IPO Cyber Readiness: Disclosure, Controls and Investor Scrutiny

A company preparing to list has to turn an informal security function into one that can survive prospectus liability, auditor testing and public disclosure deadlines, often over the 18 to 24 months before listing (an NHI Mgmt Group planning estimate, not a regulatory figure) and while it becomes a more attractive target. The obligations arrive in stages: cyber risk factors in the registration statement, disclosure controls that can make a materiality call in days, IT general controls that auditors will test, and annual governance disclosure once the company is reporting. This guide sets out what changes at each stage of an IPO and how to build the security evidence before the bankers and auditors ask for it. It is written for CISOs, CFOs, general counsel and security leads at private companies preparing for a US or UK listing. The detail of the SEC's Form 8-K Item 1.05 and Item 106 rules is in the SEC Cybersecurity Disclosure Rules Guide, and board-level questions are in the SEC Cyber Disclosure Executive Briefing; this page covers the path to listing.

Source note: SEC and FRC requirements below are summarised from the Federal Register, eCFR, SEC and FRC pages listed in the references, as checked in November 2026. This is not legal advice. Confirm against the official text before relying on it.

Key takeaways

• The prospectus is the first cyber disclosure, and it carries liability. The SEC did not extend Item 106 to registration statements, but it repeated that companies must consider the materiality of cyber risks and incidents when preparing them.
• Disclosure controls are the real readiness test. From the first day of trading a material incident has to be assessed and, if material, reported on Form 8-K generally within four business days of that determination.
• SOX gives a short runway, not an exemption. Newly public companies need not include management's internal control report in their first annual report, and emerging growth companies are exempt from auditor attestation, but auditors test IT general controls from the start.
• Do not describe what happened as hypothetical. Risk factors must match known incidents; the SEC has penalised companies for framing realised risks as possibilities.
• Identity controls carry most of the audit weight. Access to financial systems, privileged accounts and the service accounts that move financial data are where ITGC testing concentrates.

What changes when a company goes public

For a UK listing, companies in the commercial companies category of the UK Listing Rules apply the UK Corporate Governance Code on a comply or explain basis. The FRC says the 2024 Code applies to financial years beginning on or after 1 January 2025, and its Provision 29, a board declaration on the effectiveness of material internal controls, applies to financial years beginning on or after 1 January 2026. Boards decide which controls are material; for most technology-dependent businesses that analysis will cover some cyber and access controls.

Stage 1: the registration statement

When the SEC adopted its 2023 cyber rules it declined an Investor Advisory Committee recommendation to require Item 106 disclosure in registration statements, while reiterating its 2018 guidance that companies should consider the materiality of cyber risks and incidents when preparing them. That 2018 interpretive release (33-10459) notes that registration statements must not omit material facts, and that a company that learns of a material cyber risk or incident should disclose it in time, before the offer and sale of securities.

Writing the cyber risk factors

• Be specific to the business: Item 105 discourages risks that could apply generically to any registrant, and places such risks at the end under "General Risk Factors". A good cyber risk factor names the company's own exposure: dependence on a cloud provider, customer data volumes, regulated data types, payment flows, software supply chain.
• Reconcile with the incident record: every prior incident, including those handled quietly, should be reviewed by counsel against the draft wording. If something has already happened, do not write that it "could" happen.
• Keep evidence behind each claim: if the draft says the company encrypts data, uses MFA or tests its incident response plan, security should hold the evidence that this is true for the whole estate, not a pilot.
• Check consistency: the same facts appear in customer security questionnaires, SOC 2 reports and the trust page. Contradictions are easy for diligence teams and plaintiffs to find. See the How to Read a SOC 2 Report Guide.

Due diligence by underwriters and counsel

Underwriters' counsel will ask for policies, the incident log, penetration test results, audit reports and board materials. Prepare a single, version-controlled evidence set rather than answering questionnaires ad hoc. Share findings through counsel where privilege matters, and keep a list of who received what, because the IPO itself is confidential information that attackers and insiders would value.

Stage 2: disclosure controls for incidents

The 2018 guidance says disclosure controls should let a company identify cyber risks and incidents, assess their impact and judge their significance, with open communication between technical experts and disclosure advisers. After listing, the decision has a deadline: Form 8-K Item 1.05 requires disclosure generally within four business days of determining that an incident is material, and the determination must be made without unreasonable delay after discovery.

1. Define the escalation path in writing. Severity criteria in the incident response plan that send potentially material incidents to a named disclosure committee, typically the general counsel, CFO, CISO and investor relations lead. See the Incident Response Plan Template.
2. Build a materiality worksheet. Quantitative and qualitative factors agreed with counsel in advance: data types and volumes, operational outage, customer and regulatory consequences, reputational impact. Cyber risk quantification helps here; see the Cyber Risk Quantification Guide.
3. Record the decision. Who decided, when, on what information. The clock runs from the determination, and the record shows it was made without unreasonable delay.
4. Close the trading window. The 2018 guidance says companies should consider whether and when to restrict insider trading while an incident is investigated. Link the incident process to the insider trading policy so that the disclosure committee can trigger a blackout.
5. Control selective disclosure. Material nonpublic information about an incident must not reach analysts or large holders before it is public, which matters for investor relations teams used to private-company openness.
6. Rehearse before listing. Run at least one exercise with the disclosure committee using a realistic scenario and the real worksheet, timed against the four-day window. See the Cyber Incident Exercises Beyond Tabletop Guide.

