Under the SEC’s final cyber rule, the clock starts at a decision, so the decision needs a record

The week

On July 26, 2023, the Securities and Exchange Commission adopted rules on cybersecurity risk management, strategy, governance and incident disclosure for public companies. The heart of the change was a new section of Form 8-K, the short “current report” companies file to tell investors about significant events between their regular quarterly and annual reports. The new section, Item 1.05, required a company to disclose a material cybersecurity incident within four business days of the company determining that it is material.

The vote was three to two. Commissioners Hester Peirce and Mark Uyeda dissented, arguing among other things that the rules were too prescriptive and that disclosure during an active incident could help attackers. The final rules came 16 months after the SEC proposed them in March 2022, and after extensive public comment in which companies, law firms and security professionals pushed back on several elements.

The question that starts that clock usually arrives at an awkward hour. A listed company’s security team spots something wrong: an intruder in the network, files locked, perhaps data leaving the building. Within hours, a question lands on the general counsel’s desk that used to be easy to postpone: is this important enough that investors need to know? The new rule made it much harder to postpone.

“Material” is a term of art in securities law. Roughly, it means information a reasonable investor would consider important when deciding whether to buy, sell or hold a stock. A cybersecurity incident is any unauthorized event that threatens a company’s computer systems or the information in them, from a ransomware attack that locks files to an unnoticed theft of customer records.

The rule spelled out what the filing must say. A company must describe the material aspects of the incident’s nature, scope and timing. It must also describe the material impact, or reasonably likely material impact, on the company, including on its financial condition and results of operations. It need not disclose technical details of its response or its vulnerabilities that would impede the response. Information not yet known or available at filing could be added later by amending the 8-K.

The rule left very little room for delay. A company could hold back its disclosure only if the U.S. Attorney General found that disclosing it posed a substantial risk to national security or public safety. Even then, the delay ran for an initial period of up to 30 days, with limited extensions after that. Telecommunications carriers bound by the Federal Communications Commission’s customer data breach rules received a narrow, separate allowance. The company’s own wish for more time was not, by itself, a reason the rule recognized.

The SEC’s definition of an incident was also broad. It covered “a series of related unauthorized occurrences,” so a string of small intrusions by the same actor could together amount to a material incident. Companies could not treat each event in isolation.

The rules did more than set an incident deadline. They also required companies to describe, every year in their Form 10-K annual report, their processes for assessing and managing cyber risk, and how the board and management oversee that risk. Investors would now get a standing account of how each company governs cybersecurity, as well as a notice when something goes wrong.

That annual description, in a new Item 106 of Regulation S-K, covered processes for identifying and managing material cyber risks, and whether past incidents had materially affected the company. It also covered the board’s oversight and management’s role and expertise. Foreign private issuers received parallel requirements through Forms 6-K and 20-F. Both the incident filings and the annual descriptions would later have to be tagged in Inline XBRL, a machine-readable format, after a one-year phase-in.

The final rules were narrower than the proposal in other ways. The draft would have required updates on previously disclosed incidents in quarterly and annual reports. The final rules instead relied on amendments to the original 8-K. The draft would also have required disclosure when a series of individually immaterial incidents became material in the aggregate. The final rules folded that idea into the definition of an incident instead. For many companies, the 8-K would now be the first public word of an incident, ahead of any customer letter.

One element of the SEC’s 2022 proposal did not survive. The draft had asked companies to disclose whether their board members had cybersecurity expertise. The final rules dropped that requirement, which many directors had watched closely.

The rules took effect in September 2023. Annual disclosures applied to fiscal years ending on or after December 15, 2023. Incident reporting began on December 18, 2023, and on June 15, 2024 for smaller reporting companies. From then on, the clock was real, and the moment that started it was a decision made by people inside the company.

The 2022 proposal had asked boards to describe their own oversight of cyber risk. The final rule kept that annual description in lighter form. Its sharper change was elsewhere, and it is easy to miss on a first reading.

The four-business-day clock does not start when a company discovers an incident. It starts when the company determines the incident is material, and the SEC said that determination must be made without unreasonable delay. That sounds like a technicality, but a rule that starts the clock at a decision turns the decision into the thing regulators, investors and plaintiffs will examine later. If the clock ran from discovery, the facts of the attack would set the deadline. Because it runs from a judgment, the quality and timing of that judgment become the company’s exposure.

