Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure

Federal RegisterMar 23, 2022

Ask Donna

What actually matters in this document.

Text

SECURITIES AND EXCHANGE COMMISSION

17 CFR Parts 229, 232, 239, 240, and 249

[Release Nos. 33-11038; 34-94382; IC-34529; File No. S7-09-22]

RIN 3235-AM89

Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure

AGENCY:

Securities and Exchange Commission.

ACTION:

Proposed rule.

SUMMARY:

The Securities and Exchange Commission (“Commission”) is proposing rules to enhance and standardize disclosures regarding cybersecurity risk management, strategy, governance, and cybersecurity incident reporting by public companies that are subject to the reporting requirements of the Securities Exchange Act of 1934. Specifically, we are proposing amendments to require current reporting about material cybersecurity incidents. We are also proposing to require periodic disclosures about a registrant's policies and procedures to identify and manage cybersecurity risks, management's role in implementing cybersecurity policies and procedures, and the board of directors' cybersecurity expertise, if any, and its oversight of cybersecurity risk. Additionally, the proposed rules would require registrants to provide updates about previously reported cybersecurity incidents in their periodic reports. Further, the proposed rules would require the cybersecurity disclosures to be presented in Inline eXtensible Business Reporting Language (“Inline XBRL”). The proposed amendments are intended to better inform investors about a registrant's risk management, strategy, and governance and to provide timely notification of material cybersecurity incidents.

DATES:

Comments should be received on or before May 9, 2022.

ADDRESSES:

Comments may be submitted by any of the following methods:

Electronic Comments

• Use the Commission's internet comment form (

https://www.sec.gov/rules/submitcomments.htm

• Send an email to

rule-comment@sec.gov.

Please include File Number S7-09-22 on the subject line; or

Paper Comments

• Send paper comments to Vanessa A. Countryman, Secretary, Securities and Exchange Commission, 100 F Street NE, Washington, DC 20549-1090.

All submissions should refer to File Number S7-09-22. This file number should be included on the subject line if email is used. To help the Commission process and review your comments more efficiently, please use only one method of submission. The Commission will post all comments on the Commission's website (

https://www.sec.gov/rules/proposed.shtml

). Comments also are available for website viewing and printing in the Commission's Public Reference Room, 100 F Street NE, Washington, DC 20549, on official business days between the hours of 10 a.m. and 3 p.m. Operating conditions may limit access to the Commission's public reference room. All comments received will be posted without change. Persons submitting comments are cautioned that we do not redact or edit personal identifying information from comment submissions. You should submit only information that you wish to make available publicly.

Studies, memoranda, or other substantive items may be added by the Commission or staff to the comment file during this rulemaking. A notification of the inclusion in the comment file of any such materials will be made available on our website. To ensure direct electronic receipt of such notifications, sign up through the “Stay Connected” option at

www.sec.gov

to receive notifications by email.

FOR FURTHER INFORMATION CONTACT:

Ian Greber-Raines, Special Counsel, Office of Rulemaking, at (202) 551-3460, Division of Corporation Finance; and, with respect to the application of the proposal to business development companies, David Joire, Senior Special Counsel, at (202) 551-6825 or

IMOCC@sec.gov,

Chief Counsel's Office, Division of Investment Management, U.S. Securities and Exchange Commission, 100 F Street NE, Washington, DC 20549.

SUPPLEMENTARY INFORMATION:

We are proposing to amend or add the following rules and forms:

Commission reference

CFR citation (17 CFR)

Regulation S-K

17 CFR 229.10 through 229.1305.

Items 106 and 407

§ 229.106 and § 229.407.

Regulation S-T

17 CFR 232.10 through 232.903.

Rule 405

§ 232.405.

Securities Act of 1933 (“Securities Act”)

Form S-3

§ 239.13.

Form SF-3

§ 239.45.

Securities Exchange Act of 1934 (“Exchange Act”)

Rule 13a-11

§ 240.13a-11.

Rule 15d-11

§ 240.15d-11.

Schedule 14A

§ 240.14a-101.

Schedule 14C

§ 240.14c-101.

Form 20-F

§ 249.220f.

Form 6-K

§ 249.306.

Form 8-K

§ 249.308.

Form 10-Q

§ 249.308A.

Form 10-K

§ 249.310.

Table of Contents

15 U.S.C. 77a

et seq.

15 U.S.C. 78a

et seq.

I. Background

A. Existing Regulatory Framework and Interpretive Guidance Regarding Cybersecurity Disclosure

B. Current Disclosure Practices

II. Proposed Amendments

A. Overview

B. Reporting of Cybersecurity Incidents on Form 8-K

1. Overview of Proposed Item 1.05 of Form 8-K

2. Examples of Cybersecurity Incidents that May Require Disclosure Pursuant to Proposed Item 1.05 of Form 8-K

3. Ongoing Investigations Regarding Cybersecurity Incidents

4. Proposed Amendment to Form 6-K

5. Proposed Amendments to the Eligibility Provisions of Form S-3 and Form SF-3 and Safe Harbor Provision in Exchange Act Rules 13a-11 and 15d-11

C. Disclosure About Cybersecurity Incidents in Periodic Reports

1. Updates to Previously Filed Form 8-K Disclosure

2. Disclosure of Cybersecurity Incidents That Have Become Material in the Aggregate

D. Disclosure of a Registrant's Risk Management, Strategy and Governance Regarding Cybersecurity Risks

1. Risk Management and Strategy

2. Governance

3. Definitions

E. Disclosure Regarding the Board of Directors' Cybersecurity Expertise

F. Periodic Disclosure by Foreign Private Issuers

G. Structured Data Requirements

III. Economic Analysis

A. Introduction

B. Economic Baseline

1. Current Regulatory Framework

2. Affected Parties

C. Potential Benefits and Costs of the Proposed Amendments

1. Benefits

a. Benefits to investors

(i) More Informative and More Timely Disclosure

(ii) Greater Uniformity and Comparability

b. Benefits to registrants

2. Costs

3. Indirect Economic Effects

D. Anticipated Effects on Efficiency, Competition, and Capital Formation

E. Reasonable Alternatives

1. Website Disclosure

2. Disclosure Through Form 10-Q and Form 10-K

3. Exempt Smaller Reporting Companies

4. Modify Scope of Inline XBRL Requirement

IV. Paperwork Reduction Act

A. Summary of the Collection of Information

B. Summary of the Estimated Burdens of the Proposed Amendments on the Collections of Information

C. Incremental and Aggregate Burden and Cost Estimates

V. Small Business Regulatory Enforcement Fairness Act

VI. Initial Regulatory Flexibility Act Analysis

A. Reasons for, and Objectives of, the Proposed Action

B. Legal Basis

C. Small Entities Subject to the Proposed Rules

D. Projected Reporting, Recordkeeping and Other Compliance Requirements

E. Duplicative, Overlapping, or Conflicting Federal Rules

F. Significant Alternatives

Statutory Authority and Text of Proposed Rule and Form Amendments

I. Background

Public company investors and other participants in the capital markets depend on companies' use of secure and reliable information systems to conduct their businesses. A significant and increasing amount of the world's economic activities occurs through digital technology and electronic communications.

In today's digitally connected world, cybersecurity threats and incidents pose an ongoing and escalating risk to public companies, investors, and market participants.

Cybersecurity risks have increased for a variety of reasons, including the digitalization of registrants' operations;

the prevalence of remote work, which has become even more widespread because of the COVID-19 pandemic;

the ability of cyber-criminals to monetize cybersecurity incidents, such as through ransomware, black markets for stolen data, and the use of crypto-assets for such transactions;

the growth of digital payments;

and increasing company reliance on third party service providers for information technology services, including cloud computing technology.

In particular, cybersecurity

incidents involving third party service provider vulnerabilities are becoming more frequent.

Additionally, cyber criminals are using increasingly sophisticated methods to execute their attacks.

Bhaskar Chakravorti, Ajay Bhalla, & Ravi Shankar Chaturvedi,

Which Economies Showed the Most Digital Progress in 2020?,

Harv. Bus. Rev. (Dec. 18, 2020),

available at https://hbr.org/2020/12/which-economies-showed-the-most-digital-progress-in-2020. See Percentage of Business Conducted Online,

IBISWORLD,

https://www.ibisworld.com/us/bed/percentage-of-business-conducted-online/88090/

(last updated Jan. 13, 2022).

See also U.S. Department of Commerce, Bureau of Economic Analysis, Updated Digital Economy Estimates—June 2021, available at https://www.bea.gov/system/files/2021-06/DE%20June%202021%20update%20for%20web%20v3.pdf

(“The digital economy accounted for 9.6 percent ($2,051.6 billion) of current-dollar gross domestic product ($21,433.2 billion) in 2019, according to new estimates from BEA. When compared with traditional U.S. industries or sectors, the digital economy ranked just below the manufacturing sector[.]”).

See

Steve Morgan,

Cybercrime to Cost The World $10.5 Trillion Annually By 2025,

Cybercrime Magazine, (Nov. 13, 2020),

available at https://cybersecurityventures.com/cybercrime-damage-costs-10-trillion-by-2025/

; Matt Powell,

11 Eye Opening Cyber Security Statistics for 2019,

CPO Magazine (June 25, 2019)

available at https://www.cpomagazine.com/tech/11-eye-opening-cyber-security-statistics-for-2019/

(The largest cybersecurity incidents involving public companies took place in the last ten years.);

see

Michael Hill and Dan Swinhoe, cso, The 15 biggest data breaches of the 21st century,

available at https://www.csoonline.com/article/2130877/the-biggest-data-breaches-of-the-21st-century.html; see e.g.,

Commission Statement and Guidance on Public Company Cybersecurity Disclosures (“2018 Interpretive Release”), Release No. 33-10459 (Feb. 26, 2018) No. 33-10459 (Feb. 21, 2018) [83 FR 8166 Feb. 26, 2018],

available at https://www.sec.gov/rules/interp/2018/33-10459.pdf

(“Companies today rely on digital technology to conduct their business operations and engage with their customers, business partners, and other constituencies. In a digitally connected world, cybersecurity presents ongoing risks and threats to our capital markets and to companies operating in all industries, including public companies regulated by the Commission.”).

See The US Digital Trust Insights Snapshot,

PwC Research (June 2021),

available at https://www.pwc.com/us/en/services/consulting/cybersecurity-risk-regulatory/library/2021-digital-trust-insights/cyber-threat-landscape.html.

See

Stephen Klemash and Jamie Smith,

What companies are disclosing about cybersecurity risk and oversight,

EY (Aug. 10, 2020),

available at https://www.ey.com/en_us/board-matters/what-companies-are-disclosing-about-cybersecurity-risk-and-oversight

(noting “[w]ith the COVID-19-driven accelerated shift to digital business and massive, potentially permanent shifts to remote working, including virtual board and executive management meetings, cybersecurity risks are exponentially greater.”).

See Navigating Cyber 2021,

FS-ISAC,

available at https://www.fsisac.com/navigatingcyber2021-report. See also

Vikki Davis,

Combating the cybersecurity risks of working home,

Cyber Magazine (Dec. 2, 2021),

available at https://cybermagazine.com/cyber-security/combating-cybersecurity-risks-working-home. See also

Dave Burg, Mike Maddison, & Richard Watson,

Cybersecurity: How do you rise above the waves of a perfect storm?,

The EY Glob. Info. Sec. Survey (July 22, 2021),

available at https://www.ey.com/en_us/cybersecurity/cybersecurity-how-do-you-rise-above-the-waves-of-a-perfect-storm.

(in a survey of 1,000 senior cybersecurity leaders, the results indicated that 81% of those surveyed said that COVID-19 forced organizations to bypass cybersecurity processes.).

See Combating Ransomware: A Comprehensive Framework For Action: Key Recommendations from the Ransomware Task Force,

Inst. for Sec. & Tech. (Apr. 2021),

available at https://securityandtechnology.org/ransomwaretaskforce/report

; (“The explosion of ransomware as a lucrative criminal enterprise has been closely tied to the rise of Bitcoin and other cryptocurrencies, which use distributed ledgers, such as blockchain, to track transactions.”);

see

James Lewis,

Economic Impact of Cybercrime—No Slowing Down,

P. 4, CSIS (Feb. 2018) (“Monetization of stolen data, which has always been a problem for cybercriminals, seems to have become less difficult because of improvements in cybercrime black markets and the use of digital currencies.”).

But see

Avivah Litan,

Gartner Predicts Criminal Cryptocurrency Transactions Will Drop by 30% by 2024,

gartner (Jan. 14, 2022)

available at https://www.gartner.com/en/articles/gartner-predicts-criminal-cryptocurrency-transactions-will-drop-by-30-by-2024

(predicting that successful ransomware payments will drop in the near future because of a number of developments including the transparency behind the blockchain platforms that crypto tokens use).

