SEC Cyber Disclosure: Engineering the Materiality Decision

Q: When does the SEC four-business-day deadline for cyber incidents start?

It starts when the company determines that a cybersecurity incident is material, not when the incident is discovered. Form 8-K Item 1.05 is generally due four business days after that determination. The rule separately requires the materiality determination to be made without unreasonable delay after discovery, so a company cannot extend the timeline by postponing the decision. In practice the period that regulators, plaintiffs and auditors examine is the gap between detection and determination, which is why the timestamps and evidence behind the decision matter as much as the filing deadline itself.

Q: What is the difference between Item 1.05 and Item 8.01 for cyber incidents?

In a May 2024 statement, the Director of the SEC Division of Corporation Finance said Item 1.05 of Form 8-K is reserved for cybersecurity incidents the company has determined to be material. A company that wants to disclose an incident it has determined not to be material, or one whose materiality it has not yet determined, should consider Item 8.01 (other events). If an incident disclosed under Item 8.01 is later determined to be material, the company files an Item 1.05 Form 8-K within four business days of that later determination. The goal is that Item 1.05 filings keep their meaning for investors.

Q: What factors decide whether a cyber incident is material?

Materiality follows the long-standing securities-law standard of whether there is a substantial likelihood that a reasonable investor would consider the information important. The SEC has emphasised that the assessment is qualitative as well as quantitative: beyond financial impact, companies should consider harm to reputation, customer or vendor relationships and competitiveness, and the possibility of litigation or regulatory investigations. A company can determine that an incident is material before it knows the full impact. Engineering teams support this by supplying data classes affected, record counts, customers and contracts touched, and operational impact, each with a confidence level.

Q: Can a company delay filing an Item 1.05 Form 8-K?

Only through the national-security and public-safety mechanism in the rule. Disclosure may be delayed if the United States Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the SEC in writing. Ongoing investigation, incomplete forensics or a desire for certainty are not grounds for delay once materiality has been determined. If required information is not available at the time of filing, the company states that in the 8-K and files an amendment within four business days after the information becomes available.

Q: What did the SEC October 2024 cyber enforcement actions target?

In October 2024 the SEC charged Unisys, Avaya, Check Point and Mimecast over disclosures relating to intrusions linked to the SolarWinds Orion compromise, with penalties of $4 million, $1 million, $995,000 and $990,000 respectively. The alleged problems were about framing: describing cybersecurity risks as hypothetical or generic when intrusions had occurred, understating the extent of access, and omitting what was exfiltrated. The lesson for engineering and legal teams is that exposure is not limited to a late 8-K; any disclosure, including 10-K risk factors, that the company own incident records contradict can be misleading.

Q: Is the SEC going to rescind the cyber incident disclosure rule?

As of this writing the rule remains in force. In May 2025 the American Bankers Association, Bank Policy Institute, SIFMA, the Independent Community Bankers of America and the Institute of International Bankers petitioned the SEC to rescind Form 8-K Item 1.05 and the Form 6-K requirement. In January 2026 Chairman Atkins invited comment on reforming Regulation S-K, with comments due in April 2026, and some commenters asked for Item 1.05 to be removed. Even if it were rescinded, the duty not to make misleading disclosures, Item 106 governance disclosure unless changed, state breach laws and foreign regimes would remain.

Q: Who should make the cyber materiality determination?

A chartered disclosure committee with cybersecurity explicitly in scope, a defined quorum, counsel involved and a named decision owner. The security team should not make the call alone, because materiality is a legal and business judgement, and the committee should not make it without security, because it depends on technical facts and their confidence levels. The failure mode is each side waiting for the other. Define convening triggers in advance — such as confirmed exfiltration of a regulated data class or a prolonged outage of a revenue-bearing system — so the committee meets because a rule fired, not because someone felt uneasy.

Q: Should materiality determination be automated with a scoring model?

No. Automate the facts, the convening triggers, the re-assessment triggers and the timestamps, but keep the determination with a human committee that records its rationale and vote. Quantitative screens such as revenue exposure, record counts and downtime are useful for deciding when to convene, yet some of the most consequential incidents, such as a compromised signing key or a breach at a critical vendor, score low on every number in the first week. A model that outputs material yes or no is likely to be read in litigation as the company delegating a legal judgement to a spreadsheet.

Satyam Kumar

Retour au blog

cyber-security-patterns

SEC Cyber Disclosure: The Four-Day Clock Starts When You Decide, So Make the Decision an Engineered Record (2026)

By Satyam KumarSeptember 23, 202613 min read

sec cybersecurity disclosure form 8-k item 1.05 materiality determination regulation s-k item 106 cybersecurity incident reporting disclosure committee incident response ciso cyber governance sec enforcement solarwinds security compliance breach notification board cyber oversight incident register regulatory reporting

SEC Cyber Disclosure: The Four-Day Clock Starts When You Decide, So Make the Decision an Engineered Record (2026)

Frequently Asked Questions

Partager l'article

Twitter LinkedIn WhatsApp

Satyam Kumar

Founder & AI Architect, AppScale LLP

Architecte AI & Cloud. J'aide les équipes à construire des systèmes qui scalent pour des millions.

LinkedIn GitHub

SEC Cyber Disclosure: The Four-Day Clock Starts When You Decide, So Make the Decision an Engineered Record (2026)

Frequently Asked Questions

Partager l'article

Comments

Leave a comment