The Definitive Guide to Mandated SEC 10-K Cybersecurity Disclosures

SEC final cyber security disclosure requirements

As of December 18, 2023, the newly implemented SEC cybersecurity rules are now in effect. These rules, issued by the SEC, pertain to cybersecurity disclosure requirements and are applicable to all publicly traded companies.

This article delves into the Mandated SEC 10-K Cybersecurity Disclosures, examining their impact on your company’s annual reporting and detailing the critical components to include in your company’s 10-K for the 2023 fiscal year. We will outline the specifics of these disclosures and highlight the sections of the 10-K that necessitate attention. Conducting an audit or assurance process is essential to ensure these disclosures are accurate and consistent. Furthermore, we discuss how these disclosures are an integral part of the company’s annual report to shareholders.

Covered Companies

All publicly traded companies with equity securities listed on a U.S. stock exchange must adhere to SEC regulations, including the mandated SEC 10-K cybersecurity disclosures. Foreign companies listed on U.S. exchanges are also subject to these requirements.

However, private companies are not under the SEC’s jurisdiction, as they are not required to submit annual reports to the Commission.

The Final SEC 10-K Cybersecurity Disclosures

Understanding the rationale behind the new rules is crucial for these disclosures. The objective of the new SEC 10-K cybersecurity disclosure rules is to inform shareholders without necessitating a deep understanding of how companies manage their cyber risks. The final rules require the disclosure of information material to investment decisions, so it is easy to locate while not disclosing security-sensitive details.

Action: Create a section under Item 1 and label it Cyber Risk Program.

The final rules emphasize processes rather than policies and procedures. This shift to ‘process’ disclosure means your company is not obligated to disclose whether you have written policies or procedures. The focus is on ‘material’ risks, excluding risk types such as intellectual property theft, fraud, extortion, or privacy law violations.

Action: Create a section under Items 1 and label it Cyber Risk Governance

The final rules concerning management’s involvement in cyber risk have not substantially changed from the draft. There is a need to state the expertise of the individual responsible for cyber risk management.

Action: Create a section under Items 1 and label it Cyber Risk Manager(s)

For more information on items in the annual report on form 10-k see here.

Download Playbook

Cybersecurity Risk Management Program Disclosure Rules

Disclosure requirement 1:

The registrant maintains a cybersecurity risk management program.

Your company must confirm the existence of a cybersecurity risk management program and provide a brief description (2-3 sentences) of this program. Additionally, you need to explain how material cyber risks are managed and whether they are integrated into the broader risk management framework, in compliance with regulatory requirements for managing material risks. The SEC’s disclosure requirements set forth under Item 1.05 of Form 8-K and Item 106 of Regulation S-K mandate that entities disclose material cybersecurity incidents, including the specifics of what must be disclosed, the timelines, and the qualitative factors for assessing the materiality of incidents.

Disclosure requirement 2:

Engagement with third parties for risk management. The registrant employs assessors, consultants, auditors, or other third-party entities as part of its cybersecurity risk assessment program.

Your company should indicate whether third parties are engaged in your cyber risk management program. If applicable, provide a succinct description (2-3 sentences) of their involvement.

Disclosure requirement 3:

Oversight of third-party cyber risks. The registrant has established a process to identify and manage cybersecurity risks associated with third-party service providers.

If your company utilizes third-party service providers, you must disclose whether there is a process in place to oversee and manage the cyber risks they present. Provide a brief explanation (2-3 sentences) of this oversight process, if applicable.

Disclosure requirement 4:

Material risks or incidents. This involves material cybersecurity-related risks and incidents that have materially affected or are likely to materially affect the registrant’s operational outcomes or financial status.

Has your company faced cyber risks or incidents that have significantly affected your operations or financial performance? Previous cybersecurity incidents should also be disclosed, detailing how they have materially affected your company’s operations, governance, and risk management strategies. As part of this requirement, your company must confirm the accuracy of this statement. If applicable, provide details of such incidents, or state that no such risks or incidents have been encountered.

The following are NOT required under the final SEC cyber rules:

The company’s cyber risk management policies and procedures
The company’s incident management policies, and process
The company’s BCP/DR policies, and process in the event of an incident
The company’s corrective actions as a result of previous incidents

Cyber Risk Governance Disclosure Rules

Disclosure requirement 5:

Board of Directors oversight. Whether the Board or a Board committee is tasked with overseeing cybersecurity risks and whether the Board considers these risks

For this requirement, your company should indicate if the Audit Committee or another Board committee is responsible for cyber risk oversight. If so, identify the responsible body and briefly describe the program in 2-3 sentences. Additionally, outline how the Board committee or Board members incorporate material risks from cybersecurity into the overall business and risk management strategy.

