SEC Cyber Disclosure Rules: What Public Companies Must Do Now

The SEC's cybersecurity disclosure rules, adopted in July 2023 and effective for most companies starting December 2023, represent the most significant regulatory shift in how public companies handle cyber incidents. For the first time, public companies must disclose material cybersecurity incidents within four business days of determining materiality—and provide annual disclosures about their cybersecurity risk management and governance.

This isn't just a legal compliance issue. It fundamentally changes how security teams, legal departments, and executive leadership must coordinate during and after a cyber incident.

The Four-Day Clock

The headline requirement is straightforward: once a company determines that a cybersecurity incident is material, it must file an 8-K disclosure with the SEC within four business days.

But the simplicity is deceptive. The four-day clock starts ticking not when the incident occurs, but when the company determines it's material. That determination process is where things get complicated.

Material doesn't just mean "we lost a lot of data." Under SEC rules, an incident is material if there's a substantial likelihood that a reasonable investor would consider it important in making an investment decision. This includes:

• Direct financial losses
• Business disruption
• Reputational harm
• Litigation exposure
• Regulatory penalties
• Impact on operations or financial condition

For supply chain attacks, materiality assessment gets especially tricky. If a compromised dependency affects your software, you need to determine: Was customer data exposed? Were systems compromised? Could the vulnerability be exploited? What's the blast radius?

What Must Be Disclosed

The 8-K filing (under new Item 1.05) must describe:

• The nature, scope, and timing of the incident
• The material impact or reasonably likely material impact on the company, including its financial condition and operations

Notably, the SEC does not require companies to disclose specific technical details that could compromise their security response. You don't need to reveal your incident response playbook or the specific vulnerability exploited. But you do need to provide enough information for investors to understand the significance of the incident.

Annual Disclosure Requirements

Beyond incident reporting, the rules require annual disclosures in 10-K filings about:

Risk Management and Strategy

• Processes for identifying, assessing, and managing cybersecurity threats
• Whether cybersecurity risks have materially affected the company
• How cybersecurity risk management integrates with overall enterprise risk management

Governance

• Board oversight of cybersecurity risks
• Management's role in assessing and managing cybersecurity risks
• Relevant expertise of management or board members

These annual disclosures mean that cybersecurity governance is now part of the public record. Investors, analysts, and competitors can all see how a company approaches cybersecurity risk.

The Supply Chain Dimension

The SEC rules explicitly include risks from third-party service providers and supply chain relationships. Companies must consider:

• Third-party risk exposure — are your vendors and suppliers a source of material cybersecurity risk?
• Supply chain incident impact — if a vendor is compromised, can you assess materiality quickly enough to meet the four-day timeline?
• Dependency visibility — do you know what software components are in your products and where they come from?

This is where the rules intersect directly with software supply chain security. A company that doesn't track its software dependencies can't quickly assess the impact of a supply chain compromise. And if you can't assess impact quickly, you can't determine materiality, which means you can't start the four-day clock—which creates its own legal risk.

Consider a scenario: a critical vulnerability is discovered in a widely-used open-source library. If your company uses that library in customer-facing products, you need to rapidly determine:

1. Do we use this component?
2. Where is it deployed?
3. Is the vulnerability exploitable in our context?
4. What customer data or systems are at risk?
5. Does this constitute a material incident?

Without automated dependency tracking and SBOM management, answering these questions takes days or weeks—time you don't have under the SEC rules.

Operational Implications

The disclosure rules create several operational imperatives:

Materiality determination process. Companies need a defined, documented process for determining whether a cybersecurity incident is material. This process should involve security, legal, finance, and executive leadership. It should be rehearsed and tested, not invented during an actual incident.

Incident response acceleration. The four-day timeline means that incident investigation and materiality assessment need to happen in parallel, not sequentially. Security teams can't spend two weeks investigating before handing off to legal for materiality analysis.

Supply chain visibility. Companies need real-time visibility into their software supply chain. When a new vulnerability drops, the question "are we affected?" needs an answer in hours, not weeks.

Board preparation. Boards need regular briefings on cybersecurity risks, not just during incidents. The annual disclosure requirements mean that board members' understanding (or lack thereof) of cybersecurity is now part of the public record.

Cross-functional coordination. Security, legal, investor relations, and executive leadership all need to be aligned on how cyber incidents will be handled. The four-day clock doesn't leave time for organizational confusion.

Early Patterns

Several months into the new rules, some patterns are emerging:

• Companies are erring on the side of disclosure, filing 8-Ks for incidents that might not be material, to avoid the risk of under-reporting
• Materiality determinations are taking longer than expected, as companies work through the intersection of technical assessment and financial impact analysis
• Supply chain incidents are proving particularly challenging, because the blast radius is often unclear in the early days

Practical Steps

For companies subject to these rules:

1. Build your materiality framework now. Don't wait for an incident. Define what material means for your organization, with specific criteria and thresholds.

2. Integrate supply chain visibility. Ensure you can quickly answer "are we affected?" when new vulnerabilities or supply chain compromises emerge.

3. Rehearse the process. Run tabletop exercises that simulate a supply chain compromise and walk through the materiality determination and disclosure timeline.

4. Update board reporting. Begin regular cybersecurity risk briefings for the board if you haven't already. The annual disclosure requirements make this mandatory in practice.

5. Coordinate legal and security. Ensure your legal team understands the technical aspects of cybersecurity incidents and your security team understands the materiality framework.

How Safeguard.sh Helps

Safeguard.sh gives public companies the supply chain visibility required to meet SEC disclosure timelines. When a new vulnerability emerges, Safeguard.sh instantly identifies which products, versions, and deployments are affected—turning a multi-week investigation into a same-day assessment. With comprehensive SBOMs, continuous vulnerability monitoring, and automated impact analysis, Safeguard.sh helps security and legal teams answer the materiality question quickly and confidently, keeping you on the right side of the four-day clock.