SEC Cybersecurity Disclosure Rules: Form 8-K Item 1.05 and Item 106

SEC cybersecurity disclosure rules require US public companies to tell investors about material cybersecurity incidents within days, and to explain each year how they manage cybersecurity risk and how their boards oversee it. Adopted by the Securities and Exchange Commission in July 2023, the rules added Item 1.05 to Form 8-K for incidents and Item 106 to Regulation S-K for annual disclosures in Form 10-K.

For technology suppliers, the rules matter because a breach at a vendor can be a material incident for a listed customer, and that customer must assess and disclose quickly. In 2025, industry groups petitioned the SEC to rescind the incident disclosure requirement, and in 2026 the SEC opened a broad review of Regulation S-K, but the rules remained in force as of October 2026. This guide explains the requirements, materiality, the role of vendors and how to prepare.

What are the SEC cybersecurity disclosure rules?

The SEC adopted the rules on 26 July 2023, responding to the growing impact of cyber incidents on companies and investors and to inconsistent disclosure practices. The rules have two parts:

• Form 8-K Item 1.05: disclosure of material cybersecurity incidents.
• Regulation S-K Item 106: annual disclosure of cybersecurity risk management, strategy and governance in Form 10-K.

Foreign private issuers have parallel requirements on Form 6-K for incidents and Form 20-F for annual disclosures. Disclosures must be tagged in Inline XBRL.

Who must comply?

Companies that file periodic reports with the SEC, including US domestic registrants and foreign private issuers. Smaller reporting companies received an extra 180 days for incident disclosure. Private companies are not covered, but many follow the rules as good practice or because they plan to go public, and vendors to listed companies feel their effects.

Compliance dates

Requirement	Compliance date
Item 106 annual disclosures	Fiscal years ending on or after 15 December 2023
Item 1.05 incident disclosure (most registrants)	18 December 2023
Item 1.05 incident disclosure (smaller reporting companies)	15 June 2024
Inline XBRL tagging	One year after initial compliance

Form 8-K Item 1.05: material incidents

When a registrant determines that a cybersecurity incident is material, it must file a Form 8-K within four business days of that determination. The filing must describe the material aspects of the incident's nature, scope and timing, and its material impact or reasonably likely material impact on the company, including on financial condition and results of operations. Companies do not have to disclose specific technical information that would impede their response or remediation. If information is not available at the time of filing, the company must say so and file an amendment once it is available.

The materiality determination must be made without unreasonable delay after discovery. A "cybersecurity incident" includes a series of related unauthorised occurrences, so several smaller events can together be material.

Determining materiality

Materiality follows the long-standing securities law standard: information is material if there is a substantial likelihood that a reasonable investor would consider it important in making an investment decision, or if it would significantly alter the total mix of available information. Companies should consider quantitative factors, such as costs, lost revenue and fines, and qualitative factors, such as harm to reputation, customer and vendor relationships, competitiveness, and the possibility of litigation or regulatory action. Data theft affecting many customers, disruption of core operations, or compromise of critical systems are common reasons for a material determination.

In May 2024, SEC staff clarified that Item 1.05 should be used for incidents determined to be material, while companies may voluntarily disclose other incidents, including those whose materiality is not yet determined, under Item 8.01 to avoid confusing investors.

National security and public safety delay

Disclosure can be delayed if the US Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the SEC in writing. The initial delay is up to 30 days, extendable in limited circumstances. The FBI and Department of Justice have published procedures for requesting delays. Delays are rare.

Regulation S-K Item 106: annual disclosures

• Risk management and strategy: processes for assessing, identifying and managing material cyber risks, whether those processes are integrated into overall risk management, whether the company uses assessors, consultants or auditors, whether it has processes to oversee risks from third-party service providers, and whether cyber threats have materially affected or are reasonably likely to affect the company.
• Governance: the board's oversight of cyber risk, including any responsible committee and how it is informed; and management's role, including which positions or committees are responsible, their relevant expertise, and how they monitor prevention, detection, mitigation and remediation.

The final rule did not require disclosure of board members' cybersecurity expertise, which had been proposed.

