Before we get to SEC cybersecurity reporting requirements, here are a few examples. Avaya told the market that a “limited number” of its emails had been accessed. The SEC found that at least 145 files in its cloud file-sharing environment had been accessed too, and fined it $1 million in October 2024. Microsoft’s filing, dated 19 January 2024, read differently. Under Item 1.05 it said an intruder had reached “a very small percentage of employee email accounts,” that access ended on or about 13 January, and that the company had “not yet determined” whether the incident was reasonably likely to hit its finances (SEC EDGAR).
Every SEC cybersecurity filing gets read next to the company’s 10-K, its examiner findings and its auditor’s questions. A phrase like “limited number” then has to survive all three.
Need test evidence ready before a deadline exists? Talk to a Qualysec security expert!
What Do SEC Cybersecurity Reporting Requirements Cover?
Five SEC cybersecurity reporting requirements, four forms, and one clock that matters most: four business days.
| Requirement | Form | Trigger | Timing | Applies to |
|---|---|---|---|---|
| Material incident disclosure | 8-K Item 1.05 | Company determines an incident is material | Four business days after that determination | Domestic registrants |
| Incident update | 8-K amendment | Missing information is determined or becomes available | Four business days after | Domestic registrants |
| Foreign issuer incident disclosure | 6-K | Material incident disclosed or publicized abroad, to an exchange or to holders | Promptly | Foreign private issuers |
| Risk management and governance | 10-K Item 106, 20-F Item 16K | Annual report | With the annual report | All registrants |
| Structured data | Inline XBRL tagging | Any of the above | 8-K and 6-K from 18 December 2024, annual reports for fiscal years ending on or after 15 December 2024 | All registrants |
The SEC’s small business compliance guide summarizes these dates, and the adopting release in the Federal Register is the authoritative text.
Which SEC Cybersecurity Rules Apply to Which Companies?
Compliance dates for SEC cybersecurity reporting requirements differ by registrant type:
- Annual Item 106 disclosure: all registrants, smaller reporting companies included, for fiscal years ending on or after 15 December 2023.
- Incident disclosure, other registrants: from 18 December 2023.
- Incident disclosure, smaller reporting companies: from 15 June 2024. A foreign private issuer files Form 6-K “promptly” after a material incident is disclosed or publicised abroad, to an exchange or to security holders. Its annual disclosure goes on Form 20-F.
A private company sits outside the SEC cybersecurity rules and has no Item 1.05 duty, yet customer contracts and state breach laws can still force notice. A listed bank holding company gets two bosses instead: an 8-K to the SEC and a notice to its primary banking regulator.
When Is an Incident Material and When Does the Clock Start?
The four business days run from the materiality determination, not from discovery. A determination made on Monday puts the 8-K due the following Friday.
That doesn’t give a company unlimited time, because the rule expects the determination itself “without unreasonable delay” after discovery. Counsel will recognize the yardstick, borrowed from TSC Industries v. Northway (1976): is there a “substantial likelihood” that a reasonable investor would see the information as important? Dollar cost isn’t the whole answer. A breach that costs little can still count if it sours a major customer or draws a regulator’s questions. Financial institutions must also consider their broader regulatory responsibilities and data protection obligations, as discussed in our guide to financial advisors’ compliance solutions, which is why finance can’t decide alone.
- Log the detection time.
- Contain the incident.
- Scope it with logs and forensic evidence.
- Escalate to counsel and the disclosure committee.
- Record the materiality decision and its reasoning.
- File within four business days of that decision.
Item 1.05 or Item 8.01: Which Form 8-K Item Applies?
Corporation Finance Director Erik Gerding put it plainly on 21 May 2024: Item 1.05 is for incidents already found material. Immaterial ones, and ones still being assessed, can go under Item 8.01 voluntarily, because filing everything under Item 1.05 could lead investors to read minor events as major.
| Situation | Filing route | Amendment duty | Main risk |
|---|---|---|---|
| Incident determined material | Item 1.05, four business days | Yes, when missing facts emerge | Late filing, thin content |
| Incident judged immaterial | Item 8.01 if the company chooses | None under Item 1.05 | Over-disclosure misleads readers |
| Materiality not yet determined | Item 8.01, voluntary | File Item 1.05 if it later turns material | Early Item 1.05 filing implies a decision |
| Earlier Item 8.01 filing, now material | Item 1.05 | Four business days from the new determination | Gap between the two filings |
Companies took the Item 8.01 route often. A Debevoise tracker counted 29 issuers filing under Item 1.05 and 50 under Item 8.01 between the May 2024 statement and 21 May 2026. Five issuers did both. Each started with Item 8.01 and moved to Item 1.05 once the incident was found material.
