SEC Cybersecurity Disclosure Rules: Form 8-K Item 1.05 and 10-K Item 106 Guide

Last updated: 22 October 2026

Quick answer: The SEC’s cybersecurity disclosure rules, adopted in July 2023, have two parts. Form 8-K Item 1.05 requires US-listed companies to disclose a material cybersecurity incident within four business days of determining that it is material. Regulation S-K Item 106 requires an annual description in Form 10-K of how the company identifies and manages cybersecurity risk and how its board and management oversee it.

The rules turned cybersecurity into a disclosure subject. A breach may now start a regulatory clock, and the decision on whether it is material has to be made, recorded and defended.

For most companies the hard part is not drafting the Form 8-K but the process before it: getting facts to the right people quickly, applying a consistent materiality standard, and recording why an incident was or was not disclosed. This guide explains what Item 1.05 and Item 106 require, the compliance dates, the rules for foreign private issuers, the SEC staff’s 2024 guidance on voluntary filings, and how to build a materiality assessment process that holds up under scrutiny.

What are the SEC cybersecurity disclosure rules?

They are a set of amendments the SEC adopted on 26 July 2023 in its release “Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure” (Release No. 33-11216). They apply to companies that report to the SEC under the Securities Exchange Act of 1934.

The rules add three main requirements:

• Form 8-K Item 1.05: current reporting of material cybersecurity incidents.
• Regulation S-K Item 106: annual disclosure in Form 10-K of cybersecurity risk management, strategy and governance.
• Parallel requirements for foreign private issuers: Form 6-K for material incidents and Form 20-F Item 16K for annual disclosure.

The rules define a cybersecurity incident as an unauthorised occurrence, or a series of related unauthorised occurrences, on or conducted through a registrant’s information systems that jeopardises the confidentiality, integrity or availability of those systems or the information in them. The “series of related occurrences” wording matters: several small incidents by the same actor, or exploiting the same weakness, may together be material even if none is material alone.

When did the rules take effect?

Annual disclosures applied first, to 10-K reports for fiscal years ending on or after 15 December 2023; incident reporting under Item 1.05 started on 18 December 2023, with smaller reporting companies given until 15 June 2024.

The disclosures must also be tagged in Inline XBRL, which was phased in one year after the dates above. By late 2026 every requirement is fully in force.

In practice: the SEC can amend or reinterpret rules, and its staff publish compliance and disclosure interpretations (C&DIs) on Item 1.05. Check the SEC website for current guidance before relying on any summary, including this one.

What does Form 8-K Item 1.05 require?

If a company determines that a cybersecurity incident is material, it must file an Item 1.05 Form 8-K within four business days of that determination, describing the material aspects of the incident and its material or reasonably likely material impact.

What must the filing say?

Item 1.05 asks for:

• the material aspects of the nature, scope and timing of the incident; and
• the material impact, or reasonably likely material impact, on the company, including its financial condition and results of operations.

The focus is on impact, not technical detail. A company does not need to disclose specific technical information about its planned response, or about its systems, networks, devices or potential vulnerabilities, in a level of detail that would impede its response or remediation.

When does the four-day clock start?

The clock starts on the date of the materiality determination, not the date the incident was discovered. However, the instructions require the company to make that determination without unreasonable delay after discovery. Deliberately slowing an investigation, or waiting until every fact is known, is not a safe way to postpone the deadline.

If the record shows the incident was escalated promptly, assessed against a defined standard and decided at a specific meeting, the determination date is easy to support. If the decision emerged from scattered emails, it is not.

What if information is not yet available?

A company does not have to wait for complete information before filing. If required information has not been determined or is unavailable when the Form 8-K is due, the company must say so in the filing, then file an amendment (Form 8-K/A) containing that information within four business days after it is determined or becomes available.

Can disclosure be delayed for national security reasons?

Yes, but only in narrow circumstances. Disclosure can be delayed if the US Attorney General determines that it would pose a substantial risk to national security or public safety and notifies the SEC in writing. The initial delay is up to 30 days; it can be extended by a further 30 days, and in extraordinary circumstances by an additional 60 days, with further extension possible only through SEC exemptive relief.

The company cannot grant itself this delay; requests go through the Department of Justice, which with the FBI has published guidance on making them. A separate, short delay exists for companies subject to the Federal Communications Commission’s rule on breaches of customer proprietary network information.

Common mistake: assuming that contacting law enforcement pauses the Item 1.05 deadline. It does not, unless and until the Attorney General makes the determination and notifies the SEC.

What happens if a filing is late?

An untimely Item 1.05 filing does not, by itself, cost a company its Form S-3 eligibility or create Rule 10b-5 liability. That is a limited safe harbour, not a licence to file late: the SEC can still take enforcement action, and misleading statements remain actionable.

Item 1.05 or Item 8.01: what did the SEC staff clarify in May 2024?

