Dive Brief:
- Publicly-traded companies disclosed a collective 71 cybersecurity incidents in regulatory filings during the first 11 months of the Securities and Exchange Commission’s cyber incident reporting rule, BreachRx said in a Tuesday report. The SEC rule requiring companies to report an incident within four days of determining materiality went into effect Dec. 18, 2023.
- Less than 1 in 5 of those 8-K filings, which came from 47 companies — multiple companies filed updates with the SEC as they learned more — specified a material impact, according to BreachRx’s research. On average, companies disclosed cyber incidents roughly nine days after detection.
- “Given the volume of impactful incidents that companies face on a day-to-day basis, the volume of SEC notifications seems incredibly low, particularly if we examine state data breach sites that detail incidents reported to them,” BreachRx CEO Andy Lunsford said via email.
Dive Insight:
The SEC’s cyber disclosure rule continues to confound companies, resulting in a lack of compliance and insufficient details, analysis of the past year’s filings shows.
Business leaders’ concerns about sharing too much information is causing a sustained variance in the timing and fullness of cyber incident filings, Lunsford said.
“The biggest gap is that companies are not providing decision-useful information. Almost all filings to date have used very generic boilerplate language,” Lunsford said. “The SEC, like many other regulators, is seeking more transparency from companies when it comes to reporting incidents and cybersecurity risk.”
A separate SEC rule requiring publicly-traded companies to report cyber risk management and governance strategies in annual filings elicited 154 such filings as of Nov. 18, the report found. The majority of those filings described cyber risks in “nearly identical and generic terms,” BreachRx said.
