SEC Cybersecurity Disclosures Explained

On February 20, 2018, the Securities and Exchange Commission (SEC) issued new interpretative guidance on public company disclosures related to cybersecurity risks and incidents. In addition to addressing public company disclosures, the 2018 guidance reminds companies of the importance of maintaining disclosure controls and procedures to address cyber risks and incidents and reminds insiders that trading while having nonpublic information related to cyber matters could violate federal insider trading laws.

The prior SEC guidance on the topic was issued on October 13, 2011. The 2018 guidance is not dramatically different from the 2011 guidance.

How Cybersecurity Threats Drove Increased Regulatory Measures

The topic of cybersecurity has been in the forefront in recent years, with the SEC issuing a series of statements and creating two new cyber-based enforcement initiatives targeting the protection of retail investors, including protection related to distributed ledger technology (DLT) and initial coin offerings (ICOs) or cryptocurrency. Moreover, the SEC has asked the House Financial Services Committee to increase the SEC’s budget by $100 million to enhance the SEC’s cybersecurity efforts.

The SEC incorporates cybersecurity considerations in its disclosure and supervisory programs, including in the context of its review of public company disclosures, its oversight of critical market technology infrastructure and its oversight of other regulated entities, including broker-dealers, investment advisers and investment companies. Considering the rapidly changing technology, threats and risks as well as the proliferation of cybersecurity incidents affecting both private and public companies – including a hacking of the SEC’s own Electronic Data Gathering, Analysis, and Retrieval (EDGAR) system and a hacking of Equifax, causing a loss of $5 billion in market cap upon disclosure – public companies have been anticipating a needed update on the SEC disclosure-related guidance.

Then-SEC commissioner Kara Stein issued a statement on the 2018 guidance that was grim on the subject, pointing out that the risks and costs of cyberattacks had been growing and could result in devastating and long-lasting collateral effects. Commissioner Stein cited a Forbes article estimating that cybercrime would cost businesses approximately $6 trillion per year on average through 2021 and an Accenture article citing a 62% increase in such costs over the previous five years.

The Prior Lack Of Regulatory Guidance

Commissioner Stein also discussed the inadequacy of the 2011 guidance in practice as well as her skepticism of the 2018 guidance’s ability to properly fix the issue. She noted that most disclosures were boilerplate and did not provide meaningful information to investors, despite the large increase in the number and sophistication of cyberattacks on public companies – and the damage caused by them – in previous years. Commissioner Stein included a list of requirements that she would have liked to have seen in the 2018 guidance, including, for example, a discussion of the value to investors of disclosing whether any member of a company’s board of directors had experience, education, expertise or familiarity with cybersecurity matters or risks.

There were numerous media articles and blogs related to the disclosure of cyber-related matters in SEC reports. One such blog was written by Kevin LaCroix and published in the D&O Diary. Mr. LaCroix’s blog pointed out that, according to a September 19, 2016, Wall Street Journal article, cyberattacks were occurring more frequently than ever but were rarely reported. The article cited a report that reviewed the filings of 9,000 public companies from 2010 to the present and found that only 95 of those companies had informed the SEC of a data breach.

As reported in a blog published by Debevoise & Plimpton, dated September 12, 2016 (thank you, thecorporatecounsel.net), a review of Fortune 100 cyber-reporting practices revealed that most disclosures are contained in the risk factor section of regular periodic reports such as Forms 10-Q and 10-K, as opposed to interim disclosures in a Form 8-K. Moreover, only 20 incidents were reported in the period from January 2013 through the third quarter of 2015.

Priority For Guidance Rather Than Rulemaking

However, as commissioner Stein noted, the SEC only has so much authority or power through guidance, as opposed to rulemaking. She strongly advocated for new rulemaking in that regard.