Three things about that decision matter: who makes it, what record it leaves, and how it fits with the other notification clocks a regulated company already runs. Before those comes the groundwork of what actually happens inside a company when an incident begins.

After those three come the stakes: what rides on the decision for the company and the people who make it. The last two parts are practical. One describes the habits of companies that handle the decision well. The other sets out how a director can test readiness before the first night of an incident.

What a cyber incident looks like from the inside

Most leaders picture a cyberattack as a single dramatic moment. Usually it unfolds over days. The first sign is usually small: an alert from a monitoring tool, an employee who cannot open files, a customer who reports a strange email. The security team, often led by a chief information security officer (CISO), starts an investigation. Their first job is scoping: working out which systems are affected, how the intruder got in, and whether they are still inside.

Two kinds of attack dominate the headlines. Ransomware is malicious software that scrambles a company’s files so they cannot be used, followed by a demand for payment to unscramble them. Data exfiltration is the covert copying of information out of the company, such as customer records or trade secrets. Modern attackers often do both: they copy the data first, then lock the systems, and threaten to publish what they took if the company does not pay.

This matters for the SEC rule because the picture changes over days and weeks. On day one, the company may know only that some servers are encrypted. On day ten, a forensic firm, an outside specialist that examines compromised systems, may discover that millions of customer records were copied a month earlier. An incident that looked contained can become serious overnight. The rule asks companies to make a judgment on moving ground, and to keep making it as the ground shifts.

Suppose a mid-sized insurer’s claims system goes down on a Monday. By Wednesday the security team confirms ransomware on a few dozen servers and believes backups are intact. Operations will be slow for a week. Is that material? Perhaps not. The following Tuesday, the forensic firm finds evidence that policyholder medical records were copied before the encryption. Now the regulatory, reputational and litigation picture is very different. The company needs a process that can reach a sound answer on the first set of facts, revisit it on the second, and show its work both times.

The first 96 hours

The first four days of a serious incident follow a recognizable pattern, and several decisions in it shape the later disclosure. Containment comes first: isolating affected machines, disabling compromised accounts, resetting credentials and blocking known attacker infrastructure. Each step can tip off the attacker, so the security team weighs speed against the risk of prompting a destructive response.

Within the same window, the company typically engages outside counsel and a forensic firm. It notifies its cyber insurer and contacts law enforcement. It also decides how to communicate internally if email or chat may be compromised. Many companies keep a separate, out-of-band channel for exactly this reason.

Evidence preservation runs alongside all of this. Logs roll over, cloud audit trails expire and machines get rebuilt. A company that wipes and restores quickly may later find it cannot say what the attacker took, which makes any materiality judgment harder to support.

The insurer’s place in the room

Cyber insurance policies usually require prompt notice and often specify approved vendors for forensics, legal advice and negotiation. That brings a third party into decisions from the first day. It can speed things up, because the vendors are pre-contracted. It can also create tension, for instance when the insurer’s preferred firm differs from the one the company would choose. These terms are best read before an incident, with counsel, rather than during one.

Seeing incidents as a series

Because the SEC’s definition covers a series of related occurrences, the committee needs visibility across incidents as well as within each one. A phishing campaign that compromises a dozen accounts over a quarter may be minor each time and significant together. The security team should flag repeat actors, repeated techniques and repeated targets, so that someone asks whether the pattern itself is material.

Ransom decisions belong in the record

A ransom demand adds a decision with its own legal edges. The Treasury’s Office of Foreign Assets Control has warned, most recently in an updated advisory in 2021, that paying a ransom to a sanctioned person or group can violate sanctions law. Companies regulated by New York’s financial regulator must now report an extortion payment within 24 hours. Whether to pay, and on what advice, is also a fact a materiality committee should weigh, because a payment says something about how badly operations were hit. The record should show who made that call, on what information and with which advisers.

Who decides

Materiality in securities law is a judgment about what a reasonable investor would consider important in the total mix of information. It weighs qualitative factors such as harm to reputation, customer relationships, litigation and regulatory exposure, as well as immediate financial loss. A breach that costs little in cash can still be material if it damages trust in a company whose business depends on trust.

