SEC cyber disclosure rules

Two obligations, one rule#

The SEC adopted the rules on July 26, 2023 (Release No. 33-11216), published at 88 Fed. Reg. 51896, effective September 5, 2023. They create two distinct duties that are routinely conflated.

Incident disclosure — Form 8-K Item 1.05. If a company experiences a cybersecurity incident it determines to be material, it must describe the material aspects of the incident's nature, scope and timing, and its material impact or reasonably likely material impact, including on financial condition and results of operations. The filing is due within four business days after the company determines the incident is material.

Periodic disclosure — Regulation S-K Item 106. Each Form 10-K carries a new Item 1C describing the company's processes, if any, for assessing, identifying and managing material risks from cybersecurity threats; whether such risks, including from prior incidents, have materially affected or are reasonably likely to materially affect it; the board's oversight; and management's role and expertise. Item 106(b)(1) specifically asks whether the company has processes to oversee cybersecurity risks associated with its use of any third-party service provider.

The second obligation is where a company's own words become evidence about the first: a description of controls the internal record does not support is the gap regulators and plaintiffs look for, and it is what the SolarWinds litigation below was about.

Which filing, when#

Compliance with Item 1.05 began December 18, 2023 for most registrants; smaller reporting companies were given until June 15, 2024.

The determination clock is the hard part#

The four business days run from the materiality determination, and Instruction 1 to Item 1.05 requires that determination to be made "without unreasonable delay after discovery of the incident." A company cannot extend the deadline by declining to decide.

This creates real pressure, because materiality frequently depends on facts the forensic investigation has not yet established — principally what data was taken and whose. The rule anticipates that: Instruction 2 lets a company file with a statement that required information is not yet determined or unavailable, then amend within four business days of learning it. What it does not permit is waiting for the investigation to finish before deciding.

The Division of Corporation Finance addressed the opposite problem in May 2024. Because an Item 1.05 filing signals a conclusion that the incident is material, the Division encourages companies disclosing an unassessed or immaterial incident to use a different item, such as Item 8.01 — otherwise "there is a risk that investors will misperceive immaterial cybersecurity incidents as material, and vice versa."

What the materiality determination needs from the forensic investigation in the first four business days#

The determination is a judgment for counsel and the board, but it is made on facts only the examination can supply. The disclosure committee needs answers, or documented non-answers, to five questions within the first days:

• Scope of access. Which systems, accounts and environments the intruder reached, and whether the evidence supports a boundary. "We have found no evidence of" is a very different finding from "the logs needed to answer this do not exist."
• Exfiltration. Whether data left the environment, in what volume, and of what kind. Confirmed outbound transfer, staged archives and a known exfiltration tool each carry different weight; missing egress logging is itself a fact the determination must account for.
• Systems affected and their business function. Materiality turns on impact, so the inventory of affected hosts has to be mapped to what those hosts do — production, finance, customer data, source code.
• Containment status. Whether the intruder's access has been cut off and how that is known. An unresolved intrusion changes both the impact analysis and what Instruction 4 lets the company withhold.
• Timing. First evidence of compromise, first detection, and the interval between — the interval is what a regulator later tests against "without unreasonable delay."

The document that supports the determination afterwards is a written, contemporaneous forensic timeline: dated entries recording what was examined, what was found, and what could not be established and why, built from preserved forensic images and logs held under chain of custody. A determination reached on Tuesday is defended years later by showing what was known on Tuesday; without that record, the company is reconstructing its own knowledge from memory, which is where hindsight arguments are lost.

What Item 1.05 does not require#

• Technical detail. Instruction 4 states that a registrant need not disclose "specific or technical information about its planned response to the incident or its cybersecurity systems, related networks and devices, or potential system vulnerabilities in such detail as would impede the registrant's response or remediation of the incident."
• A fraud finding for a late filing. Exchange Act Rules 13a-11(c) and 15d-11(c) provide that a failure to file a report required solely under Item 1.05 is not by itself deemed a violation of Section 10(b) and Rule 10b-5, and Form S-3 eligibility survives an untimely Item 1.05 report.
• A cyber-specific materiality test. The standard is the ordinary securities one: whether a reasonable investor would consider it important. The Division's May 2024 statement stresses qualitative factors alongside quantitative ones — harm to reputation, customer or vendor relationships or competitiveness, and the possibility of litigation or regulatory action.

Enforcement posture#

SEC v. SolarWinds Corp. The SEC sued SolarWinds and its CISO in the Southern District of New York on October 30, 2023 over the company's statements about its cybersecurity practices before and after the December 2020 SUNBURST attack. On July 18, 2024, Judge Engelmayer granted the motion to dismiss "in large part": the securities-fraud claims based on the company's website Security Statement survived as "viably pled as materially false and misleading in numerous respects," while the claims based on other statements and filings, all claims about the post-SUNBURST Form 8-K disclosures (which "impermissibly rely on hindsight and speculation") and the internal accounting-controls and disclosure-controls claims were dismissed. The court noted the 2023 rules were not implicated because the conduct predated them. On November 20, 2025, the parties filed a joint stipulation dismissing the action with prejudice, which the Commission described as an exercise of its discretion that "does not necessarily reflect the Commission's position on any other case."

The four SolarWinds-customer settlements. On October 22, 2024, the SEC announced settled cease-and-desist orders against Unisys ($4 million), Avaya ($1 million), Check Point ($995,000) and Mimecast ($990,000) over their disclosures about intrusions connected to the SolarWinds compromise — alleging, for example, that Unisys described cybersecurity risks as hypothetical after two intrusions involving exfiltration of gigabytes of data, and that Avaya reported access to a "limited number" of emails when it knew at least 145 files in its cloud file-sharing environment had also been accessed. Each settled without admitting or denying the findings. Commissioners Peirce and Uyeda dissented from all four, objecting to hindsight review and reliance on immaterial details.

The tension with the investigation#

Disclosing details of an ongoing incident can compromise the response, which is why the rule asks for nature, scope, timing and impact rather than technical specifics. There is a related conflict with trade secret protection: describing what was taken can reveal what the company treated as valuable. Both are easier to manage when the incident response team and the disclosure team have worked from the same timeline since day one.