See also

Jeff Benson,

Biden Administration Seeks to Expand Crypto Tracking to Fight Ransomware,

decrypt,

available at https://decrypt.co/72582/biden-administration-seeks-expand-crypto-tracking-fight-ransomware

(noting that law enforcement agencies are putting additional resources into crypto-asset tracking as “the overwhelming majority of ransomware attackers demand Bitcoin.”).

Sumathi Bala,

Rise in online payments spurs questions over cybersecurity and privacy,

CNBC (July 1, 2021),

available at https://www.cnbc.com/2021/07/01/new-digital-payments-spur-questions-over-consumer-privacy-security-.html

(“Threats over cyber security have become a growing concern as more people turn to online payments.”).

See also

Vaibhav Goel, Deepa Mahajan, Marie-Claude Nadeau, Owen Sperling, & Stephanie Yeh,

New trends in US consumer digital payments,

McKinsey & Company (Oct. 2021),

available at https://www.mckinsey.com/industries/financial-services/our-insights/banking-matters/new-trends-in-us-consumer-digital-payments.

See The Cost of Third-Party Cybersecurity Risk Management,

Ponemon Institute LLC (Mar. 2019),

available at https://info.cybergrx.com/ponemon-report

(“Third-party breaches remain a dominant

security challenge for organizations, with over 63% of breaches linked to a third party.”);

see Digital Transformation & Cyber Risk: What You Need to Know Stay Safe,

Ponemon Sullivan Privacy Report (June 2020),

available at https://ponemonsullivanreport.com/2020/07/digital-transformation-cyber-risk-what-you-need-to-know-to-stay-safe/

(although companies are increasingly reliant on third parties, “63% of respondents say their organizations have difficulty ensuring there is a secure cloud environment.”).

See, e.g., Cost of Data Breach Report 2021,

IBM (July 2021),

available at https://www.ibm.com/security/data-breach

(finding 15% of the initial cybersecurity attack vectors were caused by cloud misconfiguration).

See Data Risk in the Third-Party Ecosystem: Second Annual Study,

Ponemon Institute LLC (Sept. 2017)

available at https://insidecybersecurity.com/sites/insidecybersecurity.com/files/documents/sep2017/cs2017_0340.pdf

(noting that “Data breaches caused by third parties are on the rise.”).

See e.g., The Cost of Third Party Cybersecurity Risk Management,

Ponemon Institute LLC (Mar. 2019),

available at https://www.cybergrx.com/resources/research-and-insights/ebooks-and-reports/the-cost-of-third-party-cybersecurity-risk-management

(“Over 53% of respondents have experienced a third-party data breach in the past 2 years at an average cost of $7.5 million.”).

See Cybersecurity: How do you rise above the waves of a perfect storm?, supra

note 6.

With an increase in the prevalence of cybersecurity incidents, there is an increased risk of the effect of cybersecurity incidents on the economy and registrants. Large scale cybersecurity attacks can have systemic effects on the economy as a whole, including serious effects on critical infrastructure and national security.

Public companies of all sizes and operating in all industries are susceptible to cybersecurity incidents that can stem from intentional or unintentional acts.

Additionally, senior management and boards of directors of public companies have become increasingly concerned about cybersecurity threats.

In a 2019 survey, chief executive officers of the largest 200 global companies rated “`national and corporate cybersecurity' as the number one threat to business growth and the international economy in the next 5 or 10 years.”

See

Cyber-Risk Oversight 2020, Key Principles and Practical Guidance for Corporate Boards (2020), nacd,

available at http://isalliance.org/wp-content/uploads/2020/02/RD-3-2020_NACD_Cyber_Handbook__WEB_022020.pdf

(“According to the Global Risks Report 2019, business leaders in advanced economies rank cyberattacks among their top concerns. A serious attack can destroy not only a company's financial health but also have systemic effects causing harm to the economy as a whole and even national security.”).

See also The Cost of Malicious Cyber Activity to the U.S. Economy

(Feb. 16, 2018), White H. Council of Econ. Advisers,

available at https://trumpwhitehouse.archives.gov/wp-content/uploads/2018/02/The-Cost-of-Malicious-Cyber-Activity-to-the-U.S.-Economy.pdf

(“An attack have significant spillover effects to corporate partners, customers, and suppliers.”) and Testimony of Robert Kolasky, Director, National Risk Management Center, Cybersecurity and Infrastructure Security Agency (CISA),

Securing U.S. Surface Transportation from Cyber Attacks,

U.S. House of Representatives, Committee on Homeland Security (Feb. 26, 2019),

available at https://www.congress.gov/116/meeting/house/108931/witnesses/HHRG-116-HM07-Wstate-KolaskyB-20190226.pdf. See also Exec. Order No. 14028, Improving the Nation's Cybersecurity,

(May 12, 2021), 86 FR 26633,

available at https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/.

See Economic Report of the President: Together with The Annual Report of the Council of Economic Advisers,

(Mar. 2019),

available at https://www.govinfo.gov/content/pkg/ERP-2019/pdf/ERP-2019.pdf

(“Drawing on new data, we document that cyber vulnerabilities are quite prevalent—even in Fortune 500 companies with significant resources at their disposal.”).

NACD,

Cyber-Risk Oversight2020, Key Principles and Practical Guidance for Corporate Boards, supra

note 12.

See EY CEO Imperative Study 2019,

July 2019,

available at https://assets.ey.com/content/dam/ey-sites/ey-com/en_gl/topics/growth/ey-ceo-imperative-exec-summ-single-spread-final.pdf.

The cost to companies and their investors of cybersecurity incidents is rising and doing so at an increasing rate.

The types of costs and adverse consequences that companies may incur or experience as a result of a cybersecurity incident include the following:

See Cost of Data Breach Report 2021,

IBM Security (July 2021),

available at https://www.ibm.com/security/data-breach

(“The average total cost of a data breach increased by nearly 10% year over year, the largest single year cost increase in the last seven years.”).

See e.g., 2018 Interpretive Release

; and Shinichi Kamiya, Jun-Koo Kang, Jungmin Kim, Andreas Milidonis, & Rene M. Stulz,

Risk management, firm reputation, and the impact of successful cyberattacks on target firms,

139 J. of Fin. Econ. at 747, 749 (2021).

• Costs due to business interruption, decreases in production, and delays in product launches;

• Payments to meet ransom and other extortion demands;

• Remediation costs, such as liability for stolen assets or information, repairs of system damage, and incentives to customers or business partners in an effort to maintain relationships after an attack;

• Increased cybersecurity protection costs, which may include increased insurance premiums and the costs of making organizational changes, deploying additional personnel and protection technologies, training employees, and engaging third-party experts and consultants;

• Lost revenues resulting from intellectual property theft and the unauthorized use of proprietary information or the failure to retain or attract customers following an attack;

• Litigation and legal risks, including regulatory actions by state and federal governmental authorities and non-U.S. authorities;

• Harm to employees and customers, violation of privacy laws, and reputational damage that adversely affects customer or investor confidence; and

• Damage to the company's competitiveness, stock price, and long-term shareholder value.

As indicated by the examples enumerated above, the potential costs and damage that can stem from a material cybersecurity incident are extensive. Many smaller companies have been targets of cybersecurity attacks so severe that the companies have gone out of business as a result.

These direct and indirect financial costs can negatively impact stock prices,

as well as short-term and long-term shareholder value. To mitigate the potential costs and damage that can result from a material cybersecurity incident, management and boards of directors may establish and maintain effective risk management strategies to address cybersecurity risks.

See

Testimony of Dr. Jane LeClair, Chief Operating Officer, National Cybersecurity Institute at Excelsior College, before the U.S. House of Representatives Committee on Small Business (Apr. 22, 2015),

available at http://docs.house.gov/meetings/SM/SM00/20150422/103276/HHRG-114-SM00-20150422-SD003-U4.pdf

(“Fifty percent of [small businesses] SMB's have been the victims of cyber attack and over 60 percent of those attacked go out of business. Often SMB's do not even know they have been attacked until it is too late.”).

See infra

note 101, section III.A.

See

NACD,

Cyber-Risk Oversight2020, Key Principles and Practical Guidance for Corporate Boards, supra

note 12.

Recent research suggests that cybersecurity is among the most critical governance-related issues for investors, especially U.S. investors.

Some

investors have been seeking information regarding registrants' cybersecurity risk management, strategy, and governance practices,

and there is evidence that the disclosure of cybersecurity incidents can affect both a registrant's reputation and its share price.

There may also be a positive correlation between a registrant's stock price and investments in certain cybersecurity technology.

Thus, whether and how a registrant is managing cybersecurity risks could impact an investor's return on investment and would be decision-useful information in an investor's investment or considerations.

2019 Responsible Investing Survey Key Findings,

RBC Glob. Asset Mgmt. (2019),

available at https://global.rbcgam.com/sitefiles/live/documents/pdf/rbc-gam-responsible-investing-survey-key-findings-2019.pdf

. This was a study developed by RBC Global Asset Management and BlueBay Asset Management LLP and distributed to a range of constituencies including institutional asset owners, consultants, clients, P&I Research Advisory Panel members, and members of the Pensions & Investment database. Study participants included individuals in Canada, Europe, Asia, and the United States. Two thirds of all respondents identified cybersecurity as an issue they were concerned about. The percentages were higher for the U.S., where out of all the environmental, social, and governance (“ESG”)-issues, the highest percentage of respondents ranked cybersecurity as the most concerning issue.

See also

J.P. Morgan Global Research,

Why is Cybersecurity Important to ESG Frameworks?

, J.P. Morgan Glob. Rsch. (Aug. 19, 2021),

available at https://www.jpmorgan.com/insights/research/why-is-cybersecurity-important-to-esg. See also Cyber security: Don't report on ESG without it

(2021), kpmg,

available at https://advisory.kpmg.us/articles/2021/cyber-security-report-on-esg.html.

See

Harvard Law School Forum on Corporate Governance Blog, posted by Steve W. Klemash, Jamie C. Smith, and Chuck Seets,

What Companies are Disclosing About Cybersecurity Risk and Oversight,

(posted Aug. 25, 2020)

available at https://corpgov.law.harvard.edu/2020/08/25/what-companies-are-disclosing-about-cybersecurity-risk-and-oversight

(“Because the threat of a breach cannot be eliminated, some investors stressed that they are particularly interested in resiliency, including how (and how quickly) companies are detecting and mitigating cybersecurity incidents. Some are asking their portfolio companies about specific cybersecurity practices, such as whether the company has had an independent assessment of its cybersecurity program, and some are increasingly focusing on data privacy and whether companies are adequately identifying and addressing related consumer concerns and expanding regulatory requirements.”).

See

Shinichi Kamiya, Jun-Koo Kang, Jungmin Kim, Andreas Milidonis, & Rene M. Stulz,

Risk management, firm reputation, and the impact of successful cyberattacks on target firms,

139 J. of Fin. Econ. at 747, 749 (2021); Georgios Spanos, and Lefteris Angelis,

The Impact of Information Security Events to the Stock Market: A Systematic Literature Review,

58 Comput. & Sec. at 216, 226 (2016) (“Respectively, negative information security events, as the security breaches, have a negative impact to the stock price of the breached firms in the majority of the studies.”).

Id.

We believe investors would benefit from more timely and consistent disclosure about material cybersecurity incidents, because of the potential impact that such incidents can have on the financial performance or position of a registrant. We also believe that investors would benefit from greater availability and comparability of disclosure by public companies across industries regarding their cybersecurity risk management, strategy, and governance practices in order to better assess whether and how companies are managing cybersecurity risks. The proposal reflects these policy goals.

Specifically, in this release, we are proposing to amend Form 8-K to require current disclosure of material cybersecurity incidents. We are also proposing to add new Item 106 of Regulation S-K that would require a registrant to: (1) Provide updated disclosure in periodic reports about previously reported cybersecurity incidents; (2) describe its policies and procedures, if any, for the identification and management of risks from cybersecurity threats, including whether the registrant considers cybersecurity risks as part of its business strategy, financial planning, and capital allocation; and (3) require disclosure about the board's oversight of cybersecurity risk, management's role in assessing and managing such risk, management's cybersecurity expertise, and management's role in implementing the registrant's cybersecurity policies, procedures, and strategies. We also are proposing to amend Item 407 of Regulation S-K to require disclosure of whether any member of the registrant's board has expertise in cybersecurity, and if so, the nature of such expertise.

Proposed Item 407(j) of Regulation S-K.

A. Existing Regulatory Framework and Interpretive Guidance Regarding Cybersecurity Disclosure

Although there are no disclosure requirements in Regulation S-K or S-X that explicitly refer to cybersecurity risks or incidents, in light of the increasing significance of cybersecurity incidents, over the past decade the Commission and staff have issued interpretive guidance concerning the application of existing disclosure and other requirements under the federal securities laws to cybersecurity risks and incidents. In 2011, the Division of Corporation Finance issued interpretive guidance (“2011 Staff Guidance”), providing the Division's views concerning operating companies' disclosure obligations relating to cybersecurity risks and incidents.

