Careers

Diversity

With 18 offices, from New York to Los Angeles and Seattle to Orlando, we live and work in communities all over the U.S., collaborating across locations, disciplines and even borders. Our experienced, highly ranked lawyers serve businesses wherever they are and wherever they want to go.

Offices

About Us

Pages

Professionals

Thought leadership: blogs, podcasts, videos, publications, events and news

Insights

Services

Pro Bono

Am Law 100 firm with practices in Business, Digital Assets and Data Management, Intellectual Property, Labor & Employment, Litigation and Tax.

Home | BakerHostetler

Joanna Wasick Comments on Crypto Enforcement Under New Administration

Carlos Ramos-Mrosovsky Presents at iLaw 2025 Conference: The ILS Global Forum of International Law

Emily Mott Elected to Board of Coastal Prairie Conservancy

2024 SEC Cybersecurity Rule Updates

core/heading

Impact Assessment Process&nbsp;– Verify that there is an internal protocol and process for (1) detecting cybersecurity incidents, (2) classifying incidents by potential impact (e.g., low, medium, high, critical), (3) escalating incidents based on severity classification to a committee that evaluates disclosure obligations (e.g., escalate all high and critical incidents), (4) assessing impact based on applicable qualitative and quantitative factors, (5) determining and documenting the decision regarding the impact assessment, and (6) if applicable, filing a Form 8-K under Item 1.05 or 8.01. Doing an executive tabletop exercise is an effective way to test and refine this process and protocol. Having members of the audit committee or board observe the exercise or briefing them on the exercise is a good way to enable effective oversight.

core/list-item

Bringdown Process&nbsp;– Ensure that there is a process to review statements related to cybersecurity before quarterly and annual filings for accuracy and completeness, including based on any security incidents or assessments that occurred since the prior filing and to avoid hypothetical statements regarding actual risks that have occurred.

Security Statements&nbsp;– Review public-facing security statements for accuracy, completeness and consistency.

core/list

The first year of a new significant regulatory obligation is often more notable for the absence of regulatory enforcement actions as regulators often observe compliance efforts and challenges, offer guidance, and look for outliers. Heading into 2024, there was concern about the ability to comply with the Securities and Exchange Commission (SEC) cybersecurity rules. Most of the concern focused on the new Form 8-K disclosure obligation for material cybersecurity incidents. Others commented that the new obligation to disclose a company’s cybersecurity risk management strategy would lead to increased regulatory scrutiny and litigation when the company disclosed a security incident that suggested that something about the company’s cybersecurity strategy disclosure was not accurate. The SEC did offer guidance on the new materiality filing requirement five months into the year, enforcement resolutions related to conduct that occurred before the rules were effective, and the concern about post-incident regulatory/litigation risk did not materialize. This alert includes Form 8-K statistics for the past year, covers notable proceedings and resolution agreements (including dissenting opinions of commissioners on high-profile cases that may be a good forecast of the SEC’s approach under a new administration), and offers insights to help navigate the evolving landscape of SEC cybersecurity regulations effectively.

core/paragraph

Background. The SEC cybersecurity rule created two new obligations that became effective in December 2023: (1) file a Form 8-K under new Item 1.05 within four days of determining that the impact of a cybersecurity incident is material (with certain content requirements related to the incident) and (2) in a new section of Form 10-K (Item 1C, which refers to the requirements of a new Item 1.06 of Regulation S-K), describe (a) the company’s cybersecurity strategy and processes for assessing, identifying and managing material risks from cybersecurity threats, (b) how management and the board oversee and management assesses and manages cybersecurity risks, including addressing which management positions or committees are responsible for such actions, and (c) “whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the registrant, including its business strategy, results of operations, or financial condition and if so, how.”

Materiality. The new rule did not create a new materiality standard. The generally applicable test for materiality still applies – whether “there is a substantial likelihood that a reasonable shareholder would consider [the incident] important in making an investment decision, or if it would have significantly altered the total mix of information made available” to the shareholder.

