SEC Cyber Disclosure Executive Briefing: What Boards Must Oversee, Ask and Disclose

Since December 2023, a US public company that decides a cyber incident is material has four business days to tell the market, and every annual report must describe how the board oversees cyber risk, so directors now sign their name to statements about a process many of them have never examined. This briefing is for directors, audit and risk committee chairs, chief executives, general counsel and chief financial officers of companies that file with the US Securities and Exchange Commission (SEC). It covers the Form 8-K Item 1.05 materiality decision, the Form 10-K Item 106 governance disclosure and what effective board oversight behind both looks like, with questions and red flags directors can use at the next meeting. It stays at board level. The clause-by-clause practitioner detail is in the SEC Cybersecurity Disclosure Rules Guide.

The risk in one paragraph

The SEC adopted its cybersecurity disclosure rules on 26 July 2023. They do two things. First, a registrant must decide "without unreasonable delay" whether an incident is material and, if it is, file a Form 8-K under Item 1.05 generally within four business days of that decision, describing the nature, scope and timing of the incident and its material or reasonably likely material impact. Second, the annual report must describe, under Regulation S-K Item 106, the company's processes for managing material cyber risk, whether cyber threats have materially affected or are reasonably likely to affect the business, the board's oversight and management's role and expertise. The legal exposure is not the breach itself: it is a disclosure that turns out to be late, incomplete or more reassuring than the facts. The SEC's 2024 enforcement actions penalised companies for describing as hypothetical risks that had already happened. The board's task is to make sure the materiality decision is made quickly by the right people on a documented basis, and that what the 10-K says about oversight is true.

Why this is a board-level issue now

• Directors are named in the disclosure: Item 106(c)(1) requires a description of the board's oversight of cyber risk, any committee responsible and how the board or committee is informed. If the description overstates what happens in the boardroom, the inaccuracy is the board's.
• The clock runs from a decision, not from discovery: the four business days start when the company determines materiality, but that determination must itself be made without unreasonable delay. A slow or undocumented decision process is a compliance failure even if the eventual filing is on time.
• Downplaying is penalised: on 22 October 2024 the SEC announced settled charges against four companies affected by the SolarWinds Orion compromise for misleading disclosures, with civil penalties of $4 million (Unisys), $1 million (Avaya), $995,000 (Check Point) and $990,000 (Mimecast). One firm described cyber risk as hypothetical after two intrusions; another said only a limited number of emails were accessed when it knew at least 145 files had also been reached.
• Staff guidance has narrowed the room for judgement: SEC staff have said paying a ransom, the incident ending, insurance cover or the size of the ransom do not by themselves make an incident immaterial, and that related incidents that are each immaterial may need to be reported together.
• The rules are under review, not withdrawn: in April 2026, five banking and securities trade associations asked the SEC to rescind Item 1.05 and Item 106 in response to Chair Atkins' request for input on Regulation S-K. As of 8 November 2026, the SEC's rulemaking activity list showed no proposed or final rule to rescind or amend Item 1.05 or Item 106, so the rules remain in force; comment letters on the Regulation S-K review were still arriving in October 2026. Boards should ask counsel to track this rather than anticipate it.

What the rules require, at a glance

Item 106 does not require a company to disclose that any director has cyber expertise. It asks about management's expertise and the board's oversight process. Disclosures are also tagged in Inline XBRL, which makes them easy for investors, analysts and regulators to compare across companies.

The materiality decision: who decides, on what basis

Materiality is the standard securities-law test: would a reasonable investor consider the information important. The SEC did not set a cyber-specific threshold, and staff interpretation 104B.08 confirms there is no fixed dollar amount. In its 21 May 2024 statement, the Division of Corporation Finance asked companies to weigh qualitative factors alongside financial impact, naming harm to reputation, customer or vendor relationships and competitiveness, and the possibility of litigation or regulatory action.

Three practical points for directors:

• Decide who decides: the determination is usually made by a disclosure committee of the general counsel, CFO, CISO and investor relations, with the CEO and audit committee chair informed. Name the group and its alternates in advance, not during the incident.
• Do not wait for forensics to finish: staff have said that where an incident is clearly material before its full impact is known, the company should file, state what is not yet determined and amend later. Waiting for certainty is the most common route to an "unreasonable delay".
• Ransom and insurance do not settle it: staff interpretations 104B.05 to 104B.07 say a paid ransom, the incident ending or insurance reimbursement do not by themselves make an incident immaterial. The company should also consider whether future cyber insurance will cost more or be harder to obtain. See the Cyber Insurance Executive Briefing.