Writing credible Item 106 disclosures

Item 106 disclosures describe processes, not technical details. Good disclosures explain how cyber risk fits into enterprise risk management, which frameworks guide the programme, how often risks are assessed, how third-party risks are managed, who leads the programme and what experience they have, how management reports to the board, and which committee oversees cyber risk. They should match what actually happens, because overstated descriptions can become evidence in enforcement or litigation after an incident. Many companies reference frameworks such as the NIST Cybersecurity Framework or ISO/IEC 27001 and describe use of external assessors and penetration testers.

Board oversight in practice

The rules do not tell boards how to oversee cyber risk, but they require companies to describe it, which has prompted many boards to formalise their approach. Common practices include assigning cyber oversight to the audit or risk committee, scheduling regular briefings from the CISO, reviewing metrics such as incident trends, vulnerability remediation and third-party risk, participating in tabletop exercises, and approving the incident disclosure process. Minutes should record these activities, because they support both the annual disclosure and the board's defence if questioned after an incident.

Third-party and vendor incidents

An incident at a service provider can be a cybersecurity incident for the registrant if it affects the registrant's information systems or data hosted by the vendor. The SEC said registrants are not expected to conduct additional inquiries beyond their regular channels of communication with vendors, but must disclose information available to them. This puts pressure on vendors to notify customers quickly and provide enough information for a materiality assessment. Listed companies are therefore adding contract terms requiring prompt incident notification, cooperation with investigations, and information sharing.

Is it mandatory or voluntary?

Mandatory for registrants. Disclosures are subject to antifraud provisions, and inaccurate or misleading cyber disclosures can lead to SEC enforcement and shareholder litigation. The SEC has pursued cases involving misleading statements about cyber incidents and weaknesses, including against companies that described risks as hypothetical when incidents had already occurred.

The 2025 to 2026 review

In May 2025, a group of financial industry associations petitioned the SEC to rescind Item 1.05 and the related Form 6-K requirement, arguing that public incident disclosure conflicts with confidential reporting to other regulators and that the delay mechanism is too narrow. In 2026, the SEC opened a broad review of Regulation S-K disclosure requirements, and some commenters urged changes to both Item 1.05 and Item 106. As of October 2026, the SEC had not adopted changes, and companies continued to file under the rules, with dozens of Item 1.05 filings and more Item 8.01 filings since the rules took effect. Companies should continue to comply and track any proposal.

Coordinating with other reporting duties

A single incident may trigger several notification regimes with different clocks and audiences. Public companies may also need to notify sector regulators, such as banking or insurance supervisors, the FTC under the GLBA Safeguards Rule within 30 days for qualifying events, HHS under HIPAA, state attorneys general and affected individuals under state breach laws, and, once its rules apply, CISA under the Cyber Incident Reporting for Critical Infrastructure Act. Some reports are confidential while the SEC filing is public. Incident response plans should map each regime, its trigger, deadline and owner, so legal teams can coordinate consistent, accurate statements.

How to prepare, step by step

1. Update incident response plans with an escalation path to legal, finance and disclosure committees.
2. Define a materiality assessment process, with criteria, decision makers and documentation.
3. Prepare disclosure templates for Item 1.05 and Item 8.01 filings.
4. Strengthen vendor contracts for prompt notification and cooperation.
5. Brief the board regularly on cyber risk and document oversight.
6. Align annual disclosures with actual practices, avoiding overstated claims.
7. Run tabletop exercises that include the four business day timeline.
8. Coordinate with other reporting duties, such as CIRCIA, sector regulators and state breach laws.

What vendors should do

• Notify affected customers promptly, often within 24 to 72 hours, with clear facts.
• Maintain logs and forensic capability to answer customer questions quickly.
• Provide a named incident contact and regular updates.
• Offer evidence of security programmes, such as SOC 2 or ISO/IEC 27001, which customers cite in Item 106 third-party risk disclosures.
• Agree contract terms on notification, cooperation and information sharing.

We build and support systems with centralised logging, monitoring, incident runbooks and prompt customer communication through our maintenance and support service.