Stage 3: SOX and IT general controls

Under the instruction to Regulation S-K Item 308, a newly public company need not include management's report on internal control over financial reporting, or the auditor's attestation report, until it has been required to file an annual report for the prior fiscal year, and its first annual report must say so. The SEC's emerging growth company page states that EGCs, companies with total annual gross revenues of less than $1.235 billion, are not required to provide the auditor attestation under SOX 404(b), for up to five fiscal years after the IPO unless they cross a threshold sooner. None of this delays the external audit itself, and auditors rely on IT general controls to trust system-generated financial data from the first audit.

The SOX IT General Controls (ITGC) Guide covers the control set in depth. For readiness, NHI Mgmt Group recommends scoping the financially relevant systems early, running the controls for at least two quarters before the first audit cycle, and keeping evidence that an auditor can sample.

Where identity fits

In NHI Mgmt Group's experience, access controls account for much of ITGC testing, and they are often where growth-stage companies are weakest.

• Human access: joiner, mover and leaver processes driven from HR data, with leavers removed from financial systems within a defined period and evidence kept. See the Joiner-Mover-Leaver Guide.
• Access reviews: quarterly reviews of financial system access by system owners, with changes actioned and tracked. See the Access Reviews Guide.
• Privileged access: named, approved administrator accounts on the ERP, databases and cloud accounts that host them, with session logging.
• Service accounts and integrations: the accounts and API keys that move data between billing, payments, CRM and the ledger are in scope too. Each needs an owner, least privilege and credential rotation. See the AI Agents and SOX Controls page where automation or agents touch financial processes.

Stage 4: the first annual report and beyond

Once reporting, the company describes in each Form 10-K under Item 106 its processes for assessing, identifying and managing material cyber risks, whether and how they integrate with overall risk management, use of assessors and consultants, oversight of third-party service provider risk, whether cyber threats have materially affected or are reasonably likely to materially affect the business, the board's oversight and management's role and expertise. Draft this description during IPO preparation and test it against what actually happens, so that the first 10-K describes a working programme.

• Board oversight: decide which committee owns cyber, how often it is briefed and what metrics it sees. See the Board Cyber Risk Reporting Guide.
• Management expertise: the rule allows prior cyber work experience, relevant degrees or certifications and other knowledge to be described. Make sure the description of the CISO role is accurate and current.
• Third parties: describe how supplier cyber risk is overseen only if that process exists and is evidenced.

Decision guidance: timeline and scale

The timeline below is an NHI Mgmt Group recommendation based on practitioner judgement, not a regulatory requirement.

Smaller companies listing as emerging growth companies can focus on ITGCs and disclosure controls first, since 404(b) attestation is deferred, but should still design controls so that attestation later is not a rebuild. Larger issuers expecting to become accelerated filers quickly need the full control set operating before listing. A company already holding ISO/IEC 27001 certification or a SOC 2 Type II report has a head start on evidence, though neither is designed around financial reporting scope; see the ISO 27001 Certification Guide.

Detection and metrics

IPO preparation and the first months of trading attract attention, so raise monitoring for impersonation of executives, finance-targeted phishing and payment fraud, and leaks of draft filings. Track readiness with:

• ITGC deficiency count: open deficiencies on in-scope systems, by severity, trending to zero before the first audit.
• Leaver removal time for financial systems: median and maximum days from HR exit to access removal.
• Access review completion: percentage of in-scope systems reviewed on schedule with changes actioned.
• Time to materiality decision in exercises: hours from incident declaration to documented decision, against the four business day window.
• Statement reconciliation: percentage of public security statements (prospectus, trust page, questionnaires) mapped to evidence.

Framework mapping

Common failure patterns

• Boilerplate risk factors. Generic text copied from peers that does not reflect the company's own exposure or its incident history.
• Hypothetical language for real events. On 22 October 2024 the SEC announced settled charges against four companies for misleading cyber disclosures, including describing risks as hypothetical after intrusions had occurred.
• No owner for the materiality call. The security team knows about an incident but there is no defined route to the people who decide on disclosure.
• Shared admin accounts in the ERP. Auditors cannot rely on access controls where actions cannot be tied to a person.
• Service accounts with no owner. Integration credentials that move financial data are never reviewed or rotated and fall outside access reviews.
• Trust page and prospectus disagree. Marketing statements about security go further than the evidence or the filed risk factors.

Practitioner checklist

• Scope financially relevant systems and run an ITGC gap assessment at least 18 months before listing.
• Remove shared admin accounts, enforce change control and evidence access reviews on in-scope systems.
• Assign owners, least privilege and rotation to service accounts and integration keys in financial data flows.
• Review the full incident history with counsel before risk factors are drafted.
• Set up a disclosure committee, materiality worksheet and decision log, and exercise them against the four-day window.
• Link the incident process to the insider trading blackout and Regulation FD policies.
• Reconcile every public and customer-facing security statement with evidence.
• Draft the future Item 106 description now and test it against actual practice.

Standards and references

• Federal Register: SEC Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure final rule
• SEC: Commission Statement and Guidance on Public Company Cybersecurity Disclosures (2018)
• eCFR: 17 CFR 229.105, Item 105 Risk factors
• SEC: Charges against four companies for misleading cyber disclosures (2024)
• eCFR: 17 CFR 229.106, Item 106 Cybersecurity
• eCFR: 17 CFR 229.308, Item 308 Internal control over financial reporting
• SEC: Emerging growth companies
• FRC: UK Corporate Governance Code

Related NHI Mgmt Group resources: SEC Cybersecurity Disclosure Rules Guide · SEC Cyber Disclosure Executive Briefing · SOX IT General Controls (ITGC) Guide · Board Cyber Risk Reporting Guide. This guide summarises SEC, SOX and UK governance requirements for security purposes and is not legal advice.