SEC Cybersecurity Disclosure Rules Guide

US public companies must tell investors about a material cybersecurity incident within four business days of deciding it is material, and must explain every year how they find, manage and govern cyber risk. The SEC adopted these rules on 26 July 2023 in Release 33-11216, creating Form 8-K Item 1.05 for incidents and Regulation S-K Item 106 for annual disclosure, with equivalents for foreign private issuers. Since then, staff interpretations, a Corporation Finance statement and enforcement cases have shaped how companies apply them. This guide covers what each requirement says, how to run a defensible materiality determination, the national security delay, voluntary disclosure, Item 106 content, foreign private issuers, enforcement and the status of the rules as of October 2026. It is written for CISOs, incident response leads, securities counsel, disclosure committees and the identity and security teams who feed them facts.

Key takeaways

• The clock starts at the materiality decision, not discovery. Item 1.05 is due within four business days of determining an incident is material, and that determination must be made "without unreasonable delay after discovery".
• Materiality is not only financial. Staff guidance points to reputation, customer and vendor relationships, competitiveness, and the possibility of litigation or regulatory action; a ransom payment or insurance cover does not make an incident immaterial.
• Item 1.05 is for material incidents only. Since May 2024 staff have asked companies to put voluntary or not-yet-assessed incident disclosures under a different item, such as Item 8.01.
• Annual disclosure describes processes, board oversight and management expertise. Item 106 in Form 10-K requires enough detail for a reasonable investor to understand how cyber risk is assessed, identified and managed, including third-party risk.
• Misleading disclosure is the enforcement risk. The SEC fined four companies in October 2024 for downplaying intrusions, while its case against SolarWinds and its CISO was dismissed with prejudice in November 2025.

The rules at a glance

Item 106 applied to annual reports for fiscal years ending on or after 15 December 2023. Item 1.05 applied from 18 December 2023, and from 15 June 2024 for smaller reporting companies.

Form 8-K Item 1.05: what to disclose

Item 1.05(a) requires a registrant that determines it has experienced a material cybersecurity incident to "describe the material aspects of the nature, scope, and timing of the incident", and the material or reasonably likely material impact, including on financial condition and results of operations. The instructions set the boundaries:

• Instruction 1: the materiality determination must be made "without unreasonable delay after discovery of the incident". Waiting for a forensic report to finish is not a reason to defer the decision.
• Instruction 2: if required information is not determined or unavailable at filing, say so, then file an amendment within four business days after it becomes available. The impact can be stated as not yet determined; the filing itself cannot wait.
• Instruction 3: "cybersecurity incident" has the Item 106(a) meaning: an unauthorised occurrence, or a series of related unauthorised occurrences, on or conducted through a registrant's information systems that jeopardises confidentiality, integrity or availability.
• Instruction 4: registrants "need not disclose specific or technical information about its planned response" or systems to the extent it would impede response or remediation. Indicators of compromise and vulnerability details stay out.
• Information systems "owned or used by" the registrant: the definition reaches cloud and SaaS providers holding your data, so an incident at a supplier can be your Item 1.05 event.

Making the materiality determination

Materiality follows the usual securities law standard: whether there is a substantial likelihood a reasonable investor would consider the information important. The SEC has not set a numeric threshold. Staff guidance adds these points:

• Who decides: a disclosure committee, usually the general counsel, CFO, CISO and investor relations, with a documented escalation path from the incident response team. The CISO supplies facts and scope; the committee owns the decision.
• What to record: the time of discovery, facts known at each meeting, factors considered, the decision and its rationale. That record is your evidence that there was no unreasonable delay.
• Revisit: an incident first judged immaterial must be reassessed as facts change, for example when data theft is confirmed or an extortion demand arrives.

Where identity fits

When an incident starts with a stolen credential, token or compromised supplier account, identity facts drive the materiality analysis: which systems the identity could reach, what data it touched and whether access is now revoked. Incident teams need fast answers from identity logs to brief the disclosure committee on scope. The third-party provider question in Item 106(b)(1)(iii) also covers vendors that hold access to your environment. See the Third-Party Access Guide and the Leaked Credential Response Playbook.

The national security and public safety delay

Item 1.05(c) allows a delay only if the US Attorney General determines that disclosure "poses a substantial risk to national security or public safety" and notifies the Commission in writing.

