ``false positives,'' that is,
incidents that appear material at first but later on with the emergence
of more information turn out not to be material.\71\
---------------------------------------------------------------------------

    \67\ See letters from ABA; NMHC; Quest.
    \68\ See letters from ABA; ACC; AIA; Auto Innovators; American
Investment Council (``AIC''); BIO; Business Roundtable; CBA;
Chamber; Confidentiality Coalition; CTIA; Davis Polk & Wardwell LLP
(``Davis Polk''); Debevoise & Plimpton (``Debevoise''); Federated
Hermes; FSSCC; Microsoft; NAM; Nasdaq Stock Market, LLC
(``Nasdaq''); NDIA; Quest; SCG; TransUnion; Wilson Sonsini Goodrich
& Rosati (``Wilson Sonsini''); Virtu.
    \69\ See letters from ABA; ACC; AIA; AIC; BIO; BPI et al.;
Business Roundtable; Confidentiality Coalition; Davis Polk; ISA;
Nasdaq; PPG; Quest; Rapid7; SCG; Sen. Portman; SIFMA; Virtu.
    \70\ See letters from CTIA; Debevoise; EIC; LTSE; New York City
Bar Association (``NYC Bar''); Quest.
    \71\ See letters from LTSE; PPG; SCG.
---------------------------------------------------------------------------

    Commenters suggested a range of alternative reporting deadlines for
Item 1.05. A common suggestion was to modify the measurement date from
the determination of materiality to another point in the lifecycle of
the incident when the incident is no longer a threat to the
registrant--commenters variously termed this as ``containment,''
``remediation,'' ``mitigation,'' and comparable terms.\72\ One
commenter recommended conditioning a reporting delay on the registrant
being actively engaged in containing the incident and reasonably
believing that containment can be completed in a timely manner.\73\
Similarly, several commenters recommended that the rule allow for a
delay in providing Item 1.05 disclosure based on a registrant's
assessment of the potential negative consequences of public disclosure,
using a variety of measures they suggested.\74\ Another suggestion was
to replace the proposed deadline with an instruction to disclose
material incidents ``without unreasonable delay.'' \75\
---------------------------------------------------------------------------

    \72\ See letters from American Council of Life Insurers
(``ACLI''); BCE Inc., Rogers Communications Inc., TELUS Corporation
(``BCE''); BPI et al.; Business Roundtable; Chamber; CTA;
Cybersecurity Coalition; Empire; FAH; Federated Hermes; FSSCC; ISA;
ITI; NAM; Nasdaq; NDIA; NMHC; NYSE Group (``NYSE''); Quest; Rapid7;
Sen. Portman; SCG; SIFMA; SM4RT Secure LLC (``SM4RT Secure'');
TransUnion.
    \73\ See letter from Rapid7.
    \74\ See letters from BSA (suggesting a ``tailored, balancing
test''); EEI (advocating delay ``to the extent . . . the registrant
in good faith concludes that its disclosure will expose it or others
to ongoing or additional risks of a cybersecurity incident''); EIC;
Microsoft (requesting that companies be allowed to ``manage the
timing'' of disclosure ``when compelling conditions exist such that
premature disclosure would result in greater harm to the company,
its investors, or the national digital ecosystem''); Nareit and The
Real Estate Roundtable (``Nareit'') (stating delay should be
permitted where disclosure ``would exacerbate injury to the company
and/or its shareholders''); SIFMA (advocating a ```responsible
disclosure' exception'' that applies ``where disclosure of a cyber
incident or vulnerability could have a more damaging effect than
delayed disclosure''); Wilson Sonsini (stating ``the Commission
should allow board members to decide to delay reporting if doing so
could cause material harm to the company'').
    \75\ See letters from CTIA; National Restaurant Association
(``NRA'').
---------------------------------------------------------------------------

    Some commenters recommended instead increasing the number of days
between the reporting trigger and the reporting deadline. A few
commenters recommended adding one business day to make the deadline
five business days; \76\ one noted this would result in every
registrant having at least a full calendar week to gather information
and prepare the Form 8-K.\77\ Another commenter recommended a deadline
of 15 business days, along with a cure period to allow registrants a
defined period of time to fix potential reporting mistakes.\78\ A few
commenters recommended a 30-day deadline,\79\ with their choice of 30
days tending to be a proxy for some other factor, such as containment
or remediation,\80\ or state notification requirements.\81\
---------------------------------------------------------------------------

    \76\ See letters from AIC; Debevoise; NYC Bar.
    \77\ See letter from AIC.
    \78\ See letter from R Street.
    \79\ See letters from APCIA; Hunton Andrews Kurth, LLP
(``Hunton''); Rapid7.
    \80\ See letters from APCIA (``[w]e believe that permitting a
registrant to delay the filing for a short period of time strikes an
appropriate balance between timely disclosure to shareholders and an
opportunity for a registrant to achieve the best resolution for
itself and its shareholders''); Rapid7 (``[i]n Rapid7's experience,
the vast majority of incidents can be contained and mitigated within
that time frame [30 days]'').
    \81\ See letters from APCIA (``[a]llowing up to 30 days for
disclosure would also bring the SEC's proposal in line with data
breach disclosure requirements at the state level''); Hunton
(``[w]hile state data breach notification laws vary from state to
state, 30 days from the cybersecurity incident is the earliest date
any state requires that notification to affected persons be made'').
---------------------------------------------------------------------------

    Several commenters recommended addressing the timing concerns by
replacing current reporting on Form 8-K with periodic reporting on
Forms 10-Q and 10-K, to allow additional time to assess an incident's
impact before reporting to markets.\82\ In this vein, one commenter
likened cybersecurity incident disclosure to the disclosure of

legal proceedings under Regulation S-K Item 103.\83\
---------------------------------------------------------------------------

    \82\ See letters from ABA; Davis Polk; Debevoise; LTSE; NYC Bar;
Quest; SCG.
    \83\ See letter from Quest.
---------------------------------------------------------------------------

    A few commenters recommended instead that the materiality trigger
be replaced with a quantifiable trigger; for example, an incident
implicating a specified percentage of revenue, or the costs of an
incident exceeding a specified benchmark, could trigger disclosure.\84\
Other commenters advocated for the disclosure trigger to be tied to any
legal obligation that forces a registrant to notify persons outside the
company.\85\
---------------------------------------------------------------------------

    \84\ See letters from BIO; Bitsight; EIC; Paylocity.
    \85\ See letters from ABA; Business Roundtable.
---------------------------------------------------------------------------

    Commenters also recommended a number of exceptions to the filing
deadline. The most common recommendation was to include a provision
allowing for delayed filing where there is an active law enforcement
investigation or the disclosure otherwise implicates national security
or public safety.\86\ A representative comment in this vein advanced a
provision whereby registrants may ``delay reporting of a cybersecurity
incident that is the subject of a bona fide investigation by law
enforcement,'' because such ``delay in reporting may not only
facilitate such an investigation, it may be critical to its success.''
\87\
---------------------------------------------------------------------------

    \86\ See letters from ABA; ACC; ACLI; AGA/INGAA; AIA; AICPA;
APCIA; Auto Innovators; Rep. Banks; BPI et al.; BIO; BSA; Business
Roundtable; CBA; Chamber; Chevron; CII; CSA; CTA; CTIA;
Cybersecurity Coalition; Debevoise; EEI; EIC; Empire; Enbridge; FAH;
FedEx Corporation (``FedEx''); FEI; FSSCC; Global Privacy Alliance
(``GPA''); Hunton; ISA; ITI; ITIF; Microsoft; NAM; Nareit; NASAA;
NDIA; NMHC; NRA; NYC Bar; Prof. Perullo; Sen. Portman; PPG; PWC;
Quest; R Street; Profs. Rajgopal & Sharpe; Rapid7; SCG; SIFMA;
TransUnion; Virtu; USTelecom--The Broadband Association
(``USTelecom''); U.S. Chamber of Commerce & various associations
(``Chamber et al.'').
    \87\ See letter from Debevoise.
---------------------------------------------------------------------------

