The SEC cybersecurity disclosure requirements, adopted on 26 July 2023, ask public companies for two things. First, a Form 8-K describing any cybersecurity incident the company determines to be material, filed within four business days of that determination. Second, an annual description in the 10-K of how the company assesses, identifies and manages cybersecurity risk, and how the board and management oversee it.
The requirements fit on a page. The hard part is proving, months later, that the right people heard about an incident in time, decided on a record, and filed on schedule. That proof comes from disclosure controls and procedures, and this guide covers the controls rather than the rule summary.
This page is general information. Materiality and disclosure decisions belong to the company and its securities counsel, so consult a qualified professional about your facts.
What the rules require
The incident disclosure
The 8-K for a material incident covers the material aspects of its nature, scope and timing. It also covers its material impact, or reasonably likely material impact, on the company, including financial condition and results of operations. The SEC placed this in Item 1.05 of Form 8-K. The filing does not have to give technical detail about systems, vulnerabilities or the planned response at a level that would impede response or remediation.
Item 1.05 disclosure began on 18 December 2023 for most registrants and 15 June 2024 for smaller reporting companies.
The annual disclosure
Regulation S-K Item 106 asks for a description of the company's processes, if any, for managing material cybersecurity risk. It also asks whether threats or past incidents have materially affected the company or are reasonably likely to. On governance, the description covers how the board oversees cyber risk, naming any responsible committee, and what management's role is in assessing and managing it. Domestic companies make this disclosure in the 10-K, and foreign private issuers make it in the 20-F.
Where the rules stand
In 2025, banking and securities industry groups petitioned the SEC to rescind the incident 8-K requirement. In 2026, several commenters on the SEC's Regulation S-K review urged rescinding it and revising the annual disclosure. Neither action changes the rules. They remain in effect unless the Commission amends them. Because the SEC's Regulation S-K review is ongoing, check the current status before relying on them.
Until then, the sensible course is to keep the controls running and documented, so they stay defensible whichever way the rules go.
The control flow, from alert to filing
Most guidance stops at "have an incident response plan." The disclosure risk sits between the security team's plan and the filing, in the handoffs. Write each step as a control with an owner, a trigger and the evidence it leaves.
1. Triage criteria in security operations
Security operations sees alerts by the thousand. The first control is a written set of criteria for when an event becomes an incident, and when an incident gets a severity rating that leaves the security team. The criteria should cover data types, systems that support financial reporting, operational outages, third-party compromises and extortion demands. The evidence is the ticket with its rating and the time it was set.
2. Escalation triggers
Name the severity levels that require notice to people outside security: legal, the CFO or controller, and whoever chairs the disclosure committee. State the time allowed for each notice. A trigger that depends on someone's judgment that the incident "seems serious" cannot be tested. A trigger tied to a severity rating, a data category or a system can be.
3. The severity to materiality handoff
Severity is a technical rating. Materiality is a securities law judgment. The handoff control makes sure the committee receives what it needs to judge: what happened, what is still unknown, the systems and data involved, the business and financial exposure, and any related earlier incidents.
4. The documented determination
The disclosure committee meets, decides and records the decision. The record shows the date and time, who attended, what was considered, and the conclusion: material, not material, or not yet determinable, with the date of the next review. This record matters more than any other in the flow, because the filing deadline runs from it.
5. Filing and amendment
A tracker holds the business-day count from the determination, the draft and review steps, and any information marked as not yet available. If the first filing leaves information out because it was not yet determined or available, the filing must say so, and an amendment follows within four business days after the information is determined or becomes available.
Materiality: the process and its record
The SEC applies the ordinary securities law test to cyber incidents. Information is material if a reasonable shareholder would likely consider it important, or if it would significantly alter the total mix of available information. Both quantitative and qualitative factors can count. Staff guidance points to longer-term effects as well as immediate ones: operations, finances, brand, customer relationships, and possible litigation or regulatory investigation, including outside the United States.
We do not tell you whether an incident is material. What a control program can do is make the process repeatable and the record complete. Three points from SEC staff guidance shape what that record needs:
Related incidents count together. A series of related unauthorized occurrences can be one incident, and related events that are each small can be material together. Keep an aggregation analysis that the committee reviews each time it meets, not only when something large happens. Ending the incident does not end the question. A ransom paid, or an intrusion that has stopped, does not remove the need to determine materiality or by itself support a conclusion that the incident was immaterial. Delay needs a reason on file. The determination has to be made without unreasonable delay after discovery, and the SEC set no fixed period for it. The evidence that you met that standard is a dated log: when the incident was discovered, when the committee first met, what information it was waiting for, and when it decided.
Timing controls
Timing failures usually come from ambiguity, not slowness. Define these in writing:
- What starts the clock. The determination date in the committee record, not the date the security team opened the ticket.
- Who counts business days. One named person, with the company's holiday calendar.
- Voluntary disclosure. SEC staff have encouraged a different 8-K item, such as Item 8.01, for incidents that are immaterial or still being assessed. If one later becomes material, the Item 1.05 8-K is due within four business days of that decision. Your procedure should say who decides which path applies.