At ANTHONY, LINDER & CACOMANOLIS, PLLC, we do not think – in the current environment advocating for fewer rules – that rulemaking related to cybersecurity disclosure will be made a priority. Moreover, we would not advocate for in-depth or robust further rules. Disclosure is based on materiality, and a company has an ongoing obligation to disclose any material information, including that which is related to cybersecurity matters. We think the SEC can question principals-based specific disclosures – and whether they are robust enough – through reviews of and comments on public company filings. Certainly, the SEC staff, which reviews thousands of filings, knows of the lack of cybersecurity disclosure and can comment. Furthermore, if the SEC wrote a few standard cybersecurity-related disclosure comments and included them in a lot of comment letters, then the marketplace might respond accordingly and beef up disclosure to avoid the comments.

Advocating For An Additional Disclosure Requirement

Although we do not generally advocate for additional rules, commissioner Stein made one suggestion that we supported, which was adding the disclosure of a cybersecurity event to the Form 8-K filing requirements. Although the 2018 SEC guidance does not specifically require a Form 8-K, in light of the importance of these events, it seems it would be appropriate, and the guidance itself requires “timely disclosure.” However, without a specific requirement, a company could elect to disclose via a press release and/or the filing of a Form 8-K under Item 7.01 Regulation FD disclosure.

When disclosing using a press release and Regulation FD item in a Form 8-K, a company may elect for the information to be “furnished, not filed.” Section 18 of the Exchange Act imposes liability for material misstatements or omissions contained in reports and other information filed with the SEC. However, reports and other information that are “furnished” to the SEC do not impose liability under Section 18. The anti-fraud provisions under Rule 10b-5 would still apply to the disclosure, but the stricter Section 18 liability would not.

2018 Guidance On Public Company Cybersecurity Disclosures

The 2018 guidance begins with an introduction describing the importance of cybersecurity in the business world of that time, driving the point home by comparing it with the importance of electricity. Cyber incidents can take many forms – both intentional and unintentional – and commonly involve the unauthorized access of information, including personal information related to customers’ accounts or credit information, data corruption, the misappropriation of assets or sensitive information, or causes of operational disruption. Attacks use increasingly complex methods, including malware, ransomware, phishing, structured query language injections and distributed denial-of-service attacks. A cyberattack can be in the form of unauthorized access or the blocking of authorized access.

The purpose of a cyberattack can vary as much as the methodology used, including for financial gain, such as the theft of financial assets, intellectual property or sensitive personal information, or as a vengeful or terrorist motive through business disruption. Perpetrators may be insiders and affiliates or third parties, including cybercriminals, competitors, nation states and “hacktivists.”

When it’s been a victim of a cyberattack or incident, a company will have direct financial and indirect negative consequences, including but not limited to:

• Remediation costs, including liability for stolen assets, costs of repairing system damage, and incentives or other costs associated with repairing customer and business relationships
• Increased cybersecurity protection costs to prevent future attacks and the potential damage caused by them; these costs include organizational changes, employee training and the engagement of third-party experts and consultants
• Lost revenues from the unauthorized use of proprietary information and lost customers
• Litigation
• Increased insurance premiums
• Damage to the company’s competitiveness, stock price and long-term shareholder value
• Reputational damage

While the 2011 disclosure guidance was conservative in its tone – trying to strike a balance between satisfying the disclosure mandates of providing material information related to risks to the investing community with a company’s need to refrain from providing disclosure that could, in and of itself, provide a road map to the very breaches that a company attempts to prevent – the 2018 guidance is more blunt in the critical need to inform investors about material cybersecurity risks and incidents when they occur.

A company’s ability to timely and properly make any required disclosure of cybersecurity risks and incidents requires the company to implement and maintain disclosure controls and procedures that provide an appropriate method of discerning the impact that such matters may have on the company and its business, financial condition and results of operations as well as a protocol to determine the potential materiality of such risks and incidents.

Insider Trading

It is also important that public company officers, directors and other insiders respect the importance and materiality of cybersecurity risk and incident knowledge and not trade a company’s security when in possession of nonpublic information related to cybersecurity matters. In that regard, companies should include cybersecurity matters in their insider trading policies and procedures. These insider trading policies should guard against trading in the period between when a company learns of a cybersecurity incident and the time it is made public and require the timely disclosure of such nonpublic information.