In May 2024, the Director of the SEC’s Division of Corporation Finance issued a statement saying Item 1.05 should be reserved for incidents the company has determined to be material, and that other incidents a company chooses to disclose should go under a different item, such as Item 8.01 (Other Events).

The statement responded to early precautionary Item 1.05 filings for incidents that had not been determined to be material, which the staff felt could confuse investors. In practice:

• Material incident: file under Item 1.05 within four business days of the determination.
• Not yet determined, or immaterial, but you want to disclose: use Item 8.01 voluntarily. If the incident is later determined to be material, file an Item 1.05 Form 8-K within four business days of that later determination.
• Immaterial and no reason to disclose: no Form 8-K is required, but keep a record of the assessment.

In June 2024 the staff added a further statement making clear that companies may share information about an incident privately with peers, vendors or others, but should keep the Regulation FD selective disclosure rules in mind.

What does Regulation S-K Item 106 require in the 10-K?

Item 106 requires an annual description, in Item 1C of Form 10-K, of the company’s cybersecurity risk management and strategy and of its cybersecurity governance at board and management level.

Risk management and strategy: Item 106(b)

Companies must describe their processes for assessing, identifying and managing material risks from cybersecurity threats in enough detail for a reasonable investor to understand them. The rule lists matters to address, including:

• whether and how the processes are integrated into the company’s overall risk management system;
• whether the company engages assessors, consultants, auditors or other third parties in connection with those processes;
• whether it has processes to oversee and identify cybersecurity risks associated with its use of third-party service providers; and
• whether any risks from cybersecurity threats, including from previous incidents, have materially affected or are reasonably likely to materially affect the company, including its business strategy, results of operations or financial condition.

A recognised framework helps here. Many companies describe their programme with reference to the NIST Cybersecurity Framework, whose 2.0 version added a dedicated Govern function. Our guide to the NIST CSF 2.0 governance tier explains how it maps to board-level oversight. Third-party oversight is also easier to describe when you run a defined vendor and third-party management process with documented assessments.

Governance: Item 106(c)

Companies must describe:

• Board oversight: the board’s oversight of risks from cybersecurity threats, including any board committee or subcommittee responsible, and the processes by which the board or committee is informed about those risks.
• Management’s role: which management positions or committees are responsible for assessing and managing material cybersecurity risks, and the relevant expertise of those people; how they are informed about and monitor the prevention, detection, mitigation and remediation of incidents; and whether they report to the board or a board committee.

The proposed rule would have required disclosure of directors’ cybersecurity expertise. The final rule dropped that requirement, but expertise of the management personnel responsible for cybersecurity is still covered.

In practice: Item 106 describes what you actually do. If the 10-K says the audit committee receives quarterly cybersecurity reports, the minutes should show it. Describing an idealised programme creates risk, as our guide to avoiding misleading SEC disclosures explains.

How do the rules apply to foreign private issuers?

Foreign private issuers follow parallel rules: annual disclosure in Form 20-F under Item 16K, and incident disclosure on Form 6-K rather than Form 8-K.

Item 16K mirrors Item 106 on risk management, strategy and governance. The Form 6-K requirement is triggered differently from Item 1.05: a foreign private issuer must furnish information on material cybersecurity incidents that it discloses or is required to disclose in its home jurisdiction, to a stock exchange on which its securities trade, or to its security holders. There is no separate four-business-day test; timing follows the general Form 6-K rules.

How do you decide whether a cybersecurity incident is material?

The SEC applies the standard securities-law test: information is material if there is a substantial likelihood that a reasonable shareholder would consider it important in making an investment decision, or if it would significantly alter the total mix of information available.

The SEC did not set a numerical threshold, and the adopting release makes clear that the assessment must consider qualitative as well as quantitative factors. A small direct cost can still be material.

Repeat the assessment as facts change. An incident judged immaterial on day two may become material on day twenty, and that later determination starts its own four-day clock.

How do you build a materiality assessment committee?

Form a small cross-functional group with authority to decide, a written charter, defined escalation triggers and a documented method, and connect it to your existing disclosure controls.

Some companies create a dedicated cybersecurity materiality committee; others fold the role into their existing disclosure committee. Either works if the people, triggers, method and record are clear.

Who should sit on it?

• CISO or head of security: facts about the incident, scope and containment.
• General counsel or securities counsel: legal analysis of materiality and disclosure obligations.
• CFO or chief accounting officer: financial impact and links to financial reporting.
• Chief risk officer or head of enterprise risk: connection to the risk register and risk appetite.
• Investor relations and communications: consistency of public statements.

Name deputies for each role: a four-day deadline leaves no room for an absent decision-maker.