That creates an organizational problem. Security teams can scope an incident technically. They are not trained to judge materiality. Lawyers and finance teams can judge materiality but cannot tell how bad an incident is from a forensic report. Each group holds half the answer, and they often speak different languages. A CISO says “lateral movement across the domain”; a general counsel needs to hear “the intruder could reach most of our systems, including the ones holding customer data.”

The decision therefore needs a defined group. In practice that is a standing disclosure or materiality committee, usually chaired by the general counsel, with the CISO, the CFO or controller, investor relations and the affected business leader. Its trigger should be written down. Examples include any incident escalated to severity one, any incident involving regulated personal data above a set volume, or any incident affecting a system that supports a material revenue line. A trigger that depends on someone deciding to call a meeting is a trigger that will be late.

“Severity one” is worth a word of explanation. Most security teams rank incidents on a scale, often from one (most serious) to four or five (minor). The ranking drives who gets woken up and how fast. Tying the committee’s trigger to that existing scale means the legal process starts automatically when the technical process says things are serious, without anyone needing to make a judgment call about whether to escalate.

Membership should have named deputies, because incidents do not wait for travel schedules. The board’s role should be defined too. Most companies keep the determination with management and inform the audit or risk committee promptly. Whatever the choice, the incident response plan should say it, so nobody debates authority during the first night of an incident.

The committee also needs agreed criteria before an incident, not during one. Useful criteria include operational disruption measured in days, the share of customers affected, the likely regulatory response, and whether the incident would change how an investor views the company’s risk. The criteria do not make the decision mechanical. They make it consistent, and consistency is what a later reviewer will test. If one incident affecting a tenth of customers was judged not material and a similar one six months later was judged material, the company should be able to explain the difference.

The legal standard in brief

The SEC did not create a new materiality test for cyber incidents. It pointed to the standard the Supreme Court set out in TSC Industries v. Northway in 1976 and Basic v. Levinson in 1988. Information is material if there is a substantial likelihood that a reasonable investor would consider it important, or if it would significantly alter the total mix of information available.

The adopting release also made clear that a company should not delay its determination simply because an investigation is still running. Uncertainty is normal. The committee’s job is to decide on what it knows and to keep deciding as it learns more.

Numbers as a screen, not a verdict

Finance teams often want a numeric threshold, such as a share of revenue or earnings. The SEC’s long-standing staff guidance on materiality, Staff Accounting Bulletin No. 99 from 1999, accepts that a rule of thumb like 5 percent can be a starting point. It also says a rule of thumb cannot replace a full analysis of qualitative factors.

Cyber incidents are a clear case for that caution. The direct cost of an incident is often small next to its effect on customers, regulators and reputation, and those effects arrive later. A committee can use numbers to screen incidents in or out of closer review. It should record the qualitative analysis whenever an incident passes the screen.

How the answer varies by company

The shape of the decision group differs with the company. A large accelerated filer usually already has a disclosure committee, set up to support the certifications the Sarbanes-Oxley Act requires of chief executives and chief financial officers. Adding cyber materiality to its remit is often the simplest route.

A smaller reporting company may have a general counsel, a CFO and an outsourced security provider. Its committee may be three people and an outside law firm, which makes deputies and pre-agreed criteria more important.

Banking organizations bring a regulatory reflex already wired in, because their incident teams know the 36-hour regulator notice. Their risk is the opposite one: treating the regulator notice as if it settled the securities question. A publicly traded hospital operator, such as one of the large investor-owned chains, runs HIPAA processes beside the SEC one. Nonprofit health systems and government agencies are outside the SEC rule altogether, though many face parallel expectations from bondholders, oversight bodies or other regulators.

The board’s place

The final rule dropped the proposed disclosure of directors’ cyber expertise. It still requires companies to describe how the board oversees cyber risk and which committee, if any, is responsible. Directors therefore need enough familiarity with the escalation process to oversee it credibly. A short annual session in which the committee walks the board through a past determination, or a rehearsal, often serves better than a general briefing on threats.

What the record shows

A company that concludes an incident is not material, or not yet material, should be able to show how and when it reached that view. That means minutes for each committee meeting, the facts known at the time, the criteria applied, the conclusion and the next review date. If the facts change, as they often do when exfiltration is discovered weeks after encryption, the record should show the reassessment and its timing.