    In calling for a law enforcement delay, associations for industries
in critical sectors emphasized the national security implications of
public cybersecurity incident disclosure. For example, one association
explained that disclosure ``may alert malicious actors that we have
uncovered their illegal activities in circumstances where our defense
and intelligence agencies wish to keep that information secret.'' \88\
Likewise, another association pointed out that, in its industry,
companies ``are likely to possess some of the nation's most critical
confidential information, including cybersecurity threat information
furnished by government entities, such as the Federal Bureau of
Investigation (FBI), the Department of Homeland Security (DHS), and the
National Security Agency (NSA),'' and therefore, disclosure may not be
possible.\89\
---------------------------------------------------------------------------

    \88\ See letter from AIA.
    \89\ See letter from EEI.
---------------------------------------------------------------------------

    Commenters largely advocated for ``a broad law enforcement
exception that applies not only in the interest of national security
but also when law enforcement believes disclosure will hinder their
efforts to identify or capture the threat actor.'' \90\ Many commenters
that responded to the Commission's request for comment regarding a
provision whereby the Attorney General determines that a delay is in
the interest of national security indicated that such a provision
should be more expansive and extend to other law enforcement
authorities.\91\ One of these commenters questioned whether the
Attorney General would opine on matters ``that are under the ambit of
other Federal agencies, such as the Department of Homeland Security,
Department of State and the Department of Defense.'' \92\ Another
commenter pointed out that ``the Department of Justice is not the
primary, or even the lead, organization in the Federal Government for
cybersecurity response, rather the Department of Homeland Security's
Cybersecurity and Infrastructure Security Agency is often the first
call that companies make,'' while ``[f]or defense contractors, the
Department of Defense is likely to have the highest interest in the
timing of an announcement.'' \93\ For the financial industry
specifically, one suggestion was to permit a delay if the Federal
Reserve, Federal Deposit Insurance Corporation, or Office of the
Comptroller of the Currency finds that disclosure would compromise the
safety or soundness of the financial institution or of the financial
system as a whole.\94\
---------------------------------------------------------------------------

    \90\ See letter from ABA.
    \91\ See letters from BPI et al.; CBA; CSA; Hunton; ITIF; SCG;
Wilson Sonsini.
    \92\ See letter from Hunton. This commenter also questioned
whether law enforcement would be inclined to provide a written
determination, particularly within four business days, because in
its experience with State data breach laws, ``the relevant state and
federal law enforcement agencies seldom (if ever) provide written
instructions when the relevant exception comes into play.''
    \93\ See letter from Wilson Sonsini.
    \94\ See letter from BPI et al. Cf. letter from FSSCC.
---------------------------------------------------------------------------

    Some commenters specifically urged that state law enforcement be
included within any delay provision,\95\ and one commenter appeared to
contemplate inclusion of foreign law enforcement.\96\ A few commenters
advocated for a confidential reporting system, whereby a registrant
would initially file a nonpublic report with the Commission while a law
enforcement investigation is ongoing, and then unseal the report upon
the investigation's completion.\97\
---------------------------------------------------------------------------

    \95\ See, e.g., letter from ITIF.
    \96\ See letter from CBA (stating ``the scope of the
contemplated exemption is indefensibly narrow, particularly for
registrants with operations outside of the United States . . . there
should be an exemption to permit delayed disclosure upon the request
of any competent national, state or local law enforcement
authority'').
    \97\ See letters from CSA; Hunton; SCG. See also letter from
LTSE (positing the Regulation SCI disclosure framework as a model
for Item 1.05).
---------------------------------------------------------------------------

    A number of commenters provided feedback regarding proposed
Instruction 1, which would have directed registrants to make their
materiality determination regarding an incident ``as soon as reasonably
practicable after discovery of the incident.'' Several commenters
recommended removing the instruction altogether as, in their view, it
would place unnecessary pressure on companies to make premature
determinations before they have sufficient information.\98\ Other
commenters stated that the instruction is too ambiguous for registrants
to ascertain whether they have complied with it.\99\ Conversely, one
commenter advised the Commission not to provide further guidance on the
meaning of ``as soon as reasonably practicable,'' explaining that doing
so would interfere with each registrant's individual assessment of what
is practicable given its specific context, resulting in pressure to
move more quickly than may be appropriate.\100\ Another commenter
likewise found that ``as soon as reasonably practicable'' is a
``reasonable approach'' that ``provides public companies with the
appropriate degree of flexibility to conduct a thorough assessment
while ensuring that the markets get timely and relevant information.''
\101\ One commenter recommended a safe harbor for actions and
determinations made in good faith to satisfy Instruction 1 that later
turn out to be mistaken.\102\
---------------------------------------------------------------------------

    \98\ See letters from ABA; AGA/INGAA; Federated Hermes; ISA;
Paylocity; Quest; SCG.
    \99\ See letter from Center for Audit Quality (``CAQ''); CSA;
Institute of Internal Auditors (``IIA''); LTSE; NYC Bar.
    \100\ See letter from Cybersecurity Coalition.
    \101\ See letter from NASAA.
    \102\ See letter from Nasdaq.
---------------------------------------------------------------------------

    In response to a request for comment in the Proposing Release,
several commenters recommended registrants be permitted to furnish
rather than file an Item 1.05 Form 8-K, so that filers of an Item 1.05
Form 8-K would not be subject to liability under Section 18 of the
Exchange Act.\103\ A significant number of commenters also endorsed the
proposal to amend 17 CFR 240.13a-

11(c) (``Rule 13a-11(c)'') and 17 CFR 240.15d-11(c) (``Rule 15d-
11(c)'') under the Exchange Act to include Item 1.05 in the list of
Form 8-K items eligible for a limited safe harbor from liability under
Section 10(b) or 17 CFR 240.10b-5 (``Rule 10b-5'') under the Exchange
Act.\104\ Likewise, the proposal to amend General Instruction I.A.3.(b)
of Form S-3 and General Instruction I.A.2 of Form SF-3 to provide that
an untimely filing on Form 8-K regarding new Item 1.05 would not result
in loss of Form S-3 or Form SF-3 eligibility received much
support.\105\
---------------------------------------------------------------------------

    \103\ See letters from BPI et al.; Business Roundtable; Chevron;
CSA; EEI; LTSE; NAM; SCG.
    \104\ See letters from ABA; APCIA; BIO; Business Roundtable;
Chevron; CTIA; Cybersecurity Coalition; Debevoise; EEI; LTSE; NYC
Bar; PWC; SCG.
    \105\ See letters from ABA; APCIA; BIO; Business Roundtable;
Chevron; CTIA; Cybersecurity Coalition; Debevoise; EEI; LTSE; NYC
Bar; PWC; SCG.
---------------------------------------------------------------------------

    Finally, a number of commenters averred that Item 1.05 would
conflict with other Federal and state cybersecurity reporting or other
regulatory regimes. For example, one commenter stated Item 1.05 would
counteract the goals of CIRCIA by requiring public disclosure of
information the act would keep confidential, and went on to assert that
CIRCIA was intended as the primary means for reporting incidents to the
Federal Government.\106\ Also related to CIRCIA, a number of commenters
urged harmonization of the Commission's proposal with forthcoming
regulations expected from CISA pursuant to CIRCIA.\107\ Several
commenters alleged Item 1.05 would conflict with rules the Department
of Health and Human Services (``HHS'') has adopted pursuant to the
Health Insurance Portability and Accountability Act (``HIPAA'')
regarding the reporting of private health information breaches.\108\ A
few commenters likewise said Item 1.05 would conflict with the
reporting regime set forth in Federal Communications Commission
(``FCC'') regulations for breaches of customer proprietary network
information.\109\ Conflicts were also alleged with regulations and
programs of the Department of Defense (``DOD''),\110\ Department of
Energy (``DOE''),\111\ and Department of Homeland Security
(``DHS'').\112\ Commenters called for harmonization of Item 1.05 with
regulations issued by Federal banking regulators,\113\ as well as with
regulations of the Federal Trade Commission (``FTC'').\114\ Some
commenters noted the potential interaction between the proposed rules
and state laws.\115\ One commenter noted the McCarran-Ferguson Act,
which provides that a state law preempts a Federal statute if the state
law was enacted for the purpose of regulating the business of insurance
and the Federal statute does not specifically relate to the business of
insurance.\116\
---------------------------------------------------------------------------

