TheCorporateCounsel.net

Last week, the WSJ reported that paragraph (c) of Item 1.05 of Form 8-K has been invoked “several times” since the SEC’s new cybersecurity disclosure rules went into effect in December. Paragraph (c) provides a framework for delaying the filing of an Item 1.05 Form 8-K if the United States Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the SEC of such determination in writing.

The article says that Matthew Olsen, assistant attorney general for national security, whose office has been delegated the responsibility for handling these determinations, reported at the WSJ’s “Tech Live: Cybersecurity” conference that “on a number of occasions, the Justice Department has delayed companies’ disclosures because making the attacks public would create substantial risks and raise national-security concerns,” without giving any numbers.

As the article notes, when the final rules were adopted, there were doubts about how easy or practical it would be for companies to avail themselves of the delay provisions. I think much of that concern was assuaged by the December guidance released by multiple agencies — the FBI’s Guidance to Victims of Cyber Incidents on SEC Reporting Requirements: Request a Delay, plus multiple CDIs from the SEC Staff, and a statement from Corp Fin Director Erik Gerding — which evidenced that necessary interagency channels of communication were being forged and processes being created for these delay provisions to work. I can’t say I’m happy to hear that there have been cyber incidents that presented national security concerns, but for companies that may need to seek this relief, it’s good to know that there’s some precedent for it.

– Meredith Ervine