ANALYSIS: SEC Cyber Rule’s Timeline Won’t Scare Most 8-K Filers

The newly adopted SEC cybersecurity rule will require public companies to file a Form 8-K within four business days after determining that a material cyberattack has occurred.

The enhanced cyber risk disclosure requirements for public companies, as well as the tight timeline for disclosure, were criticized by commentors during the SEC rulemaking. They took issue with the lack of a clear definition for a material cyberattack and the quick turnaround disclosure period.

However, Form 8-K filing data, the meaning of “materiality” as it applies to federal securities cases, and past SEC enforcement actions show that the transition to the new ...