Step-by-step: setting up the process

1. Write a charter. Define the committee’s authority, members, quorum, how decisions are made and how the board is informed.
2. Set escalation triggers. Agree in advance which incident severities, data types or affected systems must be escalated to the committee, and how fast. Link the triggers to your incident response plan.
3. Define the method. Create a standard materiality assessment template covering the quantitative and qualitative factors above, and align it with your risk appetite statement so thresholds are consistent with how the board already thinks about risk.
4. Connect to the risk register. Cybersecurity risks in your enterprise risk register should inform both incident assessments and the Item 106 description.
5. Prepare drafts. Keep pre-approved Item 1.05 and Item 8.01 templates, and a timeline for legal review and filing.
6. Test it. Run tabletop exercises at least annually (see below).
7. Review after each incident. Record lessons learned and update the charter, triggers and templates.

What evidence should you keep for each materiality decision?

Keep a dated record for every escalated incident, including those judged not material, that shows what was known, who decided, what standard was applied and why.

Decisions not to disclose are the ones most likely to be questioned later. A complete record typically includes:

• the date and time of discovery, escalation and each committee meeting;
• the facts known at each point, and their sources;
• the completed materiality assessment, with quantitative and qualitative factors;
• whether the incident is related to earlier incidents, so aggregation can be considered;
• the decision, the rationale and the people who made it;
• triggers that would prompt a reassessment, and the date of any reassessment;
• drafts and final versions of any filing.

Store this alongside the incident record rather than in personal mailboxes. A document repository with evidence management keeps minutes, assessments and approvals with a version history, and an incident and data breach management module can hold the incident register, impact assessment and reporting timeline in one place. Internal audit teams increasingly test this evidence too, as covered in our article on the IIA cybersecurity topical requirement.

How should you run a tabletop exercise for SEC disclosure?

Use a realistic scenario, involve the full materiality committee rather than only the security team, and test the decision and filing steps as well as the technical response.

A useful disclosure-focused exercise covers:

• Escalation: how long the incident takes to reach the committee.
• Ambiguity: injects that change the facts mid-exercise, such as evidence of data exfiltration discovered after an initial “contained” assessment.
• The decision: the committee applies the materiality template and records a determination.
• The clock: mapping four business days from the determination, including drafting and review of the Form 8-K.
• Choice of item: whether a voluntary Item 8.01 disclosure is appropriate if materiality is not yet determined.
• Third parties: an incident at a cloud or software vendor, where facts arrive slowly and from outside.

Record the outcome, actions and owners, and track the actions to closure. The record also supports the Item 106 description of how management monitors cybersecurity.

How can GRC software support SEC cybersecurity disclosure?

GRC software does not decide materiality for you, but it can make the process faster, consistent and documented.

Look for an incident register with impact assessments and timestamps, a risk register linked to controls, evidence storage with version history, task management and dashboards for board reporting. Enactia’s Enterprise Risk Management and Incident & Data Breach Management modules cover these, alongside frameworks such as NIST CSF and SOC 2.

When comparing tools, ask whether the platform can show an auditor the full history of an incident decision. For a wider view of US requirements such as SOC 2, HIPAA, SOX and state privacy laws, see our guide to GRC software for US companies.

Frequently asked questions

How many days do companies have to report a cybersecurity incident to the SEC?
Four business days from the date the company determines the incident is material, under Form 8-K Item 1.05. The determination itself must be made without unreasonable delay after discovery. Missing information can be filed later in a Form 8-K/A within four business days of it becoming available.

Do immaterial cybersecurity incidents need to be disclosed?
No Form 8-K is required for an incident that is not material. Companies may disclose it voluntarily, and SEC staff guidance from May 2024 says such disclosures should use another item, such as Item 8.01, rather than Item 1.05. You should still keep a record of the assessment and consider whether related incidents are material together.

Where does the Item 106 disclosure appear?
In Item 1C of the annual report on Form 10-K. It covers cybersecurity risk management and strategy, board oversight and management’s role. Foreign private issuers provide equivalent disclosure in Form 20-F under Item 16K.

Can a company delay an Item 1.05 filing?
Only if the US Attorney General determines that disclosure would pose a substantial risk to national security or public safety and notifies the SEC in writing. The initial delay is up to 30 days, with limited extensions. A company cannot delay on its own initiative, and an ongoing investigation alone is not grounds for delay.

Do the rules require directors with cybersecurity expertise?
No. The final rules dropped the proposed disclosure of board cybersecurity expertise. Companies must still describe how the board oversees cybersecurity risk and the relevant expertise of the management personnel responsible for it.

Making SEC cybersecurity disclosure repeatable

The SEC rules reward preparation. With defined escalation triggers, a standing materiality committee, a consistent method and a complete evidence trail, companies can meet the four-day deadline and explain their decisions afterwards. The same records keep the annual Item 106 description accurate.

To see how Enactia can hold your incident records, risk register and committee evidence in one place, contact us or book a demo or start your 14-day free trial.

This article is for general information and is not legal advice.