Contacting the FBI does not pause an SEC filing deadline. For a qualifying delay, the Attorney General—not the FBI or the company—must determine that disclosure poses a substantial risk to national security or public safety and notify the SEC in writing. The FBI’s guidance urges companies to reach out early so officials can assess the facts while the company continues its own materiality analysis.
What the SEC deadline requires
For a domestic SEC registrant, a cybersecurity incident that is material generally must be reported on Form 8-K, Item 1.05, within four business days after the company determines the incident is material. The four-day period does not start automatically when the incident is discovered. But the company must make its materiality determination without unreasonable delay after discovery; it cannot defer the decision simply to buy time.
Item 1.05 calls for material information about the incident’s nature, scope and timing, and its material or reasonably likely material impact, including on the company’s financial condition and results of operations. The rule does not require technical detail about planned response or systems at a level that would impede response or remediation. The SEC’s small-entity compliance guide describes the reporting requirements.
The SEC adopted the rule on July 26, 2023; it became effective September 5, 2023. The rule covers domestic registrants and foreign private issuers subject to Exchange Act reporting requirements, with specified exclusions, and also covers business development companies. The Form 8-K deadline described here applies to domestic registrants. Foreign private issuers furnish incident disclosure on Form 6-K promptly after the incident is disclosed or publicized, or required to be disclosed or publicized, in a foreign jurisdiction, to a stock exchange or to security holders.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
#1 Best Overall
Ordinary reporting and an authorized delay are different paths
| Question | Ordinary reporting | Potential delay |
|---|---|---|
| What starts the process? | Discovery leads to a prompt materiality assessment; once the domestic registrant determines the incident is material, the four-business-day filing period begins. | The company believes that disclosure within the ordinary timeframe could create the qualifying national-security or public-safety risk and promptly contacts the FBI. |
| Who decides? | The registrant assesses whether the incident is material and makes its filing. | The Attorney General must determine that disclosure poses a substantial risk to national security or public safety. |
| What communication is required? | File Form 8-K, Item 1.05, by the applicable deadline. | The Attorney General must notify the SEC in writing. FBI contact or a request alone is not that notice. |
| How long? | Four business days after the materiality determination. | An initial period of up to 30 days; a further period of up to 30 days if the risk continues; and, in extraordinary circumstances, a final additional period of up to 60 days if disclosure continues to pose a substantial risk to national security. The SEC may consider further relief through an exemptive order. |
These are not alternatives a company may choose between on its own. Under the SEC’s final rule, Release No. 33-11216, only the Attorney General can make the determination that qualifies for a delay and provide the required written notice.
What the FBI and DOJ ask companies to do
Contact the FBI early
The FBI encourages a company to contact it soon after the company believes that disclosure of a newly discovered incident may create the qualifying risk. Contact may be direct or through the U.S. Secret Service, another federal law-enforcement agency, CISA or another sector risk management agency. The FBI recommends publicly traded companies establish a relationship with the cyber squad at their local FBI field office.
Early discussion can happen before the company reaches a materiality decision. The FBI says government engagement does not itself trigger that decision. It also says requests for delay will not be processed unless they reach the FBI immediately upon the company’s determination to disclose the incident via an 8-K. Early outreach is therefore practical preparation, not approval to miss a filing deadline.
Give officials the facts tied to disclosure risk
DOJ’s December 12, 2023 guidance says a registrant that believes disclosure may create the qualifying risk should contact the FBI immediately, directly or through another U.S. government agency, and provide a concise description of the supporting facts. The key facts are about what disclosure within the normal reporting timeframe could cause—not simply how serious the incident is.
Recommended Free Tools
The FBI documents the facts and coordinates relevant government review before referring a request to DOJ. The Attorney General must invoke the delay provision within four business days after the registrant’s materiality determination. That short statutory window is why companies should not wait for their investigation to be complete before making early contact if the disclosure risk appears plausible.
The risk test is about harm from disclosure
DOJ describes the primary inquiry as whether public disclosure of the cybersecurity incident threatens public safety or national security, rather than whether the incident itself is dangerous. Public disclosure often benefits investors, public safety and national security; in many cases, a company may be able to describe material information at a level of generality that avoids the qualifying risk.
DOJ gives limited examples of circumstances that may warrant consideration:
- Disclosure could expose an unmitigated vulnerability and lead to additional incidents.
- Disclosure could reveal sensitive U.S. government information or systems to further exploitation.
- Disclosure could undermine active remediation involving critical infrastructure or a critical system.
- A government agency identifies a risk and coordinates with the registrant about it.
These are examples in DOJ guidance, not an exhaustive checklist or assurance that a delay will be granted. The fact that an incident is serious, sensitive or under investigation does not by itself satisfy the standard.
Free tools Windows power users keep installed
One-click scans. No signup required.
What happens if there is no decision by the filing deadline?
The SEC staff’s Form 8-K compliance and disclosure interpretations make clear that submitting a request does not change the filing obligation. Unless the Attorney General has made the required determination and notified the SEC in writing before the filing would otherwise be due, the company must meet the ordinary deadline. If the request is denied—or no decision arrives before that deadline—the normal clock remains in force.
If an authorized delay expires without an extension, the company generally must file within four business days after the delay period ends. If the Attorney General notifies the SEC and the registrant earlier that disclosure no longer poses the qualifying risk, the filing is due within four business days of that notification.
SEC staff also distinguish consultation from the company’s own assessment: contacting government officials does not itself make an incident material or relieve the registrant of assessing materiality without unreasonable delay. Nor must the company finish a law-enforcement conversation before starting that assessment. The practical approach is parallel work: assess materiality promptly and communicate early if disclosure itself may create the specified risk.
Practical checklist for a company facing a possible disclosure risk
- Start the materiality assessment promptly. Do not treat discovery, FBI contact or an unfinished investigation as a reason to postpone the decision.
- Contact the FBI immediately if disclosure may create the qualifying risk. Use the FBI directly or an identified government channel, and provide concise facts about the consequences of disclosure within the ordinary timeframe.
- Keep preparing the required filing. A discussion, request or pending review is not a pause; track the four-business-day deadline from the materiality determination.
- Confirm whether the legal conditions for delay have actually been met. A delay requires the Attorney General’s determination and written notice to the SEC before the ordinary filing deadline.
- Track the end of any authorized period and any notice that risk has ended. The relevant filing deadline may then run from the end of the delay or from the earlier notification.
The rule and agency procedures are time-sensitive legal obligations. For a live filing decision, consult current SEC and DOJ guidance and qualified counsel.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