Companies and commentators expressed a lot of concern that it would be too difficult for companies to meet the new materiality disclosure requirement and that disclosing details about incidents so early would create risks. But in the year before and after the effective date, tabletop exercises that included assessing impact for materiality purposes often led to companies determining that there were very few iterations of security incidents that would create a material impact. The scenario most commonly projected as having the potential to create a material impact was a sustained outage (usually meaning longer than ten days). Outside of technology companies where security is a core part of the product/service, qualitative factors were rarely identified as being sufficient to add to the cumulative impact such that the overall impact was material.

The first 18 disclosures filed under Item 1.05 of Form 8-K all stated that the company was still assessing whether the impact to financial condition/results of operations was material or the incident did not have a material impact to financial conditions/results of operations (or that they did not expect for there to be a material impact). Some mentioned that there had been impact to operations, and others said there was no impact on operations. None mentioned qualitative factor impacts. So, the SEC issued guidance on May 21, 2024, recommending that companies not file under Item 1.05 unless the company had determined that the cybersecurity incident was material. For incidents where the impact was not yet known or was not material but the company wanted to disclose the incident in a filing, the SEC encouraged companies to instead use Item 8.01, which is available for companies to voluntarily disclose information not specifically triggered by another Form 8-K item.<a id="_ftnref1" href="#_ftn1">[1]</a>

On June 24, 2024, the SEC Division of Corporate Finance issued five new Compliance &amp; Disclosure Interpretations mainly covering impact assessment for a ransomware attack. Essentially, the responses to the questions posed confirmed that a company still has to evaluate all factors (qualitative and quantitative) if it pays a ransom to obtain a decryptor to restore systems, the ransomware payment was covered by insurance or the ransomware payment was small.

Companies filed 26 initial Form 8-K Item 1.05 disclosures from December 2023 through December 2024. It was not until the 26th one – filed on December 11, 2024, by a restaurant company for an incident that disrupted its online ordering – that a filing stated that the incident had a material impact on the company’s operations and financial condition (although it said it had cyber insurance and did not expect there to be a long-term impact). Earlier first filings initially said the impact was not material, had not been determined or only affected the quarter. Two initial filings mentioned qualitative factors as risks the company remained subject to (without saying the risk materialized) (the factors mentioned were “adequacy of processes during the period of disruption, diversion of management’s attention, potential litigation, changes in customer behavior, and regulatory scrutiny”).

One ransomware group attempted to use the new rules as additional extortion pressure by filing a whistleblower report with the SEC after the company did not pay a ransom and did not file a Form 8-K. The attempt drew media coverage but likely did not have the impact the ransomware group hoped it would have.

Cybersecurity Strategy Disclosure. Form 10-K Item 1C disclosures thus far have, as expected, varied depending on the nature of the company’s size, systems and risks, with some common themes emerging and reflecting a cautious approach to avoid detailed information that could be exploited by threat actors.

With respect to cybersecurity strategy and processes, most reference risk assessment, access management, logging and monitoring, penetration testing, vulnerability scanning, threat intelligence, employee awareness and training, security monitoring, audits, and tabletop exercises. It has also been common to note use of an external framework, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Most companies use third parties to assist with these processes, and disclose that they conduct due diligence and undertake monitoring or auditing to address cybersecurity risks from using third-party service providers.

The audit or other committee of the board most often has responsibility for cybersecurity oversight, with the full board remaining responsible for the general enterprise risk management process into which cybersecurity oversight is integrated.

With respect to management’s role, most name one or two officers with responsibility, typically including the chief information security officer (CISO), and cite such person’s experience before joining the company, years of experience and, to some extent, any relevant certifications or degrees.

