SEC’s New Cybersecurity Policies

This brief summarizes SEC final rules requiring timely disclosure of material cybersecurity incidents (new Form 8-K Item 1.05 within four business days), limited security-related disclosure delays with AG and SEC approval, an expanded incident definition, mandatory annual cybersecurity risk and governance reporting in Form 10-K (Regulation S-K Item 106) for fiscal years ending on/after Dec 15, 2023, and comparable disclosure obligations for foreign private issuers via Form 6‑K and Form 20‑F; compliance timelines vary by company size and rules take effect 30 days after Federal Register publication.