December 12, 2023 at 06:00AM
The FBI has issued guidance on SEC data breach reporting, including potential delays. SEC’s new cybersecurity rules require public companies to report material breaches within 4 days via Form 8-K. FBI clarifies that Justice Dept. can grant a 30-60 day delay for national security reasons, but delays can’t exceed 120 days without SEC’s order. Some concerns were raised about the impact on investors and cybercriminals’ potential advantage. Republican lawmakers aim to overturn the rules.
Key Takeaways from the Meeting Notes:
1. The FBI has provided guidance on data breach reporting requirements of the SEC, detailing how disclosures can be delayed under certain circumstances.
2. The SEC has adopted new cybersecurity incident disclosure rules for public companies, necessitating the disclosure of any material breach within four business days through a Form 8-K filing, with the rules set to take effect this month.
3. The SEC has recognized potential exemptions from the disclosure rules for cases involving substantial risk to public safety or national security.
4. The FBI has outlined a process for granting delays in disclosure due to national security or public safety reasons, allowing for up to 120 business days in extraordinary circumstances without an exemptive order from the SEC.
5. The FBI mandates that delay requests must be submitted via specific channels, and victims are encouraged to engage with relevant agencies prior to making a materiality determination.
6. The SEC’s new disclosure rules have generated mixed reactions, with some expressing concerns about their potential impact on investors and the risk of aiding cybercriminals.
7. Republican lawmakers have filed a joint resolution to overturn the SEC rules, but it has not yet passed in the House or the Senate.
These takeaways provide a clear summary of the key points discussed in the meeting notes related to the FBI guidance, SEC disclosure rules, and reactions to the new regulations.