Disclosure requirement 6:

Reporting to the Board of Directors. The method by which the board is kept informed about cybersecurity risks. The SEC does not require disclosure of the frequency of these reports and discussions.

Your company must explain how the Board of Directors is informed about cybersecurity risks and the manner of these discussions. It is advisable to describe the escalation process and potentially how the Board is informed of any material cyber incident disclosures.

Role of Management in Cyber Risk Disclosure Rules

Disclosure requirement 7:

Managing and monitoring Cyber risks. Whether management or committees are responsible for assessing and managing cybersecurity risk, including the prevention, mitigation, detection, and resolution of cyber incidents, and the expertise and training of such individuals.

For this requirement, your company should specify who is accountable for monitoring cybersecurity incidents. You also need to outline the responsibilities associated with these requirements. Does the individual have the necessary training or expertise to manage this function? Additionally, determine whether risks from cybersecurity threats, including previous incidents, have materially affected or are likely to materially affect your operations, business strategy, and financial condition. Provide a brief description of the process.

Disclosure requirement 8:

Cyber risk manager or personnel. Whether the registrant has a designated chief information security officer or someone in a similar role, and if so, to whom that person reports within the organizational hierarchy, along with the relevant expertise of these individuals.

Your company must identify the person responsible for cyber risk management, either by name or title. Describe the roles and responsibilities assigned to this individual and detail their training or expertise. Provide a concise description of the process.

Disclosure requirement 9:

Reporting to the Board of Directors. Whether and how often such individuals or committees report to the Board of Directors or a Board committee on cybersecurity risk.

Your company needs to explain the process by which the individual responsible for cyber risk management reports to the Board of Directors. For instance, the CISO may provide quarterly reports to the CEO, who then presents annual reports to the Board.

Disclosing Material Cybersecurity Incidents

When it comes to disclosing material cybersecurity incidents, companies must file an Item 1.05 Form 8-K, detailing the nature, scope, and timing of the incident. The initial Form 8-K filing should provide investors with essential information about the incident, even if the full impact has not yet been determined. Companies should include a statement indicating that the impact (or reasonably likely impact) of the incident is still under assessment. It is crucial to consider qualitative factors when evaluating the impact of a cybersecurity incident, such as potential harm to reputation, relationships with customers or vendors, competitiveness, and the likelihood of litigation or regulatory investigations.

Temporary Delay of Disclosure for National Security or Public Safety Concerns

In certain circumstances, registrants may delay the filing of Form 8-K if the U.S. Attorney General determines that such disclosure poses a substantial risk to national security or public safety. In such cases, the registrant must notify the SEC in writing, including a statement that the disclosure poses a substantial risk to national security or public safety. Additionally, the registrant must provide a copy of this notification to the U.S. Attorney General. This provision ensures that critical national security and public safety concerns are appropriately balanced with the need for transparency in cybersecurity disclosures.

Resources and Support for Compliance

The SEC offers a range of resources and support to help companies comply with the new rule. The Commission’s Division of Corporation Finance is available to assist small companies and others with questions regarding the new rules. Additionally, the Division’s Office of Small Business Policy provides support to small entities and others with questions about the rules applicable to business development companies. The SEC’s website also offers guidance on cyber disclosures, including best practices for disclosure controls and procedures to assess the impact of a breach on the company’s business, financial condition, and results of operations.

Best Practices for Compliance

To ensure compliance with the SEC’s cyber disclosure rule, companies should adopt several best practices. First, develop a comprehensive cybersecurity risk management strategy and governance framework. Establish clear internal escalation and external reporting processes for cybersecurity incidents. When assessing the impact of a cybersecurity incident, consider qualitative factors such as reputational harm and potential litigation. Document the materiality determination process, including the rationale and basis for decisions. Utilize a standard template for reporting incidents to ensure consistency and compliance with the new requirements. Finally, balance the need for compliance with the protection of confidential information about your cybersecurity procedures and program. By following these best practices, companies can effectively manage and disclose cybersecurity risks.

Summary

Public companies now have new cybersecurity reporting obligations. These companies must disclose their cybersecurity risk management program and process, along with updates on their cybersecurity measures and any significant cyber events that occur within their organizations.

Download Playbook