Sullivan
Microsoft has discontinued support for Internet Explorer. To access the Sullivan website, please install a modern browser like Microsoft Edge or Google Chrome.

Howard Berkenblit was quoted in the article, "Rule Hastening Disclosure of Cyber Breaches Likely to Ignite Litigation, Insurance Headaches," published in Law360 [sub. req.d].

The article discusses the new SEC ruling in which public companies will now have just four business days from the time it determines a cybersecurity event is material to file a Form 8-K. The new rule raises numerous questions that are hard to answer at this point, such as how companies can cope with the four-day response when a third-party is involved.

"It really depends on what the third party is not providing," said Howard. “If the company already knows the incident is material but just needs some more details, then it must nonetheless file the 8-K with the information it has. The SEC acknowledged that a company may amend its initial 8-K to add more information that was not yet available."

On the other hand, if the company needs the information from the third party before it can make the determination of materiality, it can wait "at least a little bit, though it needs to act as soon as reasonably practicable."

The problem, Howard explained, is that everything will be viewed in hindsight. "Companies will have some difficult judgement calls about when to initially disclose and when to amend those disclosures."