• Periods: up to 30 days after the date disclosure was otherwise required; up to a further 30 days on a new determination; in extraordinary circumstances up to a further 60 days where disclosure "continues to pose a substantial risk to national security". Beyond that the Commission may grant relief by exemptive order.
• Requests do not stop the clock: C&DI 104B.01 says "Requesting a delay does not change the registrant's filing obligation". If the Attorney General declines or does not respond in time, file within four business days of the materiality determination.
• Early end: if the Attorney General decides during a delay that disclosure no longer poses a substantial risk, file within four business days of that notification (C&DI 104B.03).
• Route: requests go through the FBI, which says they "won't be processed unless they are received by the FBI immediately upon a company's determination to disclose a cyber incident via 8k". The FBI recommends earlier engagement through the FBI, Secret Service, CISA or a sector risk management agency, and states that "this engagement doesn't trigger a determination of materiality".
• Telecoms carriers: registrants subject to the FCC's customer proprietary network information breach rule (47 CFR 64.2011) may delay Item 1.05 for that rule's period, but no more than seven business days after the FCC-required notification, and must tell the SEC by EDGAR correspondence.

Voluntary disclosure: Item 1.05 or Item 8.01

Early filings used Item 1.05 for incidents the company had not found material. In his May 2024 statement, the Director of Corporation Finance wrote that "Item 1.05 is not a voluntary disclosure, and it is by definition material", and encouraged companies to use a different item for other incidents. The statement is staff guidance with no legal force, but most filers now follow it.

Regulation S-K Item 106: the annual disclosure

Risk management and strategy (Item 106(b))

• Processes: describe processes, "if any", for assessing, identifying and managing material cyber risks "in sufficient detail for a reasonable investor to understand those processes".
• Required topics (non-exclusive): whether and how they are integrated into overall risk management; whether assessors, consultants, auditors or other third parties are engaged; and whether there are processes to oversee and identify risks from third-party service providers.
• Effects: whether risks, including from previous incidents, have materially affected or are reasonably likely to materially affect business strategy, results of operations or financial condition, and how.

Governance (Item 106(c))

• Board: how the board oversees cyber risk, any responsible committee or subcommittee, and how it is informed.
• Management: which positions or committees are responsible and their expertise; how they are informed about and monitor prevention, detection, mitigation and remediation; and whether they report to the board or a committee. Instruction 2 gives examples of expertise: prior work experience, relevant degrees or certifications, and other knowledge or background.
• What the final rule left out: the proposed requirement to disclose directors' cybersecurity expertise was not adopted, and there are no quarterly Item 106 updates.

Avoid boilerplate. The October 2024 cases turned on risk factors that described risks as hypothetical when the company already knew of an intrusion. Keep Item 106 consistent with what the board actually receives.

Disclosure controls and procedures

Exchange Act Rules 13a-15 and 15d-15 require disclosure controls and procedures, and the CEO and CFO certify them each quarter. For cyber, that means information about incidents and risks must reach the people who decide disclosure in time. The Unisys settlement included a disclosure controls charge, with the SEC linking its misleading disclosures partly to deficient controls. Test this path during tabletops, not just the technical response.

Enforcement and the status of the rules

• October 2024 settlements: the SEC charged Unisys ($4 million, plus disclosure controls violations), Avaya ($1 million), Check Point ($995,000) and Mimecast ($990,000) over disclosures about intrusions linked to the SolarWinds Orion actor. Allegations included describing risks as hypothetical and minimising what was accessed. An enforcement official said "Downplaying the extent of a material cybersecurity breach is a bad strategy".
• SolarWinds: the SEC sued SolarWinds and its CISO, Timothy G. Brown, on 30 October 2023 over its pre-breach security statements. On 20 November 2025 it announced a joint stipulation to dismiss the case with prejudice, "in the exercise of its discretion", noting this "does not necessarily reflect the Commission's position on any other case". See the SolarWinds supply chain compromise.
• Rule status as of 17 October 2026: Item 1.05 and Item 106 remain in force. A joint petition (file 4-856) asks the SEC to rescind Item 1.05 and the Form 6-K requirement; the comment file shows letters from May to July 2025 and no Commission action. The SEC's rulemaking activity list shows no proposal to amend or rescind the cybersecurity rules. Check sec.gov before relying on this.

