May 22, 2024
Cyber Incidents: Corp Fin Director on Reporting Early or Immaterial Incidents
Yesterday, Corp Fin Director Erik Gerding released this statement (subject to the standard disclaimer) regarding new Item 1.05 of Form 8-K requiring public companies to disclose material cybersecurity incidents. In the statement, Director Gerding encourages companies that choose to voluntarily disclose an immaterial cybersecurity incident or choose to disclose early while a materiality determination is still being made to do so under a different item of Form 8-K — like 8.01 for Other Events. The statement notes that reporting immaterial incidents under Item 1.05 (“Material Cybersecurity Incidents”) could confuse investors.
Given the prevalence of cybersecurity incidents, this distinction between a Form 8-K filed under Item 1.05 for a cybersecurity incident determined by a company to be material and a Form 8-K voluntarily filed under Item 8.01 for other cybersecurity incidents will allow investors to more easily distinguish between the two and make better investment and voting decisions with respect to material cybersecurity incidents. By contrast, if all cybersecurity incidents are disclosed under Item 1.05, then there is a risk that investors will misperceive immaterial cybersecurity incidents as material, and vice versa.
It stresses that this is not intended to discourage or disincentivize voluntary early reporting or reporting of immaterial incidents, which can be valuable to investors, the marketplace and companies. It also reminds companies that early reporting may mean two 8-Ks will be necessary:
If a company discloses an immaterial incident (or one for which it has not yet made a materiality determination) under Item 8.01 of Form 8-K, and then it subsequently determines that the incident is material, then it should file an Item 1.05 Form 8-K within four business days of such subsequent materiality determination. That Form 8-K may refer to the earlier Item 8.01 Form 8-K, but the company would need to ensure that the disclosure in the subsequent filing satisfies the requirements of Item 1.05.
Earlier this year, I shared a Cleary alert on the potential benefits of early reporting under Item 7.01 or 8.01 that is worth sharing again.
– Meredith Ervine