What Do SEC Cybersecurity Disclosure Requirements Say You Must Disclose?
An Item 1.05 filing for SEC cybersecurity reporting requirements must describe:
- The material aspects of the nature, scope and timing of the incident
- The material impact, or reasonably likely material impact, on the company, including its financial condition and results of operations
If any of that isn’t determined or available at filing, the 8-K says so. The company then files an amendment within four business days after the information is determined or becomes available.
The filing doesn’t need specific or technical detail about the planned response. It also doesn’t need vulnerability detail that would impede response or remediation. The SEC cybersecurity disclosure requirements don’t ask for a technical post-mortem, which is why a strong filing stays factual and short.
Can Disclosure Be Delayed?
Only the Attorney General can stop the clock. A written notice to the SEC that disclosure poses a “substantial risk to national security or public safety” buys up to 30 days. A second 30 days can follow. Beyond that sits a last delay of up to 60 days, kept for extraordinary cases and available on national security grounds alone.
What Does Item 106 Require in the Annual Report?
Item 106 asks for the program, not for test results, yet the program description is where the exposure sits. The claims that survived dismissal in SEC v. SolarWinds concerned the company’s public Security Statement on access controls and passwords. Put plainly, the 10-K answers two questions. How does the company find and manage material cyber risk, and has any of it already mattered? And who oversees the work, from the board committee down to management?
Which Cybersecurity SEC Guidance Matters Beyond the Rule Text?
Gerding’s May 2024 statement, covered above, set the 1.05 versus 8.01 split. Enforcement followed five months later. On 22 October 2024, the SEC fined four companies over SolarWinds-related intrusions:
- Unisys, $4 million: it described cyber risks as hypothetical, though a threat actor had already taken gigabytes of data.
- Avaya, $1 million: it said a “limited number” of emails were accessed, though at least 145 files in its cloud file-sharing environment were also reached.
- Check Point, $995,000: it described the intrusion risks in vague, generic terms.
- Mimecast, $990,000: it left out the nature of the exfiltrated code and the number of encrypted credentials accessed.
The SolarWinds case itself, filed in October 2023 against the company and its CISO, Timothy Brown, it lost most of its claims when Judge Paul Engelmayer ruled in July 2024. A joint stipulation ended the rest on 20 November 2025, with prejudice.
Item 1.05 itself may not last. CTIA’s 2 October 2026 letter to Chairman Paul Atkins urges the SEC to “rescind mandatory reporting under Item 1.05” and go back to voluntary reporting, saying the deadline pushes companies to speak before their investigations end. The letter follows a May 2025 petition (File No. 4-856) and the SEC’s January 2026 request for comment on every Regulation S-K item. The Debevoise update of 21 May 2026 recorded no rule change. Cybersecurity SEC guidance can move faster than the text, and the Harvard Forum authors say the softer enforcement posture shouldn’t be treated as permanent. Re-check the SEC website before publishing or filing.
Worked Example: Microsoft’s Item 1.05 Filing, Line by Line
Microsoft’s 19 January 2024 8-K used Item 1.05. The cover page lists 17 January 2024 as the earliest event reported. The filing said a nation-state-associated actor had accessed “a very small percentage of employee email accounts,” including accounts of senior leaders and of cybersecurity and legal staff. Access began in late November 2023 and was detected on 12 January 2024. It was removed on or about 13 January.
Two statements stand out. The company said the incident “has not had a material impact” on operations, and it said it had “not yet determined” whether the incident was reasonably likely to materially affect its finances. It also said it was still examining the accessed information.
Each statement needs evidence behind it:
- “A very small percentage of employee email accounts”: mailbox access logs and an account inventory.
