1. Proposed Amendments

The Commission proposed to amend Form 8-K by adding new Item 1.05 that would require a registrant to disclose the following information regarding a material cybersecurity incident, to the extent known at the time of filing:

• • When the incident was discovered and whether it is ongoing;
  • A brief description of the nature and scope of the incident;
  • Whether any data were stolen, altered, accessed, or used for any other unauthorized
    purpose
  • The effect of the incident on the registrant’s operations; and
  • Whether the registrant has remediated or is currently remediating the incident.

The Commission clarified in the Proposing Release that this requirement would not extend to specific, technical information about the registrant’s planned response to the incident or its cybersecurity systems, related networks and devices, or potential system vulnerabilities in such detail as would impede the registrant’s response or remediation of the incident.

The Commission proposed to set the filing trigger for Item 1.05 as the date the registrant determines that a cybersecurity incident is material; as with all other Form 8-K items, the proposed filing deadline would be four business days after the trigger. To protect against any inclination on the part of a registrant to delay making a materiality determination with a view toward prolonging the filing deadline, the Commission proposed adding Instruction 1 to Item 1.05 requiring that “a registrant shall make a materiality determination regarding a cybersecurity incident as soon as reasonably practicable after discovery of the incident.”

The Commission affirmed in the Proposing Release that the materiality standard registrants should apply in evaluating whether a Form 8-K would be triggered under proposed Item 1.05 would be consistent with that set out in the numerous cases addressing materiality in the securities laws, including TSC Industries, Inc. v. Northway, Inc., Basic, Inc. v. Levinson, and Matrixx Initiatives, Inc. v. Siracusano, and likewise with that set forth in 17 CFR 230.405 (“Securities Act Rule 405”) and 17 CFR 240.12b-2 (“Exchange Act Rule 12b-2”). That is, information is material if “there is a substantial likelihood that a reasonable shareholder would consider it important” in making an investment decision, or if it would have “significantly altered the ‘total mix’ of information made available.” “Doubts as to the critical nature” of the relevant information should be “resolved in favor of those the statute is designed to protect,” namely investors.

The Commission explained that the timely disclosure of the information required by proposed Item 1.05 would enable investors and other market participants to assess the possible effects of a material cybersecurity incident on the registrant, including any short- and long-term financial effects or operational effects, resulting in information useful for their investment decisions. Aligning the deadline for Item 1.05 with that of the other Form 8-K items would, the Commission maintained, significantly improve the timeliness of cybersecurity incident disclosures as well as standardize those disclosures. The Commission did not propose to provide a reporting delay in cases of ongoing internal or external investigations of cybersecurity incidents. Nevertheless, the Proposing Release requested comment on whether to allow a delay in reporting where the Attorney General determines that a delay is in the interest of national security.

         2. Comments

Proposed Item 1.05 received a significant amount of feedback from commenters. Some commenters supported Item 1.05 as proposed, saying that the current level of disclosure on cybersecurity incidents is inadequate to meet investor needs, and Item 1.05 would remedy this inadequacy by effectuating the disclosure of decision-useful information. One commenter also anticipated that Item 1.05 would reduce the risk of insider trading by shortening the time between discovery of an incident and public disclosure.

Other commenters opposed proposed Item 1.05, for several reasons. Some commenters said that if proposed Item 1.05 were to result in disclosure while an incident is still ongoing, it would tip off the threat actor and thus make successful neutralization of the incident more difficult. Commenters also expressed concern that public notice of a vulnerability could draw attacks from other threat actors who were previously unaware of the vulnerability; and such attacks could target the disclosing registrant or other companies with the same vulnerability, particularly if the vulnerability is with a third-party service provider used by multiple companies. Some of these commenters objected specifically to the requirement in Item 1.05 to disclose whether remediation has occurred, stating that this information could assist threat actors in their targeting or invite further targeted attacks, while others more generally stated that the Item 1.05 disclosure would be overly detailed, such that it would give a road map to threat actors for planning attacks. One commenter argued that the prospect of possibly having to file an Item 1.05 Form 8-K could chill threat information sharing within industries, because companies would fear that any cybersecurity risk information they share could later be used to question their disclosure decisions.

Some of the commenters that disagreed with the level of disclosure required by proposed Item 1.05 recommended that the Commission narrow the disclosure requirements of the rule.For example, one such commenter advised dropping the proposed requirement to disclose “when the incident was discovered,” arguing that this detail may cause confusion, particularly where an incident was detected some time ago but a significant aspect rendering it material surfaced only recently. Another commenter opined that “whether the registrant has remediated or is currently remediating the incident” is duplicative of “whether it is ongoing,” so either of the two could be eliminated. One commenter contended that a materiality filter should be added to the details required by Item 1.05, such that companies would have to disclose only details that themselves are material, rather than immaterial details of a material incident.

