Cyber Disclosure Rules for Listed Companies Compared: SEC vs EU vs UK vs Australia

A listed company hit by a serious cyber incident can face four different disclosure tests on the same morning, each with its own trigger, clock and regulator, and only the United States has a rule written specifically for cyber. The SEC requires a Form 8-K within four business days of a materiality decision and an annual description of cyber risk management and governance. The EU and the UK rely on the general inside information duty in the Market Abuse Regulation, layered with NIS2 incident reporting and board duties for in-scope sectors and, in the UK, the Provision 29 internal controls declaration. Australia uses ASX continuous disclosure, backed by ASIC's view that directors' duties extend to cyber risk. This page compares the four regimes side by side for multinational and dual-listed issuers, and is written for general counsel, company secretaries, CISOs and disclosure committees. Status checked on 14 November 2026.

Key takeaways

• Only the SEC has a cyber-specific listing rule. Form 8-K Item 1.05 and Regulation S-K Item 106 exist because of cyber; the EU, UK and Australian regimes apply general market disclosure law to cyber incidents.
• The triggers differ in wording more than in substance. SEC materiality, MAR inside information and ASX price sensitivity all ask what a reasonable investor would weigh, but the clocks run from different points: a materiality determination, "as soon as possible", or "promptly and without delay".
• Delay rights are narrow and differ. The SEC allows delay only on a US Attorney General determination; MAR lets an issuer delay on its own responsibility if three conditions hold; ASX allows non-disclosure only while the Listing Rule 3.1A exception lasts, often bridged by a trading halt of up to two trading days.
• NIS2 is a sector regime, not a listing rule. It binds listed and unlisted essential and important entities alike, but its 24 hour, 72 hour and one month reports and its Article 20 board duties often fire on the same incident as MAR.
• One fact base, four outputs. The practical answer for a multinational is a single incident fact record and a single disclosure committee that tests each regime in parallel, so no filing contradicts another.

Regulations and frameworks at a glance

How the four regimes differ in one paragraph each

United States: a purpose-built cyber rule

The SEC rule separates the decision from the filing. Instruction 1 to Item 1.05 requires the materiality determination "without unreasonable delay after discovery", and the 8-K follows within four business days of that decision. The filing covers the nature, scope and timing of the incident and its material or reasonably likely material impact. Item 106 then requires an annual description of the processes used to assess, identify and manage material cyber risks, whether those risks have materially affected the company, board oversight, and management's role and expertise. Foreign private issuers furnish a Form 6-K when they disclose a material incident elsewhere, including to a foreign stock exchange. Item 106 applied to annual reports for fiscal years ending on or after 15 December 2023, and Item 1.05 from 18 December 2023 (15 June 2024 for smaller reporting companies). See the SEC Cybersecurity Disclosure Rules Guide.

Status: on 14 November 2026 both items remain in force. The SEC rulemaking activity list for June 2025 to November 2026 shows no cybersecurity amendment.

European Union: general market law plus sector duties

MAR Article 17(1) requires an issuer to "inform the public as soon as possible of inside information which directly concerns that issuer". Inside information under Article 7 is precise, non-public information that would be likely to have a significant effect on price, meaning information a reasonable investor would be likely to use as part of the basis of an investment decision. Article 17(4) permits delay on the issuer's own responsibility only where immediate disclosure is likely to prejudice its legitimate interests, delay is not likely to mislead the public, and confidentiality can be ensured; the competent authority must be told of the delay once the information is published. The EU Listing Act, Regulation (EU) 2024/2809, amended MAR with changes that apply from 5 June 2026, including how intermediate steps in protracted processes are treated, so read the consolidated text of Article 17 before relying on the original delay wording.

NIS2 sits alongside MAR. Article 20 requires management bodies of essential and important entities to approve cyber risk management measures, oversee their implementation and follow training, and makes them liable for infringements. Article 23 requires an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours and a final report no later than one month after the notification. A significant incident is one that has caused or is capable of causing severe operational disruption or financial loss, or considerable damage to others. The relationship between the SEC regime and NIS2 is covered in depth in SEC Cyber Disclosure vs NIS2 Reporting.

The CSRD is the third EU layer, but it is a reporting framework rather than a cyber rule. Directive (EU) 2026/470, dated 24 February 2026 and in force from 18 March 2026, amended the CSRD and narrowed the companies it covers. The European Sustainability Reporting Standards contain no standalone cyber security standard, so cyber appears in a sustainability statement only where the company's materiality assessment brings it in, for example through consumer privacy. Treat the CSRD as a consistency risk: its cyber content must match the annual report and MAR announcements.

