3 ms·
"An Item 1.05 Form 8-K will generally be due four business days after a registrant determines that a cybersecurity incident is material." Wow, that's a short a
by MR4D 3y ago
"An Item 1.05 Form 8-K will generally be due four business days after a registrant determines that a cybersecurity incident is material."
Wow, that's a short amount of time. Sometimes you know. something is material before you know much about it. And now you have to not only gather the data, but publish a legal SEC form that you can get sued over in....96 hours.
- halJordan 3y agoThe initial report is not expected to be exhaustive or final, and the word material is already a well established term of art. Here is what they are actually proposing be reported- it's really not a lot: Specifically, we propose to amend Form 8-K by adding new Item 1.05 that would require a registrant to disclose the following information about a material cybersecurity incident, to the extent the information is known at the time of the Form 8-K filing: When the incident was discovered and whether it is ongoing; A brief description of the nature and scope of the incident; Whether any data was stolen, altered, accessed, or used for any other unauthorized purpose; The effect of the incident on the registrant's operations; and Whether the registrant has remediated or is currently remediating the incident https://www.federalregister.gov/documents/2022/03/23/2022-05480/cybersecurity-risk-management-strategy-governance-and-incident-disclosure https://www.federalregister.gov/documents/2022/03/23/2022-05...
- MR4D 3y agoI promise you there will be lots of lawsuits because of this. Lawsuits that for the most part don’t do any good for the public. Making this a private disclosure to the SEC is fine. But public publication only 96 hours after discovery will lead to issues.