Question: How should security leaders navigate the SEC’s cybersecurity and disclosure rules? What do they need to do in order to ensure compliance?
Michael Gray, CTO, Thrive: While the Securities and Exchange Commission’s (SEC) Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure rules went into effect toward the end of 2023, many organizations still have questions when it comes to filings and disclosures. Under these rules, organizations have to disclose significant cybersecurity incidents and provide annual updates on their cybersecurity posture. Being able to accurately share cybersecurity updates, sometimes within short time frames, requires teams to have a deep understanding of 8-K and 10-K filings, and to implement new processes that simplify compliance.
The Difference Between an 8-K and 10-K Filing
8-K filings, in general, are periodic reports that public companies use to share information about major events that investors would likely want to know when making investment decisions. The SEC’s cybersecurity rules now explicitly require that companies disclose material cybersecurity incidents via Item 1.05 of Form 8-K.
10-K filings, on the other hand,…
