FBI Tells Companies How To Delay Disclosing Cyberattacks

The FBI has issued guidance on how companies can request a delay in disclosing cyber incidents to the Securities and Exchange Commission. This follows new SEC rules requiring prompt disclosure of “material” cybersecurity incidents within four business days.

The delay can be up to 30 business days with an option for an additional 30 days, and in extraordinary circumstances, another 60 days due to national security risks.

The guidance, summarized at the link above, addresses concerns and backlash from companies and lawmakers following the SEC’s initial rules. Rep. Andrew Garbarino (R-NY) proposed legislation that would overturn the rules.

The bureau explains that a “material cybersecurity incident” is defined as one in which “there is substantial likelihood that a reasonable shareholder would consider it important” when making an investment decision.

Simply engaging with the FBI won’t trigger “materiality,” the FBI said.

To request a delay, companies must email the FBI information about when the incident occurred and when the organization determined it was material. A failure to provide the exact date, time, and time zone for the materiality determination “will cause your delay-referral request to be denied,” the FBI warned.

The email should include detailed information about what kind of cyberattack occurred, the intrusion vectors, infrastructure or data affected, operational impact on the company, and whether there is confirmed attribution of the attack.

Companies must provide points of contact and information about whether it’s the first time they have submitted a delay-referral request.

The FBI processes delay requests on behalf of the DOJ, which evaluates them based on industry, vulnerability type, and attacker.