See

CF Disclosure Guidance: Topic No. 2—Cybersecurity (Oct. 13, 2011),

available at https://www.sec.gov/divisions/corpfin/guidance/cfguidance-topic2.htm.

In 2018, recognizing the “the frequency, magnitude and cost of cybersecurity incidents,” and the need for investors to be informed about material cybersecurity risks and incidents in a timely manner, the Commission issued interpretive guidance (“2018 Interpretive Release”) to assist operating companies in determining when they may be required to disclose information regarding cybersecurity risks and incidents under existing disclosure rules.

The 2018 Interpretive Release reinforced and expanded upon the 2011 Staff Guidance and also addressed the importance of cybersecurity policies and procedures, as well as the application of insider trading prohibitions in the context of cybersecurity.

See

Commission Statement and Guidance on Public Company Cybersecurity Disclosures, Release No. 33-10459 (Feb. 26, 2018) No. 33-10459 (Feb. 21, 2018) [83 FR 8166],

available at https://www.sec.gov/rules/interp/2018/33-10459.pdf.

In 2018, the Commission also issued a Report of Investigation pursuant to Section 21(a) of the Exchange Act regarding certain cyber-related frauds perpetrated against public companies and related internal accounting controls requirements. The report cautioned that public companies subject to the internal accounting controls requirements of Exchange Act Section 13(b)(2)(B) should consider cyber threats when implementing their internal accounting controls. The report is based on SEC Enforcement Division investigations that focused on business email compromises in which perpetrators posed as company executives or vendors and used emails to dupe company personnel into sending large sums to bank accounts controlled by the perpetrators.

See Report of Investigation Pursuant to 21(a) of the Securities Exchange Act of 1934 Regarding Certain Cyber-Related Frauds Perpetrated Against Public Companies and Related Internal Accounting Controls Requirements,

SEC Release No. 34-84429 (Oct. 16, 2018).

Specifically, the 2018 Interpretive Release stated that companies should consider the materiality of cybersecurity risks and incidents when preparing the disclosure required in registration statements under the Securities Act and Exchange Act, as well as in periodic and current reports under the Exchange Act. The 2018 Interpretive Release identified the following existing provisions in Regulations S-K and S-X that may require disclosure about cybersecurity risks, governance, and incidents:

There are corresponding provisions in Form 20-F for foreign private issuers.

• Item 105 of Regulation S-K (Risk Factors)

—the 2018 Interpretive Release sets forth issues for companies to consider in evaluating the need for cybersecurity risk factor disclosure, including risks arising in connection with acquisitions.

See also

Item 3.D of Form 20-F. Please note that Risk Factors was designated as Regulation S-K Item 503 at the time the 2018 Interpretive Release was issued.

• Item 303 of Regulation S-K (Management's Discussion and Analysis of Financial Condition and Results of Operations)

—the 2018 Interpretive Release discusses how the costs of ongoing cybersecurity efforts, the costs and other consequences of cybersecurity incidents, and the risks of potential cybersecurity incidents, among other matters, can inform a company's management's discussion and analysis. The 2018 Interpretive Release describes a wide array of potential costs that may be associated with cybersecurity issues and incidents such as loss of intellectual property and reputational harm.

See also

Item 5 of Form 20-F.

• Item 101 of Regulation S-K (Description of Business)

—the 2018 Interpretive Release notes that if cybersecurity incidents or risks materially affect a company's products,

services, relationships with customers or suppliers, or competitive conditions, the company must provide appropriate disclosure.

See also

Item 4.B of Form 20-F.

• Item 103 of Regulation S-K (Legal Proceedings)—the 2018 Interpretive Release explains that this item may require disclosure about material pending legal proceedings that relate to cybersecurity issues.

• Item 407 of Regulation S-K (Corporate Governance)

—the 2018 Interpretive Release clarifies that a company must describe how the board administers its risk oversight function to the extent that cybersecurity risks are material to a company's business, including a description of the nature of the board's role in overseeing the management of such risks.

This disclosure also is required by Item 7 of Schedule 14A.

• Regulation S-X Financial Disclosures—the 2018 Interpretive Release notes the Commission's expectation that a company would design its financial reporting and control systems to provide reasonable assurance that information about the range and magnitude of the financial impacts of a cybersecurity incident would be incorporated into its financial statements on a timely basis as that information becomes available.

The 2018 Interpretive Release also addresses the importance of a company's adoption of disclosure controls and procedures that cause the company to appropriately record, process, summarize, and report to investors material information related to cybersecurity risks and incidents.

In addition, the 2018 Interpretive Release reminds companies, their directors, officers, and other corporate insiders of the need to comply with insider trading laws in connection with information about cybersecurity risks and incidents, including vulnerabilities and breaches. The 2018 Interpretive Release further discusses disclosure obligations that companies may have under 17 CFR 243 (“Regulation FD”) in connection with cybersecurity matters. The guidance set forth in both the 2011 Staff Guidance and the 2018 Interpretive Release would remain in place if the Commission adopts the proposed rule amendments described in this release.

See supra

note 4, 2018 Interpretive Release at 8167 (“Crucial to a public company's ability to make any required disclosure of cybersecurity risks and incidents in the appropriate timeframe are disclosure controls and procedures that provide an appropriate method of discerning the impact that such matters may have on the company and its business, financial condition, and results of operations, as well as a protocol to determine the potential materiality of such risks and incidents.”).

B. Current Disclosure Practices

The majority of registrants reporting material cybersecurity incidents do so in a Form 8-K, press release, or periodic report. Although we are unable to determine the number of material cybersecurity incidents that either are not being disclosed or not being disclosed in a timely manner, the staff has observed certain cybersecurity incidents that were reported in the media but that were not disclosed in a registrant's filings. Further, the staff in the Division of Corporation Finance's review of Form 8-K filings, as well as Form 10-K and Form 20-F filings, has shown that the nature of the cybersecurity incident disclosure varies widely. In these filings, companies provide different levels of specificity regarding the cause, scope, impact, and materiality of cybersecurity incidents. For example, some companies provide a materiality analysis, disclose the estimated costs of an incident, discuss their engagement of cybersecurity professionals, and/or explain the remedial steps they have taken or are taking in response to a cybersecurity incident, while others do not provide such disclosure or provide much less detail in their disclosure on these topics.

The staff has also observed that, while the majority of registrants that are disclosing cybersecurity risks appear to be providing such disclosures in the risk factor section of their annual reports on Form 10-K, the disclosures are sometimes blended with other unrelated disclosures, which makes it more difficult for investors to locate, interpret, and analyze the information provided. Further, the staff has observed a divergence in these disclosures by industry and that, smaller reporting companies generally provide less cybersecurity disclosure as compared to larger registrants. One report noted a disconnect in which the industries experiencing the most high profile cybersecurity incidents provided disclosure with the “least amount of information.”

While cybersecurity risks and attacks may disproportionately affect certain industries at different times and in different ways, cybersecurity risks and threats may be dynamic; it is foreseeable and perhaps even predictable that malicious actors will adapt their strategies and target companies in any industry where there are perceived vulnerabilities.

Moody's Investors Service, Research Announcement, “Cybersecurity disclosures vary greatly in high-risk industries,” (Oct. 3, 2019),

available at https://www.moodys.com/research/Moodys-Cybersecurity-disclosures-vary-greatly-in-high-risk-industries--PBC_1196854.

Registrants' disclosures of both material cybersecurity incidents and cybersecurity risk management and governance have improved since the issuance of the 2011 Staff Guidance and the 2018 Interpretive Release.

Yet, current reporting may contain insufficient detail

and the staff has observed that such reporting is inconsistent, may not be timely, and can be difficult to locate. We believe that investors would benefit from enhanced disclosure about registrants' cybersecurity incidents and cybersecurity risk management and governance practices, including if the registrant's board of directors has expertise in cybersecurity matters, and we are proposing rule amendments to enhance disclosure in those areas.

Stephen Klemash and Jamie Smith,

What companies are disclosing about cybersecurity risk and oversight,

EY, supra note 6 (EY researchers looked at cybersecurity-related disclosures in the proxy statements and Form 10-K filings for the 76 “Fortune 100” companies that filed those documents from 2018 through May 31, 2020. Their finding indicated that, “[m]any companies are enhancing their cybersecurity disclosures, with modest increases across most of the disclosures tracked.”).

One report notes “the average public company's cyber disclosure contains insufficient detail for investors looking to evaluate its risk profile and to understand which remediation strategies, if any, it has implemented to control for the identified risks.” NACD et al.,

The State of Cyber-Risk Disclosures of Public Companies

at 3 (Mar. 2021)

available at https://www.nacdonline.org/insights/publications.cfm?ItemNumber=71711.

This same report contends (and cites other sources that argue) that the 2018 Interpretive Release alone has not resulted in adequate disclosures to investors.

Id.

at 4.

We welcome feedback and encourage interested parties to submit comments on any or all aspects of the proposed rule amendments. When commenting, it would be most helpful if you include the reasoning behind your position or recommendation.

II. Proposed Amendments

A. Overview

Cybersecurity risks and incidents can impact the financial performance or position of a company. Consistent, comparable, and decision-useful disclosures regarding a registrant's cybersecurity risk management, strategy, and governance practices, as well as a registrant's response to material cybersecurity incidents, would allow investors to understand such risks and incidents, evaluate a registrant's risk management and governance practices regarding those risks, and better inform their investment and voting decisions.

The proposed rules would require current and periodic reporting of

material cybersecurity incidents. Additionally, we are proposing amendments that would require periodic disclosures about a registrant's policies and procedures to identify and manage cybersecurity risk, including the impact of cybersecurity risks on the registrant's business strategy; management's role and expertise in implementing the registrant's cybersecurity policies, procedures, and strategies; and the board of directors' oversight role, and cybersecurity expertise, if any.

Specifically, we are proposing to:

• Amend Form 8-K to add Item 1.05 to require registrants to disclose information about a cybersecurity incident within four business days after the registrant determines that it has experienced a material cybersecurity incident;

Proposed Item 1.05.

• Amend Forms 10-Q and 10-K to require registrants to provide updated disclosure relating to previously disclosed cybersecurity incidents, as specified in proposed Item 106(d) of Regulation S-K. We also propose to amend these forms to require disclosure, to the extent known to management, when a series of previously undisclosed individually immaterial cybersecurity incidents has become material in the aggregate.

Proposed Item 106(d) of Regulation S-K.

• Amend Form 10-K to require disclosure specified in proposed Item 106 regarding:

○ A registrant's policies and procedures, if any, for identifying and managing cybersecurity risks;

Proposed Item 106(b) of Regulation S-K.

○ A registrant's cybersecurity governance, including the board of directors' oversight role regarding cybersecurity risks;

and

Proposed Item 106(c)(1) of Regulation S-K.

○ Management's role, and relevant expertise, in assessing and managing cybersecurity related risks and implementing related policies, procedures, and strategies.

Proposed Item 106(c)(2) of Regulation S-K.

• Amend Item 407 of Regulation S-K to require disclosure about if any member of the registrant's board of directors has cybersecurity expertise.

Proposed Item 407(j).

• Amend Form 20-F to require foreign private issuers (“FPIs”)

to provide cybersecurity disclosures in their annual reports filed on that form that are consistent with the disclosure that we propose to require in the domestic forms;

An FPI is any foreign issuer other than a foreign government, except for an issuer that (1) has more than 50% of its outstanding voting securities held of record by U.S. residents; and (2) any of the following: (i) A majority of its officers or directors are citizens or residents of the U.S.; (ii) more than 50% of its assets are located in the U.S.; or (iii) its business is principally administered in the U.S.

See

17 CFR 230.405.

See also

17 CFR 240.3b-4(c).

• Amend Form 6-K to add “cybersecurity incidents” as a reporting topic; and

• Require that the proposed disclosures be provided in Inline XBRL.

Proposed Rule 405 of Regulation S-T.

B. Reporting of Cybersecurity Incidents on Form 8-K

1. Overview of Proposed Item 1.05 of Form 8-K

There is growing concern that material cybersecurity incidents

are underreported

and that existing reporting may not be sufficiently timely.

We are proposing to address these concerns by requiring registrants to disclose material cybersecurity incidents in a current report on Form 8-K within four business days after the registrant determines that it has experienced a material cybersecurity incident.

See infra

Section II.D.3 for a discussion on the proposed definition of “cybersecurity incident.”

See New Study Reveals Cybercrime May Be Widely Underreported—Even When Laws Mandate Disclosure,

ISACA Press Release (June 3, 2019),

available at https://www.isaca.org/why-isaca/about-us/newsroom/press-releases/2019/new-study-reveals-cybercrime-may-be-widely-underreported-even-when-laws-mandate-disclosure. See also

Gerrit De Vynck,

Many ransomware attacks go unreported. The FBI and Congress want to change that.