The record is the flight recorder for the decision. After an incident, an SEC examiner, a plaintiff’s lawyer or an investor will ask a simple question: when did you know, and what did you do? Without a contemporaneous record, the company has only memory and email fragments, written in the stress of the moment. With one, it can show a reasonable process, applied in good faith, on the facts available at each point.

Several practical problems follow. Forensic firms are often engaged through outside counsel to preserve privilege, which can make factual findings slow to reach the committee. Privilege here means legal protection that can keep certain communications with lawyers confidential, including in later lawsuits. Companies want that protection, but routing everything through lawyers can add days. Companies need a protocol that gets facts to decision makers quickly while preserving privilege where it applies. Counsel should design that protocol in advance.

A second problem is incidents at vendors. Most companies now rely on outside providers for payroll, customer service software, data storage and much else. A company may learn of a vendor incident late and with incomplete facts, yet the materiality question is about impact on the company. The record should show when the company learned what, and what it did to find out more.

Contracts decide how much a company can learn. Useful terms include notice of a suspected incident within a fixed number of hours, a named contact during the response and regular written updates. Others are access to a summary of the vendor’s forensic findings and cooperation with the company’s own regulators. Many existing contracts contain only a general duty to notify “promptly.” Renewal is the moment to tighten them, starting with the vendors whose failure would be most visible to investors.

The annual 10-K description draws on the same record. Whatever a company says about its process becomes a statement investors may rely on. That includes the committee, its members and its escalation criteria. After an incident, the SEC may compare those statements with practice. Writing the description from the actual process, reviewed by security and legal together, keeps the two consistent. Aspirational language about controls is a liability rather than a reassurance. A 10-K that says “all incidents are escalated to the committee within 24 hours” needs a process and records that show it.

What each entry should contain

A usable record is short and consistent. Each committee meeting should produce an entry with the same fields:

• the date and time, and who attended;
• the facts known, with their source and confidence;
• the facts still unknown, and who is working on each;
• the criteria considered and how each applied;
• the conclusion, stated plainly as material, not material or not yet determined;
• the next review date, or the event that would trigger an earlier one; and
• any external notices owed or made under other regimes.

A template prepared in advance makes the record easy to keep under pressure. Without one, minutes tend to capture discussion and miss the conclusion.

Filing, then amending

Item 1.05 anticipates that some facts will be missing at filing. A company should say what is not yet determined and then file an amendment once that information becomes available. The record should track those open items. Each one is a promise to investors that the company will come back with an answer, and the record shows whether it did.

Where privilege has failed

Routing forensic work through counsel is common, but privilege is not guaranteed. In litigation over Capital One’s 2019 breach, a federal court ordered the bank to produce its forensic firm’s report. The court found the work served business purposes and had been arranged under a pre-existing contract, not mainly for litigation.

Counsel generally responds by keeping a distinct engagement for legal advice, with its own scope, and by limiting who receives the report. Those choices can conflict with the committee’s need for facts. Some companies resolve this by giving the committee oral briefings or short factual summaries prepared for decision-making, kept separate from the full report.

Messages count as records

Much of an incident’s real discussion happens in chat threads, text messages and calls. Those messages may be discoverable later, and they may contradict the formal minutes. A legal hold should cover them from the start. Participants should keep speculation out of informal channels, and the formal record should capture any view that affected the decision.

How it fits other clocks

Regulated companies faced several notification regimes before this rule. Banking organizations must notify their primary federal regulator within 36 hours of determining that a notification incident has occurred, under the interagency rule that took effect in 2022. HIPAA, the federal health privacy law, requires covered entities and business associates to make breach notifications to individuals and to HHS, the Department of Health and Human Services. State breach laws set their own timelines, and contracts with customers and partners add more.

Each regime has a different trigger, threshold and audience. A bank holding company might notify its regulator under the 36-hour rule well before deciding an incident is material for securities purposes. A hospital operator might owe HIPAA notifications for an incident that is never material to investors. Running these as separate processes invites inconsistency, and inconsistency between what a regulator, customers and investors were told is what draws scrutiny.