- Late November 2023 to detection on 12 January 2024: mailbox audit logs with first and last access times, which turn “late November” into a date.
- Removal on or about 13 January: timestamped containment and credential-reset records.
- No material operational impact: a documented impact assessment.
- Financial effect not yet determined: an open item, tracked toward an amendment.
The filing came four months before the May 2024 staff statement. Under that guidance, a company in the same position, with the financial effect still open, would more likely use Item 8.01.
Companies that want this level of evidence prepared before an incident can book a scoping call with Qualysec!
What Evidence Supports Each Disclosure Line?
A filing line is only as strong as the record behind it. The Unisys and Avaya cases both turned on a gap between what the company said and what it already knew.
| Filing statement | Technical evidence | Owner | Independent check |
|---|---|---|---|
| Nature of the incident | Forensic report, attack-path analysis | Incident response lead | Outside forensic review |
| Scope of systems and data | Asset inventory, access logs, data classification | Security operations | Log coverage review |
| Timing | Detection timestamps, containment record | Incident response lead | Log integrity check |
| Material impact | Business impact assessment, cost records | Finance | Disclosure committee |
| Root cause and fix | Root-cause analysis, remediation tickets | Engineering | Retest report |
| Residual risk | Penetration test and retest results | CISO | Independent penetration test |
Penetration testing doesn’t decide materiality. It answers a narrower question that auditors and counsel keep asking: was the weakness actually closed? A retest that repeats the original attack gives a dated answer that a closed ticket can’t.
Cyber Security for Banking Sector: What Do Banks Add?
Three regimes can apply at once.
- SEC filings: a listed bank holding company files Item 1.05 like any other registrant.
- Bank regulator notice: three agencies, one rule. The OCC (12 CFR Part 53), the Federal Reserve (12 CFR Part 225) and the FDIC (12 CFR Part 304) give a bank 36 hours after it decides a “notification incident” has happened, meaning one that “materially disrupted or degraded” operations or is reasonably likely to. The 36 hours start at the bank’s own decision, not at detection, so that decision date is worth protecting. Enforcement began on 1 May 2022 (Federal Register). Bank service providers carry a separate duty: notice to their bank customers once an outage runs four hours or more.
- Regulation S-P: this covers the broker-dealer, adviser and fund side. Amended in May 2024, it requires a written incident response program and customer notice within 30 days after the firm decides that sensitive information was, or probably was, accessed. Providers owe the firm a report within 72 hours. Larger entities had to comply on 3 December 2025, smaller ones on 3 June 2026.
Three clocks, three starting points. Cyber security for banking sector teams with a broker-dealer affiliate can face 36 hours to the OCC, Fed or FDIC, four business days to the SEC and 30 days to customers, each counted from a different decision. One log entry won’t cover all three.
SEC Cybersecurity Compliance Checklist
What does the SEC require on cybersecurity? Public companies must file a Form 8-K under Item 1.05 within four business days of deciding that an incident is material. They also have to describe their cyber risk management, strategy and governance each year in the 10-K. Broker-dealers, advisers and funds have one more rule on top: Regulation S-P, with a 30-day customer notice window.
Here’s what to have ready:
1. Name who decides “material.”
The four-day clock starts when you determine the incident is material, not when you discover it. But that decision has to come without unreasonable delay, so a fuzzy process won’t buy you time.
2. Start a dated log in hour one.
Small incidents count too. Related incidents must be judged together, even if each looked immaterial alone.
3. Pre-write the 8-K.
Item 1.05 asks for the nature, scope and timing, plus the material impact or likely impact. Don’t know something yet? Say so, then amend within four business days of learning it. You don’t have to share technical detail about your response or systems.
4. Don’t assume a ransom payment closes the question.
You still have to assess materiality after paying, and the payment size is only one factor.
5. Use Item 8.01 for the “not sure yet” cases.
Voluntary disclosures of immaterial or not-yet-assessed incidents go there, and if one turns material, it moves to Item 1.05 within four business days.
6. Build your 10-K cyber section (Item 1C).
Describe how you assess and manage material cyber risks, and whether that process sits inside your wider risk management. Cover the board’s oversight and management’s role too. A board cyber-expert disclosure was dropped from the final rule.
