SEC Cybersecurity Disclosure Rule 1.05(c): Item 1.05(c): delay only on the Attorney General's written determination

Filing may be delayed only if the U.S. Attorney General determines that the disclosure poses a substantial risk to national security or public safety and notifies the Commission in writing: first for up to 30 days after the report was due, then a further 30 days on a renewed determination, and in extraordinary circumstances a final 60 days for national security; beyond that the Commission may act by exemptive order. Requesting a delay changes nothing: if the Attorney General declines or does not respond, the report is due four business days after the materiality determination (C&DI 104B.01); after a delay ends without extension, four business days after its expiry (104B.02); if the Attorney General withdraws the determination, four business days after notice (104B.03). The Department of Justice procedure routes requests through the FBI as early as possible, before the materiality analysis is complete.