Timeline and cost considerations

Most of the work is in governance and process: updating incident response plans, setting up a materiality assessment process, training disclosure committees, preparing templates and documenting board oversight. This can be done within a few months. Technical improvements, such as faster detection, better logging and forensic readiness, may take longer but directly affect how quickly a company can understand an incident and make a sound materiality decision. Legal and forensic retainers arranged in advance save valuable time when an incident occurs.

Lessons from the first filings

Reviews of filings since December 2023 show patterns. Early on, some companies filed under Item 1.05 before determining materiality, which led to the SEC staff's 2024 guidance encouraging use of Item 8.01 for such cases. Many Item 1.05 filings describe ransomware or unauthorised access that disrupted operations, often with follow-up amendments as investigations progressed. Disclosures tend to be brief and avoid technical detail. Companies that prepared templates and decision processes in advance were able to file calmly within the deadline, while others struggled to coordinate legal, technical and communications teams under pressure.

Documentation you will need

• Incident response plan with disclosure escalation.
• Materiality assessment procedure and records.
• Board and committee minutes on cyber oversight.
• Risk management programme descriptions supporting Item 106.
• Vendor risk management records and contracts.
• Disclosure controls and procedures covering cyber.

Common mistakes

• Slow materiality decisions that run up against the four-day deadline.
• Describing risks as hypothetical after incidents have occurred.
• Overstating security practices in annual disclosures.
• No process for vendor incidents.
• Using Item 1.05 for immaterial incidents, contrary to SEC staff guidance.
• Disclosing technical details that help attackers.

How it relates to other frameworks

Framework	Relationship
SOX	Disclosure controls and internal control over financial reporting, which cyber incidents can affect.
COSO	Internal control and ERM frameworks used to integrate cyber risk.
NIST CSF	Framework commonly referenced in Item 106 risk management descriptions.
CIRCIA	Federal law requiring critical infrastructure entities to report incidents to CISA under rules being finalised.
State breach laws	Separate notification duties to individuals and regulators.

Real-world example

A US-listed retailer uses a SaaS order management platform built by an Indian vendor. The vendor detects unauthorised access to a database containing customer orders and notifies the retailer within 24 hours with initial facts and logs. The retailer's incident team escalates to its disclosure committee, which assesses the number of affected customers, likely costs and reputational impact, and determines within days that the incident is material. The retailer files an Item 1.05 Form 8-K within four business days of that determination, without technical details that could aid attackers, and amends it as the investigation progresses.

Next steps

1. Map incident escalation to disclosure decisions.
2. Document a materiality process.
3. Update vendor contracts.
4. Exercise the four-day timeline.
5. Track SEC review developments.

Frequently asked questions

What does Form 8-K Item 1.05 require?

Disclosure of a material cybersecurity incident within four business days after the company determines it is material.

Is the clock four days from discovery?

No. It runs from the materiality determination, which must be made without unreasonable delay after discovery, so companies cannot postpone the decision to avoid filing.

What does Item 106 require?

Annual disclosure of cyber risk management, strategy and governance, including board oversight and management roles.

Do the rules apply to foreign companies?

Foreign private issuers report incidents on Form 6-K and annual information on Form 20-F.

Can disclosure be delayed?

Only if the US Attorney General determines that disclosure poses a substantial risk to national security or public safety.

What about incidents that are not material?

SEC staff guidance says they may be disclosed voluntarily under Item 8.01 rather than Item 1.05.

Do vendor incidents count?

Yes, if they affect the registrant's information systems or data, based on information available through normal communication channels with the vendor.

Has the SEC repealed the rules?

No. Industry groups petitioned for changes and the SEC opened a Regulation S-K review, but the rules remained in force as of October 2026.

Must board members have cyber expertise?

No. The final rule does not require disclosure of board cyber expertise, though it requires describing board oversight.

What are the risks of inaccurate disclosure?

SEC enforcement and shareholder litigation under securities antifraud provisions.

Do private companies need to follow these rules?

No, but companies planning an IPO, and vendors serving listed companies, benefit from adopting similar incident and governance practices.

Who decides whether an incident is material?

Usually a disclosure committee or senior management with legal counsel, informed by the security team, following a documented process.