Public companies subject to the SEC's cybersecurity rules must file a Form 8-K under Item 1.05 for a cybersecurity incident they determine to be material. The filing is generally due four business days after that materiality determination, not four days after the incident itself.
The clock starts at materiality
The SEC's description says the 8-K is due "four business days after a registrant determines that a cybersecurity incident is material." That makes the determination process important. A company needs a way to assess materiality quickly and in good faith, with a record of who decided and why.
What the filing describes
The SEC says the filing must cover the material aspects of the incident's nature, scope and timing, and its material impact or reasonably likely material impact on the company. The company is not asked for technical detail that would help attackers.
The national security delay
Disclosure may be postponed if the U.S. Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the SEC in writing. That is an exception handled between agencies, not something a company can claim for itself.
Annual disclosures
The same rules add yearly disclosures in Form 10-K under Regulation S-K Item 106. According to the SEC, these cover:
- processes for assessing, identifying and managing material cybersecurity risks
- the material effects, or reasonably likely material effects, of cyber risks and past incidents
- board oversight of cyber risk
- management's role and expertise
How to prepare
- Add a materiality assessment step to your incident plan, with a named owner from legal or finance.
- Keep a timeline of when the team learned what. Your records will be read later.
- Align incident severity levels with the questions a disclosure committee asks.
- Practice it in a tabletop exercise with legal and investor relations present. See how to run a tabletop exercise.
What this post does not cover
It summarizes the SEC's press release. It does not cover foreign private issuers, later SEC guidance or staff interpretations. If you file with the SEC, ask securities counsel for the current position.
A materiality workflow you can write down
The rule turns on a judgment, so give the judgment a shape.
- The incident lead tells the disclosure group when an incident is confirmed and shares what is known.
- The group lists the factors it will weigh, such as impact on operations, customers and data, and likely financial effect.
- Someone records the decision, the time and the reasons, even if the answer is "not yet material".
- The group reconvenes on a schedule while facts develop, because early answers change.
- If the answer is yes, securities counsel prepares the filing and the four business day clock is tracked from the recorded time.
Keep the engineers' technical timeline separate from the legal record, and make sure they agree on the facts. Mismatched timelines are the first thing outsiders notice.
Quick check
Do private companies have to file an 8-K?
The rule applies to companies that file with the SEC. Private companies may still face contract and state law duties.
Is it four days from discovery?
No. The SEC describes it as four business days from the determination that the incident is material.
Sources
Last reviewed: 19 October 2026.
