SEC cyber disclosure rules: Form 8-K Item 1.05 explained

The SEC’s cyber disclosure rules require public companies to file a Form 8-K Item 1.05 for a cybersecurity incident they determine to be material, generally within four business days of that determination. They also require yearly risk management disclosure under Regulation S-K Item 106. This post covers only what the SEC fact sheet on the adopted final rules says.

What does the SEC fact sheet cover?

The fact sheet is titled “Public Company Cybersecurity Disclosures; Final Rules”. It says the Securities and Exchange Commission adopted final rules requiring disclosure of material cybersecurity incidents on Form 8-K, and periodic disclosure of a registrant’s cybersecurity risk management, strategy and governance in annual reports. As of 9 October 2026, it is our only source, so every statement below comes from it. Readers should check sec.gov for any later change. We do not claim that one exists.

The sheet explains the background. The Commission proposed the rules in March 2022 and observed that cybersecurity threats and incidents pose an ongoing and escalating risk to public companies, investors and market participants. Among the trends it lists are remote work, digital payments and the increasing reliance on third party service providers for information technology services, including cloud computing. For that last point, see our glossary entry on third-party risk.

The sheet also says earlier guidance from Commission staff in 2011 and from the Commission in 2018 improved disclosures, but that practices are inconsistent. The stated aim is consistent, comparable and decision-useful disclosures that let investors evaluate exposure to material cybersecurity risks and incidents.

What does Form 8-K Item 1.05 require?

The sheet says new Form 8-K Item 1.05 requires registrants to disclose any cybersecurity incident they determine to be material. The filing describes the material aspects of the nature, scope and timing of the incident. It also describes the material impact, or reasonably likely material impact, on the registrant, including its financial condition and results of operations.

For readers who handle incidents, the trigger is a materiality determination, not the incident itself. The sheet says registrants must determine the materiality of an incident without unreasonable delay following discovery. If you also work with data breach notification duties, note that the sheet describes this filing only and says nothing about breach notices under other laws.

How many days does a company have to file?

The sheet says that if the incident is determined material, the registrant files an Item 1.05 Form 8-K generally within four business days of that determination.

It also describes one route to delay. The disclosure may be delayed if the United States Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the Commission of that determination in writing. If the Attorney General indicates that further delay is necessary, the Commission will consider additional requests for delay and may grant relief through possible exemptive orders.

What does Regulation S-K Item 106 require?

The sheet says Item 106 covers the annual report side. Registrants describe their processes, if any, for assessing, identifying and managing material risks from cybersecurity threats. They also say whether any risks from cybersecurity threats, including as a result of previous incidents, have materially affected or are reasonably likely to materially affect the registrant.

Item 106 also covers governance. Registrants describe the board of directors’ oversight of risks from cybersecurity threats, and management’s role and expertise in assessing and managing those risks.

What changes for foreign private issuers?

The sheet says Form 6-K is amended to require foreign private issuers to furnish information on material cybersecurity incidents that they make, or are required to make, public or otherwise disclose in a foreign jurisdiction to any stock exchange or to security holders. Form 20-F is amended to require periodic disclosure comparable to that required in new Regulation S-K Item 106.

What are the compliance dates?

The sheet says the final rules become effective 30 days after publication of the adopting release in the Federal Register. The Federal Register notice, published 4 August 2023, gives the effective date as 5 September 2023. The compliance dates differ by requirement and by company type.

The sheet says that for smaller reporting companies the Item 1.05 date comes with an additional 180 days. On structured data, it says all registrants must tag disclosures required under the final rules in Inline XBRL.

What can readers check against the sheet?

This is a summary of one fact sheet, not legal advice, and it is not a compliance promise. The questions below come from the facts above. They are for discussion with counsel and with your legal, risk and compliance colleagues.

Where do these rules sit among other reporting deadlines?

Other posts of ours compare deadlines across regimes. See incident reporting deadlines under NIS2, CRA, SEC and CIRCIA, CIRCIA final rule status in 2026 and cyber regulations to know in 2026. For another look at the SEC rules, there is also our post on the SEC cybersecurity regulations.

The sheet is a description of the adopted rules. Check sec.gov for the rule text and for any later change.

Last checked against the official pages on 9 October 2026. Dates and status can change, so confirm on the pages listed under Sources before acting.

For background on how threats are cataloged, see the Brandefense knowledge hub pages on threat groups, malware families, ATT&CK techniques and significant incidents, and the glossary. The cyber threat intelligence page describes the related service.