The SEC’s New Incident Disclosure Ruling | FortiGuardLIVE

### Overview In this episode of FortiGuardLIVE, Anthony Giandomenico ("Tony G") and Jim Richburg discuss the implementation of the U.S. Securities and Exchange Commission (SEC) ruling on cybersecurity risk management, strategy, governance, and incident disclosure. The ruling requires publicly traded companies to disclose material cybersecurity incidents on Form 8-K within four business days (96 hours) of determining materiality. In addition, organizations must outline their cybersecurity governance and risk oversight processes in annual 10-K filings. The discussion examines how companies can prepare, navigate cross-functional decision-making, manage overlapping regulatory requirements, and address unintended consequences.

### Key Topics - **Incident Disclosure Mandates (Form 8-K):** When a publicly traded company experiences a cyber incident deemed material, it must file an 8-K disclosure with the SEC within four business days (96 hours) after making that determination. - **Annual Governance Filings (Form 10-K):** Annual disclosures require companies to describe board-level and executive oversight of cybersecurity risk, risk management processes, whether a CISO is present, and how committees oversee prevention, monitoring, detection, and mitigation. - **Determining Materiality as a Team Sport:** Materiality decisions cannot rest solely on the CISO. Evaluating impact requires technical investigators, the CFO (for financial implications), business line owners, and General Counsel scrutiny. - **Adversary Weaponization and Insurance Unintended Effects:** The discussion touches on threat actors testing the rule, such as the BlackCat ransomware group filing an SEC complaint against a compromised victim that had not reported the incident. Richburg also notes how public budgets showing cyber insurance coverage can lead adversaries to target specific organizations knowing insurers have the capacity to settle. - **Regulatory Harmonization:** Overlapping mandates—such as the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) requiring 72-hour reporting—create compliance friction. The speakers emphasize efforts aligned with the National Cyber Strategy to harmonize reporting so victimized companies are not overwhelmed during incident response.

### Technical & Operational Details - **Rulemaking Adjustments:** Following industry feedback on early drafts that raised concerns about revealing operational details that could assist attackers, the SEC backed off requests for granular policies and procedures. Instead, the final rule requires companies to disclose whether they have risk management processes rather than detailing the internal mechanics. - **Exemptions and Delays:** Delays beyond the four-day disclosure window are permitted for national security or active law enforcement investigations, allowing agencies like the FBI to request SEC disclosure delays when premature public notification would compromise an ongoing criminal investigation. - **Regulatory Deconfliction Strategy:** For companies subject to both SEC rules and CIRCIA's 72-hour requirement, the recommended operational approach is to default to the shorter reporting window, leverage established SEC materiality case law to define significance, and work with agencies such as CISA.

### Takeaways - Determining whether an incident is material is an organizational "team sport" involving security, finance, legal, and operational leadership. - Incident response plans and playbooks must be treated as living documents and updated to account for strict federal reporting timelines and cross-functional escalation pathways. - CISOs and leadership should establish proactive relationships with local law enforcement (such as the FBI) prior to an incident to facilitate disclosure delay requests if public reporting would compromise an investigation.