    \106\ See letter from Sen. Portman.
    \107\ See letters from ACC; ACLI; APCIA; BPI et al.; BIO;
Confidentiality Coalition; Chamber; CTA; CTIA; Cybersecurity
Coalition; EIC; FEI; FSSCC; Insurance Coalition (``IC''); ISA; ITI;
ITIF; Nareit; NAM; NRA; R Street; SCG; SIFMA; USTelecom.
    \108\ See letters from Chamber; Confidentiality Coalition; FAH;
R Street.
    \109\ See letters from Chamber; CTIA; USTelecom.
    \110\ See letter from Chamber et al.
    \111\ See letter from EEI.
    \112\ See letter from ACC. This letter additionally alleged
conflicts with regulations of the Department of Energy,
Transportation Security Agency, Department of Defense, and
Environmental Protection Agency, but did not explain specifically
where those conflicts lie.
    \113\ See letters from FSSCC; Structured Finance Association
(``SFA''); SIFMA.
    \114\ See letters from BIO; CTIA.
    \115\ See letters from IC (noting ``[a]n important issue will be
to ensure harmonized regulation between the federal government and
the several states with proposed or preexisting cybersecurity
regulations''); R Street (noting that state privacy laws ``mandate
reporting of incidents across very different timelines''); SIFMA
(noting that ``many state financial services and/or insurance
regulators already require regulated entities certify cybersecurity
compliance'').
    \116\ See letter from IC.
---------------------------------------------------------------------------

3. Final Amendments
    Having considered the comments, we remain convinced that investors
need timely, standardized disclosure regarding cybersecurity incidents
materially affecting registrants' businesses, and that the existing
regulatory landscape is not yielding consistent and informative
disclosure of cybersecurity incidents from registrants.\117\ However,
we are revising the proposal in two important respects in response to
concerns raised by commenters. First, we are narrowing the amount of
information required to be disclosed, to better balance investors'
needs and registrants' cybersecurity posture. And second, we are
providing for a delay for disclosures that would pose a substantial
risk to national security or public safety, contingent on a written
notification by the Attorney General, who may take into consideration
other Federal or other law enforcement agencies' findings.
---------------------------------------------------------------------------

    \117\ As the Commission has previously stated, markets rely on
timely dissemination of information to accurately and quickly value
securities. Additional Form 8-K Disclosure Requirements and
Acceleration of Filing Date, Release No. 33-8400 (Mar. 16, 2004) [69
FR 15593 (Mar. 25, 2004)] (``Additional Form 8-K Disclosure
Release''). Congress recognized that the ongoing dissemination of
accurate information by issuers about themselves and their
securities is essential to the effective operation of the markets,
and specifically recognized the importance of current reporting in
this regard by requiring that ``[e]ach issuer reporting under
Section 13(a) or 15(d) . . . disclose to the public on a rapid and
current basis such additional information concerning material
changes in the financial condition or operations of the issuer . . .
as the Commission determines . . . is necessary or useful for the
protection of investors and in the public interest.'' 15 U.S.C.
78m(l).
---------------------------------------------------------------------------

    As described above, commenters' criticisms of Item 1.05 generally
arose from two aspects of the proposal: (1) the scope of disclosure;
and (2) the timing of disclosure. With respect to disclosure scope, we
note in particular commenter concerns that the disclosure of certain
details required by proposed Item 1.05 could exacerbate security
threats, both for the registrants' systems and for systems in the same
industry or beyond, and could chill threat information sharing within
industries. We agree that a balancing of concerns consistent with our
statutory authority is necessary in crafting Item 1.05 to avoid
empowering threat actors with actionable information that could harm a
registrant and its investors. However, we are not persuaded, as some
commenters suggested,\118\ that we should forgo requiring disclosure of
the existence of an incident while it is ongoing to avoid risks, such
as the risk of tipping off threat actors. Some companies already
disclose material cybersecurity incidents while they are ongoing and
before they are fully remediated, but the timing, form, and substance
of those disclosures are inconsistent. Several commenters indicated
both that investors look for information regarding registrants'
cybersecurity incidents and that current disclosure levels are
inadequate to their needs in making investment decisions.\119\ In
addition, we note below in Section IV evidence showing that delayed
reporting of cybersecurity incidents can result in mispricing of
securities, and that such mispricing can be exploited by threat actors,
employees, related third parties, and others through trades made before
an incident becomes public.\120\ Accordingly, we believe it is
necessary to adopt a requirement for uniform current reporting of
material cybersecurity incidents.
---------------------------------------------------------------------------

    \118\ See supra note 50.
    \119\ See letters from Better Markets; CalPERS; CII.
    \120\ See infra notes 413 and 462.
---------------------------------------------------------------------------

    To that end, and to balance investors' needs with the concerns
raised by commenters, we are streamlining Item 1.05 to focus the
disclosure primarily on the impacts of a material cybersecurity
incident, rather than on requiring details regarding the incident
itself. The final rules will require the registrant to ``describe the
material aspects of the nature, scope, and timing of the

incident, and the material impact or reasonably likely material impact
on the registrant, including its financial condition and results of
operations.'' We believe this formulation more precisely focuses the
disclosure on what the company determines is the material impact of the
incident, which may vary from incident to incident. The rule's
inclusion of ``financial condition and results of operations'' is not
exclusive; companies should consider qualitative factors alongside
quantitative factors in assessing the material impact of an
incident.\121\ By way of illustration, harm to a company's reputation,
customer or vendor relationships, or competitiveness may be examples of
a material impact on the company. Similarly, the possibility of
litigation or regulatory investigations or actions, including
regulatory actions by state and Federal Governmental authorities and
non-U.S. authorities, may constitute a reasonably likely material
impact on the registrant.
---------------------------------------------------------------------------

    \121\ See also Proposing Release at 16596 (stating that ``[a]
materiality analysis is not a mechanical exercise'' and not solely
quantitative, but rather should take into consideration ``all
relevant facts and circumstances surrounding the cybersecurity
incident, including both quantitative and qualitative factors'').
---------------------------------------------------------------------------

    We are not adopting, as proposed, a requirement for disclosure
regarding the incident's remediation status, whether it is ongoing, and
whether data were compromised. While some incidents may still
necessitate, for example, discussion of data theft, asset loss,
intellectual property loss, reputational damage, or business value
loss, registrants will make those determinations as part of their
materiality analyses. Further, we are adding an Instruction 4 to Item
1.05 to provide that a ``registrant need not disclose specific or
technical information about its planned response to the incident or its
cybersecurity systems, related networks and devices, or potential
system vulnerabilities in such detail as would impede the registrant's
response or remediation of the incident.'' While the Commission
provided this assurance in the Proposing Release,\122\ we agree with
some commenters that codifying it in the Item 1.05 instructions should
provide added clarity to registrants on the type of disclosure required
by Item 1.05.
---------------------------------------------------------------------------

    \122\ Id. at 16595.
---------------------------------------------------------------------------

    With respect to commenters' questions concerning the application of
Item 1.05 to incidents occurring on third-party systems, we are not
exempting registrants from providing disclosures regarding
cybersecurity incidents on third-party systems they use, nor are we
providing a safe harbor for information disclosed about third-party
systems. While we appreciate the commenters' concerns about a
registrant's reduced control over such systems, we note the centrality
of the materiality determination: whether an incident is material is
not contingent on where the relevant electronic systems reside or who
owns them. In other words, we do not believe a reasonable investor
would view a significant breach of a registrant's data as immaterial
merely because the data were housed on a third-party system, especially
as companies increasingly rely on third-party cloud services that may
place their data out of their immediate control.\123\ Instead, as
discussed above, materiality turns on how a reasonable investor would
consider the incident's impact on the registrant.
---------------------------------------------------------------------------

