SEC Cyber Disclosure (US, 2025): Statute Rules & 8-K Timelines
SEC Cyber Disclosure (US, 2025): Statute Rules & 8-K Timelines
The SEC cybersecurity disclosure statute, effective throughout 2025, requires U.S. public companies to report material cyber incidents on Form 8-K Item 1.05 within four business days of determining materiality. The rule also mandates annual 10-K updates on governance, board oversight, and risk-management processes. (SEC)
Who’s in scope
The rule applies to all SEC registrants, including domestic issuers and foreign private issuers that file 6-Ks or 20-Fs. Subsidiaries or controlled entities of listed companies are indirectly captured if their breaches affect consolidated financial or operational performance. (Deloitte DART)
- U.S. public companies registered under the Securities Exchange Act of 1934.
- Foreign private issuers filing annual Form 20-F disclosures (material incidents reported on Form 6-K).
- SPACs and shell companies with reporting obligations.
8-K triggers and timelines
Under Item 1.05, companies must disclose a “material cybersecurity incident” within four business days after determining materiality, not from the initial detection date. (SEC)
- Trigger event: board or management concludes an incident is “material” to investors.
- Disclosure deadline: four business days after that determination.
- Allowed delay: if the U.S. Attorney General grants up to 30-day delay for national security or public safety concerns.
Form 8-K Item 1.05 — 2025 Compliance Summary
| Step |
Timing |
Key Content |
Authority |
| Incident detected |
Day 0 |
Begin internal investigation and preservation of evidence. |
SEC / DART guidance |
| Materiality determined |
Variable |
Assess business, financial, and investor impact. |
Deloitte DART |
| 8-K filed |
Within 4 business days |
Describe nature, scope, and timing; business impact. |
SEC |
| Amended filing |
As facts evolve |
Update prior 8-K with new information. |
The CPA Journal |
10-K governance disclosures
Annual reports (Form 10-K, Item 106) must describe:
- Processes for assessing, identifying, and managing material cybersecurity risks.
- Board oversight of cybersecurity threats.
- Management roles and expertise in handling such risks.
Companies must explain whether incidents materially affected or are reasonably likely to materially affect operations, results, or financial condition. (DART)
Materiality assessment
The SEC’s test mirrors that of securities law precedent: an incident is material if there is a substantial likelihood that a reasonable investor would consider it important when making an investment decision. (Deloitte DART)
- Focus on investor significance, not just monetary loss.
- Consider reputational, operational, legal, and regulatory consequences.
- Document deliberations to support timing of the determination.
Incident-response playbook alignment
Legal, compliance, and IT teams should embed SEC reporting triggers into the company’s incident-response (IR) plan:
- Identify cyber events rapidly and initiate cross-functional review.
- Engage counsel and disclosure committee within 24 hours.
- Evaluate potential materiality impacts using both quantitative and qualitative factors.
- Prepare draft Form 8-K template in advance to meet the four-day window.
- Coordinate with law enforcement if requesting a national-security delay.
Board oversight and reporting
Boards must receive regular briefings on cybersecurity risk and incident updates. Many issuers assign oversight to audit or risk committees, which review:
- Incident reports and near-misses.
- Effectiveness of disclosure controls and procedures.
- Integration of cybersecurity into enterprise-risk management (ERM).
FAQ — SEC Cyber Disclosure (2025)
When does the four-business-day clock start?
The clock starts once management determines the incident is material to investors—not at detection. (SEC)
How is materiality assessed?
Materiality depends on whether a reasonable investor would view the incident as significant. Financial, operational, and reputational factors all apply. (Deloitte DART)
Are updates required after initial filing?
Yes. Companies must file amended 8-Ks as new material facts become available to ensure disclosures remain accurate. (The CPA Journal)
Can companies delay disclosure?
Only if the U.S. Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety, permitting a delay of up to 30 days. (SEC)
What should boards document?
Boards should keep minutes showing oversight of cyber risk, incident updates, and review of disclosure controls, aligning with Item 106 of Reg S-K. (Deloitte DART)
Key Takeaways
- Form 8-K Item 1.05 requires disclosure of material cyber incidents within four business days of determining materiality.
- Annual Form 10-K must detail cybersecurity governance and board oversight.
- Materiality is judged by investor significance, not only monetary loss.
- Amend 8-K filings as facts change; maintain a cross-functional IR process.
- Boards must document oversight and ensure robust disclosure controls.
References
← Back to Main Guide
Comments
Post a Comment