Divulgación cibernética ante la SEC

The SEC's cybersecurity disclosure rules, adopted in July 2023, require public companies to disclose material cybersecurity incidents quickly and to describe, every year, how they manage cybersecurity risk and how the board and management oversee it.

The incident rule is the one practitioners feel most: once a company determines an incident is material, it has four business days to file a Form 8-K. The hard work is the materiality determination, which must be made without unreasonable delay after discovery.

• Public companies that file reports with the SEC under the Securities Exchange Act of 1934, including smaller reporting companies.
• Foreign private issuers make comparable disclosures on Form 6-K and Form 20-F.
• A cybersecurity incident is an unauthorized occurrence, or a series of related ones, on or through the company's information systems that jeopardizes their confidentiality, integrity or availability or the information in them. Incidents at vendors that affect the company's systems or data can qualify.

La SEC las hace cumplir mediante sus facultades habituales, incluidas las acusaciones por divulgaciones engañosas, controles de divulgación inadecuados y presentaciones tardías. Los fallos de divulgación también pueden sustentar demandas de inversores conforme a las leyes de valores.

1. Write a materiality process: who decides, on what facts, how fast, and how it is documented.
2. Connect incident response to disclosure counsel, so escalation to the materiality decision is quick.
3. Include third-party incidents in the escalation path.
4. Draft the Form 8-K template focused on the material impact, not technical detail that would help attackers.
5. Prepare the annual Item 106 disclosure from real processes, board minutes and management roles.
6. Test disclosure controls against a tabletop incident.