How to implement: a phased approach

1. Write the escalation path: define which incident severities go to the disclosure committee, within how many hours, and who can convene it out of hours. Link it to the incident response plan. See the Incident Response Guide.
2. Adopt a materiality framework: quantitative indicators (cost, revenue, downtime) and qualitative ones from the Gerding statement and C&DIs, with a decision record template.
3. Pre-draft filings: Item 1.05 and Item 8.01 templates approved by counsel, with Inline XBRL tagging tested by the filing agent.
4. Map parallel notifications: state breach laws, GDPR, sector regulators and contracts often run on different clocks. See the GDPR Compliance Guide for Security Teams.
5. Test it: run a tabletop with the disclosure committee using a supplier breach and a ransomware scenario, timing discovery to determination to draft filing. Fix gaps, then repeat annually.
6. Align the 10-K: draft Item 1C from real board materials, have the CISO confirm every process described exists, and keep evidence.
7. Review after each incident: reassess earlier immaterial decisions, related incidents and risk factor language. If a filing proves inaccurate, correct it by amendment rather than leaving it.

Decision guidance

• File early or wait: if disruption is already public and facts are thin, an Item 8.01 report buys time to assess without implying materiality. Do not use it to delay a decision you have effectively made.
• Smaller reporting companies: the same rules apply; a smaller business may reach materiality at lower cost thresholds, so set quantitative triggers to scale.
• Large groups: incidents at subsidiaries, joint ventures and key suppliers need a route into the parent's committee, and related events across business units must be aggregated (C&DI 104B.09).
• Foreign private issuers: Form 6-K is triggered by information made public or required to be disclosed elsewhere, so home-country notifications can create a US filing.

Detection, measurement and framework mapping

Disclosure depends on detection: centralised logging of identity, endpoint and cloud events, supplier breach notifications routed to the incident team, and threat intelligence on campaigns against your sector. Metrics for the disclosure process:

• Time to committee: hours from incident declaration to first disclosure committee briefing.
• Time to determination: days from discovery to the materiality decision, with the record attached.
• Filing timeliness: percentage of Item 1.05 filings and amendments made within four business days.
• Tabletop findings closed: percentage closed before the next exercise.
• Item 1C evidence coverage: share of described processes with current supporting evidence.

This mapping is indicative. The frameworks support the processes Item 106 describes; the rule itself does not require any framework.

Common failure patterns

• Hypothetical risk factors after a known intrusion: the core of the October 2024 cases, which grew out of the SolarWinds investigation.
• Waiting for certainty: deferring the decision until forensics finishes. Instruction 2 exists so you can file with unknowns.
• Ignoring supplier incidents: data in a provider's platform is on systems "used by" the registrant. The Snowflake breach showed one provider's customers facing their own disclosure decisions.
• Judging only data loss: operational disruption can be material without data theft, as the MGM Resorts breach and its reported $100 million loss show.
• Overly technical filings: naming vulnerabilities or response steps that help the attacker, which Instruction 4 says you need not disclose.
• A 10-K that does not match reality: describing a board committee or process that does not meet or exist.

Practitioner checklist

• Name the disclosure committee and its out-of-hours deputies, and connect it to incident response.
• Adopt a written materiality framework with quantitative and qualitative factors and a decision log.
• Pre-approve Item 1.05, Item 8.01 and amendment templates, with Inline XBRL tested.
• Know how to reach the FBI for a delay request on the day of the determination.
• Route supplier breach notices into the same triage as internal incidents.
• Aggregate related incidents across business units for collective materiality.
• Draft Item 1C from board minutes and evidence, not from last year's text.
• Rehearse a full discovery to filing sequence at least once a year.

Standards and references

• SEC: SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies
• SEC: Release 33-11216 Fact Sheet
• eCFR: 17 CFR 229.106 (Item 106) Cybersecurity
• SEC: Form 8-K Current Report and Instructions
• SEC: Exchange Act Form 8-K Compliance and Disclosure Interpretations
• SEC: Disclosure of Cybersecurity Incidents Determined To Be Material and Other Cybersecurity Incidents
• SEC: Press Release 2024-174, Unisys, Avaya, Check Point and Mimecast Cyber Disclosure Charges
• SEC: Litigation Release No. 26423, SolarWinds Corp. and Timothy G. Brown

Related NHI Mgmt Group resources: Incident Response Guide · Cyber Risk Quantification Guide · Cyber Insurance Guide · Global Cybersecurity Regulatory Map. This guide summarises the SEC cybersecurity disclosure rules, staff guidance and enforcement as of 17 October 2026 and is not legal advice.