- The Attorney General delay. A delay is available only if the U.S. Attorney General determines that disclosure poses a substantial risk to national security or public safety and tells the SEC in writing. Asking for one does not stop the clock, and if no answer arrives in time the filing is still due. Consulting the DOJ, FBI or CISA does not by itself make an incident material.
Private communications. Sharing more with vendors, customers or affected companies is allowed, but Regulation FD still governs selective disclosure of material nonpublic information. Route those communications through legal.
The 10-K description and the evidence behind it
The annual description should match what actually runs. A program described in the 10-K but never exercised turns into a liability when an incident tests it.
In October 2024 the SEC charged four companies affected by the SolarWinds compromise with materially misleading cyber disclosures. The SEC found that one of them, Unisys, had described cyber risks as hypothetical while it knew of actual intrusions. Two commissioners dissented and objected to hindsight review. Whatever one makes of those cases, the practical lesson is to check every risk factor and process statement against the incident log before filing.
For board oversight, keep evidence that matches each sentence in the governance description:
- The committee charter that assigns cyber risk
- Agendas and minutes showing when it was discussed
- The reports management delivered
- Who in management presented, and what qualifies them for the role the 10-K describes
Disclosure controls, ICFR and SOX 302
The SEC said in its 2018 interpretive guidance that disclosure controls are central to timely cyber disclosure. In 2024 it charged R.R. Donnelley with controls violations. It found that the company's disclosure controls did not route cyber information to the people making disclosure decisions, and that alerts of unusual activity were not assessed in time. The Unisys order notes that the company disclosed a material weakness in both disclosure controls and ICFR, tied to how information passed from IT and legal to governance.
Those cases are why the escalation path belongs in the control program the CFO certifies:
- Sub-certifications. Add cyber questions to the quarterly SOX 302 sub-certifications for the CISO, the head of IT and the general counsel. Ask what incidents occurred, what was escalated, and what was not.
- ITGC overlap. Logging, monitoring and access controls over financial systems already sit in IT general control testing. Scope them so a test of those controls also confirms that alerts reach triage.
- Testing. Test the escalation controls like any other control: a sample of incidents from the period, traced from ticket to rating to notice to committee record.
That testing discipline is the work we do day to day. See our services and where the standard comes from.
Tabletop the decision, not just the response
Most tabletops test the technical response. A disclosure tabletop puts legal, the CFO, the controller, investor relations and the audit committee chair in the room and makes them decide. Useful scenarios:
- A ransomware demand where payment is on the table and the intrusion appears to have ended
- A vendor breach that exposes your customers' data, where you learn what happened only from the vendor
- Three small incidents over a quarter that look related
- An incident that falls late on a Thursday before a holiday weekend
- A request to the Attorney General for delay that gets no answer by the deadline
- An incident still being assessed, and the choice between a voluntary 8-K and waiting
Score the exercise on the record it produces, not on the discussion. Look for a time-stamped determination, a reason for any delay, a business-day count and a decision on the filing path. Then fix what the record lacked.
Common gaps
- Severity criteria that never mention financial systems or disclosure
- Escalation that depends on one person's judgment, with no backup when that person is out
- No dated determination record, so the clock cannot be shown
- Related incidents reviewed one at a time and never together
- Third-party incidents left out of triage because the vendor's systems are not yours
- A 10-K description copied from last year while the program changed underneath it
- Board minutes that say "cyber update" and nothing more
- Sub-certifications with no cyber questions
- Tabletops that end before anyone decides about disclosure
Where we come in
We are not a law firm and do not make the materiality call, and we do not run incident response. We work on the controls around those decisions. We document the escalation and determination steps as controls, test them against real incidents the way an auditor would, and leave a gap list with an owner and a date on every line. Where a committee has no controls person, a quarterly audit committee advisory retainer keeps the read current. The work is senior throughout; here is who does it.
Start with a free two hour scoping call. Tell us your next filing date and what has changed since the last 10-K.
Frequently asked questions
When does the four-business-day clock start?
The SEC ties it to the company's materiality determination, not to discovery. That is why the dated committee record is the control worth testing first.
Will you tell us whether an incident is material?
No. That judgment belongs to management and securities counsel. We help build and test the process that produces the decision and the record behind it.
Do you handle the incident response itself?
No. We are not an incident response or managed security provider. Our work covers the controls that carry incident information to the people making disclosure decisions, and the evidence that it happened.
Should the escalation controls be in our SOX program?
The escalation path is a disclosure control, and enforcement cases have linked failures in it to ICFR weaknesses. Many companies cover it through 302 sub-certifications and related IT general control testing. Your auditor and counsel will have views on scope.
The rules may be rescinded. Is this work worth doing now?
The rules remain in effect until the SEC amends them. The controls also serve purposes that do not depend on Item 1.05: accurate risk factors, board oversight and timely escalation.
What does a disclosure tabletop produce?
A record you can test. That means a time-stamped determination, the reasons for any delay, a business-day count, a filing path decision, and a list of the gaps the exercise exposed, each with an owner.