By contrast, there were also commenters that recommended expanding the disclosure requirements in the proposed rule. In this regard, some commenters recommended requiring that registrants disclose asset losses, intellectual property losses, and the value of business lost due to the incident. Other suggestions included requiring that incidents be quantified as to their severity and impact via standardized rating systems, and that registrants disclose how they became aware of the incident, as this may shed light on the effectiveness of a company’s cybersecurity policies and procedures. Additionally, commenters suggested banning trading by insiders during the time between the materiality determination and disclosure of the incident.

Commenters provided reactions to the application of Item 1.05 to incidents connected with third-party systems. A number of commenters contended that registrants should be exempt from having to disclose cybersecurity incidents in third-party systems they use because of their reduced control over such systems. Similarly, several commenters advocated for a safe harbor for information disclosed about third-party systems, given registrants’ reduced visibility into such systems. A few commenters suggested a longer reporting timeframe for third-party incidents, because the registrant may be dependent on the third party for information (which may not be provided in a timely manner), and to avoid harm to other companies reliant on the same third party. Commenters also recommended that Item 1.05 be phased in over a longer period of time with respect to third-party incidents, to give registrants time to develop information sharing processes with their third-party service providers.

Commenters also requested guidance or otherwise raised concerns where the proposed requirements might trigger disclosures by third-party service providers. A commenter requested clarity on whether an incident should be disclosed by the third-party service provider registrant that owns the affected system or the customer registrant that owns the affected information, or both. And two commenters argued that third-party service providers should simply pass along information to their end customers, who would then make their own materiality determination and disclose accordingly; this should particularly be the case, a commenter said, where an attack on a third-party data center results in a data breach for an end customer but does not affect the services the data center provides.

The proposed timing of incident disclosure also received a significant level of public comment. For example, a few commenters said the level of detail required by Item 1.05 is impractical to produce in the allotted time. Other commenters said that the proposed deadline would lead to the disclosure of tentative, unclear, or potentially inaccurate information that is not decision-useful to investors, resulting in the market mispricing the underlying securities. Commenters also argued that Item 1.05 is qualitatively different from all other Form 8-K items in that the trigger for Item 1.05 is largely outside the company’s control. Some commenters worried the proposed deadline would lead to disclosure of “false positives,” that is, incidents that appear material at first but later on with the emergence of more information turn out not to be material.

Commenters suggested a range of alternative reporting deadlines for Item 1.05. A common suggestion was to modify the measurement date from the determination of materiality to another point in the lifecycle of the incident when the incident is no longer a threat to the registrant—commenters variously termed this as “containment,” “remediation,” “mitigation,” and comparable terms. One commenter recommended conditioning a reporting delay on the registrant being actively engaged in containing the incident and reasonably believing that containment can be completed in a timely manner. Similarly, several commenters recommended that the rule allow for a delay in providing Item 1.05 disclosure based on a registrant’s assessment of the potential negative consequences of public disclosure, using a variety of measures they suggested. Another suggestion was to replace the proposed deadline with an instruction to disclose material incidents “without unreasonable delay.”

Some commenters recommended instead increasing the number of days between the reporting trigger and the reporting deadline. A few commenters recommended adding one business day to make the deadline five business days; one noted this would result in every registrant having at least a full calendar week to gather information and prepare the Form 8-K. Another commenter recommended a deadline of 15 business days, along with a cure period to allow registrants a defined period of time to fix potential reporting mistakes.  A few commenters recommended a 30-day deadline, with their choice of 30 days tending to be a proxy for some other factor, such as containment or remediation,  or state notification requirements.

Several commenters recommended addressing the timing concerns by replacing current reporting on Form 8-K with periodic reporting on Forms 10-Q and 10-K, to allow additional time to assess an incident’s impact before reporting to markets. In this vein, one commenter likened cybersecurity incident disclosure to the disclosure of legal proceedings under Regulation S-K Item 103.

A few commenters recommended instead that the materiality trigger be replaced with a quantifiable trigger; for example, an incident implicating a specified percentage of revenue, or the costs of an incident exceeding a specified benchmark, could trigger disclosure. Other commenters advocated for the disclosure trigger to be tied to any legal obligation that forces a registrant to notify persons outside the company.

Commenters also recommended a number of exceptions to the filing deadline. The most common recommendation was to include a provision allowing for delayed filing where there is an active law enforcement investigation or the disclosure otherwise implicates national security or public safety. A representative comment in this vein advanced a provision whereby registrants may “delay reporting of a cybersecurity incident that is the subject of a bona fide investigation by law enforcement,” because such “delay in reporting may not only facilitate such an investigation, it may be critical to its success.”

