Complying with
SEC cybersecurity
disclosure rules

Solution brief

Addressing Form 10-K and 8-K obligations

Practical steps and how Verizon can help
On July 26, 2023, the Securities and Exchange Commission(SEC) adopted rules requiring public companies to disclosematerial cybersecurity incidents in an SEC filing (known as
Form 8-K). Companies subject to the rule must also disclose in
their annual reports on Form 10-K information regarding theircybersecurity risk management, strategy and governance.
Verizon has several solutions that can help companies complywith the new SEC rules.

any risks from cybersecurity threats have materially affectedor are reasonably likely to materially affect their businessstrategy, results of operations or financial condition.
Verizon’s Cyber Risk Programs with Cyber Risk
Quantification (under development), Security Risk
Assessment and Security Program Assessment provide
cyber risk analytics and analyses for your organization that
can help you in preparing the new disclosures required by theSEC. These services also provide organizations with a means
to continuously evaluate cyber risk posture and help identify
proactive remediation steps to reduce cyber risk exposure.

Revisit your Incident Response (IR) Plan
An IR plan is more than a potential compliance requirement.
Without a well-structured plan, your organization may not be
equipped to effectively handle a cybersecurity incident.
A robust IR plan can help:
1. Enable quick identification and containment of threats
2. Protect sensitive data
3. Minimize operational downtime
4. Mitigate the financial and reputational repercussionsof a cybersecurity incident
Verizon’s Rapid Response Retainer (RRR) is intended tohelp you reduce the time to respond, limit the scope of anincident and respond more effectively.
Verizon’s Incident Response Plan Assessment reviews
current cybersecurity incident management practices andprovides recommendations to help improve your IR plan.

Evaluate your Risk Management Program
A simple Risk Register is not sufficient to demonstratecommitment to maintaining a strong security posture. Under
the new rules, public companies are required to describe in
their annual reports on Form 10-K their processes for theassessment, identification and management of material risks
from cybersecurity threats. They must also describe whether

Strengthen your vendor risk management process
One of the most daunting tasks for public companies ismanaging vendors, including their access to company-critical
data. An insecure vendor often means your own security isat risk.
Verizon’s Vendor Risk Assessment and Monitoring reviews
your vendors’ risk management practices and provides risk
monitoring of your current vendors’ perceived risk.

Conduct executive simulations
An executive simulation (often referred to as a tabletopexercise) can help test your company’s ability to respond to
an attack. These exercises can often expose gaps in managing
all aspects of an incident—cybersecurity, IT, legal, HR,communications, recovery, and public disclosures, to namea few.
Verizon’s Executive Breach Simulation is custom-crafted toprovide you with an executive-level incident response
simulation. The exercise is often designed to incorporate
facets of real situations encountered in recent investigations,but scenarios can be tailored to meet your needs to help
address specific areas of concern.

1Solution brief

Why Verizon
Over the past 20+ years, our Cyber Security Consulting
organization has conducted tens of thousands of engagements
worldwide, leveraging our expertise to help organizations
create effective incident response plans. As a cybersecurityenhanced network services provider, we can give real-time
visibility into threat patterns, augmented by our deep/dark web
hunters and digital forensics capabilities. The global
penetration testing and red-teaming services of Verizon
complete the cycle to provide a single comprehensive threat
management platform.
The Verizon Threat Research Advisory Center (VTRAC), aspecialized division within our Cyber Security Consultingorganization, helps customers regain control and mitigate
cyber threats from their networks, applications and devices.
VTRAC team members are located across the globe, bringing
together professionals with military, law enforcement and IT
expertise who are well-versed in criminal and civil investigativerequirements. We are also a globally-approved PCI Forensic
Investigator (PFI).

Learn more
For more information about products and services that Verizon
can provide to help assess your cyber risk program and help
respond to cyber incidents, contact your Verizon Businessaccount manager.

© 2023 Verizon. All rights reserved. The Verizon name and logo and all other names, logos and slogans identifying Verizon’s products andservices are trademarks and service marks or registered trademarks and service marks of Verizon Trademark Services LLC or its affiliates
in the United States and/or other countries. All other trademarks and service marks are the property of their respective owners.
VZSB7601223

2