The Securities and Exchange Commission (SEC) Cybersecurity Disclosure Rule requires public companies to disclose material cybersecurity incidents on Form 8-K within four business days of determining materiality. Under Regulation S-K Item 106, registrants must also describe their risk management processes and board oversight regarding cybersecurity threats in annual Form 10-K filings.
This publication provides informational analysis and does not constitute legal advice. Public reporting entities should consult securities counsel for materiality determinations.
How do registrants determine materiality under Form 8-K Item 1.05?
Materiality is determined based on whether a reasonable investor would consider the incident information important in making an investment decision. Per guidance issued by the SEC Division of Corporation Finance, companies must evaluate quantitative financial impacts alongside qualitative factors, such as reputational harm and customer data loss.
| Filing Requirement | Reporting Trigger | Mandated Disclosure Content |
|---|---|---|
| Form 8-K Item 1.05 | Materiality determination date | Scope, nature, timing, and material impact of cybersecurity incident |
| Form 10-K Item 106(b) | Annual report deadline | Processes for identifying, assessing, and managing material risks |
| Form 10-K Item 106(c) | Annual report deadline | Board oversight and management expertise in cybersecurity risk |
Under what narrow conditions can incident disclosure be delayed?
Disclosure may be delayed only if the U.S. Attorney General determines in writing that public disclosure would pose a substantial risk to national security or public safety. The initial delay period is limited to 30 days under SEC Release No. 33-11216.
What this means in practice
- Formalize materiality frameworks: Establish multi-disciplinary committees involving legal, IT, and executive leadership to make rapid materiality decisions.
- Document determination dates: Maintain clear records establishing the exact date and time an incident was evaluated for materiality.
- Align Form 10-K governance disclosures: Audit board oversight charters to ensure annual disclosures accurately reflect executive oversight protocols.