US Banks Urge SEC to Repeal Cyber Disclosure Rule – Source: www.infosecurity-magazine.com

The US banking industry is lobbying to rescind one of the US Securities and Exchange Commission’s (SEC) latest rules on cyber incident reporting.

The group includes the American Bankers Association (ABA), the Bank Policy Institute (BPI), the Securities Industry and Financial Markets Association (SIFMA), the Independent Community Bankers of America (ICBA) and the Institute of International Bankers (IIB).

The rule, officially called the “Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure Rule,” was adopted by the SEC in July 2023.

It requires public companies to disclose material cybersecurity incidents within four business days of determining their materiality, with a description of the material aspects of the incident’s nature, scope and timing, as well as its material impact or reasonably likely material impact on the registrant.

This requirement amends Form 8-K by adding Item 1.05 for US-based companies and amends Form 6-K for foreign companies operating in the US.

Additionally, companies must annually report on their cybersecurity risk management, strategy and governance practices.

Disclosure Complexity and Compliance Confusion

In a petition published on May 22, the five banking associations claim the rule raises incident complexity and puts a strain on their resources.

“This rule adds [new disclosure requirements] to an already complex list of reporting and disclosure obligations that financial institutions and other critical infrastructure sector companies must follow,” said the BPI in a public statement.

“The Department of Homeland Security issued a report in 2023 identifying 45 different federal cyber incident reporting requirements, administered by 22 federal agencies,” BPI added.

Additionally, the coalition mentioned cases where companies were required to make premature disclosures.

The petition letter noted, “Registrants have been forced to publicly disclose an incident even if it is ongoing, the company’s investigation is not complete, and the incident has not been fully remediated.”

The rule is also criticized for introducing confusing compliance requirements for both the registrants and their investors.

“This has persisted despite the SEC’s repeated attempts to clarify the rule through Compliance & Disclosure Interpretations, commissioner statements and comment letters,” the petition letter continued.

Finally, the banking associations argue that the new rule creates additional risk, with some ransomware groups leveraging unfulfilled SEC disclosure requirements to put further pressure on victims during the extortion process.

After trying to lobby against the adoption of the new rule in 2023 and requesting a 12-month extension of the compliance dates for data protection and cybersecurity amendments in an April 2025 letter to the SEC, they now ask the SEC to repeal the rule or at least remove Item 1.05  of Form 8-K and the corresponding amendment in Form 6-K.