United Kingdom: MAR, the Code and board guidance

UK MAR Article 17 mirrors the EU text: inside information must be published as soon as possible, delay is possible under the same three conditions, and the issuer must inform the FCA that disclosure was delayed immediately after publication, with a written explanation if the FCA asks. The EU Listing Act changes do not apply in the UK.

The governance layer is the UK Corporate Governance Code 2024. Provision 29 asks the board to make a declaration on the effectiveness of its material internal controls, covering operational, compliance and reporting controls, for financial years beginning on or after 1 January 2026. The Code applies on a comply or explain basis to companies in the commercial companies and closed-ended investment funds categories. Where cyber controls protect systems that are material to the business, they fall naturally within the declaration. The Cyber Governance Code of Practice, published on 8 April 2025 by DSIT with the NCSC, is guidance rather than law; it describes itself as the first point of reference for board members, and its five principles give directors a structure for the evidence behind a Provision 29 declaration. See the UK Cyber Governance Code of Practice Guide.

Australia: continuous disclosure and directors' duties

ASX Listing Rule 3.1 requires an entity that becomes aware of information a reasonable person would expect to have a material effect on the price or value of its securities to tell ASX immediately. Guidance Note 8 says "immediately" means "promptly and without delay", not instantaneously. Listing Rule 3.1A excuses disclosure only while three limbs all hold: the information fits a listed category (for example, it is insufficiently definite to warrant disclosure), it is confidential and ASX has not concluded otherwise, and a reasonable person would not expect it to be disclosed. A trading halt can last up to two trading days and does not remove the obligation.

Guidance Note 8 includes a worked data breach example. An unconfirmed breach of unclear scale is normally "insufficiently definite" to require disclosure, but the entity must keep investigating urgently and prepare a draft announcement. Confirmation that a large number of customers' records were accessed is new information likely to have a material effect. Confidentiality is lost once customers are notified or a journalist approaches the company, so the market announcement should come first. A decision not to pay a ransom is not itself disclosable once the market has all material information, but publication of stolen data on the dark web requires further disclosure. ASX prefers a trading halt to a voluntary suspension here.

ASIC adds the directors' duties layer. It expects risk management frameworks to adequately address cyber risk, oversight to extend across the digital supply chain and incident response plans to be tested, and it has said that failing to address cyber risk or meet disclosure obligations may breach directors' duties. In September 2023 the ASIC Chair said that failing to prioritise cyber security "creates a foreseeable risk of harm" that exposes directors to potential enforcement action. In ASIC v RI Advice the Federal Court found that an Australian financial services licensee breached its licence obligations by failing to manage cyber risk adequately. See the Australian Privacy and Cyber Rules Guide for the privacy and critical infrastructure duties that run alongside.

Incident disclosure triggers compared

Governance and periodic disclosure compared

Threat model and failure modes per regime

• SEC: the risk is less missing the four days than describing a known intrusion as hypothetical, or deciding late. Controls are a written escalation path to the disclosure committee, a decision record per meeting and pre-approved Item 1.05 and Item 8.01 templates.
• MAR: the risk is an undocumented delay. If the issuer cannot show all three Article 17(4) conditions held throughout, and that confidentiality was preserved, the delay was unlawful. Controls are a delay log, an insider list for the incident and a leak monitoring trigger that forces publication.
• ASX: the risk is losing confidentiality before the announcement: customer notifications, journalist enquiries, threat actor leak posts and unusual trading. Controls are a holding announcement drafted on day one and a trading halt request ready to send.
• NIS2: the risk is that the regulator report and the market announcement say different things. Controls are one fact owner and a reconciliation step before each output.
• Provision 29 and Item 106: the risk is describing processes that do not run. Controls are evidence for every described process and internal audit testing of the cyber controls the board calls material.

Worked scenario: one ransomware incident, four outputs

A manufacturer with a primary listing in London, an ADR programme registered with the SEC as a foreign private issuer, a German operating subsidiary in a NIS2 sector and an Australian subsidiary discovers encrypted servers at 06:00 on a Monday.