Wash. Post (July 27, 2021),

available at https://www.washingtonpost.com/technology/2021/07/27/fbi-congress-ransomware-laws/

(quoting Eric Goldstein, executive assistant director at Cybersecurity & Infrastructure Security Agency (CISA), a federal agency created in 2018 to protect the U.S. from cyberattacks, as stating, “[w]e believe that only about a quarter of ransomware intrusions are actually reported[.]”).

See also

2018 Interpretive Release at Section II.A.1. Any material information not known or disclosable at the time of the Form 8-K filing would need to be updated in future periodic reports in response to proposed Item 106(d) of Regulation S-K.

See

discussion

infra

at Section II.C.1.

We believe that the proposed requirement to file an Item 1.05 Form 8-K within four business days after the registrant determines that it has experienced a material cybersecurity incident would significantly improve the timeliness of cybersecurity incident disclosures, as well as provide investors with more standardized and comparable disclosures.

If a triggering determination occurs within four business days before a registrant's filing of a Form 10-Q or Form 10-K, the Commission staff generally has not objected to the registrant satisfying its Form 8-K reporting obligation by including the disclosure in Item 5 (Other Information) of Part II of its Form 10-Q or Item 9B (Other Information) of its Form 10-K.

See

SEC Division of Corporation Finance, Exchange Act

Form 8

K Compliance and Disclosure Interpretations

(updated Dec. 22, 2017), Question 1,

available at https://www.sec.gov/divisions/corpfin/form8kfaq.htm.

We are proposing that the trigger for an Item 1.05 Form 8-K is the date on which a registrant determines that a cybersecurity incident it has experienced is material, rather than the date of discovery of the incident, so as to focus the Form 8-K disclosure on

incidents that are material to investors. In some cases, the date of the registrant's materiality determination may coincide with the date of discovery of an incident, but in other cases the materiality determination will come after the discovery date. If we adopt the date of the materiality determination as the Form 8-K reporting trigger, as proposed, we expect registrants to be diligent in making a materiality determination in as prompt a manner as feasible. To address any concern that some registrants may delay making such a determination to avoid a disclosure obligation, Instruction 1 to proposed Item 1.05 states: “a registrant shall make a materiality determination regarding a cybersecurity incident as soon as reasonably practicable after discovery of the incident.”

What constitutes “materiality” for purposes of the proposed cybersecurity incidents disclosure would be consistent with that set out in the numerous cases addressing materiality in the securities laws, including:

TSC Industries, Inc.

Northway, Inc.,

Basic, Inc.

Levinson,

and

Matrixx Initiatives, Inc.

Siracusano.

Information is material if “there is a substantial likelihood that a reasonable shareholder would consider it important”

in making an investment decision, or if it would have “significantly altered the `total mix' of information made available.”

In articulating this materiality standard, the Supreme Court recognized that “[d]oubts as to the critical nature” of the relevant information “will be commonplace.” But “particularly in view of the prophylactic purpose” of the securities laws, and “the fact that the content” of the disclosure “is within management's control, it is appropriate that these doubts be resolved in favor of those the statute is designed to protect,” namely investors.

TSC Indus.

Northway,

426 U.S. 438, 449 (1976).

Basic Inc.

Levinson,

485 U.S. 224, 232 (1988).

563 U.S. 27 (2011).

TSC Indus.

Northway,

426 U.S. at 449.

Id. See also

the definition of “material” in Securities Act Rule 405, 17 CFR 230.405; Exchange Act Rule 12b-2, 17 CFR 240.12b-2.

TSC Indus.

Northway,

426 U.S. at 448.

A materiality analysis is not a mechanical exercise, nor should it be based solely on a quantitative analysis of a cybersecurity incident. Rather, registrants would need to thoroughly and objectively evaluate the total mix of information, taking into consideration all relevant facts and circumstances surrounding the cybersecurity incident, including both quantitative and qualitative factors, to determine whether the incident is material. Even if the probability of an adverse consequence is relatively low, if the magnitude of the loss or liability is high, the incident may still be material; materiality “depends on the significance the reasonable investor would place on” the information.

Thus, under the proposed rules, when a cybersecurity incident occurs, registrants would need to carefully assess whether the incident is material in light of the specific circumstances presented by applying a well-reasoned, objective approach from a reasonable investor's perspective based on the total mix of information.

Basic Inc.

Levinson,

485 U.S. at 240.

2. Examples of Cybersecurity Incidents That May Require Disclosure Pursuant to Proposed Item 1.05 of Form 8-K

The following is a non-exclusive list of examples of cybersecurity incidents

that may, if determined by the registrant to be material, trigger the proposed Item 1.05 disclosure requirement:

As discussed

infra

in Section II.D, we propose to define cybersecurity incident as “an unauthorized occurrence on or conducted through a registrant's information systems that jeopardizes the confidentiality, integrity, or availability of a registrant's information systems or any information residing therein.” We believe this term is sufficiently understood and broad enough to encompass incidents that could adversely affect a registrant's information systems or information residing therein, such as gaining access without authorization or by exceeding authorized access to such systems and information that could lead, for example, to the modification or destruction of systems and information. We also propose to define information systems as “information resources, owned or used by the registrant, including physical or virtual infrastructure controlled by such information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of a registrant's information to maintain or support the registrant's operations.” The definitions of “cybersecurity incident” and “information systems” as proposed in Item 106 of Regulation S-K would also apply to such terms as used in proposed Item 1.05 of Form 8-K.

See infra

note 80.

• An unauthorized incident that has compromised the confidentiality, integrity, or availability of an information asset (data, system, or network); or violated the registrant's security policies or procedures. Incidents may stem from the accidental exposure of data or from a deliberate attack to steal or alter data;

• An unauthorized incident that caused degradation, interruption, loss of control, damage to, or loss of operational technology systems;

• An incident in which an unauthorized party accessed, or a party exceeded authorized access, and altered, or has stolen sensitive business information, personally identifiable information, intellectual property, or information that has resulted, or may result, in a loss or liability for the registrant;

• An incident in which a malicious actor has offered to sell or has threatened to publicly disclose sensitive company data; or

• An incident in which a malicious actor has demanded payment to restore company data that was stolen or altered.

3. Ongoing Investigations Regarding Cybersecurity Incidents

Proposed Item 1.05 would not provide for a reporting delay when there is an ongoing internal or external investigation related to the cybersecurity incident. As the Commission stated in the 2018 Interpretive Release, while an ongoing investigation might affect the specifics in the registrant's disclosure, “an ongoing internal or external investigation—which often can be lengthy—would not on its own provide a basis for avoiding disclosures of a material cybersecurity incident.”

Additionally, any such delay provision could undermine the purpose of proposed Item 1.05 of providing timely and consistent disclosure of cybersecurity incidents given that investigations and resolutions of cybersecurity incidents may occur over an extended period of time and may vary widely in timing and scope. At the same time, we recognize that a delay in reporting may facilitate law enforcement investigations aimed at apprehending the perpetrators of the cybersecurity incident and preventing future cybersecurity incidents. On balance, it is our current view that the importance of timely disclosure of cybersecurity incidents for investors would justify not providing for a reporting delay.

See supra

note 33, 2018 Interpretive Release.

Many states have laws that allow companies to delay providing public notice about a data breach incident or notifying certain constituencies of such an incident if law enforcement determines that notification will impede a civil or criminal investigation. A registrant may have obligations to report incidents at the state or federal level (to customers, consumer credit reporting entities, state or federal regulators and law enforcement agencies, etc.); those obligations are distinct from its obligations to disclose material information to its shareholders under the federal securities laws. To the extent that proposed Item 1.05 of Form 8-K would require disclosure in a situation in which a state law delay provision

would excuse notification, there is a possibility a registrant would be required to disclose the incident on Form 8-K even though it could delay incident reporting under a particular state law. The proposed Form 8-K requirement would advance the objective of timely reporting of material cybersecurity incidents without the uncertainties of delay. It is critical to investor protection and well-functioning, orderly, and efficient markets that investors promptly receive information regarding material cybersecurity incidents.

4. Proposed Amendment to Form 6-K

FPIs are not required to file current reports on Form 8-K.

Instead, they are required to furnish on Form 6-K

copies of all information that the FPI: (i) Makes or is required to make public under the laws of its jurisdiction of incorporation, (ii) files, or is required to file under the rules of any stock exchange, or (iii) otherwise distributes to its security holders. We are proposing to amend General Instruction B of Form 6-K to reference material cybersecurity incidents among the items that may trigger a current report on Form 6-K. As with proposed Item 1.05 of Form 8-K, the proposed change to Form 6-K is intended to provide timely cybersecurity incident disclosure in a manner that is consistent with the general purpose and use of Form 6-K.

See

Exchange Act Rules 13a-11 and 15d-11 [17 CFR 240.13a-11 and 15d-11].

17 CFR 249.306.

5. Proposed Amendments to the Eligibility Provisions of Form S-3 and Form SF-3 and Safe Harbor Provision in Exchange Act Rules 13a-11 and 15d-11

We are proposing to amend General Instruction I.A.3.(b) of Form S-3 and General Instruction I.A.2 of Form SF-3 to provide that an untimely filing on Form 8-K regarding new Item 1.05 would not result in loss of Form S-3 or Form SF-3 eligibility. Under our existing rules, the untimely filing on Form 8-K of certain specified items does not result in loss of Form S-3 or Form SF-3 eligibility, so long as Form 8-K reporting is current at the time the Form S-3 or SF-3 is filed. In the past, when we have adopted new disclosure requirements that differed from the traditional periodic reporting obligations of companies, we have acknowledged concerns about the potentially harsh consequences of the loss of Form S-3 or Form SF-3 eligibility, and addressed such concerns by specifying that untimely filing of Forms 8-K relating to certain topics would not result in the loss of Form S-3 or Form SF-3 eligibility.

For the same reason, we believe that it is appropriate to add proposed Item 1.05 to the list of Form 8-K items in General Instruction I.A.3.(b) of Form S-3 and General Instruction I.A.2 of Form SF-3.

See

Selective Disclosure and Insider Trading, Release No. 33-7881 (Aug. 15, 2000) [65 FR 51715 (Aug. 24, 2000)];

see also

Additional Form 8-K Disclosure Requirements and Acceleration of Filing Date, Release No. 33-8400 (Mar. 16, 2004) [69 FR 15593 (Mar. 25, 2004)] (the “Additional Form 8-K Disclosure Release”).

See

Selective Disclosure and Insider Trading, Release No. 33-7881 (Aug. 15, 2000) [65 FR 51715]; Additional Form 8-K Disclosure Release.

We are also proposing to amend Rules 13a-11(c) and 15d-11(c) under the Exchange Act to include new Item 1.05 in the list of Form 8-K items eligible for a limited safe harbor from liability under Section 10(b) or Rule 10b-5 under the Exchange Act.

In 2004, when the Commission adopted the limited safe harbor, the Commission noted its view that the safe harbor is appropriate if the triggering event for the Form 8-K requires management to make a rapid materiality determination.

While the registrant would need to file an Item 1.05 Form 8-K within four business days after the registrant determines that it has experienced a material cybersecurity incident, rather than within four business days after its discovery of the incident, we expect management to make a materiality determination about the incident as soon as reasonably practicable after its discovery of the incident.

In some cases, we expect that management would make a materiality determination coincident with discovering a cybersecurity incident and therefore file a Form 8-K very soon after the registrant experiences or discovers a cybersecurity incident. Therefore, we believe that it is appropriate to extend the safe harbor to this proposed new item.

Rules 13a-11(c) and 15d-11(c) each provides that “[n]o failure to file a report on Form 8-K that is required solely pursuant to Item 1.01, 1.02, 2.03, 2.04, 2.05, 2.06, 4.02(a), 5.02(e), or 6.03 of Form 8-K shall be deemed a violation of” Section 10(b) of the Exchange Act or Rule 10b-5 thereunder.

Additional Form 8-K Disclosure Release at 69 FR 15607.

Instruction 1 to proposed Item 1.05 of Form 8-K.

Request for Comment

1. Would investors benefit from current reporting about material cybersecurity incidents on Form 8-K? Does the proposed Form 8-K disclosure requirement appropriately balance the informational needs of investors and the reporting burdens on registrants?

2. Would proposed Item 1.05 require an appropriate level of disclosure about a material cybersecurity incident? Would the proposed disclosures allow investors to understand the nature of the incident and its potential impact on the registrant, and make an informed investment decision? Should we modify or eliminate any of the specified disclosure items in proposed Item 1.05? Is there any additional information about a material cybersecurity incident that Item 1.05 should require?

3. Could any of the proposed Item 1.05 disclosures or the proposed timing of the disclosures have the unintentional effect of putting registrants at additional risk of future cybersecurity incidents? If so, how could we modify the proposal to avoid this effect? For example, should registrants instead provide some of the disclosures in proposed Item 1.05 in the registrant's next periodic report? If so, which disclosures?