    \123\ See Deloitte, Global Third-Party Risk Management Survey
2022, at 15, available at https://www2.deloitte.com/content/dam/Deloitte/uk/Documents/risk/deloitte-uk-global-tprm-survey-report-2022.pdf (discussing results of a global survey of 1,309 ``senior
leaders from a variety of organizations'' indicating that ``73% of
respondents currently have a moderate to high level of dependence on
[cloud-service providers]'' and ``[t]hat is expected to increase to
88% in the years ahead'').
---------------------------------------------------------------------------

    Depending on the circumstances of an incident that occurs on a
third-party system, disclosure may be required by both the service
provider and the customer, or by one but not the other, or by neither.
We appreciate that companies may have reduced visibility into third-
party systems; registrants should disclose based on the information
available to them. The final rules generally do not require that
registrants conduct additional inquiries outside of their regular
channels of communication with third-party service providers pursuant
to those contracts and in accordance with registrants' disclosure
controls and procedures. This is consistent with the Commission's
general rules regarding the disclosure of information that is difficult
to obtain.\124\
---------------------------------------------------------------------------

    \124\ See 17 CFR 230.409 and 17 CFR 240.12b-21, which provide
that information need only be disclosed insofar as it is known or
reasonably available to the registrant. Accordingly, we are not
providing additional time to comply with Item 1.05 as it relates to
third-party incidents, as requested by some commenters.
---------------------------------------------------------------------------

    Turning to disclosure timing, we believe that the modifications
from the proposed rules regarding the disclosures called for by Item
1.05 alleviate many of the concerns some commenters had regarding the
proposed disclosure deadline of four business days from the materiality
determination. Because the streamlined disclosure requirements we are
adopting are focused on an incident's basic identifying details and its
material impact or reasonably likely material impact, the registrant
should have the information required to be disclosed under this rule as
part of conducting the materiality determination. For example, most
organizations' materiality analyses will include consideration of the
financial impact of a cybersecurity incident, so information regarding
the incident's impact on the registrant's financial condition and
results of operations will likely have already been developed when Item
1.05 is triggered.\125\ Thus, we believe that the four business day
timeframe from the date of a materiality determination will be
workable.
---------------------------------------------------------------------------

    \125\ To the extent any required information is not determined
or is unavailable at the time of the required filing, Instruction 2
to Item 1.05, as adopted, directs the registrant to include a
statement to this effect in the Form 8-K and then file a Form 8-K
amendment containing such information within four business days
after the registrant, without unreasonable delay, determines such
information or within four business days after such information
becomes available. See infra Section II.B.3.
---------------------------------------------------------------------------

    The reformulation of Item 1.05 also addresses the concern among
commenters that the disclosure may be tentative and unclear, resulting
in false positives and mispricing in the market. In the majority of
cases, the registrant will likely be unable to determine materiality
the same day the incident is discovered. The registrant will develop
information after discovery until it is sufficient to facilitate a
materiality analysis.\126\ At that point, we believe investors are best
served knowing, within four business days after the materiality
determination, that the incident occurred and what led management to
conclude the incident is material. While it is possible that
occasionally there may be incidents that initially appear material but
developments after the filing of the Item 1.05 Form 8-K reveal to be
not material, the alternative of delaying disclosure beyond the four
business day period after a materiality determination has the potential
to lead to far more mispricing and will negatively impact investors
making investment and voting decisions without the benefit of knowing
that there is a material cybersecurity incident.
---------------------------------------------------------------------------

    \126\ As discussed below, registrants should develop such
information without unreasonable delay.
---------------------------------------------------------------------------

    Commenters posited an array of alternative deadlines for the Item
1.05 Form 8-K, as recounted above. We are not persuaded by commenters'
arguments that disclosure should be delayed until companies mitigate,

contain, remediate, or otherwise diminish the harm of the incident,
because, as discussed above, Item 1.05 does not require disclosure of
the types of details that have the potential to be exploited by threat
actors, but rather focuses on the incident's material impact or
reasonably likely material impact on the registrant. While there may
be, as commenters noted, some residual risk of the disclosure of an
incident's existence tipping off threat actors, such risk is justified,
in our view, by investors' need for timely information, and similar
risk already exists today with some companies' current cybersecurity
incident disclosure practices. We are also not persuaded that Item 1.05
is sufficiently different from other Form 8-K items such that deviating
from the form's four business day deadline following the relevant
trigger would be indicated. While some commenters argued that Item 1.05
is qualitatively different from all other Form 8-K filings in that its
trigger is largely outside the company's control, we disagree because
other Form 8-K items may also be triggered unexpectedly, such as Item
4.01 (Changes in Registrant's Certifying Accountants) and Item 5.02
(Departure of Directors or Principal Officers). And as compared to
those items, the information needed for Item 1.05 may be further along
in development when the filing is triggered, whereas, for example, a
company may have no advance warning that a principal officer is
departing.
    With respect to the five business day deadline suggested by a few
commenters to allow registrants a full calendar week from the
materiality determination to the disclosure, we note that in the
majority of cases registrants will have had additional time leading up
to the materiality determination, such that disclosure becoming due
less than a week after discovery should be uncommon. More generally
with respect to the various alternative timing suggestions, we observe
that the Commission adopted the uniform four business day deadline in
2004 to simplify the previous bifurcated deadlines, and we find
commenters have not offered any compelling rationale to return to
bifurcated deadlines.\127\ Form 8-K provides for current reporting of
events that tend to be material to investor decision-making, and we see
no reason to render the reporting of Item 1.05 less current than other
Form 8-K items.
---------------------------------------------------------------------------

    \127\ See Additional Form 8-K Disclosure Release. See also
Proposed Rule: Additional Form 8-K Disclosure Requirements and
Acceleration of Filing Date, Release No. 33-8106 (June 17, 2002) [67
FR 42914 (June 25, 2002)].
---------------------------------------------------------------------------

    In the Proposing Release, the Commission requested comment on
whether to allow registrants to delay filing an Item 1.05 Form 8-K
where the Attorney General determines that a delay is in the interest
of national security.\128\ In response to comments, we are adopting a
delay provision in cases where disclosure poses a substantial risk to
national security or public safety. Pursuant to Item 1.05(c), a
registrant may delay making an Item 1.05 Form 8-K filing if the
Attorney General determines that the disclosure poses a substantial
risk to national security or public safety and notifies the Commission
of such determination in writing.\129\ Initially, disclosure may be
delayed for a time period specified by the Attorney General, up to 30
days following the date when the disclosure was otherwise required to
be provided. The delay may be extended for an additional period of up
to 30 days if the Attorney General determines that disclosure continues
to pose a substantial risk to national security or public safety and
notifies the Commission of such determination in writing.
---------------------------------------------------------------------------

    \128\ Proposing Release at 16598.
    \129\ We note that the delay provision we are adopting does not
relieve a company's obligations under Regulation FD or with respect
to the securities laws' antifraud prohibitions that proscribe
certain insider trading, including Exchange Act Section 10(b). Under
Regulation FD, material nonpublic information disclosed to any
investor, for example, through investor outreach activities, would
be required to be disclosed publicly, subject to limited exceptions.
See 17 CFR 243.100 et seq.
---------------------------------------------------------------------------

    In extraordinary circumstances, disclosure may be delayed for a
final additional period of up to 60 days if the Attorney General
determines that disclosure continues to pose a substantial risk to
national security and notifies the Commission of such determination in
writing. We are providing for the final additional delay period in
recognition that, in extraordinary circumstances, national security
concerns may justify additional delay beyond that warranted by public
safety concerns, due to the relatively more critical nature of national
security concerns. Beyond the final 60-day delay, if the Attorney
General indicates that further delay is necessary, the Commission will
consider additional requests for delay and may grant such relief
through Commission exemptive order.\130\
---------------------------------------------------------------------------

    \130\ Any exercise of exemptive authority in these circumstances
would need to meet all of the standards of Section 36 of the
Exchange Act. Furthermore, Item 1.05 of Form 8-K in no way limits
the Commission's general exemptive authority under Section 36.
---------------------------------------------------------------------------

