SEC cybersecurity incident disclosure rule
A 2023 US rule requiring listed companies to disclose a material cyber incident within four business days of determining its materiality, unless a delay is requested for national security reasons.
The rule adopted by the US Securities and Exchange Commission on July 26, 2023, in force since December 18, 2023, imposes two kinds of disclosure on companies listed in the United States. On an event basis, any cybersecurity incident deemed material must be disclosed on Form 8-K, Item 1.05, within four business days after the determination of its materiality, a determination that must itself be made without unreasonable delay. On an annual basis, the company describes in its report its cyber risk management processes and its board's role in overseeing them. Disclosure may be delayed if the US Attorney General determines it would pose a substantial risk to national security or public safety: that is the point where a corporate incident becomes a matter of state. For insurance, the rule acts on financial lines more than on the cyber policy. It creates a public date on which the share price can fall, and therefore a basis for shareholder class actions, and it exposes directors to claims of failure or delay in disclosure, which fall under their liability insurance.
On February 22, 2024, UnitedHealth Group filed a Form 8-K under Item 1.05 announcing that a threat actor, described as suspected of being linked to a nation state, had breached the systems of its subsidiary Change Healthcare. The attack turned out to be criminal ransomware, illustrating the gap between initial characterization and final attribution.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.