A public company must file Form 8-K Item 1.05 within four business days after it determines a cybersecurity incident is material. The clock starts at that determination, not at discovery, and the determination must be made without unreasonable delay. Engineering's job is to make that decision fast and well informed.
What the rule actually says
The SEC small business guide states that a domestic registrant files within four business days of the materiality determination. The filing describes the material aspects of the incident's nature, scope and timing, and its material impact or reasonably likely material impact, including on financial condition and results of operations.
It does not require technical details about the response or about systems that would impede remediation. That matters for how you brief the legal team: they need facts about scope and impact, not a packet capture.
The same rules add an annual disclosure in Regulation S-K Item 106, in the Form 10-K. It covers processes for assessing and managing material cybersecurity risks, board oversight and management's role.
Who is covered
The SEC lists domestic registrants and foreign private issuers subject to Exchange Act reporting, plus business development companies. Foreign private issuers use Form 6-K. Registered investment companies, Form 40-F filers under the Multijurisdictional Disclosure System and asset backed issuers are excluded. A private fintech that is not a registrant is not directly covered, but its public customers may ask for the same facts quickly.
What to have ready
Materiality is a legal and business call, but it rests on data engineers hold. Prepare these in advance.
- An asset inventory that says which systems hold what data.
- A clear map of production dependencies, including third party and open source components.
- Log retention long enough to establish when an intruder arrived.
- A way to say how many customers or records could be affected.
- A named person who can brief counsel in hours, not days.
The delay provision
Disclosure may be delayed if the Attorney General determines that it poses a substantial risk to national security or public safety and notifies the SEC in writing. The initial delay is up to 30 days, extendable by up to 30 more. A further delay of up to 60 days is possible in extraordinary circumstances, only for national security. Do not plan around this. It is rare and not yours to invoke.
A practical drill
Run a tabletop where the question is "can we decide materiality by Thursday?" Time how long it takes to answer scope questions. The gaps you find are almost always inventory and logging gaps.
Safeguard's asset discovery and SBOM scanning can help answer "what do we run and what is it built from". Confirm legal conclusions with counsel.
Quick check
Does the four day clock start when we discover the incident?
No. Per the SEC guide it starts when the company determines the incident is material, though that determination must be made without unreasonable delay.
Sources
Last reviewed: 19 October 2026.