    We have consulted with the Department of Justice to establish an
interagency communication process to allow for the Attorney General's
determination to be communicated to the Commission in a timely manner.
The Department of Justice will notify the affected registrant that
communication to the Commission has been made, so that the registrant
may delay filing its Form 8-K.
    We agree with commenters that a delay is appropriate for the
limited instances in which public disclosure of a cybersecurity
incident may cause harm to national security or public safety. The
final rules appropriately balance such security concerns against
investors' informational needs. In particular, the provision's
``substantial risk to national security or public safety'' bases are
sufficiently expansive to ensure that significant risks of harm from
disclosure may be protected against, while also ensuring that investors
are not denied timely access to material information.\131\ With respect
to commenters who recommended that other Federal agencies and non-
Federal law enforcement agencies also be permitted to trigger a delay
or who argued that other agencies may be the primary organization in
the Federal Government for the response, we note that the rule does not
preclude any such agency from requesting that the Attorney General
determine that the disclosure poses a substantial risk to national
security or public safety and communicate that determination to the
Commission. However, we believe that designating a single law
enforcement agency as the Commission's point of contact on such delays
is critical to ensuring that the rule is administrable.
---------------------------------------------------------------------------

    \131\ The delay provision for substantial risk to national
security or public safety is separate from Exchange Act Rule 0-6,
which provides for the omission of information that has been
classified by an appropriate department or agency of the Federal
Government for the protection of the interest of national defense or
foreign policy. If the information a registrant would otherwise
disclose on an Item 1.05 Form 8-K or pursuant to Item 106 of
Regulation S-K or Item 16K of Form 20-F is classified, the
registrant should comply with Exchange Act Rule 0-6.
---------------------------------------------------------------------------

    Turning to other timing-related issues raised by commenters, we are
not adopting commenters' suggestion to replace Item 1.05 with periodic
reporting of material cybersecurity incidents on Forms 10-Q and 10-K
because such an approach may result in significant variance as to when
investors learn of material cybersecurity incidents. Based on when an
incident occurs during a company's reporting

cycle, the timing between the materiality determination and reporting
on the next Form 10-Q or Form 10-K could vary from a matter of months
to a matter of weeks or less. For example, if two companies experience
a similar cybersecurity incident, but one determines the incident is
material early during a quarterly period and the other makes such
determination at the end of the quarterly period, commenters' suggested
approach would have both companies report the incident around the same
time despite the first company having determined the incident was
material weeks or months sooner, which would result in a significant
delay in this information being provided to investors. Such variance
would therefore reduce comparability across registrants and may put
certain registrants at a competitive disadvantage.
    We also decline to use a quantifiable trigger for Item 1.05 because
some cybersecurity incidents may be material yet not cross a particular
financial threshold. We note above that the material impact of an
incident may encompass a range of harms, some quantitative and others
qualitative. A lack of quantifiable harm does not necessarily mean an
incident is not material. For example, an incident that results in
significant reputational harm to a registrant may not be readily
quantifiable and therefore may not cross a particular quantitative
threshold, but it should nonetheless be reported if the reputational
harm is material. Similarly, whereas a cybersecurity incident that
results in the theft of information may not be deemed material based on
quantitative financial measures alone, it may in fact be material given
the impact to the registrant that results from the scope or nature of
harm to individuals, customers, or others, and therefore may need to be
disclosed.
    In another change from the proposal, and to respond to commenters'
concerns that the proposed ``as soon as reasonably practicable''
language in Instruction 1 could pressure companies to draw conclusions
about incidents with insufficient information, we are revising the
instruction to state that companies must make their materiality
determinations ``without unreasonable delay.'' As explained in the
Proposing Release, the instruction was intended to address any concern
that some registrants may delay making such a determination to avoid a
disclosure obligation.\132\ We understand commenter concerns that the
proposed instruction could result in undue pressure to make a
materiality determination before a registrant has sufficient
information to do so, and we recognize that a materiality determination
necessitates an informed and deliberative process. We believe the
revised language should alleviate this unintended consequence, while
providing registrants notice that, though the determination need not be
rushed prematurely, it also cannot be unreasonably delayed in an effort
to avoid timely disclosure. For example, for incidents that impact key
systems and information, such as those the company considers its
``crown jewels,'' \133\ as well as incidents involving unauthorized
access to or exfiltration of large quantities of particularly important
data, a company may not have complete information about the incident
but may know enough about the incident to determine whether the
incident was material. In other words, a company being unable to
determine the full extent of an incident because of the nature of the
incident or the company's systems, or otherwise the need for continued
investigation regarding the incident, should not delay the company from
determining materiality. Similarly, if the materiality determination is
to be made by a board committee, intentionally deferring the
committee's meeting on the materiality determination past the normal
time it takes to convene its members would constitute unreasonable
delay.\134\ As another example, if a company were to revise existing
incident response policies and procedures in order to support a delayed
materiality determination for or delayed disclosure of an ongoing
cybersecurity event, such as by extending the incident severity
assessment deadlines, changing the criteria that would require
reporting an incident to management or committees with responsibility
for public disclosures, or introducing other steps to delay the
determination or disclosure, that would constitute unreasonable delay.
In light of the revision to Instruction 1, we find that a safe harbor,
as suggested by some commenters, is unnecessary; adhering to normal
internal practices and disclosure controls and procedures will suffice
to demonstrate good faith compliance. Importantly, we remind
registrants, as the Commission did in the Proposing Release, that
``[d]oubts as to the critical nature'' of the relevant information
``will be commonplace'' and should ``be resolved in favor of those the
statute is designed to protect,'' namely investors.\135\
---------------------------------------------------------------------------

    \132\ Proposing Release at 16596.
    \133\ See National Cybersecurity Alliance, Identify Your ``Crown
Jewels'' (July 1, 2022), available at https://staysafeonline.org/cybersecurity-for-business/identify-your-crown-jewels/ (explaining
that ``[c]rown jewels are the data without which your business would
have difficulty operating and/or the information that could be a
high-value target for cybercriminals'').
    \134\ We note that Form 8-K Item 1.05 does not specify whether
the materiality determination should be performed by the board, a
board committee, or one or more officers. The company may establish
a policy tasking one or more persons to make the materiality
determination. Companies should seek to provide those tasked with
the materiality determination information sufficient to make
disclosure decisions.
    \135\ Proposing Release at 16596 (quoting TSC Indus. v.
Northway, 426 U.S. at 448). The Court's opinion in TSC Indus. has a
nuanced discussion of the balance of considerations in setting a
materiality standard. 426 U.S. at 448-450.
---------------------------------------------------------------------------

    Revised Instruction 1 should also reassure registrants that they
should continue sharing information with other companies or government
actors about emerging threats. Such information sharing may not
necessarily result in an Item 1.05 disclosure obligation. The
obligation to file the Item 1.05 disclosure is triggered once a company
has developed information regarding an incident sufficient to make a
materiality determination, and a decision to share information with
other companies or government actors does not in itself necessarily
constitute a determination of materiality. A registrant may alert
similarly situated companies as well as government actors immediately
after discovering an incident and before determining materiality, so
long as it does not unreasonably delay its internal processes for
determining materiality.
    As proposed, we are adding Item 1.05 to the list of Form 8-K items
in General Instruction I.A.3.(b) of Form S-3, so that the untimely
filing of an Item 1.05 Form 8-K will not result in the loss of Form S-3
eligibility.\136\ We note the significant support from commenters
regarding this proposal, and as noted in the Proposing Release,
continue to believe that the consequences of the loss of Form S-3
eligibility would be unduly severe given the circumstances that will
surround Item 1.05 disclosures. Likewise, as supported by many
commenters, we are adopting as proposed amendments to Rules 13a-11(c)
and 15d-11(c) under the Exchange Act to include new Item 1.05 in the
list of Form 8-K items eligible for a limited safe harbor from
liability under Section 10(b) or Rule 10b-5 under the Exchange Act.
This accords with the view the Commission articulated in 2004 that the
safe harbor is appropriate if the triggering event for the Form 8-K

requires management to make a rapid materiality determination.\137\
---------------------------------------------------------------------------