1. Hour 0 to 4: the incident lead declares a major incident and the disclosure committee meets. The German subsidiary's team starts the NIS2 clock because production is severely disrupted.
2. Hour 4 to 24: the committee assesses whether the disruption is inside information under UK MAR. It decides to delay for a few hours while scoping, records each Article 17(4) condition, opens an insider list and prepares a holding announcement. The NIS2 early warning goes to the German authority within 24 hours.
3. Day 2: a leak site post names the company. Confidentiality is lost, so the UK announcement is released immediately and the FCA is told of the earlier delay. Because the information is now public in the UK, a Form 6-K is furnished in the US.
4. Day 3: the NIS2 notification, with an initial assessment of severity and impact, goes in within 72 hours and is reconciled with the market announcement.
5. Day 5: stolen customer data is confirmed. The Australian subsidiary is not listed, so ASX rules do not apply, but if the parent also had an ASX listing the confirmation would be new price-sensitive information under Guidance Note 8.
6. Annual report: the board's Provision 29 declaration and Form 20-F Item 16K must describe the same governance and must not contradict what was said during the incident.

Decision guidance and trade-offs

• Which regime sets the pace: for most incidents the general market rules (MAR and ASX) move fastest because loss of confidentiality forces immediate publication. The SEC four days is a ceiling, not a target.
• One committee or several: a single group disclosure committee with jurisdiction leads is easier to keep consistent than separate local committees; large groups can delegate drafting but should centralise the decision record.
• Delay or announce: MAR delay and ASX non-disclosure only work while confidentiality holds. In ransomware cases the threat actor controls publicity, so plan to announce early.
• Dual listings: any disclosure in one market can trigger another: a Form 6-K for foreign private issuers, or a matching ASX release for dual-listed entities.
• Governance statements: write Item 106, the Provision 29 declaration and any CSRD content from the same evidence base, reviewed by the same people.

Detection and measurement

Disclosure depends on how fast facts reach the committee from logs, supplier notices and leak site monitoring. Track:

• Time to committee: hours from major incident declaration to the first disclosure committee briefing.
• Time to decision: hours from discovery to a recorded decision under each regime.
• Delay documentation rate: share of MAR delays with all three conditions recorded and the regulator notified.
• Consistency defects: number of differences found between regulator reports, market announcements and later filings.
• Exercise coverage: share of listing jurisdictions included in the annual disclosure tabletop.

Framework mapping

The mapping is indicative: none of the four regimes requires a specific framework.

Common failure patterns

• Treating each regime separately: a NIS2 report describing severe disruption while the market announcement calls the incident contained invites questions from both regulators.
• Silent delay under MAR: delaying without recording the three conditions or without telling the FCA or national authority afterwards.
• Notifying customers before the market: Guidance Note 8 treats customer notification as the end of confidentiality, so the ASX announcement should go first.
• Hypothetical risk language after a known incident: the core of the SEC's 2024 cases described in the SEC guide, and equally misleading under MAR and ASX rules.
• Ignoring supplier incidents: data held by a provider is still your exposure; the Snowflake breach left many listed customers assessing their own disclosure duties.
• Governance statements without evidence: describing quarterly board reporting or tested plans that do not exist undermines both Item 106 and a Provision 29 declaration.

Practitioner checklist

• List every market where the group has securities and every NIS2 entity in the group, with the regulator and clock for each.
• Set up one disclosure committee with jurisdiction leads and a single incident fact owner.
• Keep a decision record template covering SEC materiality, MAR inside information, ASX price sensitivity and NIS2 significance.
• Pre-draft holding announcements for each market and Item 1.05, Item 8.01 or Form 6-K templates where relevant.
• Maintain a MAR delay log and insider list template, and a ready ASX trading halt request.
• Trigger publication automatically on leak site posts, journalist contact or customer notification.
• Reconcile every regulator report with public statements before release.
• Build Item 106, Provision 29 and sustainability statements from one evidence set, tested by internal audit.
• Run an annual tabletop that includes every listing jurisdiction. See the Board Cyber Risk Reporting Guide.

Standards and references

• SEC: Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure fact sheet
• EUR-Lex: Regulation (EU) No 596/2014 on market abuse
• EUR-Lex: Directive (EU) 2022/2555 (NIS2)
• legislation.gov.uk: UK MAR Article 17
• FRC: UK Corporate Governance Code
• GOV.UK: Cyber Governance Code of Practice
• ASX: Guidance Note 8, Continuous Disclosure
• ASIC: Cyber risk, be prepared

Related NHI Mgmt Group resources: SEC Cybersecurity Disclosure Rules Guide · SEC Cyber Disclosure vs NIS2 Reporting · NIS2 Directive Guide · UK Cyber Governance Code of Practice Guide · Board and Director Cyber Liability Guide. This guide summarises listed company cyber disclosure rules in the US, EU, UK and Australia and is not legal advice.