Disclosure Of Cybersecurity Risks And Incidents

Public companies have many disclosure requirements, including through periodic reports on Forms 10-K, 10-Q and 8-K; through Securities Act registration statements, such as on Forms S-1 and S-3; and generally through the anti-fraud provisions of both the Exchange Act and Securities Act, which requires a company to disclose “such further material information, if any, as may be necessary to make the required statements, in light of the circumstances under which they are made, not misleading.” The SEC considers omitted information to be material if there is a substantial likelihood that a reasonable investor would consider the information important in making an investment decision or that disclosure of the omitted information would have been viewed by the reasonable investor as having significantly altered the total mix of information available.

As with all disclosure requirements, the disclosure of cybersecurity risks and incidents requires a materiality analysis. Although there continues to be no specific disclosure requirement or rule under either Regulation S-K or S-X that addresses cybersecurity risks, attacks or other incidents, many of the disclosure rules encompass these disclosures indirectly, such as risk factors, internal control assessments, management discussion and analysis, legal proceedings, disclosure controls and procedures, corporate governance and financial statements. As mentioned, as with all other disclosure requirements, an obligation to disclose cybersecurity risks, attacks or other incidents may be triggered to avoid making other required disclosures misleading, considering the circumstances.

A company has two levels of cybersecurity disclosure to consider. The first is its controls and procedures and corporate governance to address cybersecurity matters themselves and the timely and thorough reporting of the same. The second is the reporting of actual incidents. In determining the materiality of a particular cybersecurity incident, a company should consider the following:

• The importance of any compromised information
• The impact of an incident on company operations
• The nature, extent and potential magnitude of the event
• The range of harm such an incident can cause, including that to reputation, financial performance, customer and vendor relationships, litigation or regulatory investigations

Of course, the 2018 guidance is also clear that a company would not need to disclose the depth of information that could, in and of itself, provide information necessary to breach cyber defenses. A company would not need to disclose specific technical information about cybersecurity systems, related networks or devices, or specific devices and networks that may be more susceptible to attack due to weaker systems.

The updated guidance also reminds companies that they have a duty to correct prior disclosures that the company determines were untrue at the time that material information was made or omitted and to update disclosures that become inaccurate after the fact.

Like the prior guidance, the 2018 guidance provides specific input into areas of disclosure.

Risk Factors

Obviously, where appropriate, cybersecurity risks need to be included in risk factor disclosures. The SEC guidance in this regard is very commonsensical. Companies should evaluate their cybersecurity risks and take into account all available relevant information, including prior cyber incidents and the severity and frequency of those incidents. Companies should consider the probability of an incident and the quantitative and qualitative magnitude of the risk, including potential costs and other consequences of an attack or other incident. Consideration should be given to the potential impact of the misappropriation of assets or sensitive information, the corruption of data or operational disruptions. A company should also consider the adequacy of preventative processes and plans in place should an attack occur. Actual threatened attacks may be material and require disclosure.

As with all risk factor disclosures, the company must adequately describe the nature of the material risks and how such risks affect the company. Likewise, generic risk factors that could apply to all companies should not be included. Risk factor disclosure may include:

• Discussion of the company’s business operations that gives rise to material cybersecurity risks and the potential costs and consequences, including industry-specific risks and third-party and service provider risks
• The costs associated with maintaining cybersecurity protections, including insurance coverage
• The probability of an occurrence and its potential magnitude
• The potential for reputational harm
• The description of past incidents, including their severity and frequency
• The adequacy of preventative actions taken to reduce cybersecurity risks and the associated costs, including any limits on the company’s ability to prevent or mitigate risks
• Existing and pending laws and regulations that may affect the companies’ cybersecurity requirements and the associated costs
• Litigation, regulatory investigation and remediation costs associated with cybersecurity incidents

Management Discussion And Analysis (MD&A)