The most notable point of difference among the Item 1C disclosures is how companies have approached the requirement to describe “whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the registrant, including its business strategy, results of operations, or financial condition and if so, how.” Many tracked the language of the rule to say there were no material effects or reasonably likely material effects, with some adding knowledge qualifiers, limited historical time frames and statements that there can be no assurance that such effects may not occur. Approaches varied as to the extent to which the disclosure covered the “reasonably likely” forward-looking aspect of the requirement, and some did not address this part of the rule at all. Cross-references to the Risk Factors section of the filing were very common, particularly when limited forward-looking disclosure was provided.

Companies are reminded that for fiscal 2024 filings, the Item 1C disclosure must be tagged in Inline XBRL (iXBRL). The tagging process requires companies to identify the provision of S-K Item 106 for which the tagged disclosure is responsive, as well as determine which flags to mark as “true” or “false.” It is understood that this true or false designation applies to the flag for “Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant,” which may be challenging to align with disclosure that does not affirmatively state whether or not such effects have occurred or are reasonably likely to occur.

Enforcement. SEC enforcement actions that were active in litigation or resolved in 2024 arose from incidents that occurred before the effective date of the cybersecurity rules. The claims were for securities fraud for insufficient disclosure as well as violations of the requirements to maintain internal controls and disclosure controls and procedures under the Exchange Act. And they were almost exclusively related to the 2020 SolarWinds incident. The civil fraud lawsuit brought by the SEC against SolarWinds and its CISO was the most notable action.

On June 18, 2024, the SEC entered into a resolution agreement with a marketing/packaging/print and supply chain company requiring a $2.1 million payment to resolve claims related to a December 2021 ransomware attack. The SEC’s allegations were made under Exchange Act Section 13(b)(2)(B) and Rule 13a-15a for failure to maintain adequate internal accounting controls and failure to maintain adequate disclosure controls and procedures. The company used a third-party provider to review and audit alerts generated by its network’s internal detection control system, and the SEC asserted that the company’s internal policies with respect to the direction of, oversight of and responses to the third-party provider were insufficient because the company’s personnel were not adequately reviewing the alerts from the third-party provider and were not properly investigating the third-party provider’s warnings. As a result of these deficiencies in its internal accounting controls and disclosure controls, the SEC alleged that the company failed to timely respond to and disclose a ransomware attack. The charges were settled under the resolution agreement, while similar claims were pending against SolarWinds, as discussed below. Two commissioners dissented, issuing a statement (repeating a view expressed in recent prior dissents) that the SEC lacks jurisdiction under the provision to charge companies for alleged “control failures” that do not involve accounting controls in particular and that this broad reading improperly “gives [the SEC] a hook to regulate public companies’ cybersecurity practices.”

On July 18, 2024, a federal court dismissed most (but not all) of the claims brought by the SEC in an enforcement action against SolarWinds Corp. and its CISO. The enforcement action stemmed from allegations by the SEC that SolarWinds made materially misleading statements and omissions about the company’s cybersecurity risks following a prolonged cyberattack. The SEC alleged that SolarWinds had failed to maintain appropriate internal accounting controls and had distributed misleading and incorrect public communications, and that a “Security Statement” by SolarWinds was materially misleading.

On October 22, 2024, the SEC entered into resolution agreements with four technology companies regarding such companies’ disclosures about the impact of a compromise of their systems as a result of the exploitation of the vulnerable SolarWinds code. While these enforcement inquiries began in 2021 (ahead of the effective date of the cyber disclosure rules), the settlements were written with a view to the now effective disclosure rules. One company paid $4 million and the others each paid around $1 million in penalties.

Litigation. While the frequency of lawsuits by consumers against a company after disclosure of a security incident has increased over the past five years, securities and governance class action and shareholder derivative claims are rare. Of the 26 companies that filed a Form 8-K Item 1.05 regarding a cybersecurity incident in 2024, only two faced a shareholder lawsuit (and one lawsuit was withdrawn). The shareholder derivative claims that were filed were breach of fiduciary duty, indemnification, contribution, and violations of Sections 14(a) and 20(a) of the Exchange Act.

