CrowdStrike Outage: A Test of Form PF Current Report Procedures

When faulty code in a software update released by cybersecurity firm CrowdStrike crashed certain computer systems running Microsoft Windows this summer, it caused chaos for airlines, banks, shipping companies, healthcare providers and other organizations. It also was the first large-scale test of certain SEC reporting requirements, including those issued in the December 2023 amendments to Form PF, which oblige large hedge fund advisers to file reports no later than 72 hours after the occurrence of designated trigger events, such as a significant disruption of “critical operations.” This article summarizes the Form PF current reporting requirements, discusses the details of the CrowdStrike outage, explains what fund managers should have considered when they determined whether to file a current report and provides key takeaways from the incident. See “A Framework for Materiality Determinations Under SEC’s Cyber Incident Disclosure Rules” (Jul. 10, 2024).

To read the full article

Continue reading your article with a CSLR subscription.