In MD&A, a company should consider all the same factors that it would consider in its risk factors. A company would need to include discussion of cybersecurity risks and incidents in its MD&A if the costs or other consequences associated with one or more known incidents or the risk of potential future incidents result in a material event, trend or uncertainty that is reasonably likely to have a material effect on the company’s results of operations, liquidity or financial condition or could impact previously reported financial statements. The discussion should include any material realized or potential reduction in revenues, the loss of intellectual property, any remediation efforts, the maintenance of insurance, the increase in cybersecurity protection costs, any potential harm to reputation, any litigation and regulatory investigations. Furthermore, even if an attack did not result in direct losses, such as in the case of a failed attempted attack, but does result in other consequences, such as a material increase in cybersecurity expenses, then disclosure would be appropriate.

Business Description And Legal Proceedings

Disclosure of cyber-related matters may be required in a company’s business description when they affect a company’s products, services, relationships with customers and suppliers, or competitive conditions. Likewise, material litigation would need to be included in the “legal proceedings” section of a periodic report or registration statement. The litigation disclosure should include any proceedings that relate to cybersecurity issues.

Financial Statements

Cyber-related matters may need to be included in a company’s financial statements prior to, during and/or after an incident. Costs to prevent cyber incidents are generally capitalized and included on the balance sheet as an asset. Generally accepted accounting principles (GAAP) provide for specific recognition, measurement and classification treatment for the payment of incentives to customers or business relations, including after a cyberattack. Cyber incidents can also result in direct losses or the necessity to account for loss contingencies, including those related to warranties, direct loss of revenue, customer incentives, breaches of contract, product recalls and replacements, indemnifications or remediations. Incidents can result in loss of and, therefore, accounting impairment to goodwill, intangible assets, trademarks, patents, capitalized software and even inventory. Financial statement disclosure may also include expenses related to investigation, breach notification, remediation and litigation, including the costs of legal and other professional service providers.

Broad Risk Oversight

A company must disclose the extent of the role of its board of directors in the risk oversight of the company, such as how the board administers its oversight function and the effect this has on the board’s leadership structure. To the extent that cybersecurity risks are material to a company’s business, this discussion should include the nature of the board’s role in overseeing the management of that risk. Information should also be included on how the board engages with management on cybersecurity risk management.

Controls And Procedures

The 2018 guidance clearly provides that companies should adopt comprehensive policies and procedures related to cybersecurity and assess their compliance regularly, including policy/procedure compliance related to the sufficiency of disclosure controls and procedures. Procedures must address a company’s ability to record, process, summarize and report financial and other information in SEC filings. Additionally, any deficiency in these controls and procedures should be reported.

The SEC reminds companies that their principal executive officer and principal financial officer must make individual certifications regarding the design and effectiveness of disclosure controls and procedures. These certifications should take into account cybersecurity-related controls and procedures.

Furthermore, as discussed above, a company should have proper policies and procedures preventing officers, directors and other insiders from trading on material nonpublic information related to cybersecurity risks and incidents.

Regulation FD And Selective Disclosure

Companies may have disclosure obligations under Regulation FD related to cybersecurity matters. Under Regulation FD, “when an issuer, or person acting on its behalf, discloses material nonpublic information to certain enumerated persons (in general, securities market professionals and holders of the issuer’s securities who may well trade on the basis of the information), it must make public disclosure of that information.” The SEC reminds companies that these requirements also relate to cybersecurity matters and that, along with all the other disclosure requirements, policies and procedures, should specifically address any disclosures of material nonpublic information related to cybersecurity.

Maintain Full Compliance With Our Help

If you have questions about SEC cybersecurity disclosures and want to discuss your company’s policies, contact our attorneys at ANTHONY, LINDER & CACOMANOLIS, PLLC, in West Palm Beach to schedule a consultation. They can provide you with the guidance and explanations you need. Our lawyers draw on their more than 100 combined years of experience as well as their wealth of in-depth, up-to-date knowledge of this complex area of law.

Call us today at 877-541-3263 or complete our online contact form to get in touch.