SEC proposes four-day rule for public companies to report cyberattacks

And it'll be in an 8-K for all to see

A new rule proposed by the US Securities and Exchange Commission (SEC) would force public companies to disclose cyberattacks within four days along with periodic reports about their cyber-risk management plans.

Specifically, the proposed rule would amend the Form 8-K reporting requirements to include cybersecurity incident disclosure "within four business days after the registrant determines that it has experienced a material cybersecurity incident." The 8-K is the form that the SEC requires public companies file to publicly announce corporate changes or big events that may be material to shareholders. 

Crypto claims

Separately, the SEC this week accused two siblings of swindling more than $124m from thousands of netizens in a massive fraud operation that included misleading roadshows, YouTube videos, and an ominous-sounding digital token called Ormeus Coin.

According to the SEC, John and JonAtina (Tina) Barksdale sold Ormeus Coin to folks on crypto-trading platforms beginning in June 2017. At the same time, they started up a multi-level marketing business called Ormeus Global that sold subscription packages, including Ormeus Coin and an investment in a crypto trading program, it is claimed.

The brother and sister duo then held roadshows and produced phony social media posts and YouTube videos to promote the biz, the SEC claimed in a lawsuit against the pair.

While the siblings claimed one of the largest global cryptomining operations supported Ormeus Coin, the Barksdales abandoned the mining operation in 2019 with less than $3m in total revenue, it is said. But that didn't stop them from telling investors Ormeus Coin had a $250m operation that produced $5.4m to to $8m per month in revenues.

Prosecutors in New York have also unsealed a criminal complaint against John Barksdale.

It would also amend the quarterly 10-Q and annual 10-K reporting requirements with mandates that corporations provide updates about previously undisclosed incidents after a series of them "become material in the aggregate," along with information about policies and procedures, if they have any, for managing cyber risk and cybersecurity governance.

This includes the board of directors' oversight, details about any board members' cybersecurity expertise, and management's role and experience handling cyber risks and implementing cybersecurity policies, procedures, and strategies.

"Today, cybersecurity is an emerging risk with which public issuers increasingly must contend," SEC Chair Gary Gensler said in a statement. "Investors want to know more about how issuers are managing those growing risks. A lot of issuers already provide cybersecurity disclosure to investors. I think companies and investors alike would benefit if this information were required in a consistent, comparable, and decision-useful manner."

The proposed SEC rule comes as similar cyber reporting mandates are finally picking up steam with more members of the US Congress.

Earlier this month, the US Senate unanimously passed the Strengthening American Cybersecurity Act of 2022. It would, among other things, require critical infrastructure operators and federal agencies to report cyberattacks and ransomware payments. The proposed law now heads to the House for a vote.

These types of breach reporting mandates aren't new ideas. Some lawmakers, members of the Biden administration, and private-sector security analysts have been pushing for more robust cyberattack reporting rules since last year's high-profile ransomware attacks against Colonial Pipeline, meat processor JBS, and Kaseya, among others. 

However Russia's invasion of Ukraine and the threat of potential cyberattacks against the West in retaliation for sanctions have given these proposed laws a new sense of urgency. CISA recently updated guidance to US businesses about potential threats from Russia.

While the federal agency hasn't seen any specific cyber threats, "every organization — large and small — must be prepared to respond to disruptive cyber activity," CISA warned. ®