As of December 18, 2023, all issuers other than smaller reporting companies (SRCs) need to comply with new Item 1.05 of Form 8-K or the equivalent disclosure in Form 6-K for foreign private issuers. For a full description of the disclosure required pursuant to new Item 1.05 of Form 8-K or Form 6-K, as applicable, please see our client alert. SRCs will have until June 15, 2024 to comply.

In addition, during the week of December 11th, the SEC’s Division of Corporation Finance released a series of C&DIs related to new Item 1.05 of Form 8-K. Each of the C&DIs is centered on the mechanics of the delay provision set forth in Item 1.05(c), which enables companies to postpone disclosure under the item if the U.S. Attorney General determines that disclosure poses a “substantial risk to national security or public safety” and notifies the SEC within the requisite time period. The general theme of the C&DIs is that if the U.S. Attorney General fails to make a determination and notify the SEC before the applicable deadline (i.e., within four business days of the determination that an incident is material or within four business days of the expiration of the delay period in the case of an issuer seeking an extension of the delay period, etc.), the issuer must file the Form 8-K prior to the deadline’s passage. In addition, the SEC has specified that merely engaging with the U.S. Attorney General regarding the availability of the delay provision does not necessitate a finding that the cybersecurity incident was material.