    \136\ Because of our decision to exempt asset-backed issuers
from the new rules (see infra Section II.G.1), we are not amending
Form SF-3.
    \137\ Additional Form 8-K Disclosure Release at 15607.
---------------------------------------------------------------------------

    We decline to permit registrants to furnish rather than file the
Item 1.05 Form 8-K, as suggested by some commenters. While we
understand commenters' points that reducing liability may ease the
burden on registrants, we believe that treating Item 1.05 disclosures
as filed will help promote the accuracy and reliability of such
disclosures for the benefit of investors. Of the existing Form 8-K
items, only Items 2.02 (Results of Operations and Financial Condition)
and 7.01 (Regulation FD Disclosure) are permitted to be furnished
rather than filed. The Commission created exceptions for those two
items to allay concerns that do not pertain here. Specifically, with
respect to Item 2.02, the Commission was motivated by concerns that
requiring the information to be filed would discourage registrants from
proactively issuing earnings releases and similar disclosures.\138\
Similarly, with respect to Item 7.01, the Commission decided to allow
the disclosure to be furnished to address concerns that, if required to
be filed, the disclosure could be construed as an admission of
materiality, which might lead some registrants to avoid making
proactive disclosure.\139\ By contrast, Item 1.05 is not a voluntary
disclosure, and it is by definition material because it is not
triggered until the registrant determines the materiality of an
incident. It is thus more akin to the Form 8-K items other than Items
2.02 and 7.01, in that it is a description of a material event that has
occurred about which investors need adequate information. Therefore,
the final rules require an Item 1.05 Form 8-K to be filed.
---------------------------------------------------------------------------

    \138\ See Conditions for Use of Non-GAAP Financial Measures,
Release No. 33-8176 (Jan. 22, 2003) [68 FR 4819 (Jan. 30, 2003)].
    \139\ See Selective Disclosure and Insider Trading, Release No.
33-7881 (Aug. 15, 2000) [65 FR 51715 (Aug. 24, 2000)].
---------------------------------------------------------------------------

    We are not including a new rule to ban trading by insiders during
the materiality determination time period, as suggested by some
commenters. Those with a fiduciary duty or other relationship of trust
and confidence are already prohibited from trading while in possession
of material, nonpublic information.\140\ And because we are adopting
the four business days from materiality determination deadline, we
agree with the point raised by some commenters that the risk of insider
trading is low given the limited time period between experiencing a
material incident and public disclosure. We also note that we recently
adopted amendments to 17 CFR 240.10b5-1 (``Rule 10b5-1'') that added a
certification condition for directors and officers wishing to avail
themselves of the rule's affirmative defense; specifically, if relying
on the amended affirmative defense, directors and officers need to
certify in writing, at the time they adopt the trading plan, that they
are unaware of material nonpublic information about the issuer or its
securities, and are adopting the plan in good faith and not as part of
a plan or scheme to evade the insider trading prohibitions.\141\
Therefore, given the timing of the incident disclosure requirement as
well as the recently adopted amendments to Rule 10b5-1, we do not find
need for a new rule banning trading by insiders during the time period
between the materiality determination and disclosure.
---------------------------------------------------------------------------

    \140\ United States v. O'Hagan, 521 U.S. 642 (1997).
    \141\ See Insider Trading Arrangements and Related Disclosures,
Release No. 33-11138 (Dec. 14, 2022) [87 FR 80362 (Dec. 29, 2022)].
---------------------------------------------------------------------------

    A number of commenters raised concerns about conflicts with other
Federal laws and regulations. Of the Federal laws and regulations that
we reviewed and commenters raised concerns with, we have identified one
conflict, with the FCC's notification rule for breaches of customer
proprietary network information (``CPNI'').\142\ Of the remaining
Federal laws and regulations noted by commenters as presenting
conflicts, our view is that Item 1.05 neither directly conflicts with
nor impedes the purposes of other such laws and regulations.
---------------------------------------------------------------------------

    \142\ 47 CFR 64.2011. CPNI is defined in 47 CFR 222(h)(1) as:
``(A) information that relates to the quantity, technical
configuration, type, destination, location, and amount of use of a
telecommunications service subscribed to by any customer of a
telecommunications carrier, and that is made available to the
carrier by the customer solely by virtue of the carrier-customer
relationship; and (B) information contained in the bills pertaining
to telephone exchange service or telephone toll service received by
a customer of a carrier; except that such term does not include
subscriber list information.''
---------------------------------------------------------------------------

    The FCC's rule for notification in the event of breaches of CPNI
requires covered entities to notify the United States Secret Service
(``USSS'') and the Federal Bureau of Investigation (``FBI'') no later
than seven business days after reasonable determination of a CPNI
breach, and further directs the entities to refrain from notifying
customers or disclosing the breach publicly until seven business days
have passed following the notification to the USSS and FBI.\143\ To
accommodate registrants who are subject to this rule and may as a
result face conflicting disclosure timelines,\144\ we are adding
paragraph (d) to Item 1.05 providing that such registrants may delay
making a Form 8-K disclosure up to the seven business day period
following notification to the USSS and FBI specified in the FCC
rule,\145\ with written notification to the Commission.\146\
---------------------------------------------------------------------------

    \143\ We note that the FCC recently proposed amending its rule;
among other things, the proposal would eliminate the seven-business
day waiting period, potentially eliminating the conflict. Federal
Communications Commission, Data Breach Reporting Requirements, 88 FR
3953 (Jan. 23, 2023).
    \144\ Commission staff consulted with FCC staff about a
potential delay provision to address any conflict between the FCC
rule and the Form 8-K reporting requirements.
    \145\ The exception we are creating does not apply to 47 CFR
64.2011(b)(3), which provides that the USSS or FBI may direct the
entity to further delay notification to customers or public
disclosure beyond seven business days if such disclosure ``would
impede or compromise an ongoing or potential criminal investigation
or national security.'' If the USSS or FBI believes that disclosure
would result in a substantial risk to national security or public
safety, it may, as explained above, work with the Department of
Justice to seek a delay of disclosure.
    \146\ Such notice should be provided through correspondence on
EDGAR no later than the date when the disclosure required by Item
1.05 was otherwise required to be provided.
---------------------------------------------------------------------------

    We also considered the conflicts commenters alleged with CIRCIA.
Specifically, they stated that Item 1.05 is at odds with the goals of
CIRCIA, and that it may conflict with forthcoming regulations from
CISA. The confidential reporting system established by CIRCIA serves a
different purpose from Item 1.05 and through different means; the
former focuses on facilitating the Federal Government's preparation for
and rapid response to cybersecurity threats, while the latter focuses
on providing material information about public companies to investors
in a timely manner. While CISA has yet to propose regulations to
implement CIRCIA, given the statutory authority, text, and legislative
history of CIRCIA, it appears unlikely the regulations would affect the
balance of material information available to investors about public
companies, because the reporting regime CIRCIA establishes is
confidential.\147\ Nonetheless, the Commission participates in
interagency working groups on cybersecurity regulatory implementation,
and will continue to monitor developments in this area to determine if
modification to Item 1.05 becomes appropriate in light of future
developments.\148\
---------------------------------------------------------------------------

    \147\ 6 U.S.C. 681e.
    \148\ Should a conflict arise in the future with CISA
regulations or regulations of another Federal agency, the Commission
can address such conflict via rulemaking or other action at that
time.
---------------------------------------------------------------------------

    We also considered the HIPAA-related conflict alleged by
commenters,

specifically with respect to HHS's rule on Notification in the Case of
Breach of Unsecured Protected Health Information. That rule provides,
in the event of a breach of unsecured protected health information, for
the covered entity to provide notification to affected individuals
``without unreasonable delay and in no case later than 60 calendar days
after discovery of a breach.'' \149\ If the breach involves more than
500 residents of a state or jurisdiction, the rule directs the covered
entity to also notify prominent media outlets within the same
timeframe.\150\ The rule further provides that if a company receives
written notice from ``a law enforcement official'' requesting a delay
and specifying the length of the delay, then the company ``shall . . .
delay such notification, notice, or posting for the time period
specified by the official.'' \151\
---------------------------------------------------------------------------

