As companies prepare for the upcoming proxy and annual report season, the following supplements the list of key items to consider contained in our October 2, 2023 post:
Prepare for 8-K reporting of cybersecurity incidents: starts December 18
As discussed in our July 27, 2023 post, all companies – except for smaller reporting companies – must begin reporting material cybersecurity incidents in Form 8-Ks or 6-Ks on December 18, 2023. Accordingly, companies should review and address the recommended actions in our earlier post. SRCs will have an additional 180 days, with compliance required beginning on June 15, 2014.
These reports supplement the requirement for disclosure in annual reports of cybersecurity risk management, strategy and governance.
Implement cybersecurity controls and procedures
As discussed in our November 1, 2023 post on the SEC’s landmark cybersecurity disclosure lawsuit, companies should review their controls and procedures, as well as their culture, public statements and documentation regarding cybersecurity matters.
Update D&O questionnaires
Companies should review our December 5, 2023 post for potential topics to address in their D&O questionnaires.