4. We are proposing to require registrants to file an Item 1.05 Form 8-K within four business days after the registrant determines that it has experienced a material cybersecurity incident. Would the proposed four-business day filing deadline provide sufficient time for registrants to prepare the disclosures that would be required under proposed Item 1.05? Should we modify the timeframe in which a registrant must file a Form 8-K under proposed Item 1.05? If so, what timeframe would be more appropriate for making these disclosures?

5. Should there be a different triggering event for the Item 1.05 disclosure, such as the registrant's discovery that it has experienced a cybersecurity incident, even if the registrant has not yet been able to determine the materiality of the incident? If so, which information should be disclosed in Form 8-K based on a revised triggering event? Should we instead require disclosure only if the expected costs arising from a cybersecurity incident exceed a certain quantifiable threshold,

e.g.,

a percentage of the company's assets, equity, revenues or net income or alternatively a precise number? If so, what would be an appropriate threshold?

6. To what extent, if any, would the proposed Form 8-K incident reporting obligation create conflicts for a registrant with respect to other obligations of the registrant under federal or state law? How would any such conflicting obligations arise, and what mechanisms could the Commission use to ensure that registrants can comply with other laws and regulations while providing these

timely disclosures to investors? What costs would registrants face in determining the extent of a potential conflict?

7. Should any rule provide that the Commission shall allow registrants to delay reporting of a cybersecurity incident where the Attorney General requests such a delay from the Commission based on the Attorney General's written determination that the delay is in the interest of national security?

8. We are proposing to include an instruction that “a registrant shall make a materiality determination regarding a cybersecurity incident as soon as reasonably practicable after discovery of the incident.” Is this instruction sufficient to mitigate the risk of a registrant delaying a materiality determination? Should we consider further guidance regarding the timing of a materiality determination? Should we, for example, suggest examples of timeframes that would (or would not), in most circumstances, be considered prompt?

9. Should certain registrants that would be within the scope of the proposed requirements, but that are subject to other cybersecurity-related regulations, or that would be included in the scope of the Commission's recently-proposed cybersecurity rules

for advisers and funds, if adopted, be excluded from the proposed requirements? For example, should the proposed Form 8-K reporting requirements or the other disclosure requirements described in this release, as applicable, exclude business development companies (“BDCs”),

or the publicly traded parent of an adviser?

See

Cybersecurity Risk Management for Investment Advisers, Registered Investment Companies, and Business Development Companies, Release No. 34-94197 (Feb. 9, 2022) [87 FR 13524 (Mar. 9, 2022)] (“Investment Management Cybersecurity Proposing Release”). In this release, the Commission proposed new rules and rule amendments that would require: (i) Registered investment advisers (“advisers”) and investment companies (“funds”) to adopt and implement written cybersecurity policies and procedures reasonably designed to address cybersecurity risks; (ii) advisers to report significant cybersecurity incidents affecting the adviser, or its fund or private fund clients, to the Commission; (iii) advisers and funds to provide cyber-related disclosures to clients and investors; and (iv) advisers and funds to maintain certain records related to the proposed cybersecurity risk management obligations and the occurrence of cybersecurity incidents.

For purposes of this release, the terms “public companies,” “companies,” and “registrants,” include issuers that are business development companies as defined in section 2(a)(48) of the Investment Company Act of 1940 (“Investment Company Act”), but not those investment companies registered under that Act.

10. As described further below, we are proposing to define cybersecurity incident to include an unauthorized occurrence on or through a registrant's “information systems,” which is proposed to include “information resources owned or used by the registrant.” Would registrants be reasonably able to obtain information to make a materiality determination about cybersecurity incidents affecting information resources that are used but not owned by them? Would a safe harbor for information about cybersecurity incidents affecting information resources that are used but not owned by a registrant be appropriate? If so, why, and what would be the appropriate scope of a safe harbor? What alternative disclosure requirements would provide investors with information about cybersecurity incidents and risks that affect registrants via information systems owned by third parties?

11. We are proposing that registrants be required to file rather than permitted to furnish an Item 1.05 Form 8-K. Should we instead permit registrants to furnish an Item 1.05 Form 8-K, such that the Form 8-K would not be subject to liability under Section 18 of the Exchange Act unless the registrant specifically states that the information is to be considered “filed” or incorporates it by reference into a filing under the Securities Act or Exchange Act?

12. We note above a non-exclusive list of examples that would merit disclosure under Item 1.05 of Form 8-K covers some, but not all, types of material cybersecurity incidents. Are there additional examples we should address? Should we include a non-exclusive list of examples in Item 1.05 of Form 8-K?

13. Should we include Item 1.05 in the Exchange Act Rules 13a-11 and 15d-11 safe harbors from public and private claims under Exchange Act Section 10(b) and Rule 10b-5 for failure to timely file a Form 8-K, as proposed?

14. Should we include Item 1.05, as proposed, in the list of Form 8-K items where failure to timely file a Form 8-K will not result in the loss of a registrant's eligibility to file a registration statement on Form S-3 and Form SF-3?

C. Disclosure About Cybersecurity Incidents in Periodic Reports

1. Updates to Previously Filed Form 8-K Disclosure

Proposed Item 106(d)(1) of Regulation S-K would require registrants to disclose any material changes, additions, or updates to information required to be disclosed pursuant to Item 1.05 of Form 8-K in the registrant's quarterly report filed with the Commission on Form 10-Q or annual report filed with the Commission on Form 10-K for the period (the registrant's fourth fiscal quarter in the case of an annual report) in which the material change, addition, or update occurred.

We are proposing this requirement to balance the need for prompt and timely disclosure regarding material cybersecurity incidents with the fact that a registrant may not have complete information about a material cybersecurity incident at the time it determines the incident to be material. Proposed Item 106(d)(1) provides a means for investors to receive regular updates regarding the previously reported incident when and for so long as there are material changes, additions, or updates during a given reporting period. For example, after filing the initial Form 8-K disclosure, the registrant may become aware of additional material information about the scope of the incident and whether any data was stolen or altered; the proposed Item 106(d)(1) disclosure requirements would allow investors to stay informed of such developments.

The registrant also may be able to provide information about the effect of the previously reported cybersecurity incident on its operations as well as a description of remedial steps it has taken, or plans to take, in response to the incident that was not available at the time of the initial Form 8-K filing.

In order to assist registrants in developing updated incident disclosure in its periodic reports, proposed Item 106(d)(1) provides the following non-exclusive examples of the type of disclosure that should be provided, if applicable:

Notwithstanding proposed Item 106(d)(1), there may be situations where a registrant would need to file an amended Form 8-K to correct disclosure from the initial Item 1.05 Form 8-K, such as where that disclosure becomes inaccurate or materially misleading as a result of subsequent developments regarding the incident. For example, if the impact of the incident is determined after the initial Item 1.05 Form 8-K filing to be significantly more severe than previously disclosed, an amended Form 8-K may be required.

• Any material impact of the incident on the registrant's operations and financial condition;

• Any potential material future impacts on the registrant's operations and financial condition;

• Whether the registrant has remediated or is currently remediating the incident; and

• Any changes in the registrant's policies and procedures as a result of the cybersecurity incident, and how the incident may have informed such changes.

2. Disclosure of Cybersecurity Incidents That Have Become Material in the Aggregate

Proposed Item 106(d)(2) would require disclosure when a series of previously undisclosed individually immaterial cybersecurity incidents become material in the aggregate. Thus, registrants would need to analyze related cybersecurity incidents for materiality, both individually and in the aggregate. If such incidents become material in the aggregate, registrants would need to disclose: When the incidents were discovered and whether they are ongoing; a brief description of the nature and scope of such incidents; whether any data was stolen or altered; the impact of such incidents on the registrant's operations and the registrant's actions; and whether the registrant has remediated or is currently remediating the incidents.

While such incidents conceptually could take a variety of forms, an example would be where one malicious actor engages in a number of smaller but continuous cyber-attacks related in time and form against the same company and collectively, they are either quantitatively or qualitatively material, or both. Such incidents would need to be disclosed in the periodic report for the period in which a registrant has made a determination that they are material in the aggregate.

Request for Comment

15. Should we require registrants to disclose any material changes or updates to information that would be disclosed pursuant to proposed Item 1.05 of Form 8-K in the registrant's quarterly or annual report, as proposed? Are there instances, other than to correct inaccurate or materially misleading prior disclosures, when a registrant should be required to update its report on Form 8-K or file another Form 8-K instead of providing disclosure of material changes, additions, or updates in a subsequent Form 10-Q or Form 10-K?

16. Should we require a registrant to provide disclosure on Form 10-Q or Form 10-K when a series of previously undisclosed and individually immaterial cybersecurity incidents becomes material in the aggregate, as proposed? Alternatively, should we require a registrant to provide disclosure in Form 8-K, rather than in a periodic report, as proposed, when a series of previously undisclosed and individually immaterial cybersecurity incidents becomes material in the aggregate?

D. Disclosure of a Registrant's Risk Management, Strategy and Governance Regarding Cybersecurity Risks

1. Risk Management and Strategy

Companies typically address significant risks to their businesses by developing risk management systems, which may include policies and procedures for identifying, assessing, and managing the risks. These policies and procedures may then be subject to oversight by a company's management and board.

Policies and procedures reasonably designed to provide oversight, risk assessments, and incident responses may be adopted to help prevent or mitigate cyber-attacks and potentially prevent future attacks. Staff in the Division of Corporation Finance has observed that most of the registrants that disclosed a cybersecurity incident in 2021 did not describe their cybersecurity risk oversight and related policies and procedures. Some of these registrants provided only general disclosures, such as a reference to cybersecurity as one of the risks overseen by the board or a board committee.

See

Martin Lipton, Wachtell, Lipton, Rosen & Katz,

Spotlight on Boards 2018,

Harv. L. Sch. F. on Corp. Governance (May 31, 2018),

available at https://corpgov.law.harvard.edu/2018/05/31/spotlight-on-boards-2018

(one of the board's responsibilities is to, “[o]versee and understand the corporation's risk management and compliance efforts and how risk is taken into account in the corporation's business decision-making; respond to red flags if and when they arise.”).

We are proposing Item 106(b) of Regulation S-K to require registrants to provide more consistent and informative disclosure regarding their cybersecurity risk management and strategy. We believe that disclosure of the relevant policies and procedures, to the extent a registrant has established any, would benefit investors by providing greater transparency as to the registrant's strategies and actions to manage cybersecurity risks. For example, proposed disclosure about whether the registrant has a cybersecurity risk assessment program and undertakes activities designed to prevent, detect, and minimize effects of cybersecurity incidents can improve an investor's understanding of the registrant's cybersecurity risk profile. Given that a significant number of cybersecurity incidents pertain to third party service providers, the proposed rules would require disclosure concerning a registrant's selection and oversight of third-party entities as well.

See

Stephen Klemash and Jamie Smith,

What companies are disclosing about cybersecurity risk and oversight,

EY, supra note 6 (“Around a third of the disclosed data breaches related to cyber attacks of third-party service providers.”).

Additionally, cybersecurity risks may have an impact on a registrant's business strategy, financial outlook, or financial planning. Across industries, companies increasingly rely on information technology, collection of data, and use of digital payments as critical components of their business model and strategy. Their exposure to cybersecurity risks and previous cybersecurity incidents may affect these critical components, informing changes in their business model, financial condition, financial planning, and allocation of capital. For example, a company with a business model that relies highly on collecting and safeguarding sensitive and personally identifiable information from its customers may consider raising additional capital to invest in enhanced cybersecurity protection, improvements in its information security infrastructure, or employee cybersecurity training. Another company may examine the risks and decide that its business model should be adapted to minimize its collection of sensitive and personally identifiable information in order to reduce its risk exposure. These strategic decisions have implications for the company's financial planning and future financial performance. Disclosure about the impact of cybersecurity risks on business strategy would enable investors to assess whether companies will become more resilient or conversely, more vulnerable to cybersecurity risks in the future.

We also propose requiring disclosure of whether cybersecurity related risk and previous incidents have affected or are reasonably likely to affect the registrant's results of operations or financial condition. Investors would likely want to understand the financial impacts of cybersecurity risks and previous cybersecurity incidents in order to understand how these risks and incidents affect the company's financial performance or position, and thus the return on their investment. For example, a company that has previously experienced a cybersecurity incident may plan to provide compensation to consumers or it may anticipate regulatory fines or legal judgments as a result of the incident. These financial impacts would help investors understand the degree to which cybersecurity risks and incidents could affect the company's financial performance or position.

Proposed Item 106(b) would therefore require registrants to disclose its

policies and procedures, if it has any, to identify and manage cybersecurity risks and threats, including: Operational risk; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. Specifically, proposed Item 106(b) of Regulation S-K would require disclosure, as applicable, of whether:

See

proposed Item 106(b).

