The SEC’s new rule on cybersecurity has finally been issued. The final decision to disclose cybersecurity breaches will all come down to materiality. Despite the new rule, these disclosures are not a new requirement. In 2018, the SEC released interpretative guidance on this matter. The 2022 Ideagen Audit Analytics Cybersecurity Report only found 43 public companies that initially disclosed their cyber incident in a filing with the SEC in 2022. These disclosures represented only 34% of all disclosures that year.

In this article, Audit Analytics takes a closer look at the SEC’s new rule on cybersecurity, which will require 8-K filings to begin.