On June 20, the Director of the Division of Corporation Finance released a statement addressing clarifying the questions and concerns of cybersecurity incident disclosure and selective disclosure issues under Regulation FD. Here’s a breakdown of the new Compliance and Disclosure Interpretations (C&DIs) and the director’s recent statement. 

Question 104B.05: Materiality Determination for Ransomware Attacks 

• Clarifies that even if a ransomware incident is resolved prior to a materiality determination (e.g., due to a ransomware payment), companies must still assess the materiality of the incident. 

Question 104B.06: Reporting Obligations Post-Ransomware Payment 

• States that if a company determines a cybersecurity incident is material, it must file an Item 1.05 Form 8-K within four business days, even if the incident is resolved (e.g., through a ransomware payment) before the deadline. The obligation to report remains regardless of the incident’s resolution. 

Question 104B.07: Impact of Cybersecurity Insurance on Materiality 

• Emphasizes that having cybersecurity insurance does not automatically render an incident immaterial. Companies must consider all relevant facts, including immediate and long-term impacts on operations, finances, brand perception, and customer relationships, as well as changes in insurance availability or costs. 

Question 104B.08: Ransom Payment Size in Materiality Assessment 

• Clarifies that the size of a ransomware payment is just one factor in determining materiality. A small ransom payment does not necessarily mean the incident is immaterial. Companies should assess the overall context and impact of the incident, considering both quantitative and qualitative harms. 

Question 104B.09: Cumulative Materiality of Multiple Cyber Incidents 

• Addresses situations where a company faces a series of individually immaterial cybersecurity incidents. Companies must assess whether these incidents, collectively, are material. For example, continuous smaller attacks by the same threat actor or multiple attacks exploiting the same vulnerability could cumulatively be material. 

Director’s Statement on Selective Disclosure Regarding Cybersecurity Incidents 

• Erik Gerding, the director of the Division of Corporation Finance, released a statement clarifying that the SEC’s new cybersecurity rules do not restrict companies from discussing cybersecurity incidents beyond what is disclosed in an Item 1.05 Form 8-K. He reassured companies that privately disclosing additional information does not necessarily trigger Regulation FD requirements if the information shared is immaterial or shared with persons not covered by Regulation FD, such as attorneys, investment bankers, or under confidentiality agreements. 

Conclusion 

The SEC’s new C&DIs and Gerding’s statement highlight the increased focus on cybersecurity disclosures and the complexities companies face under the new regime. Companies are advised to consult with legal counsel and knowledgeable advisors when navigating cybersecurity threats or incidents to ensure compliance with the latest disclosure requirements. If you’re interested in learning more about the SEC’s requirements, our team would love to help you understand the requirements and help you to achieve/maintain compliance. You can reach us via our Contact form at https://layer8security.com/contact-us/. 

BACK TO BLOGS