The answer is a single incident record that lists each regime, its trigger, the date the trigger was met and the deadline, with one owner coordinating what is said to whom. The materiality decision is one row in that record. In practice it can be a simple table on a shared screen. One row shows the bank regulator, triggered Monday at 2 p.m. and due Wednesday at 2 a.m. The next shows three state breach laws with their own deadlines. Further down sits the SEC row, with the date the committee met and its conclusion. Everyone in the room can see what is owed, to whom, and when.

Treating it that way also guards against a mistake many observers expected: filing an 8-K under Item 1.05 for every incident out of caution. Over-filing dilutes the signal to investors and can itself mislead. If every minor event is labeled a material incident, investors cannot tell which ones matter. The record should show why an incident was or was not disclosed, and under which item.

A map of common clocks

Each regime applies to particular organizations, and a single incident can trigger several. Organizations should confirm which apply to them with counsel. Common examples include:

• Bank regulators. Banking organizations notify their primary federal regulator within 36 hours of determining a notification incident has occurred. Bank service providers must notify their bank customers as soon as possible when an incident disrupts services for four hours or more.
• New York’s Department of Financial Services. Its amended cybersecurity regulation, effective in November 2023, requires covered entities to report qualifying incidents within 72 hours. It requires notice of an extortion payment within 24 hours, followed by a written explanation within 30 days.
• HIPAA. Covered entities and business associates notify affected individuals no later than 60 days after discovering a breach, with HHS and media notice for larger breaches.
• The FTC’s Safeguards Rule. Non-bank financial institutions under the FTC’s jurisdiction, such as many mortgage brokers and auto dealers, must report certain breaches affecting 500 or more consumers within 30 days, from May 2024.
• The SEC’s amended Regulation S-P. Adopted in 2024, it requires broker-dealers, investment advisers, investment companies and transfer agents to notify affected individuals within 30 days of certain breaches, with phased compliance dates.
• State breach laws and contracts. These add their own triggers, recipients and deadlines.

Multinationals add more. The European Union’s Digital Operational Resilience Act, which applied from January 2025, sets incident reporting deadlines measured in hours for financial entities in its scope.

The delay process needs groundwork

The Attorney General delay is narrow, and it cannot be improvised. The Justice Department published guidelines in December 2023 on how it would assess requests, and the FBI set up a process for companies to start one. A request has to begin early, well inside the four-business-day window. As a result, the companies best placed to use it are those that already know whom to call at the FBI and have shared facts with agents from the start.

One fact base, many audiences

Consistency depends on one fact base. A single owner, often in legal, maintains the current agreed facts. Every external statement, from the regulator notice to the customer letter to the 8-K, draws on that document. When the facts change, the owner updates it and checks which statements need correcting.

Holding statements prepared in advance help too. They let the company acknowledge an incident quickly without committing to facts it does not yet have. The trade-off is tone: a statement too vague can read as evasive, and one too specific can turn out wrong.

What rides on the decision

This is more than paperwork for the legal department: the materiality decision touches nearly every part of a company’s standing at once.

Money. A disclosure can move the share price, and a late or inconsistent one can invite shareholder lawsuits alleging that investors were kept in the dark. The cost of defending such a suit can dwarf the cost of the incident itself.

Regulators. The SEC can test a company’s conduct against both the incident rule and what its 10-K said about its process. A bank or hospital operator may face its own sector regulator asking the same questions from a different angle.

Customers and partners. They tend to forgive a company that was attacked. They are far less forgiving of one that seemed to hide it, or that told them something different from what it told investors.

People. Executives who make the call, and the CISO who informs it, carry personal reputational risk. A clear process with a written record protects them as much as it protects the company, because it shows they acted reasonably on what they knew.

The common thread is credibility. A company that discloses on time, consistently and with a clear rationale keeps it. One that cannot explain its own timeline loses it, regardless of how well its engineers fought the actual attack.

The case against the rule, and why the record still matters

The strongest criticism of the rule came from inside the Commission. The dissenting commissioners argued that public disclosure within days could help attackers during an active incident, and that the rule intruded on companies’ judgment. Some security practitioners agreed. They worried that the four-day clock would push companies to make public statements before they understood what had happened.

