SEC Assessment Three Months after Implementation of Cybersecurity Disclosure Regulations
In the digital age, companies face the daunting task of determining the materiality of a cybersecurity incident for Securities and Exchange Commission (SEC) disclosure. This process involves a meticulous evaluation of both qualitative and quantitative factors that reflect the incident's impact and importance to a reasonable investor.
Qualitative factors, such as the sensitivity and type of data compromised, operational disruption, reputational damage, regulatory environment, nature and scope of the incident, potential impact on business, and related unauthorized occurrences, all play a significant role in this assessment. For instance, the compromise of personally identifiable information, trade secrets, or national security-related data, operational disruptions exceeding several hours, reputational damage including brand value loss and customer attrition, and potential impacts such as ongoing investigations or financial impacts that may not be immediately quantifiable are all factors that could render an incident material.
Quantitative factors, on the other hand, include financial impact measures like ransomware payments, estimated losses, fines, or declines in stock value following the incident, revenue benchmarks, downtime costs and operational losses, and aggregate impact assessments considering total losses or probable future impacts relevant to disclosure requirements.
The SEC requires an objective analysis combining these quantitative and qualitative factors to determine whether a cybersecurity incident is material, triggering disclosure obligations typically within four business days after materiality determination. The standard is whether a "reasonable investor would consider the incident important" or if it significantly alters the total mix of available information about the company.
In practice, companies use frameworks that may multiply financial impact by data volume and downtime to compute a materiality score, considering sector-specific concerns especially for financial services, healthcare, energy, and technology industries where sensitivity and regulatory scrutiny are higher.
Recent events have highlighted the importance of this process. Fidelity National Financial, for example, disclosed a cyberattack in an 8-K filing with the SEC, but did not expect the attack to have a material impact on earnings. However, the amended 8-K filing revealed that 1.3 million customers were potentially impacted by the attack.
Similarly, MGM Resorts disclosed in October that a cyberattack against the company during September would have a $100 million financial impact on its Las Vegas area properties.
The SEC's cyber incident reporting rule, which went into effect on Dec. 18, underscores the importance of timely and accurate disclosure. Publicly traded firms are required to report a cyber incident within four business days of determining materiality.
However, it's important to note that companies are not often able to determine materiality directly after an incident, as explained by Erik Gerding, director of the SEC's division of corporate finance, in a December statement.
Moreover, the focus has shifted from merely managing the attack itself to managing the reputational impact of how the company handles a ransomware attack. Matt Gorham, leader of the Cyber & Privacy Innovation Institute at PwC and a former assistant director at the FBI, stated this in a recent interview.
In conclusion, the materiality of a cybersecurity incident is a fact-specific and nuanced judgment involving impact severity and likelihood, business context and regulatory exposure, type and sensitivity of compromised data, financial benchmarks scaled to company size, and broader operational and reputational consequences. Companies must navigate this complex landscape carefully to ensure compliance with SEC disclosure requirements and maintain investor confidence.
- In the digital age, the type and sensitivity of data compromised during a cybersecurity incident plays a significant role in determining its materiality for Securities and Exchange Commission (SEC) disclosure.
- The SEC's cyber incident reporting rule requires an objective analysis combining qualitative and quantitative factors to determine if a cybersecurity incident is material, triggering disclosure obligations typically within four business days after materiality determination.
- Financial services, healthcare, energy, and technology industries, known for higher sensitivity and regulatory scrutiny, use frameworks that multiply financial impact by data volume and downtime to compute a materiality score.
- The focus in handling cyberattacks has shifted from managing the attack itself to managing the reputational impact of how the company responds to a ransomware attack, highlighting the importance of incident response in maintaining investor confidence.
