Divulgação cibernética da SEC

The SEC's cybersecurity disclosure rules, adopted in July 2023, require public companies to disclose material cybersecurity incidents quickly and to describe, every year, how they manage cybersecurity risk and how the board and management oversee it.

The incident rule is the one practitioners feel most: once a company determines an incident is material, it has four business days to file a Form 8-K. The hard work is the materiality determination, which must be made without unreasonable delay after discovery.

• Public companies that file reports with the SEC under the Securities Exchange Act of 1934, including smaller reporting companies.
• Foreign private issuers make comparable disclosures on Form 6-K and Form 20-F.
• A cybersecurity incident is an unauthorized occurrence, or a series of related ones, on or through the company's information systems that jeopardizes their confidentiality, integrity or availability or the information in them. Incidents at vendors that affect the company's systems or data can qualify.

A SEC fiscaliza por meio de seus poderes habituais, incluindo acusações por divulgações enganosas, controles de divulgação inadequados e registros tardios. Falhas de divulgação também podem fundamentar ações de investidores com base nas leis de valores mobiliários.

1. Write a materiality process: who decides, on what facts, how fast, and how it is documented.
2. Connect incident response to disclosure counsel, so escalation to the materiality decision is quick.
3. Include third-party incidents in the escalation path.
4. Draft the Form 8-K template focused on the material impact, not technical detail that would help attackers.
5. Prepare the annual Item 106 disclosure from real processes, board minutes and management roles.
6. Test disclosure controls against a tabletop incident.