In calling for a law enforcement delay, associations for industries in critical sectors emphasized the national security implications of public cybersecurity incident disclosure. For example, one association explained that disclosure “may alert malicious actors that we have uncovered their illegal activities in circumstances where our defense and intelligence agencies wish to keep that information secret.” Likewise, another association pointed out that, in its industry, companies “are likely to possess some of the nation’s most critical confidential information, including cybersecurity threat information furnished by government entities, such as the Federal Bureau of Investigation (FBI), the Department of Homeland Security (DHS), and the National Security Agency (NSA),” and therefore, disclosure may not be possible.

Commenters largely advocated for “a broad law enforcement exception that applies not only in the interest of national security but also when law enforcement believes disclosure will hinder their efforts to identify or capture the threat actor.” Many commenters that responded to the Commission’s request for comment regarding a provision whereby the Attorney General determines that a delay is in the interest of national security indicated that such a provision should be more expansive and extend to other law enforcement authorities. One of these commenters questioned whether the Attorney General would opine on matters “that are under the ambit of other Federal agencies, such as the Department of Homeland Security, Department of State and the Department of Defense.” Another commenter pointed out that “the Department of Justice is not the primary, or even the lead, organization in the Federal government for cybersecurity response, rather the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency is often the first call that companies make,” while “for defense contractors, the Department of Defense is likely to have the highest interest in the timing of an announcement.” For the financial industry specifically, one suggestion was to permit a delay if the Federal Reserve, Federal Deposit Insurance Corporation, or Office of the Comptroller of the Currency finds that disclosure would compromise the safety or soundness of the financial institution or of the financial system as a whole.

Some commenters specifically urged that state law enforcement be included within any delay provision, and one commenter appeared to contemplate inclusion of foreign law enforcement. A few commenters advocated for a confidential reporting system, whereby a registrant would initially file a nonpublic report with the Commission while a law enforcement investigation is ongoing, and then unseal the report upon the investigation’s completion.

A number of commenters provided feedback regarding proposed Instruction 1, which would have directed registrants to make their materiality determination regarding an incident “as soon as reasonably practicable after discovery of the incident.” Several commenters recommended removing the instruction altogether as, in their view, it would place unnecessary pressure on companies to make premature determinations before they have sufficient information. Other commenters stated that the instruction is too ambiguous for registrants to ascertain whether they have complied with it. Conversely, one commenter advised the Commission not to provide further guidance on the meaning of “as soon as reasonably practicable,” explaining that doing so would interfere with each registrant’s individual assessment of what is practicable given its specific context, resulting in pressure to move more quickly than may be appropriate. Another commenter likewise found that “as soon as reasonably practicable” is a “reasonable approach” that “provides public companies with the appropriate degree of flexibility to conduct a thorough assessment while ensuring that the markets get timely and relevant information.” One commenter recommended a safe harbor for actions and determinations made in good faith to satisfy Instruction 1 that later turn out to be mistaken.

In response to a request for comment in the Proposing Release, several commenters recommended registrants be permitted to furnish rather than file an Item 1.05 Form 8-K, so that filers of an Item 1.05 Form 8-K would not be subject to liability under Section 18 of the Exchange Act. A significant number of commenters also endorsed the proposal to amend 17 CFR 240.13a-11(c) (“Rule 13a-11(c)”) and 17 CFR 240.15d-11(c) (“Rule 15d-11(c)”) under the Exchange Act to include Item 1.05 in the list of Form 8-K items eligible for a limited safe harbor from liability under Section 10(b) or 17 CFR 240.10b-5 (“Rule 10b-5”) under the Exchange Act. Likewise, the proposal to amend General Instruction I.A.3.(b) of Form S-3 and General Instruction I.A.2 of Form SF-3 to provide that an untimely filing on Form 8-K regarding new Item 1.05 would not result in loss of Form S-3 or Form SF-3 eligibility received much support.

Finally, a number of commenters averred that Item 1.05 would conflict with other Federal and state cybersecurity reporting or other regulatory regimes. For example, one commenter stated Item 1.05 would counteract the goals of CIRCIA by requiring public disclosure of information the act would keep confidential, and went on to assert that CIRCIA was intended as the primary means for reporting incidents to the Federal government. Also related to CIRCIA, a number of commenters urged harmonization of the Commission’s proposal with forthcoming regulations expected from CISA pursuant to CIRCIA. Several commenters alleged Item 1.05 would conflict with rules the Department of Health and Human Services (“HHS”) has adopted pursuant to the Health Insurance Portability and Accountability Act (“HIPAA”) regarding the reporting of private health information breaches. A few commenters likewise said Item 1.05 would conflict with the reporting regime set forth in Federal Communications Commission (“FCC”) regulations for breaches of customer proprietary network information. Conflicts were also alleged with regulations and programs of the Department of Defense (“DOD”), Department of Energy (“DOE”), and Department of Homeland Security (“DHS”). Commenters called for harmonization of Item 1.05 with regulations issued by Federal banking regulators, as well as with regulations of the Federal Trade Commission (“FTC”). Some commenters noted the potential interaction between the proposed rules and state laws. One commenter noted the McCarran-Ferguson Act, which provides that a state law preempts a federal statute if the state law was enacted for the purpose of regulating the business of insurance and the federal statute does not specifically relate to the business of insurance.

