The SEC Cyber Disclosure Rules: Item 1.05 and Item 106

The call that starts this problem rarely sounds like a securities question. The security team says the intrusion is contained, the forensics firm has a preliminary picture, and someone asks whether any of this has to be filed. If the company reports to the Securities and Exchange Commission, a clock started somewhere inside that conversation, and nobody outside the company can tell you exactly when.

What Are the SEC Cyber Disclosure Rules?

Two disclosure requirements bolted onto forms public companies already file, adopted together on July 26, 2023 to replace interpretive guidance that had produced disclosure the Commission found inconsistent.

The first is event driven. A registrant that determines a cybersecurity incident is material files a Form 8-K under Item 1.05 describing the incident and its impact. The second is periodic. Every annual report carries a section added by Item 106 of Regulation S-K describing how the company assesses and manages cybersecurity risk and who oversees it. Foreign private issuers get parallel obligations: material incidents on Form 6-K, the annual description in Item 16K of Form 20-F.

These are rules about disclosure, not about security. Nothing in either item tells you to run multi-factor authentication or patch on a schedule, and the standard the Commission enforces is accuracy rather than adequacy of defense.

The trigger is also a determination rather than an incident. The SEC's own small entity compliance guide says the deadline is tied not to discovery but to the registrant's determination that the incident is material. That is the compliance problem in one sentence, because the company controls the determination and the Commission gets to review how long it took.

Who Has to Comply With the SEC Cybersecurity Rules?

Every company subject to the reporting requirements of Section 13 or 15(d) of the Securities Exchange Act of 1934, plus business development companies. Form 40-F filers under the Multijurisdictional Disclosure System are outside them, as are asset-backed issuers and registered investment companies.

Private companies sit outside the rules and get pulled back in sideways. A vendor to a registrant finds its notification clause rewritten so the customer can make its own materiality call inside four business days, which means notice in hours. That pressure is changing private company practice faster than the state breach notification statutes have.

A smaller reporting company here is an issuer with a public float under $250 million, or annual revenues under $100 million with either no public float or a float under $700 million.

What Item 1.05 of Form 8-K Requires

Less than most people expect, with more judgment attached.

Read Instruction 4 twice, because it answers the objection security teams raise first. The rule does not ask you to publish the intrusion vector, the malware family or the systems still being rebuilt. Filings that comply are short and read as descriptions of business impact rather than incident reports.

The amendment obligation surprises people. An initial filing may say the impact is not yet known, and it cannot stay that way, because once the number exists the clock runs again.

Getting this right depends less on legal skill than on whether the incident response plan names who makes the call, on what evidence, and how it is recorded.

What Counts as a Material Cybersecurity Incident?

Materiality here is the ordinary securities standard, not a severity rating. Information is material if there is a substantial likelihood a reasonable shareholder would consider it important in making an investment decision, or if it would significantly alter the total mix of information available. The compliance guide points registrants at that line of Supreme Court authority and tells them to weigh quantitative and qualitative factors together.

The incident itself is defined broadly. Item 106(a) of Regulation S-K defines a cybersecurity incident as an unauthorized occurrence, or a series of related unauthorized occurrences, on or conducted through a registrant's information systems that jeopardizes the confidentiality, integrity or availability of those systems or any information residing on them. That middle phrase catches companies out: a run of small intrusions by the same actor is assessed as one incident.

Paying a ransom does not end the analysis. The staff addressed it in Question 104B.05 of the Form 8-K compliance and disclosure interpretations: where a registrant makes a ransomware payment and the attacker ends the disruption or returns the data before the determination is made, the registrant still has to make that determination, and cannot conclude the incident is immaterial simply because the disruption stopped.

When Can a Company Delay Disclosure?

There is one narrow exception, and it belongs to the Attorney General rather than to the company.

