FBI Guidance to Victims of Cyber Incidents
on SEC Reporting Requirements: Request a Delay
To request a reporting delay, victim companies must contact the FBI directly by filling out the form located at sec8k.ic3.gov or through the U.S. Secret Service, the Cybersecurity and Infrastructure Security Agency, the Department of Defense, or another sector risk management agency.
*Each request must contain all of the following information:
- What is the name of your company?
- When did the cyber incident occur?
- When did you make a determination to disclose a cyber incident via 8k? Include the date, time, and time zone. (Note: Failure to report this information immediately upon determination will cause your delay-referral request to be denied.)
- Are you already in contact with the FBI or another U.S. government agency regarding this incident? If so, provide the names and field offices of the FBI points of contact or information regarding the U.S. government agency with whom you're in contact.
- Describe the incident in detail. Include the following details, at minimum:
- What type of incident occurred?
- What are the known or suspected intrusion vectors, including any identified vulnerabilities if known?
- What infrastructure or data were affected (if any) and how were they affected?
- What is the operational impact on the company, if known?
- Is there confirmed or suspected attribution of the cyber actors responsible?
- What is the current status of any remediation or mitigation efforts?
- Where did the incident occur? Provide the street address, city, and state where the incident occurred.
- Who are your company’s points of contact for this matter? Provide the name, phone number, and email address of personnel you want the FBI to contact to discuss this request.
- Has your company previously submitted a delay referral request or is this the first time? If you have previously submitted a delay request, please include details about when DOJ made its last delay determination(s), on what grounds, and for how long it granted the delay (if applicable).