3. Final Amendments

Having considered the comments, we remain convinced that investors need timely, standardized disclosure regarding cybersecurity incidents materially affecting registrants’ businesses, and that the existing regulatory landscape is not yielding consistent and informative disclosure of cybersecurity incidents from registrants.  However, we are revising the proposal in two important respects in response to concerns raised by commenters. First, we are narrowing the amount of information required to be disclosed, to better balance investors’ needs and registrants’ cybersecurity posture. And second, we are providing for a delay for disclosures that would pose a substantial risk to national security or public safety, contingent on a written notification by the Attorney General, who may take into consideration other Federal or other law enforcement agencies’ findings.

As described above, commenters’ criticisms of Item 1.05 generally arose from two aspects of the proposal: (1) the scope of disclosure; and (2) the timing of disclosure. With respect to disclosure scope, we note in particular commenter concerns that the disclosure of certain details required by proposed Item 1.05 could exacerbate security threats, both for the registrants’ systems and for systems in the same industry or beyond, and could chill threat information sharing within industries. We agree that a balancing of concerns consistent with our statutory authority is necessary in crafting Item 1.05 to avoid empowering threat actors with actionable information that could harm a registrant and its investors. However, we are not persuaded, as some commenters suggested, that we should forgo requiring disclosure of the existence of an incident while it is ongoing to avoid risks, such as the risk of tipping off threat actors. Some companies already disclose material cybersecurity incidents while they are ongoing and before they are fully remediated, but the timing, form, and substance of those disclosures are inconsistent. Several commenters indicated both that investors look for information regarding registrants’ cybersecurity incidents and that current disclosure levels are inadequate to their needs in making investment decisions. In addition, we note below in Section IV evidence showing that delayed reporting of cybersecurity incidents can result in mispricing of securities, and that such mispricing can be exploited by threat actors, employees, related third parties, and others through trades made before an incident becomes public. Accordingly, we believe it is necessary to adopt a requirement for uniform current reporting of material cybersecurity incidents.

To that end, and to balance investors’ needs with the concerns raised by commenters, we are streamlining Item 1.05 to focus the disclosure primarily on the impacts of a material cybersecurity incident, rather than on requiring details regarding the incident itself. The final rules will require the registrant to “describe the material aspects of the nature, scope, and timing of the incident, and the material impact or reasonably likely material impact on the registrant, including its financial condition and results of operations.” We believe this formulation more precisely focuses the disclosure on what the company determines is the material impact of the incident, which may vary from incident to incident. The rule’s inclusion of “financial condition and results of operations” is not exclusive; companies should consider qualitative factors alongside quantitative factors in assessing the material impact of an incident. By way of illustration, harm to a company’s reputation, customer or vendor relationships, or competitiveness may be examples of a material impact on the company. Similarly, the possibility of litigation or regulatory investigations or actions, including regulatory actions by state and Federal governmental authorities and non-U.S. authorities, may constitute a reasonably likely material impact on the registrant.

We are not adopting, as proposed, a requirement for disclosure regarding the incident’s remediation status, whether it is ongoing, and whether data were compromised. While some incidents may still necessitate, for example, discussion of data theft, asset loss, intellectual property loss, reputational damage, or business value loss, registrants will make those determinations as part of their materiality analyses. Further, we are adding an Instruction 4 to Item 1.05 to provide that a “registrant need not disclose specific or technical information about its planned response to the incident or its cybersecurity systems, related networks and devices, or potential system vulnerabilities in such detail as would impede the registrant’s response or remediation of the incident.” While the Commission provided this assurance in the Proposing Release, we agree with some commenters that codifying it in the Item 1.05 instructions should provide added clarity to registrants on the type of disclosure required by Item 1.05.

With respect to commenters’ questions concerning the application of Item 1.05 to incidents occurring on third-party systems, we are not exempting registrants from providing disclosures regarding cybersecurity incidents on third-party systems they use, nor are we providing a safe harbor for information disclosed about third-party systems. While we appreciate the commenters’ concerns about a registrant’s reduced control over such systems, we note the centrality of the materiality determination: whether an incident is material is not contingent on where the relevant electronic systems reside or who owns them. In other words, we do not believe a reasonable investor would view a significant breach of a registrant’s data as immaterial merely because the data were housed on a third-party system, especially as companies increasingly rely on third-party cloud services that may place their data out of their immediate control. Instead, as discussed above, materiality turns on how a reasonable investor would consider the incident’s impact on the registrant.