    \149\ 45 CFR 164.404(b). The notification must describe the
breach, the types of unsecured protected health information
involved, steps the individuals should take to protect themselves,
what the entity is doing to mitigate harm and remediate, and where
the individuals can seek additional information. Id.
    \150\ 45 CFR 164.406.
    \151\ 45 CFR 164.412.
---------------------------------------------------------------------------

    We do not view Form 8-K Item 1.05 as implicated by the HHS rule.
Importantly, the HHS rule's delay provision applies specifically to any
``notification, notice, or posting required under this subpart,'' or in
other words notice to affected individuals, media, and the Secretary of
HHS.\152\ Such notification focuses on the consequences of the breach
for the affected individuals; for example, individuals must be told
what types of protected health information were accessed, and what
steps they should take to protect themselves from harm.\153\ This is
different from the disclosure required by Item 1.05, which focuses on
the consequences for the company that are material to investors, and
whose timing is tied not to discovery but to a materiality
determination. The HHS rule does not expressly preclude the latter type
of public disclosure, or other potential communications companies
experiencing a breach may make. Therefore, we believe that a registrant
subject to the HHS rule will not face a conflict in complying with Item
1.05.\154\
---------------------------------------------------------------------------

    \152\ Id.
    \153\ 45 CFR 164.404(c).
    \154\ For the same reason, the Federal Trade Commission's Health
Breach Notification rule, which is similar to HHS's rule, does not
present a conflict either. See 16 CFR part 318.
---------------------------------------------------------------------------

    We also considered the conflicts commenters alleged with
regulations and programs of DOD, DOE, DHS, the Federal banking
regulatory agencies, state insurance laws, and miscellaneous other
Federal agencies or laws. We find that, while there may be some overlap
of subject matter, Item 1.05 neither conflicts with nor impedes the
purpose of those regulations and programs.\155\ We disagree with one
commenter's assertion that cybersecurity incident disclosure ``falls
squarely within the jurisdiction of state insurance commissioners'' as
state cybersecurity incident reporting regulations would not pertain to
the ``business of insurance'' as courts have interpreted the McCarran-
Ferguson Act, and the commenter did not note any particular state
insurance laws that would present a conflict.\156\ With respect to
Federal banking regulatory agencies specifically, we note that, in the
event they believe that the disclosure of a material cybersecurity
incident would threaten the health of the financial system in such a
way that results in a substantial risk to national security or public
safety, they may, as explained above, work with the Department of
Justice to seek to delay disclosure.
---------------------------------------------------------------------------

    \155\ For example, one commenter alleged conflicts with DHS's
Chemical Facilities Anti-Terrorism Standards program (``CFATS'') and
with the Maritime Transportation Security Act (``MTSA''). See letter
from American Chemistry Council. Both CFATS and MTSA provide for the
protection of certain sensitive information, but neither is
implicated by cybersecurity incident disclosure to the Commission.
    \156\ See, e.g., SEC v. National Sec., Inc., 393 U.S. 453
(1969).
---------------------------------------------------------------------------

    It would not be practical to further harmonize Item 1.05 with other
agencies' cybersecurity incident reporting regulations, as one
commenter suggested,\157\ because Item 1.05 serves a different
purpose--it is focused on the needs of investors, rather than the needs
of regulatory agencies, affected individuals, or the like. With respect
to state insurance and privacy laws, commenters did not provide any
evidence sufficient to alter the Commission's finding in the Proposing
Release that, to the extent that Item 1.05 would require disclosure in
a situation where state law would excuse or delay notification, we
consider prompt reporting of material cybersecurity incidents to
investors critical to investor protection and well-functioning,
orderly, and efficient markets.
---------------------------------------------------------------------------

    \157\ See letter from BIO.
---------------------------------------------------------------------------

B. Disclosures About Cybersecurity Incidents in Periodic Reports

1. Proposed Amendments
    The Commission proposed to add new Item 106 to Regulation S-K to,
among other things, require updated cybersecurity disclosure in
periodic reports. If a registrant previously provided disclosure
regarding one or more cybersecurity incidents pursuant to Item 1.05 of
Form 8-K, proposed 17 CFR 229.106(d)(1) (Regulation S-K ``Item
106(d)(1)'') would require such registrant to disclose ``any material
changes, additions, or updates'' on the registrant's quarterly report
on Form 10-Q or annual report on Form 10-K.\158\ In addition, proposed
Item 106(d)(1) would require disclosure of the following information:
---------------------------------------------------------------------------

    \158\ Proposing Release at 16598.
---------------------------------------------------------------------------

     Any material effect of the incident on the registrant's
operations and financial condition;
     Any potential material future impacts on the registrant's
operations and financial condition;
     Whether the registrant has remediated or is currently
remediating the incident; and
     Any changes in the registrant's policies and procedures as
a result of the cybersecurity incident, and how the incident may have
informed such changes.\159\
---------------------------------------------------------------------------

    \159\ Id.
---------------------------------------------------------------------------

    The Commission explained that it paired current reporting under
Item 1.05 of Form 8-K with periodic reporting under 17 CFR 229.106(d)
(Regulation S-K ``Item 106(d)'') to balance investors' need for timely
disclosure with their need for complete disclosure.\160\ When an Item
1.05 Form 8-K becomes due, the Commission noted, a registrant may not
possess complete information about the material cybersecurity incident.
Accordingly, under the proposed rules, a registrant would provide the
information known at the time of the Form 8-K filing and follow up in
its periodic reports with more complete information as it becomes
available, along with any updates to previously disclosed information.
---------------------------------------------------------------------------

    \160\ Id.
---------------------------------------------------------------------------

    The Commission also proposed 17 CFR 229.106(d)(2) (Regulation S-K
``Item 106(d)(2)'') to require disclosure in a registrant's next
periodic report when, to the extent known to management, a series of
previously undisclosed individually immaterial cybersecurity incidents
become material in the aggregate.\161\ The Proposing Release explained
that this requirement may be triggered where, for example, a threat
actor engages in a number of smaller but continuous related
cyberattacks against the same company and collectively they become
material.\162\ Item 106(d)(2) would require disclosure of essentially
the

same information required in proposed Item 1.05 of Form 8-K, as
follows:
---------------------------------------------------------------------------

    \161\ Id. at 16599.
    \162\ Id.
---------------------------------------------------------------------------

     A general description of when the incidents were
discovered and whether they are ongoing;
     A brief description of the nature and scope of the
incidents;
     Whether any data were stolen or altered in connection with
the incidents;
     The effect of the incidents on the registrant's
operations; and
     Whether the registrant has remediated or is currently
remediating the incidents.\163\
---------------------------------------------------------------------------

    \163\ Id. at 16619-16620.
---------------------------------------------------------------------------

2. Comments
    Reaction among commenters to proposed Item 106(d)(1) was mixed.
Some wrote in support, noting that updated incident disclosure is
needed to avoid previously disclosed information becoming stale and
misleading as more information becomes available, and saying that
updates help investors assess the efficacy of companies' cybersecurity
procedures.\164\ Others took issue with specific aspects of the
proposed rule. For example, some commenters stated that the proposed
requirement to disclose ``any potential material future impacts'' is
vague and difficult to apply, and urged removing or revising it.\165\
Similarly, other commenters said that registrants should not be
required to describe progress on remediation, noting that such
information could open them up to more attacks.\166\ In the same vein,
one commenter suggested that no updates be required until remediation
is sufficiently complete.\167\ One commenter said the requirement to
disclose changes in policies and procedures is unnecessary and overly
broad,\168\ and another commenter said the requirement should be
narrowed to ``material changes.'' \169\
---------------------------------------------------------------------------

    \164\ See letters from AICPA; Crindata; R Street. See also IAC
Recommendation.
    \165\ See letters from EEI; Prof. Perullo; PWC; SCG.
    \166\ See letters from BCE; BPI et al.; Enbridge. See also
letter from EEI (suggesting narrowing the rule to ``material
remediation,'' and delaying such disclosure until remediation is
complete).
    \167\ See letter from EEI.
    \168\ See letter from Prof. Perullo.
    \169\ See letter from EEI.
---------------------------------------------------------------------------

