iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A public company generally has four business days to file Form 8-K Item 1.05 after it determines that a cybersecurity incident is material. The company must make that materiality determination without unreasonable delay after discovering the incident. The clock does not automatically start at the first sign of a breach, but delaying the decision can itself create compliance risk.
The SEC’s 2023 rules also require periodic disclosures about cybersecurity risk management, strategy and governance. In practice, companies struggle to turn incomplete technical investigations into specific, decision-useful statements about business impact while protecting details that could make remediation harder.
What the SEC’s 2023 rules require
The SEC adopted the rules on July 26, 2023. Most registrants became subject to the Form 8-K Item 1.05 incident-disclosure requirement on December 18, 2023.
| Requirement | What it covers | Timing |
|---|---|---|
| Form 8-K Item 1.05 | A material cybersecurity incident’s nature, scope and timing, plus its material or reasonably likely material impact on the registrant, including financial condition and results of operations. | File within four business days after the registrant determines the incident is material. |
| Regulation S-K Item 106 | Periodic-report disclosures about cybersecurity risk-management processes, strategy and governance. | Included in the company’s applicable periodic reports. |
Inline XBRL tagging for material cybersecurity incident disclosures in Form 8-K and Form 6-K was required by December 18, 2024.
#1 Best Overall
When the four-business-day clock starts
Materiality, not discovery, starts the filing period
The four-business-day period begins when the registrant determines that the incident is material. Discovery starts the internal assessment, not an automatic filing deadline. The materiality decision itself must be made without unreasonable delay after discovery.
A narrow national-security or public-safety delay
The SEC permits a limited delay when the Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety. That exception is not a general extension for an incomplete investigation.
Later facts can require an amendment
An initial filing may not contain information that was unavailable when the company filed. If material facts become known later, the company may need to amend its Form 8-K. A fast initial filing therefore has to be accurate about what is known while leaving room to update the record.
Recommended Free Tools
What Item 1.05 must describe
Nature, scope and timing
The filing should explain what happened, the affected scope and the relevant timing in terms investors can understand. It is not enough to label an event a “cyber incident” without describing its material characteristics.
Actual or reasonably likely impact
The company must address the incident’s material impact, or reasonably likely material impact, on the registrant. That analysis includes effects on financial condition and results of operations. Operational disruption, lost revenue, additional costs, customer or supplier effects, regulatory consequences and other qualitative effects may all matter to the determination.
Technical details that may be withheld
The adopting release does not require specific technical information about planned response, systems, networks, devices or vulnerabilities when providing it in detail could impede response or remediation. That protection does not excuse the company from explaining material business consequences. A filing can omit exploitable technical particulars while still giving investors a concrete account of scope, timing and impact.
Related incidents must be assessed together
Several events that appear immaterial individually may be material in combination. Companies should examine whether occurrences are related by time, form, actor or exploited vulnerability and whether their collective quantitative or qualitative effect is material.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWho decides whether an attack is material?
Materiality is a company disclosure decision, not a determination made by the CISO alone. The CISO and technical teams often have the earliest access to incomplete facts, while legal, finance, investor relations, senior management, the board and the disclosure committee evaluate securities-law significance and business impact.
SEC staff recommends active discussions among CISOs, cybersecurity experts and technologists, the disclosure committee and the people advising the company on securities-law compliance. The staff’s director, Erik Gerding, described the need to “foster conversations among chief information security officers, the company’s other cybersecurity experts and technologists, the company’s disclosure committee, and those responsible for advising them on securities law compliance.”
A company may alert similarly situated companies or government actors before completing the materiality determination when doing so does not unreasonably delay the internal process. Information sharing and the disclosure decision are separate tracks.
Why filings remain vague
The CISO is expected to support a legal and financial judgment while the investigation is still changing. Early facts may identify affected systems but not yet quantify revenue loss, restoration costs, customer impact or the likelihood of recurrence. Internal teams may also fear that detailed wording will expose vulnerabilities or prejudice remediation.
Evidence of the resulting disclosure gap comes from BreachRx’s 2024 analysis, as reported by Axios: only 16.9% of public 8-K cyber-incident filings in that analysis provided specific details about material impact on the business, and 48% provided any specifics about how the organization was responding to an ongoing incident. Those figures measure the detail in the filings studied; they do not establish that every company in the sample violated the rule.
Best Value
Vagueness becomes especially risky when it replaces an impact analysis with generic statements such as “the company is investigating” or “no material impact is known at this time” without explaining the basis, affected operations or reasonably likely consequences.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.A practical cross-functional workflow
- Detect and preserve facts. Open an incident record, preserve logs and evidence, and record discovery time, known systems, affected data and containment actions.
- Assign a disclosure owner. Bring the CISO or incident commander together with securities counsel, finance, investor relations, the disclosure committee and appropriate executives.
- Map related occurrences. Link earlier or parallel events by timing, actor, technique, vulnerability, system or business effect before treating each as an isolated event.
- Assess business impact. Document operational interruption, financial effects, customer and supplier consequences, legal or regulatory exposure, reputational effects and reasonably likely future impacts.
- Record the materiality decision. Capture the facts considered, the decision-maker, the decision time and any dissent or unresolved uncertainty. The four-business-day period is measured from this decision.
- Draft and review Item 1.05. State nature, scope, timing and material or reasonably likely material impact. Remove technical details whose disclosure could impede remediation, but do not remove information needed to make the business impact understandable.
- File and maintain the record. File within four business days of the materiality determination, prepare the required Inline XBRL tagging, monitor for material new facts and amend the filing when warranted.
How to judge the quality of a company’s approach
| Evaluation area | Stronger practice | Common weakness |
|---|---|---|
| Speed | Materiality is assessed promptly after discovery, with decision time documented. | The decision waits for a complete forensic investigation. |
| Business-impact analysis | Uses specific operational, financial and qualitative effects, including reasonably likely effects. | Relies on boilerplate and does not explain how the business could be affected. |
| Coordination | CISO, legal, finance, board-level stakeholders and the disclosure committee share a defined process. | Technical and securities-law judgments occur in separate silos. |
| Technical protection | Withholds exploitable response, architecture and vulnerability details while preserving material disclosure. | Uses security concerns to avoid describing material impact at all. |
| Related incidents | Tests whether events are connected and evaluates their combined effect. | Assesses every alert only on a stand-alone basis. |
| Structured reporting | Maintains data and controls needed for Inline XBRL tagging and later amendments. | treats tagging and updates as last-minute filing tasks. |
What companies can leave out—and what they cannot
A company can generally avoid detailed technical information that would reveal exploitable systems, planned response steps, device configurations or vulnerabilities and thereby impede remediation. It cannot use that protection to omit the material aspects of what occurred, when it occurred, how broadly it extended or how it has affected—or is reasonably likely to affect—the business.
The defensible standard is therefore selective specificity: enough factual and financial context for an investor to understand the event’s significance, without a blueprint that would make the incident harder to contain.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
