In a 3-2 vote, the Securities and Exchange Commission (SEC) adopted new cybersecurity rules yesterday (July 26, 2023) applicable to public companies.

The rules, which will become effective thirty days after publication in the Federal Register, require public companies to “disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance.”

The new rules require companies to file an Item 1.05 Form 8-K for “any cybersecurity incident they determine to be material and to describe the material aspects of the incident’s nature, scope, and timing as well as its material impact or reasonably likely material impact on the registrant.” The Item 1.05 Form 8-K will be due “four business days after a registrant determines that a cybersecurity incident is material.” The disclosure may be delayed “if the United States Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the Commission of such determination in writing.”

In addition, a new S-K Item 106 will require registrants to describe their processes “for assessing, identifying, and managing material risks from cybersecurity threats, as well as the material effects or reasonably likely material effects of risks from cybersecurity threats and previous cybersecurity incidents” and will require companies to “describe the board of directors’ oversight of risks from cybersecurity threats and management’s role and expertise in assessing and managing material risks from cybersecurity threats.” The disclosures are required to be included in the annual 10-K Form. Public companies’ cybersecurity processes are in the crosshairs of the SEC, and focus and attention to cybersecurity practices, including beefing up the cyber capabilities of members of the board and senior management are clearly factors the SEC will expect. There is a dearth of cybersecurity professionals as it is. Public companies’ nominating committees have a formidable job in front of them