Rule 2023
Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure (SEC rules)
Issued by Securities and Exchange Commission
Effective: 5 Sep 2023
Plain-English summary
Adopted 26 July 2023, effective 5 September 2023. Requires current disclosure of material cybersecurity incidents (Form 8-K Item 1.05, due four business days after a materiality determination) and periodic disclosure of cybersecurity risk management, management's role and board oversight.
Who it applies to
Capital Markets · Corporates (Listed)
Topics
Cybersecurity & IT Risk Corporate Governance
Obligations arising from this law or regulation
| Obligation | Timing | Regulator | Source | Detail |
|---|---|---|---|---|
| Material cybersecurity incident disclosure on Form 8-K | Deadline Within four business days of determining materiality | SEC | official | |
An Item 1.05 Form 8-K must be filed within four business days of determining an incident was material, and the determination must be made without unreasonable delay. The Attorney General can authorise delays for national security or public safety, initially up to 30 days. |
||||
| No obligations match these filters. | ||||
Latest news
No related news yet. We publish updates as regulators act.