The FBI is outlining how its agents will handle requests from publicly traded companies that want to delay having to disclose a cybersecurity incident under the new controversial Securities and Exchange Commission rules that take effect next week.
The rules go into action December 18, though smaller companies have until mid-June to start complying.
One role the FBI will play is fielding requests from companies to delay disclosing an event, with the SEC saying such delays can be granted if disclosures would risk national security or public safety.
To help companies prepare for the new rules, the FBI this month issued a seven-page public notice detailing how the law enforcement agency will handle requests to delay disclosure for at least 30 days, though such delays can't be more than 120 days.
The Attorney General's Office makes the final decision on a delay request.
The FBI is responsible for taking in and documenting the requests, checking the government's national security and public safety regulations, and referring the information to the Justice Department.
An agent will start investigating whether disclosing the incident would be a national security or public safety issue within two hours of receiving the delay request either directly from the victim or from a U.S. agency, such as the Cybersecurity and Infrastructure Security Agency or the Secret Service.
The FBI also urged companies to reach out to the FBI before determining whether an incident is a material one and soon after believing that disclosure of an attack poses a national security or public safety risk.
Could help with the FBI's review of the disclosure delay request, the FBI wrote.
The SEC created the rules to bring uniformity to how and when public companies disclose cybersecurity incidents.
Companies will have to disclose the incidents in their Form 8-K submissions within four days of determining they are material.
They'll need to outline their cybersecurity management and strategy.
The new rule has gotten pushback from companies, including on how to define whether an incident is material.
In one conversation on Reddit, an individual said he had been worried about such government intervention.
3 Months is standard for public company financial disclosure and allowing a company's Cybersecurity teams to do a thorough investigation on incidents.
This Cyber News was published on securityboulevard.com. Publication date: Mon, 11 Dec 2023 17:43:05 +0000