SEC Staff Clarifies Form 8-K Reporting Requirements for Cyber Incidents | Paul, Weiss

Public companies should carefully consider the specific item of Form 8-K under which they disclose cybersecurity incidents. Since Item 1.05 was added, many companies have erred on the side of providing early disclosure under Item 1.05 even before the company has determined that an incident is material. Gerding acknowledges that early, voluntary disclosures have value to investors and the marketplace. But his statement is a reminder that such early disclosures are not the end of the analysis. Even if a company made an early disclosure, once it determines that an incident is material the company is required to disclose the material impact of the incident in a subsequent filing that satisfies all of the requirements of Item 1.05.

Source: SEC Staff Clarifies Form 8-K Reporting Requirements for Cyber Incidents | Paul, Weiss