TheCorporateCounsel.net

Whenever a company determines it has experienced a “cybersecurity incident,” it then needs to assess whether that incident is material based on company-specific facts and circumstances. The SEC Staff recently made clear that immaterial incidents should not be reported under Item 1.05 and that immaterial cybersecurity incidents or early disclosure should be reported under a different item of Form 8-K — like 8.01 for Other Events. For companies that get to the materiality step, keep in mind that the SEC has made clear that the materiality assessment is not limited to the incident’s impact on the company’s financial condition and results of operation.

– Corp Fin Director Erik Gerding’s recent statement about reporting immaterial incidents and some of the 5 new CDIs on Item 1.05 included guidance on assessing materiality.

– The adopting release also included a discussion of materiality and listed qualitative factors to consider.

– This WilmerHale resource (see especially page 22) does a great job of summarizing quantitative considerations, qualitative considerations and factors that are NOT relevant based on the adopting release and the firm’s experience helping companies evaluate disclosure obligations under the 2011 Staff Guidance and 2018 Interpretive Guidance.

– Check out our “Cybersecurity” Practice Area for a wealth of other resources!

This is an evolving area and one where it’s important to be able to think on your feet but also avoid rushing to conclusions. Our Proxy Disclosure & Executive Compensation Conferences include a panel dedicated to addressing the real-time reporting of cyber incidents during which attendees will hear from Tamara Brightwell of Wilson Sonsini, Howard Dicker of Weil Gotshal, Sophia Hudson of Kirkland & Ellis, and Bill Ridgway of Skadden. Our panel on navigating 10-K updates will also be addressing how companies approached cybersecurity disclosures in 10-Ks. We hope you join us in person! Register soon (this week, actually) by visiting our online store or by calling us at 800-737-1271 to get the early bird rate!

– Meredith Ervine