3 ms·

SEC Adopts Rules on Public Company Cybersecurity Disclosures

18 points by mfiguiere 3y ago

MR4D 3y ago
"An Item 1.05 Form 8-K will generally be due four business days after a registrant determines that a cybersecurity incident is material." Wow, that's a short amount of time. Sometimes you know. something is material before you know much about it. And now you have to not only gather the data, but publish a legal SEC form that you can get sued over in....96 hours.
- halJordan 3y ago
  The initial report is not expected to be exhaustive or final, and the word material is already a well established term of art. Here is what they are actually proposing be reported- it's really not a lot: Specifically, we propose to amend Form 8-K by adding new Item 1.05 that would require a registrant to disclose the following information about a material cybersecurity incident, to the extent the information is known at the time of the Form 8-K filing: When the incident was discovered and whether it is ongoing; A brief description of the nature and scope of the incident; Whether any data was stolen, altered, accessed, or used for any other unauthorized purpose; The effect of the incident on the registrant's operations; and Whether the registrant has remediated or is currently remediating the incident https://www.federalregister.gov/documents/2022/03/23/2022-05480/cybersecurity-risk-management-strategy-governance-and-incident-disclosure https://www.federalregister.gov/documents/2022/03/23/2022-05...
  - MR4D 3y ago
    I promise you there will be lots of lawsuits because of this. Lawsuits that for the most part don’t do any good for the public. Making this a private disclosure to the SEC is fine. But public publication only 96 hours after discovery will lead to issues.
olivierduval 3y ago
GDPR - Art. 33.1 - Notification of a personal data breach to the supervisory authority "In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. 2Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay." OK, it's not ALL cybersecurity incident but limited to personal data breach... but the delay is 72h ! So, in a way, it look to me like SEC is only playing catch-up
- halJordan 3y ago
  Not everything has to be a pissing match and in any case under these rules the company must report the incident to "the supervisory authority" within 48 hours. The 96 is the public disclosure.

18 points by mfiguiere 3y ago

MR4D 3y ago

"An Item 1.05 Form 8-K will generally be due four business days after a registrant determines that a cybersecurity incident is material." Wow, that's a short amount of time. Sometimes you know. something is material before you know much about it. And now you have to not only gather the data, but publish a legal SEC form that you can get sued over in....96 hours.

halJordan 3y ago
The initial report is not expected to be exhaustive or final, and the word material is already a well established term of art. Here is what they are actually proposing be reported- it's really not a lot: Specifically, we propose to amend Form 8-K by adding new Item 1.05 that would require a registrant to disclose the following information about a material cybersecurity incident, to the extent the information is known at the time of the Form 8-K filing: When the incident was discovered and whether it is ongoing; A brief description of the nature and scope of the incident; Whether any data was stolen, altered, accessed, or used for any other unauthorized purpose; The effect of the incident on the registrant's operations; and Whether the registrant has remediated or is currently remediating the incident https://www.federalregister.gov/documents/2022/03/23/2022-05480/cybersecurity-risk-management-strategy-governance-and-incident-disclosure https://www.federalregister.gov/documents/2022/03/23/2022-05...
- MR4D 3y ago
  I promise you there will be lots of lawsuits because of this. Lawsuits that for the most part don’t do any good for the public. Making this a private disclosure to the SEC is fine. But public publication only 96 hours after discovery will lead to issues.

olivierduval 3y ago

GDPR - Art. 33.1 - Notification of a personal data breach to the supervisory authority "In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. 2Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay." OK, it's not ALL cybersecurity incident but limited to personal data breach... but the delay is 72h ! So, in a way, it look to me like SEC is only playing catch-up

halJordan 3y ago
Not everything has to be a pissing match and in any case under these rules the company must report the incident to "the supervisory authority" within 48 hours. The 96 is the public disclosure.