Federal Agencies Release Guidelines for Delaying Cybersecurity Incident Disclosures.
SEC Rules for Disclosing Material Cybersecurity Incidents. (PHOTO: The National Law Review)
New Cybersecurity Rules Demand Quick Company Disclosures:
According to The CLS Blue Sky Blog report, Public companies now face stricter rules from the U.S. Securities and Exchange Commission (SEC) regarding cybersecurity. As of December 18, 2023, companies must reveal significant cybersecurity incidents within just four business days using SEC Form 8-K Item 1.05. However, there’s an exception allowing companies to delay disclosure if there’s a big risk to national security or public safety.
READ ALSO: Unbelievable Scam: Florida Woman Returns Home to Find Driveway Stolen
FBI Helps Companies Navigate Delayed Cybersecurity Reporting:
The Federal Bureau of Investigation (FBI) is guiding companies through the process of delaying public reports under the SEC rule. In their notice on December 6, 2023, the FBI emphasized that companies should ask for a delay at the same time they decide if the cybersecurity incident is significant. They must promptly provide detailed information about the incident, cyber actors involved, and the ongoing efforts to fix the situation.
READ ALSO: Gypsy Rose Blanchard Speaks Out After Release from Prison
DOJ Sets Rules for Holding Back Details on Cybersecurity Incidents:
The Department of Justice (DOJ) released guidelines on December 12, 2023, to define when companies can delay telling the public about significant cybersecurity incidents. The DOJ stressed that this decision depends on whether public disclosure could harm public safety or national security. The guidelines mention specific situations, like new cyber techniques, systems with sensitive government information, ongoing fixes, or concerns raised by a U.S. government agency. Companies are advised to consult early with law enforcement and government agencies when deciding to delay disclosure.
