On June 24, the Securities and Exchange Commission (SEC) released five additional Compliance and Disclosure Interpretations for Item 1.05 of Form 8-K (Material Cybersecurity Incidents). These interpretations provide additional guidance as to whether and when materiality determinations should be made and when related reporting obligations arise.
In particular, the interpretations are intended to provide additional guidance in the following scenarios:
- When a registrant makes a ransomware payment, the threat actor returns data and stops disruption all before the registrant makes a materiality determination.
- When a registrant makes a ransomware payment, the threat actor returns data and stops disruption, after the registrant makes a materiality determination and before it reports such an incident.
- When ransomware payment is fully covered by insurance.
- Whether the small size of ransomware payment determines lack of materiality in itself.
- Whether a series of immaterial cybersecurity incidents is reportable.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.