Those concerns have weight. The rule tried to address them by not requiring technical details that would impede the response, and by allowing companies to amend filings later. Whatever one thinks of the balance, the case for a governed decision does not depend on it. A defined committee, written criteria and a contemporaneous record serve every clock a company runs. They would be worth having even if the SEC rule were withdrawn.

Other parties watching

Investors and regulators are not the only audiences. Credit agreements often require borrowers to notify lenders of material events. Directors and officers liability insurers will look at how the decision was made if a shareholder suit follows. Rating agencies may ask how an incident affects operations and finances. Each audience reads the same facts, and each will notice if the story told to one differs from the story told to another.

The CISO’s position

The annual disclosure asks companies to describe management’s cyber expertise, which often means naming the CISO’s role and background. That puts the security leader’s work closer to public statements than before. Many companies responded by reviewing whether their CISO counts as an officer under the directors and officers insurance policy, and whether indemnification covers the role. A CISO should also see, and be able to challenge, the 10-K language that describes the program they run.

Habits of the companies that handle it well

A company that handles this well tends to share a few traits. Its committee exists before it is needed, with named members and deputies. Its triggers are tied to the security team’s own severity scale. Its criteria are written down and have been tested in at least one rehearsal, often called a tabletop exercise. That is a structured meeting where leaders walk through a realistic, invented incident hour by hour and practice making the calls. Its incident record covers every notification regime in one place. And its 10-K description matches what actually happens.

Where companies go wrong, the problem is usually timing or ownership:

• Waiting for certainty. Facts in a cyber incident are rarely complete for weeks. A committee that will not decide until the forensic report is final risks an “unreasonable delay.” The better habit is to decide on what is known, record it, and set a date to revisit.
• Leaving the decision to the security team. Technical severity and investor materiality are different questions. A CISO alone should not be making a securities law judgment, and should not be left exposed for making one.
• Separate clocks, separate stories. When the bank regulator, customers and investors hear different accounts at different times, the gaps become the story.
• Treating vendors as someone else’s problem. An incident at a key supplier can be material to the company that relies on it. Contracts should require prompt notice and cooperation.
• Polished 10-K language that outruns reality. Describing an ideal process rather than the real one creates a statement that can be tested, and found wanting, after the next incident.

Suppose two retailers suffer similar ransomware attacks. The first has a committee that meets within hours and records its view that the incident is not yet material. It reconvenes three days later when the forensic firm reports stolen payment data, and files its 8-K within four business days of that second meeting. The second has no committee. Its CISO briefs the CEO informally, the general counsel hears about stolen data from a reporter a week later, and nobody can say when the company “determined” anything. Both may face the same attack, but only the first can show when and why it decided.

Rehearsals that test the decision

Many tabletop exercises focus on technical response and stop before the hard part. A rehearsal designed for this rule includes the materiality decision itself. It should include the general counsel, the CFO and at least one deputy who has never sat on the committee. The facts should shift partway through, for example when exfiltration is discovered after the committee has already concluded the incident is not material.

Timing the rehearsal is useful. How long it takes to convene, to reach a first view and to draft a filing gives a realistic baseline. Including a scenario at a vendor tests the hardest case, where facts arrive late and second-hand.

Materials prepared in advance

Companies that handle the clock well usually keep a small kit ready:

• a shell 8-K under Item 1.05, with the required elements laid out;
• a shell for voluntary disclosure of incidents not determined to be material;
• holding statements for customers, employees and the press;
• the committee’s meeting template and criteria; and
• a contact list for regulators, law enforcement, the insurer and key vendors.

These documents do not make the decision. Each one saves hours in the four days the rule allows.

Measures worth tracking

A few measures tell management and the board whether the process works. Useful ones are the time from a severity-one declaration to the first committee meeting, and the time from meeting to determination. Others are the number of determinations revisited because facts changed, and the share of open items closed by amendment on schedule. Each measure should come from the record itself, which gives the company a reason to keep the record well.

After the filing

The process does not end with the 8-K. A post-incident review should compare each determination with what was later learned. Where the committee was slow or wrong, the criteria or triggers may need to change. The 10-K description may need updating to match the process as it actually ran. Open items promised to investors must be closed by amendment. Companies that skip this review tend to repeat the same delays in the next incident.