• The registrant has a cybersecurity risk assessment program and if so, provide a description of such program;

• The registrant engages assessors, consultants, auditors, or other third parties in connection with any cybersecurity risk assessment program;

• The registrant has policies and procedures to oversee and identify the cybersecurity risks associated with its use of any third-party service provider (including, but not limited to, those providers that have access to the registrant's customer and employee data), including whether and how cybersecurity considerations affect the selection and oversight of these providers and contractual and other mechanisms the company uses to mitigate cybersecurity risks related to these providers;

• The registrant undertakes activities to prevent, detect, and minimize effects of cybersecurity incidents;

• The registrant has business continuity, contingency, and recovery plans in the event of a cybersecurity incident;

• Previous cybersecurity incidents have informed changes in the registrant's governance, policies and procedures, or technologies;

• Cybersecurity related risk and incidents have affected or are reasonably likely to affect the registrant's results of operations or financial condition and if so, how; and

• Cybersecurity risks are considered as part of the registrant's business strategy, financial planning, and capital allocation and if so, how.

2. Governance

Disclosure regarding board oversight of a registrant's cybersecurity risk and the inclusion or exclusion of management from the oversight of cybersecurity risks and the implementation of related policies, procedures, and strategies impacts an investor's ability to understand how a registrant prepares for, prevents, or responds to cybersecurity incidents.

Accordingly, proposed Item 106(c) would require disclosure of a registrant's cybersecurity governance, including the board's oversight of cybersecurity risk and a description of management's role in assessing and managing cybersecurity risks, the relevant expertise of such management, and its role in implementing the registrant's cybersecurity policies, procedures, and strategies.

See

John F. Saverese et al.,

Cybersecurity Oversight and Defense—A Board and Management Imperative,

Harv. L.Sch. F. on Corp. Governance (May 14, 2021),

available at https://corpgov.law.harvard.edu/2021/05/14/cybersecurity-oversight-and-defense-a-board-and-management-imperative/.

Proposed amendments to Form 10-K clarify that an asset-backed issuer (as defined in Item 1101 of Regulation AB) that does not have any executive officers or directors may omit the information required by 17 CFR 229.106(c) (Item 106(c) of Regulation S-K).

Specifically, as it pertains to the board's oversight of cybersecurity risk, disclosure required by proposed Item 106(c)(1) would include a discussion, as applicable, of the following:

See

proposed Item 106(c)(1). In the case of a FPI with a two-tier board of directors, proposed Instruction 1 to Item 106(c) clarifies that the term “board of directors” means the supervisory or non-management board. In the case of a FPI meeting the requirements of 17 CFR 240.10A-3(c)(3), for purposes of proposed Item 106(c), the term, “board of directors” means the registrant's board of auditors (or similar body) or statutory auditors, as applicable.

• Whether the entire board, specific board members or a board committee is responsible for the oversight of cybersecurity risks;

• The processes by which the board is informed about cybersecurity risks, and the frequency of its discussions on this topic; and

• Whether and how the board or board committee considers cybersecurity risks as part of its business strategy, risk management, and financial oversight.

This proposed disclosure about the board's oversight would inform investors about the role of the board in cybersecurity risk management, which may help inform their investment and voting decisions. Proposed Item 106(c)(1) would also reinforce the 2018 Interpretive Release, which states that the board's role in overseeing cybersecurity risks should be disclosed if “cybersecurity risks are material to a company's business” and that such disclosures should address how a board “engages with management on cybersecurity issues” and “discharg[es] its [cybersecurity] risk oversight responsibility.”

See

2018 Interpretive Release.

Proposed Item 106(c)(2) would require a description of management's role in assessing and managing cybersecurity-related risks and in implementing the registrant's cybersecurity policies, procedures, and strategies. This description would include, but not be limited to, the following information:

See

proposed Item 106(c)(2).

• Whether certain management positions or committees are responsible for measuring and managing cybersecurity risk, specifically the prevention, mitigation, detection, and remediation of cybersecurity incidents, and the relevant expertise of such persons or members;

• Whether the registrant has a designated chief information security officer,

or someone in a comparable position, and if so, to whom that individual reports within the registrant's organizational chart, and the relevant expertise

of any such persons;

The chief information security officer may be responsible for identifying and monitoring cybersecurity risks, communicating with senior management and the registrant's business units about acceptable risk levels, developing risk mitigation strategies, and implementing a security framework that protects the registrant's digital assets.

The Role of the CISO and the Digital Security Landscape,

isaca j. vol. 2, at 22, 23-29 (2019)

available at https://www.isaca.org/resources/isaca-journal/issues/2019/volume-2/the-role-of-the-ciso-and-the-digital-security-landscape.

Proposed Instruction 2 to Item 106(c) provides guidance that “expertise” in Item 106(c)(2)(i) and (ii) may include, for example: Prior work experience in cybersecurity; any relevant degrees or certifications; any knowledge, skills, or other background in cybersecurity.

• The processes by which such persons or committees are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents; and

• Whether and how frequently such persons or committees report to the board of directors or a committee of the board of directors on cybersecurity risk.

This proposed disclosure of how a registrant's management assesses and implements policies, procedures, and strategies to mitigate cybersecurity risks would be of importance to investors both as they understand how registrants are planning for cybersecurity risks and as they make decisions as to how best to allocate their capital.

3. Definitions

Proposed Item 106(a) defines the terms “cybersecurity incident,” “cybersecurity threat,” and “information systems,” as used in proposed Item 106 and proposed Form 8-K Item 1.05 as follows:

See

proposed Item 106(a). These three terms are derived from a number of established sources.

See

Presidential Policy Directive—United States Cyber Incident Coordination (July 26, 2016) (“PPD-41”); 6 U.S.C. 1501 (2021); 44 U.S.C. 3502 (2021); 44 U.S.C. 3552 (2021);

see also

National Institute of Standards and Technology (NIST), Computer Security Resource Center Glossary (last visited Feb.

6, 2022),

available at https://csrc.nist.gov/glossary

(“NIST Glossary”). The proposed definitions also are consistent with proposed definitions in the Investment Management Cybersecurity Proposing Release.

See

Investment Management Cybersecurity Proposing Release at notes 27, 28, and 30. We believe the proposed terms are sufficiently precise for registrants to understand and use in connection with the proposed rules. Use of common terms is intended to facilitate compliance and reduce regulatory burdens. Using common terms and similar definitions with the Investment Management Cybersecurity Proposing Release along with other federal cybersecurity rulemakings is intended to facilitate compliance and reduce regulatory burdens.

•

Cybersecurity incident

means an unauthorized occurrence on or conducted through a registrant's information systems that jeopardizes the confidentiality, integrity, or availability of a registrant's information systems or any information residing therein.

•

Cybersecurity threat

means any potential occurrence that may result in, an unauthorized effort to adversely affect the confidentiality, integrity or availability of a registrant's information systems or any information residing therein.

•

Information systems

means information resources, owned or used by the registrant, including physical or virtual infrastructure controlled by such information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of the registrant's information to maintain or support the registrant's operations.

What constitutes a “cybersecurity incident” for purposes of our proposal should be construed broadly and may result from any one or more of the following: An accidental exposure of data, a deliberate action or activity to gain unauthorized access to systems or to steal or alter data, or other system compromises or data breaches.

See supra

Section II.B.2, for examples of cybersecurity incidents that may require disclosure pursuant to proposed Item 1.05 of Form 8-K.

Request for Comment

17. Should we adopt Item 106(b) and (c) as proposed? Are there other aspects of a registrant's cybersecurity policies and procedures or governance that should be required to be disclosed under Item 106, to the extent that a registrant has any policies and procedures or governance? Conversely, should we exclude any of the proposed Item 106 disclosure requirements?

18. Are the proposed definitions of the terms “cybersecurity incident,” “cybersecurity threat,” and “information systems,” in Item 106(a) appropriate or should they be revised? Are there other terms used in the proposed amendments that we should define?

19. The proposed rule does not define “cybersecurity.” We could define the term to mean, for example: “any action, step, or measure to detect, prevent, deter, mitigate, or address any cybersecurity threat or any potential cybersecurity threat.” Would defining “cybersecurity” in proposed Item 106(a) be helpful? Why or why not? If defining this term would be helpful, is the definition provided above appropriate, or is there another definition that would better define “cybersecurity”?

20. Should we require the registrant to specify whether any cybersecurity assessor, consultant, auditor, or other service that it relies on is through an internal function or through an external third-party service provider? Would such a disclosure be useful for investors?

21. As proposed, a registrant that has not established any cybersecurity policies or procedures would not have to explicitly state that this is the case. If applicable, should a registrant have to explicitly state that it has not established any cybersecurity policies and procedures?

22. Are there concerns that certain disclosures required under Item 106 would have the potential effect of undermining a registrant's cybersecurity defense efforts or have other potentially adverse effects by highlighting a registrant's lack of policies and procedures related to cybersecurity? If so, how should we address these concerns while balancing investor need for a sufficient description of a registrant's policies and procedures for purposes of their investment decisions?

23. Should we exempt certain categories of registrants from proposed Item 106, such as smaller reporting companies, emerging growth companies, or FPIs? If so, which ones and why? How would any exemption impact investor assessments and comparisons of the cybersecurity risks of registrants? Alternatively, should we provide for scaled disclosure requirements by any of these categories of registrants, and if so, how?

24. Should we provide for delayed compliance or other transition provisions for proposed Item 106 for certain categories of registrants, such as smaller reporting companies, emerging growth companies, FPIs, or asset-backed securities issuers? Proposed Item 106(b), which would require companies to provide disclosures regarding existing policies and procedures for the identification and management of cybersecurity incidents, would be required in annual reports. Should the proposed Item 106(b) disclosures also be required in registration statements under the Securities Act and the Exchange Act?

25. To what extent would disclosure under proposed Item 106 overlap with disclosure required under Item 407(h) of Regulation S-K (“Board leadership structure and role in oversight”) with respect to board oversight of cybersecurity risks? To the extent there is significant overlap, should we expressly provide for the use of hyperlinks or cross-references in Item 106? Are there other approaches that would effectively decrease duplicative disclosure without being cumbersome for investors?

E. Disclosure Regarding the Board of Directors' Cybersecurity Expertise

Cybersecurity is already among the top priorities of many boards of directors

and cybersecurity incidents and other risks are considered one of the largest threats to companies.

Accordingly, investors may find disclosure of whether any board members have cybersecurity expertise to be important as they consider their investment in the registrant as well as their votes on the election of directors of the registrant.

NACD,

2019-2020 NACD Public Company Governance Survey, available at https://corpgov.law.harvard.edu/wp-content/uploads/2020/01/2019-2020-Public-Company-Survey.pdf.

See id.

We propose to amend Item 407 of Regulation S-K by adding paragraph (j) to require disclosure about the cybersecurity expertise of members of the board of directors of the registrant, if any. If any member of the board has cybersecurity expertise, the registrant would have to disclose the name(s) of any such director(s), and provide such detail as necessary to fully describe the nature of the expertise.

Consistent with proposed Instruction 1 to Item 106(c), we are proposing an instruction to Item 407(j) to clarify that in the case of a FPI with a two-tier board of directors the term “board of directors” means the supervisory or non-management board. In the case of a FPI meeting the requirements of 17 CFR 240.10A-3(c)(3), for purposes of 407(j), the term, “board of directors” means the registrant's board of auditors (or similar body) or statutory auditors, as applicable.

See

proposed Instruction 2 to Item 407(j). Likewise, proposed General Instruction J to Form 10-K permits an asset-backed issuer that does not have any executive officers or directors to omit the Item 407 disclosure required by Form 10-K as these entities are generally passive pools of assets and are subject to substantially different reporting requirements than operating companies. Similarly, such entities would be permitted to omit the proposed Item 407(j) disclosure from Form 10-K under General Instruction J for the same reason.

The proposed requirements would build upon the existing disclosure requirements in Item 401(e) of Regulation S-K (business experience of directors) and Item 407(h) of Regulation

S-K (board risk oversight). The proposed Item 407(j) disclosure would be required in a registrant's proxy or information statement when action is to be taken with respect to the election of directors, and in its Form 10-K.

Proposed Item 407(j) would not define what constitutes “cybersecurity expertise,” given that such expertise may cover different experiences, skills, and tasks. Proposed Item 407(j)(1)(ii) does, however, include the following non-exclusive list of criteria that a registrant should consider in reaching a determination on whether a director has expertise in cybersecurity:

• Whether the director has prior work experience in cybersecurity, including, for example, prior experience as an information security officer, security policy analyst, security auditor, security architect or engineer, security operations or incident response manager, or business continuity planner;

• Whether the director has obtained a certification or degree in cybersecurity; and

• Whether the director has knowledge, skills, or other background in cybersecurity, including, for example, in the areas of security policy and governance, risk management, security assessment, control evaluation, security architecture and engineering, security operations, incident handling, or business continuity planning.

