As we discussed in this blog post, one of the challenges in the SEC’s July 2023 cybersecurity disclosure rules is determining when an Item 1.05 Form 8-K to disclose a material cybersecurity incident will be required.  The Instructions for the 1.05 Form 8-K state:

Item 1.05 Material Cybersecurity Incidents. 

(a) If the registrant experiences a cybersecurity incident that is determined by the registrant to be material, describe the material aspects of the nature, scope, and timing of the incident, and the material impact or reasonably likely material impact on the registrant, including its financial condition and results of operations.

The instructions also state:

A registrant need not disclose specific or technical information about its planned response to the incident or its cybersecurity systems, related networks and devices, or potential system vulnerabilities in such detail as would impede the registrant’s response or remediation of the incident.

On December 18, 2023, V.F. Corporation, a marketer of “Active-Lifestyle Brands,” filed an Item 1.05 Form 8-K.  After a description of the cybersecurity breach and its impact on the company’s operations, the Form 8-K includes this language about materiality:

As the investigation of the incident is ongoing, the full scope, nature and impact of the incident are not yet known. As of the date of this filing, the incident has had and is reasonably likely to continue to have a material impact on the Company’s business operations until recovery efforts are completed. The Company has not yet determined whether the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.

As always, your thoughts and comments are welcome!

When the SEC issued its new cybersecurity disclosure Final Rule, it created the new Item 1.05 Form 8-K requiring disclosure of material cybersecurity incidents.  You can read more about the Final Rule and the Form 8-K, along with the related implementation timing, in this blog post.

One of the complex issues in the 1.05 Form 8-K is this instruction:

(c) Notwithstanding General Instruction B.1. to Form 8-K, if the United States Attorney General determines that disclosure required by paragraph(a)of this Item1.05 poses a substantial risk to national security or public safety, and notifies the Commission of such determination in writing, the registrant may delay providing the disclosure required by this Item 1.05 for a time period specified by the Attorney General, up to 30 days following the date when the disclosure required by this Item 1.05 was otherwise required to be provided. Disclosure may be delayed for an additional period of up to 30 days if the Attorney General determines that disclosure continues to pose a substantial risk to national security or public safety and notifies the Commission of such determination in writing. In extraordinary circumstances, disclosure may be delayed for a final additional period of up to 60 days if the Attorney General determines that disclosure continues to pose a substantial risk to national security and notifies the Commission of such determination in writing. Beyond the final 60-day delay under this paragraph, if the Attorney General indicates that further delay is necessary, the Commission will consider additional requests for delay and may grant such relief through Commission exemptive order.

The FBI has established a process to request such disclosure delays on this webpage: FBI Guidance to Victims of Cyber Incidents on SEC Reporting Requirements.  Interestingly, the guidance suggests that companies establish a relationship with the cyber squad at their local field office.  It also notes that “delay requests won’t be processed unless they are received by the FBI immediately upon a company’s determination to disclose a cyber incident via 8k.”

On December 14, 2023, CorpFin issued four new Compliance and Disclosure Interpretations in Section 104B (C&DIs) that address questions about the delay process.  The new C&DIs address issues including what a company should do if it contacts the Attorney General, but a determination is not made by the original due date for the Form 8-K.  In this situation, the 8-K must be filed by its original due date.  The C&DIs also clarify that consulting with the Department of Justice about a cyber security incident does not create a presumption that the incident is material.

To provide additional support for companies as they work to provide required cyber security disclosures, on December 14, 2023, CorpFin Director Eric Gerding published this Speech providing an overview of the new rules and specific thoughts about the cybersecurity incident disclosures on Form 8-K and the cybersecurity governance and risk management disclosures required in new Item 1C for Form 10-K.  In his speech Director Gerding states:

“But I want to reassure companies and their representatives that our Division does not seek to make ‘gotcha’ comments or penalize foot faults.  To the extent appropriate, we may issue forward-looking comments to companies or additional CDIs.”

As always, your thoughts and comments are welcome!

On December 4, 2023, SEC Chief Accountant Dr. Paul Munter issued a Statement titled “The Statement of Cash Flows: Improving the Quality of Cash Flow Information Provided to Investors.”  In his introduction Dr. Munter notes:

“Unfortunately, we have observed that preparers and auditors may not always apply the same rigor and attention to the statement of cash flows as they do to other financial statements, which may impede high quality financial reporting for the benefit of investors.”

He also discusses the importance of cash flow information to investors and that the statement of cash flows has consistently been one of the higher frequency areas of restatements.

The statement addresses several statement of cash flow considerations including:

• • Materiality;
  • The importance of proper classification;
  • How misclassification in the statement of cash flows can be material and lead to “Big R” restatements;
  • Internal control considerations;
  • The potential advantages of using the direct method to present cash from operating activities;
  • The FASB’s project to make targeted improvements to the statement of cash flows; and
  • Focus points for auditors as they examine cash flow information.

Dr. Munter’s conclusion makes the point:

“The statement of cash flows represents a critical piece of a complete picture of an issuer’s financial health and operations. Issuers and auditors have a responsibility, under securities laws and professional standards, to apply the same high level of care and professionalism to the preparation, review, and audit of the statement of cash flows as is required for the other financial statements.”

As always, your thoughts and comments are welcome!

On November 22, 2023, the SEC postponed the effective date of its Share Repurchase Disclosure Modernization rule.  The postponement was in the wake of an opinion by the U.S. Court of Appeals for the Fifth District in Chamber of Com. of the USA v SEC.  You can read more in the SEC’s Announcement.  The rule has been stayed pending further Commission action.  Companies do not need to comply with the new rule at this time.  It would have required daily share repurchase disclosures for the first full fiscal quarter that began on or after October 1, 2023.

As always, your thoughts and comments are welcome.