Testing readiness before the first night

A director or senior executive does not need to understand the technical details to test whether the company is ready. These questions should get clear, specific answers:

• Who is on our materiality committee, who are their deputies, and when did they last meet in a rehearsal?
• What exactly triggers a committee meeting, and does that trigger fire automatically from the security team’s severity rating?
• If we decided an incident was not material, could we show the minutes, the facts known at the time and the next review date?
• Do we keep one record of every notification deadline we face, with one person coordinating what we tell each audience?
• Does our 10-K description of cyber governance match what we actually do, and who checked it?

The questions work for any listed company, whatever its sector. A bank, a hospital operator and a software firm will answer them differently, because each runs different clocks beside the SEC’s. Each should still be able to answer every one without hesitation.

Answering them takes no large budget, only a decision about who owns the decision, made calmly in advance rather than at two in the morning.

With hindsight

The rules took effect as scheduled in December 2023, and early filings showed companies unsure where the line sat. Some filed under Item 1.05 before determining materiality, reaching for the new section out of caution rather than judgment. That was precisely the over-filing risk many had anticipated.

Some of those early filers said in the same filing that the incident had not had, or was not reasonably likely to have, a material impact. To investors, a material incident item followed by a statement of no material impact sent a confusing signal.

In May 2024 the SEC’s Division of Corporation Finance stepped in. It said Item 1.05 should be reserved for incidents determined to be material, with other disclosures made voluntarily under Item 8.01, a general-purpose section of Form 8-K for events a company chooses to report. Companies could tell investors about smaller incidents if they wished, but not in the box meant for material ones. The guidance reinforced that the determination is the hinge of the whole rule. In the months after the statement, filings for incidents not yet judged material shifted toward Item 8.01, as the staff had suggested.

Personal liability for security leaders became the other big worry. The SEC’s enforcement action against SolarWinds and its CISO, brought in 2023 under earlier law, raised fears that the people who run security programs could be held personally responsible for what their companies told investors. A federal judge dismissed most of the claims in July 2024, and in November 2025 the SEC voluntarily dismissed the remaining claims. Even so, the episode gave security leaders a strong reason to care about what their companies say about security in public filings, and to make sure it matches reality.

The SEC also showed how it would judge the wording of disclosures. In October 2024 it settled charges against four technology companies, Unisys, Avaya, Check Point and Mimecast, over statements about the SolarWinds-related intrusions they had suffered. The SEC said the companies had minimized what they knew, in some cases describing as hypothetical risks that had already materialized. Commissioners Peirce and Uyeda dissented. For companies, the message was that the words chosen to describe an incident, and the facts behind them, would both be examined.

The notification map grew more crowded. New York’s financial regulator added a 24-hour notice for extortion payments to its existing 72-hour incident notice. The SEC amended Regulation S-P in 2024 to require customer notification by broker-dealers, investment advisers and other covered firms. CISA proposed rules in April 2024 under the Cyber Incident Reporting for Critical Infrastructure Act. They would require covered entities to report substantial incidents within 72 hours and ransom payments within 24 hours. Each new clock strengthened the case for one coordinated incident record.

Vendor incidents tested the rule early. In June 2024 a ransomware attack on CDK Global, which supplies software to thousands of car dealerships, disrupted sales and service across the industry. Several publicly traded dealer groups filed 8-Ks about the disruption. Each had to judge the materiality of an incident in someone else’s systems, on facts supplied by the vendor, which was the hardest case the rule created.

The rule itself drew continued opposition. In 2025 several banking and securities industry groups asked the SEC to rescind the incident disclosure item. They argued that it conflicted with confidential reporting to bank regulators and risked helping attackers.

Under new leadership in 2025 the SEC reorganized its cyber enforcement unit, but the disclosure rules stayed in force. Enforcement priorities may shift with each commission. The obligation in the rulebook does not shift with them.

The practical meaning has not changed. The Item 1.05 clock still starts at the determination, so the case for a defined decision group with a written record is unchanged. A company that can show who decided, on what facts, using which criteria, and when it looked again is well placed whatever the enforcement climate. One that cannot will find that the absence of a record is itself hard to explain. The rule rewards documented preparation, which any well-run company can put in place.