Depending on the circumstances of an incident that occurs on a third-party system, disclosure may be required by both the service provider and the customer, or by one but not the other, or by neither. We appreciate that companies may have reduced visibility into third-party systems; registrants should disclose based on the information available to them. The final rules generally do not require that registrants conduct additional inquiries outside of their regular channels of communication with third-party service providers pursuant to those contracts and in accordance with registrants’ disclosure controls and procedures. This is consistent with the Commission’s general rules regarding the disclosure of information that is difficult to obtain.

Turning to disclosure timing, we believe that the modifications from the proposed rules regarding the disclosures called for by Item 1.05 alleviate many of the concerns some commenters had regarding the proposed disclosure deadline of four business days from the materiality determination. Because the streamlined disclosure requirements we are adopting are focused on an incident’s basic identifying details and its material impact or reasonably likely material impact, the registrant should have the information required to be disclosed under this rule as part of conducting the materiality determination. For example, most organizations’ materiality analyses will include consideration of the financial impact of a cybersecurity incident, so information regarding the incident’s impact on the registrant’s financial condition and results of operations will likely have already been developed when Item 1.05 is triggered. Thus, we believe that the four business day timeframe from the date of a materiality determination will be workable.

The reformulation of Item 1.05 also addresses the concern among commenters that the disclosure may be tentative and unclear, resulting in false positives and mispricing in the market. In the majority of cases, the registrant will likely be unable to determine materiality the same day the incident is discovered. The registrant will develop information after discovery until it is sufficient to facilitate a materiality analysis. At that point, we believe investors are best served knowing, within four business days after the materiality determination, that the incident occurred and what led management to conclude the incident is material. While it is possible that occasionally there may be incidents that initially appear material but developments after the filing of the Item 1.05 Form 8-K reveal to be not material, the alternative of delaying disclosure beyond the four business day period after a materiality determination has the potential to lead to far more mispricing and will negatively impact investors making investment and voting decisions without the benefit of knowing that there is a material cybersecurity incident.

Commenters posited an array of alternative deadlines for the Item 1.05 Form 8-K, as recounted above. We are not persuaded by commenters’ arguments that disclosure should be delayed until companies mitigate, contain, remediate, or otherwise diminish the harm of the incident, because, as discussed above, Item 1.05 does not require disclosure of the types of details that have the potential to be exploited by threat actors, but rather focuses on the incident’s material impact or reasonably likely material impact on the registrant. While there may be, as commenters noted, some residual risk of the disclosure of an incident’s existence tipping off threat actors, such risk is justified, in our view, by investors’ need for timely information, and similar risk already exists today with some companies’ current cybersecurity incident disclosure practices. We are also not persuaded that Item 1.05 is sufficiently different from other Form 8-K items such that deviating from the form’s four business day deadline following the relevant trigger would be indicated. While some commenters argued that Item 1.05 is qualitatively different from all other Form 8-K filings in that its trigger is largely outside the company’s control, we disagree because other Form 8-K items may also be triggered unexpectedly, such as Item 4.01 (Changes in Registrant’s Certifying Accountants) and Item 5.02 (Departure of Directors or Principal Officers). And as compared to those items, the information needed for Item 1.05 may be further along in development when the filing is triggered, whereas, for example, a company may have no advance warning that a principal officer is departing.

With respect to the five business day deadline suggested by a few commenters to allow registrants a full calendar week from the materiality determination to the disclosure, we note that in the majority of cases registrants will have had additional time leading up to the materiality determination, such that disclosure becoming due less than a week after discovery should be uncommon. More generally with respect to the various alternative timing suggestions, we observe that the Commission adopted the uniform four business day deadline in 2004 to simplify the previous bifurcated deadlines, and we find commenters have not offered any compelling rationale to return to bifurcated deadlines. Form 8-K provides for current reporting of events that tend to be material to investor decision-making, and we see no reason to render the reporting of Item 1.05 less current than other Form 8-K items.

In the Proposing Release, the Commission requested comment on whether to allow registrants to delay filing an Item 1.05 Form 8-K where the Attorney General determines that a delay is in the interest of national security. In response to comments, we are adopting a delay provision in cases where disclosure poses a substantial risk to national security or public safety. Pursuant to Item 1.05(c), a registrant may delay making an Item 1.05 Form 8-K filing if the Attorney General determines that the disclosure poses a substantial risk to national security or public safety and notifies the Commission of such determination in writing. Initially, disclosure may be delayed for a time period specified by the Attorney General, up to 30 days following the date when the disclosure was otherwise required to be provided. The delay may be extended for an additional period of up to 30 days if the Attorney General determines that disclosure continues to pose a substantial risk to national security or public safety and notifies the Commission of such determination in writing.