7. Rehearse once a year.
Get legal, finance, and your CISO in one room for a tabletop. It’s the cheapest way to find the gaps.
8. Regulated by Regulation S-P?
You need a written incident response program, and customer notice as soon as practicable, no later than 30 days after you become aware. Service providers must tell you within 72 hours. Both compliance dates have passed: 3 December 2025 for larger firms and 3 June 2026 for the rest. The SEC’s FY2026 exam priorities include checking this.
9. One narrow exception:
A filing can be delayed only if the US Attorney General tells the SEC in writing that disclosure risks national security or public safety. Don’t build a plan around it.
How Qualysec Helps Public Companies and Banks
Qualysec tests web applications, mobile apps, APIs, cloud environments, networks, AI/ML, and connected devices, with manual work alongside automated tools. It doesn’t decide materiality. Counsel and the disclosure committee do, using the facts the tests supply.
Penetration Testing and Validation Evidence
A 10-K that says production access is limited to named administrators can be pen-tested directly: the tester tries to reach production with a standard account and reports what happened.
- Authentication and access control checks
- API and cloud permission testing
- Findings with severity ratings and reproduction steps
Scoping Tests Around Incident Findings and Retesting After Remediation
Once forensics names the systems and paths an intruder used, a test can retrace them, and a retest repeats the original attack against each fix. The dated result gives counsel and auditors something a closed ticket can’t.
- Targeted tests on affected systems
- Retests after remediation
- A dated result for the evidence file
Reports Written for Disclosure Committees and Auditors
A report only an engineer can read does little for a disclosure committee. Qualysec reports set out the scope, the method, a severity rating for each finding, the steps to reproduce it and its fix status.
- Findings readable by non-technical reviewers
- Remediation guidance for engineering owners
- Records that support audit and counsel reviews
Conclusion
Avaya’s “limited number” of emails and Unisys’s “hypothetical” risks cost $1 million and $4 million, because each company already knew more than it said. Microsoft’s 8-K listed the accounts, the dates, and the open questions instead. A company with its materiality process, incident log, and retest records in place before a breach can write that kind of filing against a four-business-day deadline, and that groundwork decides how any SEC cybersecurity filing reads under pressure.
Ready to build the evidence behind your disclosures? Discuss your scope and timeline with Qualysec!
FAQs
1. What does the SEC require a public company to report after a cyber incident?
A company that determines an incident is material files a Form 8-K under Item 1.05 within four business days. The filing describes the material nature, scope and timing of the incident and its material impact or reasonably likely impact. Separately, the annual 10-K describes cyber risk management, board oversight and management’s role under Item 106.
2. How many days do you have to file after a cyber incident?
Four business days, counted from the date the company determines the incident is material and not from discovery. The company must still make that determination without unreasonable delay after discovery. If facts are missing at filing, the 8-K says so, and an amendment follows within four business days of the information becoming available.
3. What is the difference between Item 1.05 and Item 8.01?
Item 1.05 is for incidents a company has determined are material and carries the four-business-day deadline. Item 8.01 is a voluntary route for immaterial incidents or ones whose materiality isn’t yet determined, under staff guidance from 21 May 2024. A company that later finds an Item 8.01 incident material then files under Item 1.05.
4. Do smaller reporting companies have to comply?
Yes, with later dates for incident reports. Smaller reporting companies began Item 1.05 and Form 6-K reporting on 15 June 2024, six months after other registrants on 18 December 2023. Annual Item 106 disclosure applied to all registrants, smaller ones included, for fiscal years ending on or after 15 December 2023.
5. Can a company delay disclosure?
Only if the Attorney General determines that disclosure poses a substantial risk to national security or public safety and notifies the SEC in writing. The first delay lasts up to 30 days, a second can add up to 30 more, and an extraordinary final delay of up to 60 days applies only for national security. Companies can’t delay on their own.
6. What must the 10-K say about cybersecurity?
Item 106 requires a description of the processes for assessing, identifying and managing material cybersecurity risks. It also covers whether those risks have materially affected the company or are reasonably likely to, board oversight including any responsible committee, and management’s role. The disclosures are tagged in Inline XBRL, and the description must match the program that actually operates.
