Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11SEC-reporting companies do not have to disclose every cyber incident. A domestic registrant must report a cybersecurity incident on Form 8-K Item 1.05 when it determines the incident is material, generally within four business days of that determination. The company must make the materiality decision without unreasonable delay after discovering the incident. SEC Corporation Finance staff later clarified how voluntary reports and additional communications fit alongside that binding rule; those staff statements are nonbinding.
Which companies and filings do the rules cover?
The SEC adopted cybersecurity disclosure rules on July 26, 2023, covering domestic registrants and foreign private issuers subject to Exchange Act reporting, as well as business development companies. The filing route depends on the issuer type:
| Issuer | Material incident disclosure | Annual cybersecurity disclosure |
|---|---|---|
| Domestic registrant | Form 8-K, Item 1.05, after determining an incident is material | Form 10-K under Regulation S-K Item 106 |
| Foreign private issuer | Form 6-K promptly after the incident is disclosed or otherwise publicized, or required to be disclosed or publicized, in a foreign jurisdiction, to an exchange, or to security holders | Form 20-F |
The SEC’s rule-adoption announcement and compliance guide describe the requirements. The four-business-day Item 1.05 clock applies to domestic registrants; the Form 6-K trigger for foreign private issuers is framed around disclosure or publication, not that same materiality-decision clock.
When does a domestic registrant have to file Item 1.05?
The filing deadline is four business days after the registrant determines that the incident is material—not four business days after discovery. The company must make that determination without unreasonable delay after discovery. Materiality follows the familiar reasonable-investor and total-mix standard; the rule does not set a single dollar-loss threshold.
#1 Best Overall
The SEC’s Form 8-K Compliance and Disclosure Interpretations address common edge cases:
- The incident has ended: A company still must assess materiality if a disruption stops before the decision is made.
- Data was restored or a ransom was paid: Those developments do not, by themselves, remove the need to assess materiality or cancel the deadline once an incident has been determined material.
- Several related incidents occurred: A series of related unauthorized occurrences may need to be considered together rather than only one event at a time.
- There is no quantified loss: Materiality can involve qualitative effects, including reputational harm, not just a numeric measure.
What must the incident filing say?
Item 1.05 calls for the material aspects of the incident’s nature, scope, and timing, along with its material or reasonably likely material impact. The impact disclosure includes effects on financial condition and results of operations. A company need not expose technical response details or vulnerability information at a level that would impede its response or remediation.
If a required impact detail has not been determined or is unavailable when the company files, the Form 8-K instructions require it to say so. The registrant must then amend the filing within four business days after that information is determined or becomes available. The SEC’s compliance guide summarizes these content and amendment requirements.
What did SEC staff clarify about voluntary disclosure?
In a May 21, 2024 statement, Erik Gerding, Director of the Division of Corporation Finance, explained that Item 1.05 is for incidents the registrant determines are material. Staff recommends that a company choosing to disclose an incident before making that determination—or one it determines is immaterial—use Item 8.01 or another appropriate Form 8-K item instead. The aim is to avoid confusing investors about whether the company has made a materiality determination.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →This is staff guidance, not a change to the rule. Gerding said the clarification was not intended to discourage voluntary disclosure of incidents that have not yet been assessed or that are found immaterial. An issuer that first reports under Item 8.01 must still determine materiality without unreasonable delay. The SEC’s May 2024 statement expressly says it has no legal force or effect and creates no new obligations.
| Incident status | Filing approach | What follows |
|---|---|---|
| Determined material | Item 1.05 | File within four business days of the determination, subject to the limited national-security or public-safety delay. |
| Not yet assessed, but the company elects to disclose | Staff recommends Item 8.01 or another appropriate item rather than Item 1.05 | Make the materiality determination without unreasonable delay. |
| Determined immaterial, but the company elects to disclose | Staff recommends Item 8.01 or another appropriate item rather than Item 1.05 | The voluntary disclosure does not turn the incident into a material one. |
Can a company share more information outside its SEC filing?
Yes. A June 20, 2024 Division of Corporation Finance staff statement says the rules do not prohibit additional incident communications, including information shared with commercial counterparties. That statement is a staff view, not a binding rule. Companies should separately consider Regulation FD when sharing material nonpublic information selectively with covered market professionals or shareholders. See the SEC staff’s June 2024 statement.
Is there a delay for national security or public safety?
The final rule permits a limited delay when the Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the SEC in writing. If the Attorney General later ends the delay, the SEC’s Form 8-K interpretations say the issuer must file within four business days after notice is given to both the SEC and the registrant. This is a narrow exception, not a general extension for incident response or incomplete investigation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What must companies disclose annually?
Under Regulation S-K Item 106, a domestic registrant’s Form 10-K describes its processes, if any, for assessing, identifying, and managing material cybersecurity risks; material or reasonably likely material effects of those risks and prior incidents; the board’s oversight; and management’s role and relevant expertise. Foreign private issuers provide corresponding annual disclosures in Form 20-F.
Recommended Free Tools
The rules also require Inline XBRL tagging. The SEC compliance guide set December 18, 2024, for incident-disclosure tagging and applied annual-disclosure tagging to fiscal years ending on or after December 15, 2024. Those dates have passed; smaller reporting companies received additional time before beginning incident-disclosure compliance. Entity-specific obligations should be checked against the applicable rule and current filing instructions. EDGAR added Item 1.05 to Form 8-K and related forms in its December 18, 2023 update, as noted in the EDGAR Release 23.4 announcement.
How to read the clarifications
The underlying Commission rules and form instructions establish the filing obligations. The Division of Corporation Finance’s 2024 statements explain staff’s views on voluntary reporting and additional communications, but expressly do not have legal force or effect. The Form 8-K interpretations are also staff interpretations, not a substitute for the rule text or legal advice. For current filing decisions, consult the applicable SEC requirements and qualified counsel.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
