The national-security and public-safety delay provision
The national-security and public-safety delay provision allows a registrant to postpone the public disclosure of a material cybersecurity incident if the US Attorney General determines that such disclosure would pose a substantial risk to national security or public safety. This serves as an exception to the standard requirement to file Form 8-K within four business days of determining an incident is material.
What it means
The provision is designed to prevent "attacker tipping" and protect critical infrastructure during active investigations where immediate transparency would jeopardize state interests or endanger lives. It balances investor rights to information with the government's need to manage sensitive security crises.
In practice, this is not a self-certification process. A company cannot unilaterally decide that an incident falls under national security concerns to avoid disclosure; the delay must be formally granted by the Department of Justice (DOJ).
The scope of this provision applies specifically to the timing of the Form 8-K filing. It does not exempt the organization from making a materiality determination or from maintaining internal records of the event.
How to meet it
- Establish clear communication channels with federal law enforcement agencies, such as CISA and the FBI, during the incident response phase.
- Integrate a "national security impact" assessment into your existing cybersecurity incident response plan (IRP).
- Define an internal workflow for notifying legal counsel when an incident may qualify for a delay request under SEC rules.
- Develop a formal process to petition the SEC for a disclosure delay via the US Attorney General.
- Maintain a strict timeline of events, documenting exactly when materiality was determined and when the request for delay was submitted.
Evidence an auditor asks for
- Written correspondence or official requests sent to the SEC/DOJ seeking the disclosure postponement.
- Formal written authorization from the US Attorney General (or their designated representative) granting the specific delay period.
- Incident response logs that show a clear gap between the materiality determination date and the eventual filing date, justified by the government's order.
- Internal legal memos documenting the rationale for seeking the national security exception.
Common pitfalls
- Treating "national security" as a self-declared status rather than a government-granted permission.
- Assuming that notifying law enforcement automatically triggers a delay in SEC reporting without receiving formal DOJ approval.
- Failing to document the date of materiality determination separately from the delay request, making it impossible to prove if the four-day window was missed.