Proposed Item 407(j)(2) would state that a person who is determined to have expertise in cybersecurity will not be deemed an expert for any purpose, including, without limitation, for purposes of Section 11 of the Securities Act (15 U.S.C. 77k),

as a result of being designated or identified as a director with expertise in cybersecurity pursuant to proposed Item 407(j).

This proposed safe harbor is intended to clarify that Item 407(j) would not impose on such person any duties, obligations, or liability that are greater than the duties, obligations, and liability imposed on such person as a member of the board of directors in the absence of such designation or identification.

This provision should alleviate such concerns for cybersecurity experts considering board service. Conversely, we do not intend for the identification of a cybersecurity expert on the board to decrease the duties and obligations or liability of other board members.

15 U.S.C. 77k.

See

proposed Item 407(j)(3)(i).

See

proposed Item 407(j)(3)(ii).

See

proposed Item 407(j)(3)(iii).

Request for Comment

26. Would proposed Item 407(j) disclosure provide information that investors would find useful? Should it be modified in any way?

27. Should we require disclosure of the names of persons with cybersecurity expertise on the board of directors, as currently proposed in Item 407(j)(1)? Would a requirement to name such persons have the unintended effect of deterring persons with this expertise from serving on a board of directors?

28. When a registrant does not have a person with cybersecurity expertise on its board of directors, should the registrant be required to state expressly that this is the case under proposed Item 407(j)(1)? As proposed, we would not require a registrant to make such an explicit statement.

29. Proposed Item 407(j) would require registrants to describe fully the nature of a board member's expertise in cybersecurity without mandating specific disclosures. Is there particular information that we should instead require a registrant to disclose with respect to a board member's expertise in cybersecurity?

30. As proposed, Item 407(j)(1) includes a non-exclusive list of criteria that a company should consider in determining whether a director has expertise in cybersecurity. Are these factors for registrants to consider useful in determining cybersecurity expertise? Should the list be revised, eliminated, or supplemented?

31. Would the Item 407(j) disclosure requirements have the unintended effect of undermining a registrant's cybersecurity defense efforts or otherwise impose undue burdens on registrants? If so, how?

32. Should 407(j) disclosure of board expertise be required in an annual report and proxy or information statement, as proposed?

33. To what extent would disclosure under proposed Item 407(j) overlap with disclosure required under Item 401(e) of Regulation S-K with respect to the business experience of directors? Are there alternative approaches that would avoid duplicative disclosure without being cumbersome for investors?

34. As proposed, Item 407(j) does not include a definition of the term “expertise” in the context of cybersecurity? Should Item 407(j) define the term “expertise”? If so, how should we define the term?

35. Should certain categories of registrants, such as smaller reporting companies, emerging growth companies, or FPIs, be excluded from the proposed Item 407(j) disclosure requirement? How would any exclusion affect the ability of investors to assess the cybersecurity risk of a registrant or compare such risk among registrants?

36. Should we adopt the proposed Item 407(j)(2) safe harbor to clarify that a director identified as having expertise in cybersecurity would not have any increased level of liability under the federal securities laws as a result of such identification? Are there alternatives we should consider?

37. As proposed, disclosure under Item 407(j) would be required in a proxy or information statement. Should we require the disclosure under Item 407(j) to appear in a registrant's proxy or information statement regardless of whether the registrant is relying on General Instruction G(3)? Is this information relevant to a security holder's decision to vote for a particular director?

F. Periodic Disclosure by Foreign Private Issuers

We propose to amend Form 20-F to add Item 16J that would require an FPI to include in its annual report on Form 20-F the same type of disclosure that we propose in Items 106 and 407(j) of Regulation S-K and that would be required in periodic reports filed by domestic registrants. One difference is that while domestic registrants would be required to include the proposed Item 407(j) disclosure about board expertise in both their annual reports and proxy or information statements, FPIs are not subject to Commission rules for proxy or information statement filings and thus, would only be required to include this disclosure in their annual reports.

Exchange Act Rule 3a12-3(b) [17 CFR 240.3a12-3(b)].

With respect to incident disclosure, where an FPI has previously reported an incident on Form 6-K, the proposed amendments would require an update regarding such incidents, consistent with proposed Item 106(d)(1) of Regulation S-K.

We are also proposing to amend Form 20-F to require FPIs to disclose on an annual basis information regarding any previously undisclosed material cybersecurity incidents that have occurred during the reporting period, including a series of previously undisclosed individually immaterial cybersecurity incidents that has become material in the aggregate.

See

proposed Item 16J(d)(1).

See

proposed Item 16J(d)(2).

The Commission created Form 40-F in connection with its establishment of a multijurisdictional disclosure system (“MJDS”). This system generally

permits eligible Canadian FPIs to use Canadian disclosure standards and documents to satisfy the Commission's registration and disclosure requirements. Accordingly, we are not proposing prescriptive cybersecurity disclosure requirements for Form 40-F filers.

Request for Comment

38. Should we amend Form 20-F, as proposed to require disclosure regarding cybersecurity risk management and strategy, governance, and incidents? Additionally, should we amend Form 6-K, as proposed, to add “cybersecurity incidents” as a reporting topic? Are there unique considerations with respect to FPIs in these contexts?

39. We are not proposing any changes to Form 40-F. Should we instead require an MJDS issuer filing an annual report on Form 40-F to comply with the Commission's specific proposed cybersecurity-related disclosure requirements in the same manner as Form 10-K or Form 20-F filers?

G. Structured Data Requirements

We are proposing to require registrants to tag the information specified by Item 1.05 of Form 8-K and Items 106 and 407(j) of Regulation S-K in Inline XBRL in accordance with Rule 405 of Regulation S-T (17 CFR 232.405) and the EDGAR Filer Manual.

The proposed requirements would include block text tagging of narrative disclosures, as well as detail tagging of quantitative amounts disclosed within the narrative disclosures. Inline XBRL is both machine-readable and human-readable, which improves the quality and usability of XBRL data for investors.

This tagging requirement would be implemented by including a cross-reference to Rule 405 of Regulation S-T in proposed Item 1.05 of Form 8-K and Items 106 and 407(j) of Regulation S-K, and by revising Rule 405(b) of Regulation S-T [17 CFR 232.405(b)] to include the listed disclosure Items. In conjunction with the EDGAR Filer Manual, Regulation S-T governs the electronic submission of documents filed with the Commission. Rule 405 of Regulation S-T specifically governs the scope and manner of disclosure tagging requirements for operating companies and investment companies, including the requirement in Rule 405(a)(3) to use Inline XBRL as the specific structured data language to use for tagging the disclosures.

See

Inline XBRL Filing of Tagged Data, Securities Act Release No. 10514 (June 28, 2018) [83 FR 40846 (Aug. 16, 2018)]. Inline XBRL allows filers to embed XBRL data directly into an HTML document, eliminating the need to tag a copy of the information in a separate XBRL exhibit. Inline XBRL is both human-readable and machine-readable for purposes of validation, aggregation, and analysis.

Id.

at 40851.

Requiring Inline XBRL tagging of the disclosures provided pursuant to these disclosure items would benefit investors by making the disclosures more readily available and easily accessible to investors, market participants, and others for aggregation, comparison, filtering, and other analysis, as compared to requiring a non-machine readable data language such as ASCII or HTML. This Inline XBRL tagging would enable automated extraction and analysis of the granular data required by the proposed rules, allowing investors and other market participants to more efficiently perform large-scale analysis and comparison of this information across registrants and time periods. For narrative disclosures, an Inline XBRL requirement would allow investors to extract and search for disclosures about cybersecurity incidents reported on Form 8-K, updated information about cybersecurity incidents reported in a registrant's periodic reports, a registrant's cybersecurity policies and procedures, management's role in assessing and managing cybersecurity risks, and the board of directors' oversight of cybersecurity risk and cybersecurity expertise rather than having to manually run searches for these disclosures through entire documents. The Inline XBRL requirement would also enable automatic comparison of these disclosures against prior periods, and targeted artificial intelligence/machine learning assessments of specific narrative disclosures rather than the entire unstructured document. At the same time, we do not expect the incremental compliance burden associated with tagging the proposed additional information to be unduly burdensome because registrants subject to the proposed tagging requirements are for the most part subject to similar Inline XBRL requirements in other Commission filings.

Request for Comment

40. Should we require registrants to tag the disclosures required by proposed Item 1.05 of Form 8-K and Items 106 and 407(j) of Regulation S-K in Inline XBRL, as proposed? Are there any changes we should make to ensure accurate and consistent tagging? If so, what changes should we make? Should we require registrants to use a different structured data language to tag these disclosures? If so, what structured data language should we require? Are there any registrants, such as smaller reporting companies, emerging growth companies, or FPIs that we should exempt from the tagging requirement?

General Request for Comment

We request and encourage any interested person to submit comments regarding the proposed rule amendments, specific issues discussed in this release, and other matters that may have an effect on the proposed rule amendments. With regard to any comments, we note that such comments are of particular assistance to our rulemaking initiative if accompanied by supporting data and analysis of the issues addressed in those comments.

III. Economic Analysis

A. Introduction

Cybersecurity threats and incidents continue to increase in prevalence and seriousness, posing an ongoing and escalating risk to public companies, investors, and other market participants.

The number of reported breaches disclosed by public companies has increased over the last decade, from 28 in 2011 to 144 in 2019 and 117 in 2020.

Although estimating the total cost of cybersecurity incidents is difficult, as many events may be unreported, some estimates put the total costs in the trillions of dollars per year in the U.S. alone.

The Council of Economic Advisers estimated that in 2016 the total cost of cybersecurity incidents was between $57 billion and $109 billion, or between 0.31 and 0.58 percent of U.S. GDP in that year.

Unless otherwise noted, when we discuss the economic effects of the proposed amendments on “other market participants,” we mean those market participants that typically provide services for investors and who rely on the information in registrant's filings (such as financial analysts, investment advisers, and portfolio managers).

Audit Analytics,

Trends in Cybersecurity Breaches

(Mar. 2021) (stating that: “[c]ybersecurity breaches can result in a litany of costs, such as investigations, legal fees, and remediation. There is also the risk of economic costs that directly impact financial performance, such as a reduction in revenue due to lost sales.”).

See

Cybersecurity and Infrastructure Security Agency,

Cost of a Cyber Incident: Systemic Review and Cross-Validation

(Oct. 26, 2020),

available at https://www.cisa.gov/sites/default/files/publications/CISA-OCE_Cost_of_Cyber_Incidents_Study-FINAL_508.pdf.

See supra

note 12, The Council of Economic Advisers,

The Cost of Malicious Cyber Activity to the U.S. Economy

(Feb. 2018).

As described earlier, while cybersecurity incident disclosure has become more frequent since the issuance of the 2011 Staff Guidance and 2018 Interpretive Release, there is concern that material cybersecurity incidents are underreported.

For instance, the staff has observed that certain cybersecurity incidents were reported in the media but not disclosed in a registrant's filings.

Even when

disclosures about cybersecurity breaches are made, they may not be timely. According to Audit Analytics data, in 2020, it took on average 44 days for companies to discover breaches, and then in addition, it took an average of 53 days and a median of 37 days for companies to disclose a breach after its discovery.

100

Additionally, incident disclosure practices currently vary widely across registrants--some registrants disclose incidents through Form 8-K and some may disclose on a company website or in a press release. Because cybersecurity incidents can significantly impact companies' stock prices, delayed reporting results in mispricing of registrants' securities, harming investors.

101

Therefore, more timely and informative disclosure of a cybersecurity incident is needed for investors to assess an incident's impact and a registrant's ability to respond to the incident and to make more informed decisions.

See supra

section II.B and note 46.

See also

Lawrence A. Gordon, Martin P. Loeb, and Lei Zhou,

The Impact of Information Security Breaches: Has There Been a Downward Shift in Costs?,

19 (1) J. of Comput. Sec. 33, 33-56 (2011) (finding “the impact of the broad class of information security breaches on stock market returns of firms is significant”);

see also

Georgios Spanos and Lefteris Angelis,

The Impact of Information Security Events to the Stock Market: A Systematic Literature Review,

58 Comput. & Sec. 216-229 (2016) (documenting that the majority (75.6%) of the studies the paper reviewed report statistical significance of the impact of security events to the stock prices of firms).

But see

Katherine Campbell, Lawrence A. Gordon, Martin P. Loeb, and Lei Zhou,

The Economic Cost of Publicly Announced Information Security Breaches: Empirical Evidence From the Stock Market,

11 (3) J. of Comput. Sec. 432, 431-448 (2003) (while finding limited evidence of an overall negative stock market reaction to public announcements of information security breaches, they also find “the nature of the breach affects this result”, and “a highly significant negative market reaction for information security breaches involving unauthorized access to confidential data, but no significant reaction when the breach does not involve confidential information”; they thus conclude that “stock market participants appear to discriminate across types of breaches when assessing their economic impact on affected firms”).