The only route to delay is narrow: the US Attorney General must determine that disclosure poses a substantial risk to national security or public safety and notify the SEC in writing. Staff interpretation 104B.01 makes clear that asking for a delay does not stop the four-day clock, and 104B.04 says consulting the Department of Justice or other agencies does not by itself make an incident material.

The 10-K governance disclosure: making it true

Item 106 asks companies to describe processes, not to claim outcomes, but every sentence must match reality. Directors should read the draft with the same scepticism they bring to the financial statements.

• Integration with enterprise risk: if the 10-K says cyber risk is part of the overall risk management process, the risk register and the risk committee papers should show it. See the Risk Appetite and Tolerance for Cyber Guide.
• Third parties: Item 106(b)(1)(iii) asks whether the company has processes to oversee risks from third-party service providers. Many material incidents start at a supplier or through a supplier's access, so this sentence needs evidence behind it. See the Third-Party Risk Management (TPRM) Guide.
• Management expertise: the description of the CISO's or equivalent's experience must be accurate and current; a change of role holder can make last year's text wrong.
• How the board is informed: if the filing says the audit committee receives quarterly cyber reports, minutes should show them. See the Board Cyber Report Template.
• Material effects of past incidents: Item 106(b)(2) asks whether threats, including prior incidents, have materially affected or are reasonably likely to affect strategy, results or financial condition. Generic, hypothetical risk-factor language after a real incident is exactly what the 2024 enforcement actions targeted.

Board oversight that stands up to scrutiny

For the personal exposure questions directors and CISOs ask, see the Board and Director Cyber Liability Guide and the CISO Personal Liability Guide.

Where it sits in the frameworks

See the NIST CSF 2.0 Govern Function Guide.

Five questions for the board to ask

1. Who decides materiality, and how fast? Show us the named disclosure committee, its alternates, the severity levels that convene it and the target time from escalation to decision.
2. When did we last rehearse a materiality decision? Walk us through the most recent exercise: how long the decision took, what information was missing and what changed afterwards.
3. Is everything our 10-K says about oversight true today? Who checked each statement in the Item 106 text against minutes, reports and current role holders?
4. Have we had incidents that were each small but related? How does the incident register flag repeated activity by one actor or through one vulnerability for aggregate assessment?
5. What would we say, and to whom, in the first 48 hours? How are customer, supplier, regulator and law enforcement communications kept consistent with the 8-K and with Regulation FD?

Red flags in management answers

• "We will know if it is material when forensics finish": the process waits for certainty the rules do not require.
• No named decision-makers: materiality will be argued about in the middle of the incident.
• Incident severity and materiality never connected: the security team's severity scale does not trigger the legal assessment.
• Risk factors unchanged after an incident: the 10-K still describes as possible what has already happened.
• "We cannot say anything outside the 8-K": staff stated on 20 June 2024 that Item 1.05 does not stop private sharing with vendors, customers or law enforcement, though Regulation FD still applies.
• Third-party oversight claimed but not evidenced: no register of suppliers with access to critical systems or data.

What good looks like

• A written materiality assessment procedure, owned by the general counsel, with a named cross-functional disclosure committee and pre-agreed qualitative and quantitative factors.
• Escalation thresholds that move a serious incident from the security team to the disclosure committee within hours, built into the Incident Response Plan Template or equivalent.
• Pre-drafted 8-K and stakeholder communication templates reviewed by counsel.
• An annual exercise that includes the disclosure committee and the committee chair. See the Tabletop Exercise Guide.
• An Item 106 draft that is checked line by line against evidence by someone other than its author.
• Quarterly board reporting on cyber risk against appetite. See the Board Cyber Risk Reporting Guide.

Where to invest first

1. Decision process: define and document the disclosure committee and materiality procedure; it costs little and removes the largest compliance risk.
2. Escalation and evidence: link incident severity to legal escalation and keep a contemporaneous decision log.
3. Rehearsal: a tabletop that ends with a materiality decision under time pressure.
4. Disclosure accuracy: an evidence check for the Item 106 text before every 10-K.
5. Prevention where incidents start: stolen credentials, unmanaged service accounts and supplier access drive many material incidents; fund identity controls and third-party oversight so there is less to disclose.

