With the SEC’s new cyber disclosure rules being published in the Federal Register on Friday, we can confirm the compliance dates for the new Item 1.05 Form 8-Ks. To comply with new Item 1.05 of Form 8-K and in Form 6-K, all companies other than smaller reporting companies must begin complying on Monday, December 18, 2023 (which officially is also “Bake Cookies Day”). This date is as expected – the rule called for compliance on the date that is the later of 90 days after publication in the Federal Register or December 18th.
Smaller reporting companies have an additional 180 days before their compliance requirement kicks in on June 15, 2024.
As we blogged about when the SEC adopted the cyber disclosure rules, the rules become effective 30 days from when they are published in the Federal Register – so that now means September 5, 2023. And compliance periods for disclosures other than Form 8-K and 6-K take effect as follows:
- Form 10–K – All companies must provide such disclosures beginning with annual reports for fiscal years ending on or after December 15, 2023. So the compliance starts with calendar year fiscal year companies in their next Form 10-K.
- iXBRL Tagging – Inline XBRL tagging of data will be required beginning one year after the initial compliance dates described above.