Regulation FD. Companies facing the new disclosure requirements also raised concerns regarding the application of Regulation FD when sharing with commercial counterparties such as vendors or customers additional information about a material cybersecurity incident that goes beyond the disclosure provided under Form 8-K. The SEC also issued a statement<a href="#_ftn3" id="_ftnref3">[3]</a> regarding these concerns, indicating the new Form 8-K requirements do not impact considerations under Regulation FD. Regulation FD prohibits the sharing of material nonpublic information selectively with market professionals (such as brokers, dealers and investment advisers) securities holders when it is reasonably foreseeable that the securityholder will trade on the basis of the information, without making such information simultaneously available to the public. It remains permissible for a company to privately provide information about a cybersecurity incident beyond what was disclosed in Form 8-K Item 1.05 if (i) the private information is immaterial, (ii) the parties receiving such private information are not covered by Regulation FD, or (iii) the parties receiving such private information owe a duty of trust to the company or enter into a confidentiality agreement with the company regarding the information.

Important Compliance Efforts for 2025

The SEC guidance and enforcement proceeding outcomes from the past year provide useful insight as companies are updating their Item 1C disclosures for their upcoming Form 10-Ks and continuing to refine their disclosure controls and procedures related to cybersecurity matters and considering whether a filing is required under Form 8-K. Given the outcome of the SolarWinds case and upcoming change in administration, the SEC may be limited going forward in using charges related to ineffective internal controls to cite companies for violations relating to cybersecurity incidents; however, close attention will still be paid to disclosures under the new rules and how companies are assessing materiality. As a result, the following steps are recommended:

Impact Assessment Process – Verify that there is an internal protocol and process for (1) detecting cybersecurity incidents, (2) classifying incidents by potential impact (e.g., low, medium, high, critical), (3) escalating incidents based on severity classification to a committee that evaluates disclosure obligations (e.g., escalate all high and critical incidents), (4) assessing impact based on applicable qualitative and quantitative factors, (5) determining and documenting the decision regarding the impact assessment, and (6) if applicable, filing a Form 8-K under Item 1.05 or 8.01. Doing an executive tabletop exercise is an effective way to test and refine this process and protocol. Having members of the audit committee or board observe the exercise or briefing them on the exercise is a good way to enable effective oversight.

Bringdown Process – Ensure that there is a process to review statements related to cybersecurity before quarterly and annual filings for accuracy and completeness, including based on any security incidents or assessments that occurred since the prior filing and to avoid hypothetical statements regarding actual risks that have occurred.

Security Statements – Review public-facing security statements for accuracy, completeness and consistency.

core/separator

<a href="#_ftnref1" id="_ftn1">[1]</a> Disclosure of Cybersecurity Incidents Determined To Be Material and Other Cybersecurity Incidents, May 21, 2024, Erik Gerding, Director, Division of Corporation Finance (<a href="https://www.sec.gov/newsroom/speeches-statements/gerding-cybersecurity-incidents-05212024#_ftn1">https://www.sec.gov/newsroom/speeches-statements/gerding-cybersecurity-incidents-05212024#_ftn1</a>)

<a href="#_ftnref2" id="_ftn2">[2]</a> <a href="https://www.sec.gov/newsroom/speeches-statements/peirce-uyeda-statement-solarwinds-102224">https://www.sec.gov/newsroom/speeches-statements/peirce-uyeda-statement-solarwinds-102224</a>

<a href="#_ftnref3" id="_ftn3">[3]</a> Selective Disclosure of Information Regarding Cybersecurity Incidents, June 20, 2024, Erik Gerding, Director, Division of Corporation Finance (https://www.sec.gov/newsroom/whats-new/gerding-cybersecurity-incidents-06202024)

Related Services

Featured Insights