Item 106 of Regulation S-K requires public companies to describe, in their annual report, how they assess and manage material cybersecurity risk, how the board oversees it, and what role management plays. Engineering does not write the text, but it supplies the facts that make the text true. This is education, not legal advice.
Item 106 is not the incident rule
People mix up two parts of the same SEC package. Form 8-K Item 1.05 is about a single material incident and a short filing clock. Item 106 is the yearly description of how the program works. We cover the incident side in our 8-K guide. This post is about the annual side.
According to the SEC fact sheet on the final rules, Item 106 requires a description of the processes, if any, for assessing, identifying and managing material risks from cybersecurity threats. It also asks whether any such risks, including ones from previous incidents, have materially affected or are reasonably likely to materially affect the company. Disclosure began with annual reports for fiscal years ending on or after December 15, 2023.
The three things the text has to cover
The fact sheet names three areas.
- Processes for assessing, identifying and managing material cyber risk.
- The board's oversight of those risks.
- Management's role and expertise in assessing and managing them.
Each one is a claim someone will sign. If the filing says risks are assessed on a regular cycle, there should be a cycle, a record of it, and an owner.
What engineering should be able to hand over
Legal and finance teams draft. They need inputs they can defend. A useful pack from engineering is short:
- A plain description of how vulnerabilities are found, triaged and fixed, with the real service levels you meet, not the ones in a policy you hope to meet.
- Who owns the program, their reporting line, and how often leadership hears from them.
- How third-party and open source risk is tracked, for example whether you keep an inventory of dependencies.
- How incidents are escalated to the people who decide materiality.
Notice the word "real". Drafting from the policy binder instead of from what actually runs is how filings drift away from reality.
Keep the description and the practice aligned
A few habits help.
Review the draft against evidence. If the text says the board is briefed quarterly, find the calendar entries or the minutes. If it says vulnerabilities are remediated within a window, pull the last two quarters of data.
Avoid absolutes. Phrases like "we prevent" or "we ensure" are hard to support. Describing processes is what the rule asks for.
Update when practice changes. If you retire a scanner or reorganise the security team, tell whoever owns the filing before the next cycle, not after.
Where tooling fits
An inventory of software components, scan history and recorded approvals gives the filing team something concrete to point to. Safeguard's compliance and evidence automation and SBOM and dependency scanning can keep that record current, and you can try a free scan at gold.safeguard.sh/scan. Whether any of it appears in a filing is a decision for your counsel.
Quick check
Does Item 106 require disclosing every incident?
No. Item 106 describes risk management, strategy and governance. Disclosure of a specific material incident sits under Form 8-K Item 1.05.
Who decides what goes in the filing?
Your legal and finance teams, with counsel. Engineering supplies accurate facts about how the program really works.
Sources
Last reviewed: 19 October 2026.
