With the SEC's 2023 rules, companies must promptly determine the materiality of a cybersecurity incident. Pre-established criteria and communication channels will be essential to making timely disclosures, especially given the four-business-day window for Form 8-K submissions after deeming an incident as material.