Metrics to track

A 90-day plan

1. Days 1 to 30: general counsel presents the materiality procedure and disclosure committee membership; the committee chair confirms which committee owns cyber and reviews last year's Item 106 text against reality.
2. Days 31 to 60: management links incident severity levels to legal escalation, prepares draft 8-K and communication templates and sets up the incident register cross-check for related incidents.
3. Days 61 to 90: run a tabletop ending in a materiality decision with the disclosure committee; report the timing and gaps to the committee; agree the evidence check for the next 10-K.

Common failure patterns

• Treating the 8-K as the security team's job: materiality is a legal and financial judgement; leaving it to the CISO alone produces either over-filing or late filing.
• Using Item 1.05 for everything: staff asked companies not to file immaterial or unassessed incidents under Item 1.05, and to use Item 8.01 for voluntary disclosure.
• Boilerplate governance text: copying peer disclosures describes a process the company does not run.
• Assuming a paid ransom closes the matter: staff interpretations say it does not.
• Losing the decision record: no contemporaneous note of when facts were known and when materiality was decided, which is what a regulator will ask for first.

Lessons from incidents

The 2024 Change Healthcare attack on a UnitedHealth Group subsidiary shows the scale a single incident can reach: attackers used a stolen credential on a remote access portal without multi-factor authentication, the company reportedly paid a $22 million ransom, the stolen data resurfaced with a second group, and UnitedHealth projected 2024 cyberattack costs of $2.87 billion. See the Change Healthcare breach. For boards, two lessons follow. Paying a ransom did not end the incident, which is why SEC staff say payment does not remove the duty to assess materiality. And the root cause was an ordinary identity control, so the cheapest way to reduce disclosure risk is to reduce the number of incidents that become material. The SolarWinds-related enforcement actions add the disclosure lesson: the penalties were for how companies described what they knew, not for being breached.

Practitioner checklist

• Document the materiality procedure, decision-makers and alternates, and the factors they must consider.
• Link incident severity levels to escalation to the disclosure committee and the committee chair.
• Keep a contemporaneous decision log for every incident assessed.
• Maintain draft Item 1.05 and Item 8.01 filings and stakeholder messages, reviewed by counsel.
• Cross-check the incident register for related incidents that may be material together.
• Verify every Item 106 statement against evidence before each annual report.
• Confirm that board and committee cyber reporting happens at the cadence the 10-K states.
• Rehearse a materiality decision at least annually, including the Attorney General delay route.
• Assign counsel to track any SEC rulemaking on Item 1.05 and Item 106.

Standards and references

• SEC: SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure
• SEC: Public Company Cybersecurity Disclosures Final Rules Fact Sheet
• eCFR: 17 CFR 229.106 (Item 106) Cybersecurity
• SEC Division of Corporation Finance: Disclosure of Cybersecurity Incidents Determined To Be Material and Other Cybersecurity Incidents
• SEC Division of Corporation Finance: Selective Disclosure of Cybersecurity Incident Information
• SEC: Exchange Act Form 8-K Compliance and Disclosure Interpretations (Section 104B)
• SEC: Rulemaking Activity (checked 8 November 2026)
• Bank Policy Institute: Banks Comment on Reforms to SEC's Regulation S-K (10 April 2026)
• SEC: SEC Charges Four Companies With Misleading Cyber Disclosures
• NIST: Cybersecurity Framework 2.0

How NHI Mgmt Group can help

We provide independent identity and non-human identity risk assessments and board briefings, including how stolen credentials, service accounts and supplier access, the routes behind many material incidents, are governed. Our NHI Foundation Level Training Course helps security and IAM teams govern service accounts, API keys and secrets. Contact us to arrange a briefing.

Related NHI Mgmt Group resources: SEC Cybersecurity Disclosure Rules Guide · Board and Director Cyber Liability Guide · Cyber Incident Readiness Executive Briefing. This guide summarises the SEC cybersecurity disclosure rules and staff guidance as checked on 8 November 2026 and is not legal advice.