134

See

Chris Florakis, Christodoulos Louca, Roni Michaely, and Michael Weber,

Cybersecurity Risk.

(No. w28196), Nat'l Bureau of Econ. Rsch, (2020).

In addition, the mispricing resulting from delayed or limited disclosure could be exploited by the malicious actors who caused a cybersecurity incident, or those who could access and trade on material information stolen during a cybersecurity incident, causing further harm to investors.

135

Malicious actors may trade ahead of an announcement of a data breach that they caused or pilfer material information to trade on ahead of company announcements. Trading on undisclosed cybersecurity information is particularly pernicious, because profits generated from this type of trading would provide incentives for malicious actors to “create” more incidents and proprietary information to trade on.

136

More informative and timely disclosure as a result of the proposed amendments would reduce mispricing and information asymmetry, and thereby reduce opportunities for malicious actors to exploit the mispricing, all of which would enhance investor protection.

135

See

Joshua Mitts and Eric Talley,

Informed Trading and Cybersecurity Breaches,

9 Harv. Bus. L. Rev. 1 (2019) (“In many respects, then, the cyberhacker plays a role in creating and imposing a unique harm on the targeted company—one that (in our view) is qualitatively different from “exogenous” information shocks serendipitously observed by an information trader. Allowing a coordinated hacker-trader team to capture these arbitrage gains would implicitly subsidize the very harm-creating activity that is being “discovered” in the first instance.”).

136

Id.

Overall, we believe enhanced disclosure as a result of the proposed amendments could benefit investors by allowing them to make more informed decisions. Similarly, other market participants that rely on financial statement information to provide services to investors would also benefit, because more informative and timely disclosure would allow them to better understand a registrant's cybersecurity risks and ability to manage such risks. As a result, they would be able to better evaluate registrants' securities and provide better recommendations. However, we note that the potential benefit could be reduced to the extent that registrants have already been providing the relevant disclosures.

We are unable to quantify the potential benefit to investors and other market participants as a result of the increase in disclosure and improvement in pricing under the proposed amendments. The estimation requires information about the fundamental value of securities and the extent of the mispricing. We do not have access to such information, and therefore cannot provide a reasonable estimate.

(ii) Greater Uniformity and Comparability

The proposed disclosure about cybersecurity incidents and cybersecurity risk management, strategy, and governance could also lead to more uniform and comparable disclosures, benefiting investors by lowering their search costs and information processing costs. As discussed in Section I, while some registrants currently file Form 8-K to report an incident, their reporting practices vary widely.

137

Some provide a discussion of materiality, the estimated costs of an incident, or the remedial steps taken as a result of an incident, while others do not provide such disclosure or provide much less detail in their disclosure. Disclosures related to risk management, strategy, and governance also vary significantly across registrants—such information could be disclosed in places such as the risk factors section, or in the management's discussion and analysis section of Form 10-K, or not at all. Investors currently may find it costly to compare the disclosures of different companies because they would have to spend time to search and retrieve information from different locations. For both types of disclosures, the proposed amendments would specify the topics to be disclosed and the reporting sections to include such disclosures, and as a result, both the incident disclosure and risk management, strategy, and governance disclosure should be more uniform across registrants, making it easier to compare. By specifying a set of topics that registrants should disclose, the proposed disclosure requirement should provide investors and other market participants with a benchmark of a minimum set of information for registrants to disclose, allowing them to better evaluate and compare registrants' cybersecurity risk and disclosure.

137

See supra

section I.B.

We note that to the extent that the disclosures related to cybersecurity risk management, strategy, and governance become too uniform or “boilerplate,” the benefit of comparability may be diminished. However, we also note that given the level of the specificity that would be required, the resulting disclosures are unlikely to become boilerplate.

The proposed requirement to tag the cybersecurity disclosure in Inline XBRL would likely augment the aforementioned informational and comparability benefits by making the proposed disclosures more easily retrievable and usable for aggregation, comparison, filtering, and other analysis. XBRL requirements for public operating company financial statement disclosures have been observed to mitigate information asymmetry by reducing information processing costs, thereby making the disclosures easier to access and analyze.

138

See, e.g.,

J.Z. Chen, H.A. Hong, J.B. Kim, and J.W. Ryou,

Information processing costs and corporate tax avoidance: Evidence from the SEC's XBRL mandate,

40 J. of Acct. and Pub. Pol'y. 2 (finding XBRL reporting decreases likelihood of firm tax avoidance because “XBRL reporting reduces the cost of IRS monitoring in terms of information processing, which dampens managerial incentives to engage in tax avoidance behavior”);

see also

P.A. Griffin, H.A., Hong, J-B, Kim, and Jee- Hae Lim,

The SEC's XBRL Mandate and Credit Risk: Evidence on a Link between Credit Default Swap Pricing and XBRL Disclosure,

2014 American Accounting Association Annual Meeting (2014) (finding XBRL reporting enables better outside monitoring of firms by creditors, leading to a reduction in firm default risk);

see also

E. Blankespoor,

The Impact of Information Processing Costs on Firm Disclosure Choice: Evidence from the XBRL Mandate,

57 J. of Acc. Res. 919, 919-967 (2019) (finding “firms increase their quantitative footnote disclosures upon implementation of XBRL detailed tagging requirements designed to reduce information users' processing costs,” and “both regulatory and non-regulatory market participants play a role in monitoring firm disclosures,” suggesting “that the processing costs of market participants can be significant enough to impact firms' disclosure decisions”).

While these observations are specific to operating company financial statement disclosures and not to disclosures outside the financial statements, such as the proposed cybersecurity disclosures, they suggest that the proposed Inline XBRL requirements could directly or indirectly (

i.e.,

through information intermediaries such as financial media, data aggregators, and academic researchers) provide investors with increased insight into cybersecurity-related information at specific companies and across companies, industries, and time periods.

139

Also,

unlike XBRL financial statements (including footnotes), which consist of tagged quantitative and narrative disclosures, the proposed cybersecurity disclosures would consist largely of tagged narrative disclosures.

140

Tagging narrative disclosures can facilitate analytical benefits such as automatic comparison or redlining of these disclosures against prior periods and the performance of targeted artificial intelligence or machine learning assessments (tonality, sentiment, risk words, etc.) of specific cybersecurity disclosures rather than the entire unstructured document.

141

139

See, e.g.,

N. Trentmann,

Companies Adjust Earnings for Covid-19 Costs, but Are They Still a One-Time Expense?,

The Wall Street J. (2020) (citing an XBRL research software provider as a source for the analysis described in the article);

see also

R. Hoitash, and U. Hoitash,

Measuring Accounting Reporting Complexity with XBRL,

93 Account. Rev. 259 (2018).

140

The proposed cybersecurity disclosure requirements do not expressly require the disclosure of any quantitative values; if a registrant includes any quantitative values that are nested within the required discussion (

e.g.,

disclosing the number of days until containment of a cybersecurity incident), those values would be individually detail tagged, in addition to the block text tagging of the narrative disclosures.

141

To illustrate, without Inline XBRL, using the search term “remediation” to search through the text of all registrants' filings over a certain period of time, so as to analyze the trends in registrants' disclosures related to cybersecurity incident remediation efforts during that period, could return many narrative disclosures outside of the cybersecurity incident discussion (

e.g.,

disclosures related to potential environmental liabilities in the risk factors section). If Inline XBRL is used, however, it would enable a user to search for the term “remediation” exclusively within the proposed cybersecurity disclosures, thereby likely reducing the number of irrelevant results.

b. Benefits to Registrants

142

While registrants are legally distinct entities from investors, benefits and costs to registrants as a result of the proposed amendments would ultimately accrue to their investors.

The proposed amendments regarding both incident reporting and risk management, strategy, and governance disclosure could potentially lower registrants' cost of capital, especially for those who currently have strong cybersecurity risk management, strategy, and governance measures in place. Economic theory suggests that better disclosure could reduce information asymmetry between management and investors, reducing the cost of capital, and thereby improving firms' liquidity and their access to capital markets.

143

In an asymmetric information environment, investors recognize that registrants may take advantage of their position by issuing securities at a price that is higher than justified by the issuer's fundamental value. As a result, investors demand a discount to compensate for the risk of adverse selection. This discount translates into a higher cost of capital.

144

By providing more disclosure, the firm can reduce the risk of adverse selection faced by investors and the discount they demand, ultimately decreasing the firm's cost of capital.

145

Applying this theory to cybersecurity disclosure, the increased disclosure as a result of the proposed amendments could decrease the cost of capital and increase firm value.

143

See

Douglas W. Diamond and Robert E. Verrecchia,

Disclosure, Liquidity, and the Cost of Capital,

46 J. Fin. 1325, 1325-1359 (1991) (finding that revealing public information to reduce information asymmetry can reduce a firm's cost of capital through increased liquidity).

See also

Christian Leuz and Robert E. Verrecchia,

The Economic Consequences of Increased Disclosure,

38 J. Acct. Res. 91 (2000) (providing empirical evidence that increased disclosure lowers the information asymmetry component of the cost of capital in a sample of German firms);

see also

Christian Leuz and Peter D. Wysocki,

The Economics of Disclosure and Financial Reporting Regulation: Evidence and Suggestions for Future Research,

54 J. Acct. Res. 525 (2016) (providing a comprehensive survey of the literature on the economic effect of disclosure).

144

See

Leuz and Verrecchia,

The Economic Consequences of Increased Disclosure,

38 J. Acct. Res. 91 (2000) (stating: “A brief sketch of the economic theory is as follows. Information asymmetries create costs by introducing adverse selection into transactions between buyers and sellers of firm shares. In real institutional settings, adverse selection is typically manifest in reduced levels of liquidity for firm shares (

e.g.,

Copeland and Galai [1983], Kyle [1985], and Glosten and Milgrom [1985]). To overcome the reluctance of potential investors to hold firm shares in illiquid markets, firms must issue capital at a discount. Discounting results in fewer proceeds to the firm and hence higher costs of capital. A commitment to increased levels of disclosure reduces the possibility of information asymmetries arising either between the firm and its shareholders or among potential buyers and sellers of firm shares. This, in turn, should reduce the discount at which firm shares are sold, and hence lower the costs of issuing capital (

e.g.,

Diamond and Verrecchia [1991] and Baiman and Verrecchia [1996]).”).

145

Although disclosure could be beneficial for the firm, several conditions must be met for firms to voluntarily disclose all their private information.

See

Anne Beyer, Daniel A. Cohen, Thomas Z. Lys, and Beverly R. Walther,

The Financial Reporting Environment: Review Of The Recent Literature,

50 J. Acct. & Econ. 296, 296-343 (2010) (discussing conditions under which firms voluntarily disclose all their private information, and these conditions include “(1) disclosures are costless; (2) investors know that firms have, in fact, private information; (3) all investors interpret the firms' disclosure in the same way and firms know how investors will interpret that disclosure; (4) managers want to maximize their firms' share prices; (5) firms can credibly disclose their private information; and (6) firms cannot commit ex-ante to a specific disclosure policy.”). Increased reporting could also help determine the effect of investment on firm value.

See

Lawrence A. Gordon, Martin P. Loeb, William Lucyshyn, and Lei Zhou,

The Impact of Information Sharing on Cybersecurity Underinvestment: A Real Options Perspective,

34 (5) J. Acct. & Pub. Policy 509, 509-519 (2015) (arguing that “information sharing could reduce the tendency by firms to defer cybersecurity investments.”).

The proposed amendments' effect on cost of capital might vary depending on registrants' current level of cybersecurity risk management, strategy, and governance and whether they are already making disclosures regarding their efforts. To the extent that they have not been making the proposed disclosure, registrants with stronger cybersecurity risk management, strategy, and governance measures could be priced more favorably under the proposed amendments because the proposed disclosure would allow the market to better differentiate them from the registrants with less robust measures. To the extent that some registrants are already making disclosures about their robust cybersecurity risk management, strategy, and governance programs, these registrants would benefit less. However, if registrants that previously had less robust cybersecurity risk management, strategy, and governance disclose improvements in their cybersecurity risk management, strategy, and governance in response to the proposed amendments, their cost of capital could also decrease.

Registrants could also benefit from more uniform regulations regarding the timing of disclosures and the types of cybersecurity incident and risk disclosures as a result of the proposed amendments. Currently, the stigma or reputation loss associated with cybersecurity breaches may result in companies limiting reporting about or delaying reporting of cybersecurity incidents.

146

If all registrants are required to report cybersecurity incidents on Form 8-K within four business days as proposed, this could reduce the reputation costs that any one company might suffer after reporting an attack and also reduce the incentives to underreport.

146

See supra

note 133, Kamiya,

This text is long and has been trimmed here. Open the source document for the complete record.

This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.