SEC Form 8-K Item 1.05 and ransomware: when disclosure is due

For US public companies, the SEC's 2023 rules say an Item 1.05 Form 8-K is generally due four business days after the company determines a cybersecurity incident is material. The clock starts at that determination, not at the first sign of attack. This is not legal advice.

What the SEC adopted

The SEC adopted its cybersecurity disclosure rules on 26 July 2023. Two parts matter for ransomware:

• Form 8-K Item 1.05. Registrants disclose cybersecurity incidents they determine to be material, describing the nature, scope and timing, and the material or reasonably likely material impact.
• Regulation S-K Item 106. In the annual report, registrants describe their processes, if any, for assessing, identifying and managing material risks from cybersecurity threats, plus board oversight and management's role and expertise.

The release also notes the US Attorney General can delay disclosure for national security or public safety reasons.

Where ransomware fits

A ransomware event is a cybersecurity incident. Whether it is material is a judgement the company makes, usually with counsel, looking at effects on operations, finances and customers. The press release does not define a ransomware threshold, so do not assume that encryption alone, or a ransom amount, settles the question.

Why the timing matters

The four business day window runs from the materiality determination, so a process that reaches a decision quickly is worth building:

1. Assign who assesses materiality, and who must be in the room.
2. Define the facts you need: affected systems, data theft, operational downtime, customer impact.
3. Keep a log of when information arrived and when decisions were made.
4. Prepare a disclosure template ahead of time.

Link it to your incident plan

Your response plan should connect technical triage to the disclosure team. The technical lead who finds out that data was copied needs a route to the people who decide on materiality, because it can change the assessment.

The annual side

Item 106 expects you to describe your risk management processes. A tested ransomware plan, with documented backup tests and exercises, gives you something accurate to say. Do not describe processes you do not operate.

Common pitfalls

• Treating the technical incident ticket as separate from the disclosure decision.
• Waiting for every forensic fact before making any materiality assessment.
• Writing a disclosure that describes controls you do not operate.
• Forgetting that third party systems hold your data and may be the incident's source.

These are planning points, not SEC statements. Your securities counsel owns the details.

Quick check

Sources

• SEC press release 2023-139

Last reviewed: 19 October 2026.