The process runs through law enforcement rather than the SEC. The Department of Justice's material cybersecurity incident delay determinations guidelines, issued December 12, 2023, tell registrants to contact the FBI immediately with a concise description of why disclosure would create the risk. The guidelines are candid that the categories are narrow, and that the question is whether the public disclosure threatens national security or public safety, not whether the incident does.

Timing is unforgiving. The Attorney General has to invoke the delay inside the same four business day window, so the guidelines press registrants to raise it well before the materiality analysis is finished. Question 104B.01 closes the gap: requesting a delay does not change the filing obligation, and a registrant may delay only if the Attorney General determines and notifies the Commission in writing before the Form 8-K would otherwise be due.

What Form 10-K Item 106 Requires

The annual half attracts less attention and absorbs more effort, because it has to be written, reviewed and tagged every year whether or not anything happened.

Notice what is absent. Item 106(c) asks about management's expertise and the board's oversight. It never asks whether any director has cybersecurity expertise.

The practical effect of 106(b)(1) is that a company has to have processes it can describe. Most answer by naming a recognized framework, and describing the program against the NIST Cybersecurity Framework is the common approach because its functions give the disclosure a shape a reader can follow. The third-party clause pulls vendor risk work into the filing, which is why so many 10-K sections now describe a supplier assessment process that did not exist before 2024.

Nothing in the governance paragraph forbids an outsourced CISO arrangement, and plenty of registrants disclose one. It does mean the arrangement, the reporting line and the cadence of board updates become public.

Item 1.05 vs Item 8.01 for Cybersecurity Incidents

For the first year, registrants used Item 1.05 for incidents they had not determined were material, often adding a line saying no material impact was expected. That drained the item of meaning. On May 21, 2024 the Director of the Division of Corporation Finance issued a statement on which item to use: Item 1.05 is not a voluntary disclosure and is by definition material, because it is not triggered until the company determines the incident is material. A company disclosing an incident it has not so determined was encouraged to use a different item, for example Item 8.01.

Genuinely material cyber incidents at public companies are rarer than the volume of breach headlines suggests, and voluntary disclosure has become the normal route. That is the argument now being made against keeping Item 1.05 at all.

What Are the Penalties for SEC Cyber Disclosure Failures?

There is no fine schedule. A missed or late Item 1.05 filing violates the reporting provisions in Section 13(a) of the Exchange Act and the rules under it, and the Commission can seek civil penalties and a cease and desist order. No per-day amount is published anywhere.

One carve-out is regularly misstated. Under Rule 13a-11(c), no failure to file a Form 8-K required solely under Item 1.05, among other items, is deemed a violation of Section 10(b) and Rule 10b-5. Missing the filing is not by itself securities fraud. Saying something false in it is a different matter, and that is where the exposure has always been.

The enforcement record is the only useful yardstick. On October 22, 2024 the Commission charged four companies over disclosures relating to the SolarWinds compromise, announcing settled civil penalties of $4 million for Unisys, $1 million for Avaya, $995,000 for Check Point Software Technologies and $990,000 for Mimecast. The theme across all four was minimization: describing risk as hypothetical while knowing an intrusion had occurred, or narrowing the scope of what an attacker reached. None turned on filing late.

Are the SEC Cyber Disclosure Rules Going Away?

Not so far, and planning on it would be a mistake. The requirement is live and registrants are filing under it.

There is a serious effort to remove part of it. On May 22, 2025 the Commission received a joint petition for rulemaking, file number 4-856 asking it to rescind the Form 8-K Item 1.05 and Form 6-K incident requirements. The petitioners are banking and securities industry associations, and their argument is that public disclosure on a four day clock cuts against the confidential reporting channels built to protect critical infrastructure and warn other potential victims. Anyone running compliance in a regulated institution feels that tension, since the same incident already reports to banking and insurance regulators on their own timetables.

A petition is not a rule change, and Item 106 is not part of the request, so the annual disclosure survives even a full grant. Until the Commission proposes something, keep the process running.

How to Prepare for SEC Cyber Disclosure