    More generally, commenters sought clarification on how to
differentiate instances where updates should be included in periodic
reports from instances where updates should be filed on Form 8-K; they
found the guidance in the Proposing Release on this point ``unclear.''
\170\ And one commenter argued that, regardless of where the update is
filed, the incremental availability of information would make it
difficult for companies to determine when the update requirement is
triggered.\171\
---------------------------------------------------------------------------

    \170\ See letter from PWC; accord letter from Deloitte. The
Proposing Release stated: ``Notwithstanding proposed Item 106(d)(1),
there may be situations where a registrant would need to file an
amended Form 8-K to correct disclosure from the initial Item 1.05
Form 8-K, such as where that disclosure becomes inaccurate or
materially misleading as a result of subsequent developments
regarding the incident. For example, if the impact of the incident
is determined after the initial Item 1.05 Form 8-K filing to be
significantly more severe than previously disclosed, an amended Form
8-K may be required.'' Proposing Release at 16598.
    \171\ See letter from Quest.
---------------------------------------------------------------------------

    With respect to proposed Item 106(d)(2), a large number of
commenters expressed concern about the aggregation requirement, saying,
for example, that companies experience too many events to realistically
communicate internally upward to senior management, and that retaining
and analyzing data on past events would be too costly.\172\ A number of
other commenters relatedly said that, for the aggregation requirement
to be workable, companies need more guidance on the nature, timeframe,
and breadth of incidents that should be collated.\173\ In this regard,
one supporter of the requirement explained in its request for
additional guidance that ``cybersecurity incidents are so unfortunately
common that a strict reading of this section could cause overreporting
to the point that it is meaningless for shareholders.'' \174\
---------------------------------------------------------------------------

    \172\ See letters from ABA; ACLI; AIA; Business Roundtable; EEI;
Enbridge; Ernst & Young LLP (``E&Y''); FAH; FedEx; Center on Cyber
and Technology Innovation at the Foundation for Defense of
Democracies (``FDD''); GPA; Hunton; ITI; ISA; LTSE; Microsoft;
Nareit; NAM; NDIA; NRA; Prof. Perullo; SCG; SIFMA.
    \173\ See letters from ACC; APCIA; BDO USA, LLP (``BDO''); BPI
et al.; CAQ; Chamber; Chevron; Deloitte; EIC; FEI; M. Barragan; PWC;
R Street.; TransUnion.
    \174\ See letter from R Street.
---------------------------------------------------------------------------

    Some commenters suggested revising the rule to cover only
``related'' incidents.\175\ Possible definitions offered for
``related'' incidents included those ``performed by the same malicious
actor or that exploited the same vulnerability,'' \176\ and those
resulting from ``attacks on the same systems, processes or controls of
a registrant over a specified period of time.'' \177\ Suggestions for
limiting the time period over which aggregation should occur included
the preceding one year,\178\ and the preceding two years.\179\ One
commenter requested the Commission clarify that a company's Item
106(d)(2) disclosure need describe only the aggregate material impact
of the incidents, rather than describing each incident individually;
the commenter was concerned with threat actors becoming informed of a
company's vulnerabilities through overly detailed disclosure.\180\
Another commenter suggested granting registrants additional time to
come into compliance with Item 106(d)(2) after Commission adoption, so
that they can develop system functionality to retain details about
immaterial incidents.\181\
---------------------------------------------------------------------------

    \175\ See letters from ABA; APCIA; EEI; E&Y PWC.
    \176\ See letter from ABA.
    \177\ See letter from E&Y.
    \178\ See letter from APCIA.
    \179\ See letter from EEI.
    \180\ See letter from AGA/INGAA.
    \181\ See letter from Deloitte.
---------------------------------------------------------------------------

    Commenters also wrote in support of the aggregation
requirement.\182\ One of these commenters stated that aggregation is
needed especially where an advanced persistent threat actor \183\ seeks
to exfiltrate data or intellectual property over time.\184\
---------------------------------------------------------------------------

    \182\ See letters from CII; CSA; R Street; NASAA.
    \183\ The National Institute of Standards and Technology
explains that an advanced persistent threat ``is an adversary or
adversarial group that possesses the expertise and resources that
allow it to create opportunities to achieve its objectives by using
multiple attack vectors, including cyber, physical, and deception.
The APT objectives include establishing a foothold within the
infrastructure of targeted organizations for purposes of
exfiltrating information; undermining or impeding critical aspects
of a mission, function, program, or organization; or positioning
itself to carry out these objectives in the future. The APT pursues
its objectives repeatedly over an extended period, adapts to
defenders' efforts to resist it, and is determined to maintain the
level of interaction needed to execute its objectives.'' National
Institute of Standards and Technology, NIST Special Publication 800-
172, Enhanced Security Requirements for Protecting Controlled
Unclassified Information (Feb. 2021), at 2.
    \184\ See letter from CSA.
---------------------------------------------------------------------------

3. Final Amendments
    In response to comments, we are not adopting proposed Item
106(d)(1) and instead are adopting a new instruction to clarify that
updated incident disclosure must be provided in a Form 8-K amendment.
Specifically, we are revising proposed Instruction 2 to Item 1.05 of
Form 8-K to direct the registrant to include in its Item 1.05 Form 8-K
a statement identifying any information called for in Item 1.05(a) that
is not determined or is unavailable at the time of the required filing
and then file an amendment to its Form 8-K containing such information
within four business days after the registrant, without unreasonable
delay, determines such information or within four business days after
such information becomes available. This change mitigates commenters'
concerns with Item 106(d)(1). In particular, under the final rules,
companies will not have to distinguish whether information

regarding a material cybersecurity incident that was not determined or
was unavailable at the time of the initial Form 8-K filing should be
included on current reports or periodic reports, as the reporting would
be in an amended Form 8-K; details that commenters suggested raised
security concerns, such as remediation status, are not required; and
concerns that the proposed rule was vague or overbroad have been
addressed by narrowing the required disclosure to the information
required by Item 1.05(a). We also believe that use of a Form 8-K
amendment rather than a periodic report will allow investors to more
quickly identify updates regarding incidents that previously were
disclosed.
    We appreciate that new information on a reported cybersecurity
incident may surface only in pieces; the final rules, however, do not
require updated reporting for all new information. Rather, Instruction
2 to Item 1.05 directs companies to file an amended Form 8-K with
respect to any information called for in Item 1.05(a) that was not
determined or was unavailable at the time of the initial Form 8-K
filing. Other than with respect to such previously undetermined or
unavailable information, the final rules do not separately create or
otherwise affect a registrant's duty to update its prior statements. We
remind registrants, however, that they may have a duty to correct prior
disclosure that the registrant determines was untrue (or omitted a
material fact necessary to make the disclosure not misleading) at the
time it was made \185\ (for example, if the registrant subsequently
discovers contradictory information that existed at the time of the
initial disclosure), or a duty to update disclosure that becomes
materially inaccurate after it is made \186\ (for example, when the
original statement is still being relied on by reasonable investors).
Registrants should consider whether they need to revisit or refresh
previous disclosure, including during the process of investigating a
cybersecurity incident.\187\
---------------------------------------------------------------------------

    \185\ See Backman v. Polaroid Corp., 910 F.2d 10, 16-17 (1st
Cir. 1990) (en banc) (finding that the duty to correct applies ``if
a disclosure is in fact misleading when made, and the speaker
thereafter learns of this'').
    \186\ See id. at 17 (describing the duty to update as
potentially applying ``if a prior disclosure `becomes materially
misleading in light of subsequent events''' (quoting Greenfield v.
Heublein, Inc., 742 F.2d 751, 758 (3d Cir. 1984))). But see
Higginbotham v. Baxter Intern., Inc., 495 F.3d 753, 760 (7th Cir.
2007) (rejecting duty to update before next quarterly report);
Gallagher v. Abbott Laboratories, 269 F.3d 806, 808-11 (7th Cir.
2001) (explaining that securities laws do not require continuous
disclosure).
    \187\ Relatedly, registrants should be aware of the requirement