Stephenie Gosnell Handler, Julia Lapitskaya, and Michael A. Titera are Partners at Gibson, Dunn & Crutcher LLP. This post is based on a Gibson Dunn memorandum by Ms. Handler, Ms. Lapitskaya, Mr. Titera, Alexandria Johnson, Isaac Maycock, and Kayla Jahangiri.
I. Introduction
This alert highlights key trends and insights from our analysis of the cybersecurity disclosures made by 97 S&P 100 companies in their 2024 Form 10-K filings, as required by new Item 106 of Regulation S-K (“Item 106”), as of November 30, 2024. [1]
As discussed in a previous client alert, the Securities and Exchange Commission (“SEC” or “Commission”) adopted on July 26, 2023, a final rule requiring public companies to provide current disclosure of material cybersecurity incidents and annual disclosure regarding cybersecurity risk management, strategy, and governance. Under Item 106, which is required to be addressed in new Item 1C of Form 10-K, public companies must include disclosures in their annual reports regarding their (1) cybersecurity risk management and strategy, including with respect to their processes for identifying, assessing, and managing cybersecurity threats and whether risks from cybersecurity threats have materially affected them, and (2) cybersecurity governance, including with respect to oversight by their boards and management. [2] All public companies were required to comply with these disclosure requirements for the first time beginning with their annual reports on Form 10-K or 20-F for the fiscal year ending on or after December 15, 2023.