In extraordinary circumstances, disclosure may be delayed for a final additional period of up to 60 days if the Attorney General determines that disclosure continues to pose a substantial risk to national security and notifies the Commission of such determination in writing. We are providing for the final additional delay period in recognition that, in extraordinary circumstances, national security concerns may justify additional delay beyond that warranted by public safety concerns, due to the relatively more critical nature of national security concerns. Beyond the final 60-day delay, if the Attorney General indicates that further delay is necessary, the Commission will consider additional requests for delay and may grant such relief through Commission exemptive order.

We have consulted with the Department of Justice to establish an interagency communication process to allow for the Attorney General’s determination to be communicated to the Commission in a timely manner. The Department of Justice will notify the affected registrant that communication to the Commission has been made, so that the registrant may delay filing its Form 8-K.

We agree with commenters that a delay is appropriate for the limited instances in which public disclosure of a cybersecurity incident may cause harm to national security or public safety. The final rules appropriately balance such security concerns against investors’ informational needs. In particular, the provision’s “substantial risk to national security or public safety” bases are sufficiently expansive to ensure that significant risks of harm from disclosure may be protected against, while also ensuring that investors are not denied timely access to material information. With respect to commenters who recommended that other Federal agencies and non-Federal law enforcement agencies also be permitted to trigger a delay or who argued that other agencies may be the primary organization in the Federal government for the response, we note that the rule does not preclude any such agency from requesting that the Attorney General determine that the disclosure poses a substantial risk to national security or public safety and communicate that determination to the Commission. However, we believe that designating a single law enforcement agency as the Commission’s point of contact on such delays is critical to ensuring that the rule is administrable.

Turning to other timing-related issues raised by commenters, we are not adopting commenters’ suggestion to replace Item 1.05 with periodic reporting of material cybersecurity incidents on Forms 10-Q and 10-K because such an approach may result in significant variance as to when investors learn of material cybersecurity incidents. Based on when an incident occurs during a company’s reporting cycle, the timing between the materiality determination and reporting on the next Form 10-Q or Form 10-K could vary from a matter of months to a matter of weeks or less. For example, if two companies experience a similar cybersecurity incident, but one determines the incident is material early during a quarterly period and the other makes such determination at the end of the quarterly period, commenters’ suggested approach would have both companies report the incident around the same time despite the first company having determined the incident was material weeks or months sooner, which would result in a significant delay in this information being provided to investors. Such variance would therefore reduce comparability across registrants and may put certain registrants at a competitive disadvantage.

We also decline to use a quantifiable trigger for Item 1.05 because some cybersecurity incidents may be material yet not cross a particular financial threshold. We note above that the material impact of an incident may encompass a range of harms, some quantitative and others qualitative. A lack of quantifiable harm does not necessarily mean an incident is not material. For example, an incident that results in significant reputational harm to a registrant may not be readily quantifiable and therefore may not cross a particular quantitative threshold, but it should nonetheless be reported if the reputational harm is material. Similarly, whereas a cybersecurity incident that results in the theft of information may not be deemed material based on quantitative financial measures alone, it may in fact be material given the impact to the registrant that results from the scope or nature of harm to individuals, customers, or others, and therefore may need to be disclosed.

In another change from the proposal, and to respond to commenters’ concerns that the proposed “as soon as reasonably practicable” language in Instruction 1 could pressure companies to draw conclusions about incidents with insufficient information, we are revising the instruction to state that companies must make their materiality determinations “without unreasonable delay.” As explained in the Proposing Release, the instruction was intended to address any concern that some registrants may delay making such a determination to avoid a disclosure obligation. We understand commenter concerns that the proposed instruction could result in undue pressure to make a materiality determination before a registrant has sufficient information to do so, and we recognize that a materiality determination necessitates an informed and deliberative process. We believe the revised language should alleviate this unintended consequence, while providing registrants notice that, though the determination need not be rushed prematurely, it also cannot be unreasonably delayed in an effort to avoid timely disclosure. For example, for incidents that impact key systems and information, such as those the company considers its “crown jewels,” as well as incidents involving unauthorized access to or exfiltration of large quantities of particularly important data, a company may not have complete information about the incident but may know enough about the incident to determine whether the incident was material. In other words, a company being unable to determine the full extent of an incident because of the nature of the incident or the company’s systems, or otherwise the need for continued investigation regarding the incident, should not delay the company from determining materiality. Similarly, if the materiality determination is to be made by a board committee, intentionally deferring the committee’s meeting on the materiality determination past the normal time it takes to convene its members would constitute unreasonable delay. As another example, if a company were to revise existing incident response policies and procedures in order to support a delayed materiality determination for or delayed disclosure of an ongoing cybersecurity event, such as by extending the incident severity assessment deadlines, changing the criteria that would require reporting an incident to management or committees with responsibility for public disclosures, or introducing other steps to delay the determination or disclosure, that would constitute unreasonable delay. In light of the revision to Instruction 1, we find that a safe harbor, as suggested by some commenters, is unnecessary; adhering to normal internal practices and disclosure controls and procedures will suffice to demonstrate good faith compliance. Importantly, we remind registrants, as the Commission did in the Proposing Release, that “doubts as to the critical nature” of the relevant information “will be common place” and should “be resolved in favor of those the statute is designed to protect,” namely investors.

