Are You SEC Ready? What You Need to Know

### Overview In this LinkedIn Live flash panel hosted by Optiv, Managing Partner Justin Williams, Vice President of Cyber Risk Strategy and Board Relations James Turgal, and Director of Strategy and Risk Management Adam Wisnieski analyze the SEC's newly adopted cybersecurity disclosure rules finalized on July 26. The panel breaks down what the finalized regulation requires for public companies, boards of directors, C-level executives, and third-party risk management under aggressive compliance timelines.

### Key Topics - **Regulatory Timeline and Deadlines**: Following official publication in the Federal Register, incident reporting under Form 8-K / Item 1.05 requires compliance 90 days post-publication (marking December 18 at the latest). Annual disclosure rules (Item 106) take effect for annual 10-K filings for fiscal years ending on or after December 15, 2023 (such as calendar-year filers on December 31). Smaller reporting companies are granted an extended window of 180 to 270 days. - **Materiality and Four-Day Disclosure Window**: The rule requires public companies to disclose a material cybersecurity incident on Form 8-K within four business days after determining materiality. Determining materiality depends on the perspective of a "reasonable investor," evaluating qualitative and quantitative impacts such as financial conditions, operational results, data loss, vendor relationships, and brand impact. - **Management and Board Governance (Item 106)**: Registrants must describe their processes for identifying, assessing, and managing material cybersecurity risks, as well as management’s role (specific positions or committees) and board oversight. The panel notes that while specific cybersecurity board qualifications were not mandated, significant accountability and oversight pressure are placed squarely on CISOs and CEOs. - **Supply Chain and Third-Party Risk**: Third-party service provider compromises affecting a registrant are not exempt; material impacts originating from vendors must still be reported, potentially resulting in dual filings if both entities are registrants. Companies are also expected to disclose their reliance on external cybersecurity service providers. - **National Security and Law Enforcement Exceptions**: Unlike earlier proposals, the final rule provides a safe harbor allowing the U.S. Attorney General to delay public disclosure for 30 days due to national security or law enforcement risks, extendable to 60 days, and up to roughly 120 days in extraordinary circumstances.

### Technical Details - **Item 1.05 (Form 8-K)**: Focuses on incident disclosure, requiring details on the nature, scope, timing, and material impact (or reasonably likely material impact) of an incident within four business days of a materiality determination. - **Item 106 (Form 10-K)**: Mandates annual disclosures regarding risk assessment and management processes, prior incident impact, committee and management roles (including Item 106(c)(2)), prevention/mitigation monitoring, and reporting up to the board. - **Materiality Determination Process**: The panel emphasizes that the four-day clock starts upon determining materiality, not at the moment of initial triage or discovery. However, companies cannot artificially delay investigations beyond reasonable timeframes established by standard operating baselines.

### Takeaways Organizations have a narrow window (approximately 90 to 120 days) to establish cross-functional alignment. Compliance cannot remain an isolated security issue; it demands an integrated operating model across three main pillars: IT/cybersecurity, legal (General Counsel), and finance (CFO/accounting). Organizations must explicitly document their incident triage and value stream mapping to define quantifiable harm and determine precisely who makes the materiality determination and briefs the board.