United States. Cybersecurity. Regulation
SEC cyber disclosure rulesSEC Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure rules (Form 8-K Item 1.05; Regulation S-K Item 106)
Partly verified
Medium confidence.Foreign private issuers have equivalent Form 6-K/20-F duties. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
§1Summary
- Synopsis
Requires SEC registrants to disclose material cybersecurity incidents on Form 8-K within four business days of determining materiality, and to describe cyber risk management, strategy and governance annually.
- Key themes
- Unique features
Trigger is materiality to investors rather than harm to individuals; disclosure can be delayed only on Attorney General national security determination.
- SaaS relevance
Applies to listed SaaS companies, and SaaS vendors to listed companies will face incident-information demands from customers.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Form 8-K within 4 business days of materiality determination
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- SEC enforcement remedies under securities laws
§3Dates
- Key dates
- Adopted
- In force
- 8-K incident reporting from 2023-12-18 (smaller reporting companies 2024-06-15); annual 10-K disclosures for fiscal years ending on/after 2023-12-15.
§4Text and authority
- Text
- Authoritative text sec.gov
- Authority
- US Securities and Exchange Commission (SEC)
§5Where it applies
- Domestic law of
- United States
- Also applies in
- Alabama
- Alaska
- Arizona
- Arkansas
- California
- Colorado
- Connecticut
- Delaware
- District of Columbia
- Florida
- Georgia
- Guam
- Hawaii
- Idaho
- Illinois
- Indiana
- Iowa
- Kansas
- Kentucky
- Louisiana
- Maine
- Maryland
- Massachusetts
- Michigan
- Minnesota
- Mississippi
- Missouri
- Montana
- Nebraska
- Nevada
- New Hampshire
- New Jersey
- New Mexico
- New York
- North Carolina
- North Dakota
- Ohio
- Oklahoma
- Oregon
- Pennsylvania
- Puerto Rico
- Rhode Island
- South Carolina
- South Dakota
- Tennessee
- Texas
- US Virgin Islands
- Utah
- Vermont
- Virginia
- Washington
- West Virginia
- Wisconsin
- Wyoming
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Foreign private issuers have equivalent Form 6-K/20-F duties. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.