The FBI has issued guidance regarding the data breach reporting requirements of the Securities and Exchange Commission, providing useful information on how disclosures can be delayed.
The SEC announced in late July that it had adopted new cybersecurity incident disclosure rules for public companies, requiring them to disclose, through a Form 8-K filing, any material breach within four business days.
When it announced the new rules, the SEC noted that some companies may be exempt if there is substantial risk to public safety or national security.
The FBI has now provided some clarifications on this exemption, explaining that the Justice Department can grant a 30-day delay for national security or public safety reasons.
The disclosure can be delayed for another 30 days, or 60 days in extraordinary circumstances involving national security, but the delays cannot exceed a total of 120 business days without an exemptive order from the SEC. The FBI is accepting the delay requests on behalf of the Justice Department and organizations seeking to delay disclosure must follow certain procedures.
While some applauded the SEC for its initiative when it announced the new rules, others raised concerns about the impact on investors and some warned that the disclosure rules could actually help cybercriminals.
Republican lawmakers filed a joint resolution last month in an effort to overturn the rules, but it has yet to pass the House or the Senate.
This Cyber News was published on www.securityweek.com. Publication date: Tue, 12 Dec 2023 11:43:19 +0000