Revised Instruction 1 should also reassure registrants that they should continue sharing information with other companies or government actors about emerging threats. Such information sharing may not necessarily result in an Item 1.05 disclosure obligation. The obligation to file the Item 1.05 disclosure is triggered once a company has developed information regarding an incident sufficient to make a materiality determination, and a decision to share information with other companies or government actors does not in itself necessarily constitute a determination of materiality. A registrant may alert similarly situated companies as well as government actors immediately after discovering an incident and before determining materiality, so long as it does not unreasonably delay its internal processes for determining materiality.

As proposed, we are adding Item 1.05 to the list of Form 8-K items in General Instruction I.A.3.(b) of Form S-3 , so that the untimely filing of an Item 1.05 Form 8-K will not result in the loss of Form S-3 eligibility. We note the significant support from commenters regarding this proposal, and as noted in the Proposing Release, continue to believe that the consequences of the loss of Form S-3 eligibility would be unduly severe given the circumstances that will surround Item 1.05 disclosures. Likewise, as supported by many commenters, we are adopting as proposed amendments to Rules 13a-11(c) and 15d-11(c) under the Exchange Act to include new Item 1.05 in the list of Form 8-K items eligible for a limited safe harbor from liability under Section 10(b) or Rule 10b-5 under the Exchange Act. This accords with the view the Commission articulated in 2004 that the safe harbor is appropriate if the triggering event for the Form 8-K requires management to make a rapid materiality determination.

We decline to permit registrants to furnish rather than file the Item 1.05 Form 8-K, as suggested by some commenters. While we understand commenters’ points that reducing liability may ease the burden on registrants, we believe that treating Item 1.05 disclosures as filed will help promote the accuracy and reliability of such disclosures for the benefit of investors. Of the existing Form 8-K items, only Items 2.02 (Results of Operations and Financial Condition) and 7.01 (Regulation FD Disclosure) are permitted to be furnished rather than filed. The Commission created exceptions for those two items to allay concerns that do not pertain here. Specifically, with respect to Item 2.02, the Commission was motivated by concerns that requiring the information to be filed would discourage registrants from proactively issuing earnings releases and similar disclosures. Similarly, with respect to Item 7.01, the Commission decided to allow the disclosure to be furnished to address concerns that, if required to be filed, the disclosure could be construed as an admission of materiality, which might lead some registrants to avoid making proactive disclosure. By contrast, Item 1.05 is not a voluntary disclosure, and it is by definition material because it is not triggered until the registrant determines the materiality of an incident. It is thus more akin to the Form 8-K items other than Items 2.02 and 7.01, in that it is a description of a material event that has occurred about which investors need adequate information. Therefore, the final rules require an Item 1.05 Form 8-K to be filed.

We are not including a new rule to ban trading by insiders during the materiality determination time period, as suggested by some commenters. Those with a fiduciary duty or other relationship of trust and confidence are already prohibited from trading while in possession of material, nonpublic information. And because we are adopting the four business day from materiality determination deadline, we agree with the point raised by some commenters that the risk of insider trading is low given the limited time period between experiencing a material incident and public disclosure. We also note that we recently adopted amendments to 17 CFR 240.10b5-1 (“Rule 10b5-1”) that added a certification condition for directors and officers wishing to avail themselves of the rule’s affirmative defense; specifically, if relying on the amended affirmative defense, directors and officers need to certify in writing, at the time they adopt the trading plan, that they are unaware of material nonpublic information about the issuer or its securities, and are adopting the plan in good faith and not as part of a plan or scheme to evade the insider trading prohibitions. Therefore, given the timing of the incident disclosure requirement as well as the recently adopted amendments to Rule 10b5-1, we do not find need for a new rule banning trading by insiders during the time period between the materiality determination and disclosure.

