Joint Comments to SEC to Rescind Cyber Disclosure Rule

Dear Ms. Countryman,

The American Bankers Association, Bank Policy Institute, Securities Industry and Financial Markets Association, Independent Community Bankers of America, and Institute of International Bankers respectfully petition the Securities and Exchange Commission pursuant to Rule 192 of the SEC's Rules of Practice, for a rulemaking to amend the SEC's Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure rule. When the rule was first proposed and enacted, concerns that the SEC had exceeded its authority and expertise and that the rule was deeply flawed were raised by the dissenting commissioners, by Congress, and by businesses across multiple sectors, including the financial services industry. While we continue to have significant concerns regarding the rule as a whole—including the requirements of Regulation S-K Item 106 relating to cybersecurity risk management, strategy, and governance disclosures—we believe the most urgent and problematic aspects are the cybersecurity incident disclosure mandates under Form 8-K Item 1.05 for domestic issuers and under Form 6-K for foreign private issuers, both of which require rapid—often premature— disclosure of material cybersecurity incidents. These requirements impose additional risks, cost, and complexity on SEC registrants, undermining the SEC's mission to facilitate capital formation, while also failing to generate the type of decision-useful information which would advance the SEC's mission to protect investors. Accordingly, this petition requests the rescission of both Form 8-K Item 1.05 and the corresponding Form 6-K requirements.

In the year and a half since Item 1.05 became effective, the fears expressed by industry have manifested.

• Premature Disclosure: Registrants have been forced to publicly disclose an incident even if it is ongoing, the company's investigation is not complete, and the incident has not been fully remediated.
• Unhelpful to Investors: The premature disclosure has harmed registrants and at the same time failed to provide the market with meaningful or actionable information upon which to make investment decisions.
• Confusion: The rule has been met with significant confusion, including about when to file under Item 1.05, 8.01 or neither. This has persisted despite the SEC's repeated attempts to clarify the rule through Compliance & Disclosure Interpretations, commissioner statements, and comment letters
• Weaponization by Hackers: In multiple instances threat actors have used the rule's prescriptive requirements as additional extortion leverage.

The SEC previously expressed that it was not persuaded that the risks relating to Item 1.05 identified by industry would come to pass. The staff of the SEC has since found it necessary to create a patchwork of guidance and comment letters in an attempt to address these risks. We continue to believe that Item 1.05 was flawed in its conception, and request that the SEC review the record and reconsider.

Download the joint comment letter to read the full text.