SEC Cybersecurity Disclosure Rules Explained: Form 8-K Item 1.05 and Item 106

A ransomware attack hits a public company on a Monday. The security team is still containing it when the general counsel asks the question that now matters as much as the technical response: is this material, and if so, when do we have to tell investors?

Since December 2023, US public companies have had a clear answer to that question in the form of the SEC’s cybersecurity disclosure rules. They set a short deadline for reporting material incidents and require companies to explain, every year, how they manage cyber risk and who oversees it.

This guide explains what the rules require, the key deadlines, how companies are applying them in practice and what’s being debated now. This is not legal advice.

What the SEC cybersecurity rules are

On July 26, 2023, the Securities and Exchange Commission adopted final rules titled “Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure” (Release No. 33-11216). They apply to companies that file reports under the Securities Exchange Act of 1934.

The rules have 2 main parts:

1. Incident disclosure: a new Form 8-K Item 1.05 for material cybersecurity incidents.
2. Annual governance disclosure: a new Regulation S-K Item 106, reported in Form 10-K, covering risk management, strategy and governance.

Foreign private issuers have parallel requirements on Form 6-K for incidents and Form 20-F for annual disclosure.

The SEC said disclosure practices had been inconsistent under earlier staff guidance from 2011 and Commission guidance from 2018, and that investors needed consistent, comparable information.

Incident reporting: Form 8-K Item 1.05

Under Item 1.05, a company must disclose any cybersecurity incident it determines to be material. The filing must describe the material aspects of:

• The nature, scope and timing of the incident.
• Its material impact, or reasonably likely material impact, on the company, including its financial condition and results of operations.

The timeline

• Determine materiality without unreasonable delay after discovering the incident.
• File the Form 8-K generally within 4 business days of determining the incident is material.
• File an amended 8-K with any required information that wasn’t determined or available at the time of the first filing, within 4 business days of when it becomes available.

Note what starts the clock: the materiality determination, not the date of the breach. That’s why documented, prompt decision-making matters so much.

The national security delay

Disclosure may be delayed if the US Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the SEC in writing. The rule allows an initial delay of up to 30 days, an additional 30 days, and in extraordinary circumstances a further 60 days, each on written notice from the Attorney General. Beyond that, the SEC may grant relief by exemptive order.

Key takeaway: The 4-business-day clock starts when your company decides an incident is material, and that decision must be made without unreasonable delay. Build the materiality process before you need it, not during a breach.

Annual disclosure: Regulation S-K Item 106

Item 106 requires companies to describe in their annual report on Form 10-K:

• Risk management and strategy: their processes, if any, for assessing, identifying and managing material risks from cybersecurity threats, and whether those risks, including from previous incidents, have materially affected or are reasonably likely to materially affect the business.
• Board oversight: how the board of directors oversees risks from cybersecurity threats.
• Management’s role: how management assesses and manages material cybersecurity risks, and the relevant expertise of those responsible.

Many companies describe frameworks they align with, such as the NIST Cybersecurity Framework or the CIS Critical Security Controls, along with their use of third-party assessors and how they manage risks from vendors.

Key compliance dates

How companies are applying the rules in practice

After the rules took effect, some companies filed Item 1.05 reports for incidents they hadn’t yet found material, or had decided were immaterial, out of caution. In May 2024, the SEC’s Division of Corporation Finance director Erik Gerding issued a statement addressing this.

The statement encouraged companies that want to voluntarily disclose an incident that isn’t material, or not yet determined to be material, to use a different Form 8-K item, such as Item 8.01 (“Other Events”), and to reserve Item 1.05 for material incidents. It said the goal wasn’t to discourage voluntary disclosure, but to avoid confusing investors. A June 2024 follow-up statement addressed how companies can share incident details privately with business partners without running afoul of Regulation FD.

SEC staff have also published Compliance and Disclosure Interpretations (C&DIs) on Item 1.05, including how the Attorney General delay process works and that consulting with the Department of Justice doesn’t by itself make an incident material. Securities counsel will usually review these alongside the rule text.

What’s being debated now

The rules remain controversial. In May 2025, a group of banking and securities industry trade associations, including the American Bankers Association and SIFMA, petitioned the SEC to rescind Item 1.05 and its Form 6-K counterpart. Then, on January 13, 2026, SEC Chairman Paul Atkins announced a comprehensive review of Regulation S-K and invited public comment on refocusing disclosure on material information. Some commenters have asked the SEC to eliminate Item 106 or rescind Item 1.05.

As of this writing, the SEC has not adopted any change to the cybersecurity disclosure rules, and they remain in effect. That may change. Check the SEC’s rulemaking activity page and press releases for current status before relying on any summary, including this one.

How to prepare: a step-by-step plan

Whether you’re a public company or preparing for an IPO, here’s a practical sequence.

1. Map the rules to owners. Assign responsibility across security, legal, finance, investor relations and the board.
2. Build a materiality framework. Define who decides, what factors they weigh (financial, operational, legal, reputational, customer impact) and how quickly they must meet after an incident is escalated.
3. Update your incident response plan. Add escalation triggers that bring legal and disclosure counsel in early. Our guide on how to create an incident response plan covers the core structure.
4. Document every decision. Record when the incident was discovered, when it was escalated, who decided on materiality and why.
5. Pre-draft disclosure templates. Prepare Item 1.05 and Item 8.01 shells so counsel isn’t starting from a blank page under deadline pressure.
6. Strengthen third-party risk management. Many incidents start at vendors; see our explainer on supply chain attacks.
7. Brief the board regularly. Item 106 asks how the board oversees cyber risk, so make that oversight real and documented.
8. Run tabletop exercises that include the disclosure decision, not just the technical response.
9. Align with your insurer. Check notification requirements in your policy; our guide to cyber insurance requirements explains common conditions.

How the SEC rules fit with other reporting duties

The SEC rules sit alongside, not instead of, other obligations. Depending on your industry and location, you may also have to notify state regulators and affected individuals under state breach laws, report to sector regulators, or meet contractual notice duties to customers. Critical infrastructure companies should also watch CISA’s rulemaking under the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA). CISA says reports under CIRCIA aren’t required until its final rule takes effect, and that rule hadn’t been published as of this writing, so check CISA’s CIRCIA page for updates.

Private companies aren’t subject to these SEC rules, but many are asked about cyber governance by investors, lenders and enterprise customers. Frameworks such as SOC 2 often fill that role.

Conclusion

The SEC’s cybersecurity rules turned cyber incidents into a disclosure issue as well as a technical one. Public companies need a fast, documented way to decide materiality, a ready path to file within 4 business days and an honest annual account of how they manage cyber risk. The rules are under review, so keep an eye on the SEC for changes, but build the process now. This is not legal advice; work with securities counsel on your specific obligations.

Sources

• SEC Press Release 2023-139: SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure — adoption date and summary of requirements
• SEC Fact Sheet: Public Company Cybersecurity Disclosures; Final Rules — materiality timing, Attorney General delay, compliance dates
• SEC Final Rule Release No. 33-11216 — full rule text including amended 8-K instruction
• SEC: Statement by Erik Gerding on disclosure of cybersecurity incidents (May 21, 2024) — use of Item 8.01 for immaterial or undetermined incidents
• SEC: Statement by Chairman Atkins on reforming Regulation S-K (Jan. 13, 2026) — ongoing Regulation S-K review
• SEC: Joint petition for rulemaking to amend cybersecurity disclosure rules (File 4-856) — industry request to rescind Item 1.05