A number of commenters raised concerns about conflicts with other Federal laws and regulations. Of the Federal laws and regulations that we reviewed and commenters raised concerns with, we have identified one conflict, with the FCC’s notification rule for breaches of customer proprietary network information (“CPNI”). Of the remaining Federal laws and regulations noted by commenters as presenting conflicts, our view is that Item 1.05 neither directly conflicts with nor impedes the purposes of other such laws and regulations.

The FCC’s rule for notification in the event of breaches of CPNI requires covered entities to notify the United States Secret Service (“USSS”) and the Federal Bureau of Investigation (“FBI”) no later than seven business days after reasonable determination of a CPNI breach, and further directs the entities to refrain from notifying customers or disclosing the breach publicly until seven business days have passed following the notification to the USSS and FBI. To accommodate registrants who are subject to this rule and may as a result face conflicting disclosure timelines, we are adding paragraph (d) to Item 1.05 providing that such registrants may delay making a Form 8-K disclosure up to the seven business day period following notification to the USSS and FBI specified in the FCC rule,  with written notification to the Commission.

We also considered the conflicts commenters alleged with CIRCIA. Specifically, they stated that Item 1.05 is at odds with the goals of CIRCIA, and that it may conflict with forthcoming regulations from CISA. The confidential reporting system established by CIRCIA serves a different purpose from Item 1.05 and through different means; the former focuses on facilitating the Federal government’s preparation for and rapid response to cybersecurity threats, while the latter focuses on providing material information about public companies to investors in a timely manner. While CISA has yet to propose regulations to implement CIRCIA, given the statutory authority, text, and legislative history of CIRCIA, it appears unlikely the regulations would affect the balance of material information available to investors about public companies, because the reporting regime CIRCIA establishes is confidential. Nonetheless, the Commission participates in interagency working groups on cybersecurity regulatory implementation, and will continue to monitor developments in this area to determine if modification to Item 1.05 becomes appropriate in light of future developments.

We also considered the HIPAA-related conflict alleged by commenters, specifically with respect to HHS’s rule on Notification in the Case of Breach of Unsecured Protected Health Information. That rule provides, in the event of a breach of unsecured protected health information, for the covered entity to provide notification to affected individuals “without unreasonable delay and in no case later than 60 calendar days after discovery of a breach.” If the breach involves more than 500 residents of a state or jurisdiction, the rule directs the covered entity to also notify prominent media outlets within the same timeframe. The rule further provides that if a company receives written notice from “a law enforcement official” requesting a delay and specifying the length of the delay, then the company “shall … delay such notification, notice, or posting for the time period specified by the official.”

We do not view Form 8-K Item 1.05 as implicated by the HHS rule. Importantly, the HHS rule’s delay provision applies specifically to any “notification, notice, or posting required under this subpart,” or in other words notice to affected individuals, media, and the Secretary of HHS. Such notification focuses on the consequences of the breach for the affected individuals; for example, individuals must be told what types of protected health information were accessed, and what steps they should take to protect themselves from harm. This is different from the disclosure required by Item 1.05, which focuses on the consequences for the company that are material to investors, and whose timing is tied not to discovery but to a materiality determination. The HHS rule does not expressly preclude the latter type of public disclosure, or other potential communications companies experiencing a breach may make. Therefore, we believe that a registrant subject to the HHS rule will not face a conflict in complying with Item 1.05.

We also considered the conflicts commenters alleged with regulations and programs of DOD, DOE, DHS, the Federal banking regulatory agencies, state insurance laws, and miscellaneous other Federal agencies or laws. We find that, while there may be some overlap of subject matter, Item 1.05 neither conflicts with nor impedes the purpose of those regulations and programs. We disagree with one commenter’s assertion that cybersecurity incident disclosure “falls squarely within the jurisdiction of state insurance commissioners” as state cybersecurity incident reporting regulations would not pertain to the “business of insurance” as courts have interpreted the McCarran-Ferguson Act, and the commenter did not note any particular state insurance laws that would present a conflict. With respect to Federal banking regulatory agencies specifically, we note that, in the event they believe that the disclosure of a material cybersecurity incident would threaten the health of the financial system in such a way that results in a substantial risk to national security or public safety, they may, as explained above, work with the Department of Justice to seek to delay disclosure.

It would not be practical to further harmonize Item 1.05 with other agencies’ cybersecurity incident reporting regulations, as one commenter suggested, because Item 1.05 serves a different purpose—it is focused on the needs of investors, rather than the needs of regulatory agencies, affected individuals, or the like. With respect to state insurance and privacy laws, commenters did not provide any evidence sufficient to alter the Commission’s finding in the Proposing Release that, to the extent that Item 1.05 would require disclosure in a situation where state law would excuse or delay notification, we consider prompt reporting of material cybersecurity incidents to investors critical to investor protection and well-functioning, orderly, and efficient markets.