United StatesSEC Cybersecurity Risk Management, Governance, and Incident Disclosure (Regulation S-K Item 106; Form 8-K Item 1.05)
17 CFR 229.106; 17 CFR 249.308 (Form 8-K Item 1.05)
In force since .
A vulnerability and incident reporting rule binding private bodies.
What it requires
- This instrument reaches your organization only if it is an Securities and Exchange Commission (SEC) reporting company that files on the domestic forms (a United States public company, or an issuer that has registered a class of securities with the Securities and Exchange Commission and files current reports on Form 8-K); a foreign private issuer owes the same two duties on Form 6-K and in item 16K of Form 20-F instead. Declare is_listed_company where that status holds; the role is the fact itself, and no activity stands in for it.
- If your organization is an SEC reporting company, determine, without unreasonable delay after you discover a cybersecurity incident, whether the incident is material, and if it is, file a Form 8-K under Item 1.05 within four business days after you make that determination.NIST CSF 2.0DE.AE-08NIST CSF 2.0RS.CO-02
- If the information called for in Item 1.05 is not determined or is unavailable when you file, state that in the filing and file an amendment to the Form 8-K within four business days after you determine it or it becomes available.NIST CSF 2.0RS.CO-02
- Separately, describe in your annual report, under Regulation S-K Item 106, your processes for assessing, identifying and managing material cybersecurity risks and your board's and management's oversight of those risks.NIST CSF 2.0GV.RM-03NIST CSF 2.0GV.RR-01
- An incident disclosure described above may be delayed where the United States Attorney General determines it would pose a substantial risk to national security or public safety and notifies the Commission of that determination in writing; the delay is a capped exception and not a second reporting duty on its own timeline.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST CSF 2.0
- GV.RM-03Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
- GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
- DE.AE-08Incidents are declared when adverse events meet the defined incident criteria
- RS.CO-02Internal and external stakeholders are notified of incidents
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What this law does
An Securities and Exchange Commission (SEC) reporting company must describe, in its annual report under Regulation S-K Item 106, its processes for assessing and managing cybersecurity risk. It must also describe its board's and management's oversight of that risk. This duty applies beginning with annual reports for fiscal years ending on or after . Under Item 1.05 of Form 8-K, the same company must determine, without unreasonable delay after discovering a cybersecurity incident, whether the incident is material.
If the incident is material, the company must file a Form 8-K describing it within four business days of that determination. The United States Attorney General may authorize a delay of up to 30 days, and a further 30 days, where disclosure would pose a substantial risk to national security or public safety, and in extraordinary circumstances a final 60 days where the continuing risk is to national security, up to 120 days in total.
Registrants other than smaller reporting companies had to comply with Item 1.05 from , and smaller reporting companies from .
When LexLint raises it
When your app profile says your app is a listed company.
Back to the example · Lint your app
Page updated .