SEC Clarifies Cybersecurity Incident Disclosure Rules: Key Takeaways for Companies

The Securities and Exchange Commission (SEC) continues to refine its stance on the disclosure of material cybersecurity incidents, addressing corporate concerns and compliance complexities. On June 20, 2024, Erik Gerding, the Director of the SEC’s Division of Corporation Finance, provided further clarification regarding the selective disclosure of cybersecurity incidents. This move comes in response to persistent questions surrounding the SEC’s final cybersecurity disclosure rules, specifically under Item 1.05 of Form 8-K.