On March 9, 2022, the SEC voted to propose rules mandating sweeping cybersecurity measures for public companies and foreign private issuers. [1] Most notably, the rules would impose a 4-day reporting requirement for domestic issuers who have experienced a “material cybersecurity incident.” The rules would also require foreign issuers to disclose information about material cybersecurity incidents on Forms 6-K and 20-F.

The proposed rules broadly define a “cybersecurity incident” to cover effectively any intrusion of a company’s systems: “an unauthorized occurrence on or conducted through a registrant’s information systems that jeopardizes the confidentiality, integrity, or availability of a registrant’s information systems or any information residing therein.”  Within four days of determining that such an incident is material—with no extension of time for an “ongoing investigation”—the issuer would have to disclose on an amended Form 8-K:

• when the incident was discovered;
• whether it was ongoing;
• a brief description of its nature and scope;
• whether any data was stolen, altered, accessed, or used for any other unauthorized purpose;
• the effect of the incident on operations; and
• whether the company “has remediated or is currently remediating the incident.”

The proposed rules do not offer any further color on what may render a cybersecurity incident “material” but reiterate the conventional standard: “information is material if ‘there is a substantial likelihood that a reasonable shareholder would consider it important.’”

(more…)