SEC’s Corp Fin Director Issues Statement on Cybersecurity Incident Disclosures

On May 21, 2024, the SEC’s Director of the Division of Corporation Finance issued a statement on cybersecurity incident disclosures in light of the SEC’s new cybersecurity disclosure rules. The statement advises on (1) when disclosure should be made under an Item 1.05 Form 8-K (Material Cybersecurity Incidents), versus another Item, such as Item 8.01 (Other Events), and (2) materiality determinations generally for cybersecurity incidents. The statement by Erik Gerding was provided in his official capacity as the Commission’s Director of Division of Corporation Finance but notes that it does not necessarily reflect the views of the Commission and does not alter or amend applicable law.¹

Summary of Gerding’s Statement

In summary, Director Gerding advises the following in his statement: 

• Item 1.05 for Material Cybersecurity Incident Versus Item 8.01 for Immaterial Incidents. In cases where a company chooses to voluntarily disclose a cybersecurity incident for which it has not yet made a materiality determination (or a cybersecurity incident that the company already determined was not material), the “Division of Corporation Finance encourages the company to disclose that cybersecurity incident under a different item of Form 8-K (for example, Item 8.01)” titled “Other Events” – rather than under the newly adopted Item.1.05 of the Form 8-K titled “Material Cybersecurity Incidents.”
• Item 8.01 Form 8-K for Immaterial Incident, Followed by Item 1.05 if Incident Becomes Material. If a company chooses to disclose an immaterial incident (or one for which it has not yet made a materiality determination) under Item 8.01 of Form 8-K, and it subsequently determines that the incident is material, it should file an Item 1.05 Form 8-K within four business days of such subsequent materiality determination. That subsequent Form 8-K on Item 1.05 may refer to the earlier Item 8.01 Form 8-K and will need to satisfy the requirements of Item 1.05.

In addition, Director Gerding addresses the following:

• Assess All Relevant Factors to Determine Materiality. In determining whether a cybersecurity incident is material, companies should assess “all relevant factors” – in particular, a materiality assessment should “not be limited to the incident’s impact on the company’s financial condition and results of operation” and should “consider qualitative factors alongside quantitative factors,” such as whether the incident will harm its “reputation, customer or vendor relationships, or competitiveness” as well as consider “the possibility of litigation or regulatory investigations or actions, including regulatory actions by state and Federal Governmental authorities and non-U.S. authorities.”
• Ability to Determine a Cybersecurity Incident is Material, Before Impacts are Known. In cases where a cybersecurity incident is so significant that a company concludes that it is material even though the company has not yet determined its impact (or reasonably likely impact), the company should disclose the incident in an Item 1.05 Form 8-K, include a statement noting that the company has not yet determined the impact (or reasonably likely impact) of the incident, and then amend the Form 8-K to disclose the impact once that information is available. As the statement notes, the initial Form 8-K filing should still “provide investors with information necessary to understand the material aspects of the nature, scope, and timing of the incident, notwithstanding the company’s inability to determine the incident’s impact (or reasonably likely impact) at that time.”

The Director’s statement explains that it is “not intended to discourage companies from voluntarily disclosing cybersecurity incidents for which they have not yet made a materiality determination, or from disclosing incidents that companies determine to be immaterial.” Rather, the intent of the statement is to “encourage the filing of such voluntary disclosures in a manner that does not result in investor confusion” and it acknowledges the value of such voluntary disclosures to investors, the marketplace, and ultimately to companies. At the same time, the statement emphasizes that, as noted in the adopting release, “Item 1.05 is not a voluntary disclosure, and it is by definition material because it is not triggered until the company determines the materiality of an incident.” As a result, the statement posits that “if all cybersecurity incidents are disclosed under Item 1.05, then there is a risk that investors will misperceive immaterial cybersecurity incidents as material, and vice versa.”

White & Case Survey of Disclosures

White & Case’s Public Company Advisory Group has been tracking Form 8-K cybersecurity incident disclosures since December 18, 2023, the effective date of the new rules. Between December 18, 2023, and May 23, 2024, 22 companies filed a total of 35 cybersecurity incident-related 8-Ks, either disclosing cybersecurity incidents or updating information on previously disclosed incidents:

• 22 were Form 8-Ks and 13 were Form 8-K/As to update previous disclosures
• 26 of these were under Item 1.05 “Material Cybersecurity Incidents” 
• 7 of these were under Item 8.01 “Other Events”
• 2 of these were under Item 7.01 “Regulation FD Disclosure”²
• Of the 26 filed under Item 1.05, a total of 23, or 88%, explicitly stated that they did not have a material impact or that the company had not yet made a materiality determination regarding the incident.
• Of the nine filed under other items (Item 8.01 or Item 7.01), a total of eight, or 89%, explicitly stated that they did not have a material impact or that the company had not yet made a materiality determination.

For more information on our survey, including data on the actual impacts disclosed and timing of the disclosures, as well as survey information on annual report on Form 10-K/20-F cybersecurity disclosures, please contact the authors of this client alert. 

Conclusion

Director Gerding’s statement was issued in an environment that provides numerous challenges for public companies as they consider how, when and whether to disclose information about a cybersecurity incident. Companies are routinely subject to cybersecurity incidents, the vast majority of which are not significant, and beyond an item number for a Form 8-K,³ companies are weighing how, when and whether to disclose these incidents in the face of potential media scrutiny, notification requirements under various cybersecurity incident and data breach notification regulations, the potential for regulatory scrutiny and enforcement,⁴ threats of private action from the plaintiff’s bar, as well as volatile developments with respect to the cybersecurity incidents, among other concerns. Accordingly, as companies consider their disclosures on cybersecurity incidents, the focus should remain on the controls necessary to determine whether an incident is material and on the substantive disclosures that will ultimately be helpful for investors and companies in light of the applicable facts and circumstances.

The following White & Case attorneys authored this alert: Maia Gez, Scott Levi, F. Paul Pittman, Michelle Rutta, Joel Cohen, Tami Stark, Danielle Herrick

_{1 See Footnote 1 of the statement, which also notes that “this statement, like all staff statements, has no legal force or effect: it does not alter or amend applicable law, and it creates no new or additional obligations for any person.”
2 Note that three of the Form 8-Ks filed under Item 1.05 also filed Item 7.01 disclosure in the same Form 8-K.
3 The item numbers in a Form 8-K tend to be a technical aspect of disclosure and SEC form compliance. With regard to fundamental antifraud liability concerns, it is important to remember that the substance of the disclosure is the information being provided to investors, regardless of the item number used. For additional considerations, also see Instruction 3 of the Form 8-K and market practice for using the Item 5.03 item number even when not technically required. 
4 See our client alert on the Solarwinds case. The defendants in the case have since filed a motion to dismiss the case and rejected the SEC’s claims, arguing that its disclosure in a Form 8-K had disclosed the key facts about the attack only one trading day after the company learned of the incident.} 

_{White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.}

_{This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.}

_{© 2024 White & Case LLP}