SEC Cybersecurity Disclosure Rules

Form 8-K Item 1.05 disclosure of material cybersecurity incidents within four business days and annual Form 10-K disclosure of risk management, strategy and governance. Separate Regulation S-P amendments add customer notification duties from 2025-2026.

Analysis

The SEC Cybersecurity Disclosure Rules require public companies to disclose material cybersecurity incidents within four business days of determining materiality and to provide annual disclosures on cybersecurity risk management, strategy, governance, and board oversight in their Form 10‑K (or Form 20‑F for foreign issuers).SEC Adopting Release SummarySEC Final Rule – Cybersecurity Risk Management, Strategy, Governance, and IncidentsKPMG Summary of SEC Cyber Rules

Key Requirements

• Material cybersecurity incident disclosure on Form 8‑K (Item 1.05)
• Public companies must file an Item 1.05 Form 8‑K within four business days after determining that a cybersecurity incident is material, describing the incident’s nature, scope, timing, and material impact or reasonably likely material impact.SEC Press Release on Cyber RulesSEC Final Rule – Cybersecurity Risk Management, Strategy, Governance, and IncidentsAmerican Academy of Actuaries Brief
• The four‑business‑day clock runs from the determination of materiality, not initial discovery, and companies must make materiality determinations without unreasonable delay after discovering an incident.SEC Final Rule – Cybersecurity Risk Management, Strategy, Governance, and IncidentsKPMG Board Lens AnalysisSidley SEC Cyber Update

• Annual disclosure of cybersecurity risk management, strategy, and governance (Regulation S‑K Item 106 / Form 10‑K Item 1C)
• Companies must describe processes for assessing, identifying, and managing material risks from cybersecurity threats, including use of third‑party service providers and whether such processes are integrated into the overall enterprise risk management program.SEC Final Rule – Cybersecurity Risk Management, Strategy, Governance, and IncidentsSEC Press Release on Cyber RulesCPA Journal Rule Analysis
• Companies must disclose material effects or reasonably likely material effects of cybersecurity risks and incidents on business, operations, or financial condition.SEC Final Rule – Cybersecurity Risk Management, Strategy, Governance, and IncidentsKPMG Summary of SEC Cyber RulesKPMG Board Lens Analysis

• Disclosure of board oversight and management’s role in cybersecurity
• Annual reports must describe board of directors’ oversight of risks from cybersecurity threats, including how the board is informed and how often cybersecurity is considered.SEC Final Rule – Cybersecurity Risk Management, Strategy, Governance, and IncidentsSEC Press Release on Cyber RulesKPMG Board Lens Analysis
• Companies must also describe management’s role and expertise in assessing and managing material cybersecurity risks, including which management positions or committees are responsible and how they report to the board.SEC Final Rule – Cybersecurity Risk Management, Strategy, Governance, and IncidentsSidley SEC Cyber UpdateCPA Journal Rule Analysis

• Applicability to registrants under the Exchange Act, including foreign private issuers and smaller reporting companies
• The rules apply to all public companies subject to the reporting requirements of the Securities Exchange Act of 1934, including foreign private issuers (Form 20‑F / Form 6‑K) and smaller reporting companies, with some phased‑in timing for smaller reporting companies.SEC Final Rule – Cybersecurity Risk Management, Strategy, Governance, and IncidentsSEC Press Release on Cyber RulesSidley SEC Cyber Update

• Inline XBRL tagging of cybersecurity disclosures
• Registrants must tag cybersecurity disclosures in Inline XBRL, beginning one year after initial compliance dates (for annual reports) and on specified dates for incident disclosures, to facilitate machine‑readable analysis.SEC Final Rule – Cybersecurity Risk Management, Strategy, Governance, and IncidentsCPA Journal Rule AnalysisSidley SEC Cyber Update

Compliance Challenges

• Determining “materiality” quickly and consistently
• Organizations struggle to assess materiality under time pressure, balancing incomplete technical information, evolving impacts, and legal risk, while still meeting the four‑business‑day disclosure requirement.SEC Final Rule – Cybersecurity Risk Management, Strategy, Governance, and IncidentsKPMG Board Lens AnalysisAmerican Academy of Actuaries Brief
• Industry commentary notes concerns that premature or over‑disclosure could hinder incident response or increase legal exposure, while under‑disclosure risks enforcement.Wiley Legal Alert on SEC Cyber RulesZscaler SEC Cyber Rules OverviewDeloitte Heads Up – SEC Cyber Disclosure Rule

• Coordinating legal, security, and investor‑relations under tight deadlines
• The rules require cross‑functional coordination (CISO, CIO, legal, risk, finance, IR, communications) to draft accurate Form 8‑K disclosures aligned with ongoing incident response.KPMG Board Lens AnalysisSidley SEC Cyber UpdateDeloitte Heads Up – SEC Cyber Disclosure Rule
• Reports highlight that many companies did not previously have formal playbooks to integrate incident response and securities disclosure obligations.Zscaler SEC Cyber Rules OverviewAmerican Academy of Actuaries BriefKPMG Summary of SEC Cyber Rules

• Documenting and evidencing risk management and governance practices
• Companies must describe risk management processes, board oversight, and management expertise, which can expose gaps in governance and require significant documentation, board education, and policy updates.SEC Final Rule – Cybersecurity Risk Management, Strategy, Governance, and IncidentsSEC Press Release on Cyber RulesKPMG Board Lens Analysis
• Industry analyses note that board cyber expertise is often limited, necessitating training and governance restructuring to support credible disclosure.KPMG Board Lens AnalysisDeloitte Heads Up – SEC Cyber Disclosure RuleZscaler SEC Cyber Rules Overview

• Balancing disclosure with security and law‑enforcement considerations
• The SEC rule includes limited provisions for delayed disclosure where the U.S. Attorney General determines immediate disclosure would pose a substantial risk to national security or public safety, but operationalizing this is complex.SEC Final Rule – Cybersecurity Risk Management, Strategy, Governance, and IncidentsSEC Press Release on Cyber RulesWiley Legal Alert on SEC Cyber Rules
• Companies must coordinate with law enforcement and government agencies while still meeting securities‑law deadlines.Sidley SEC Cyber UpdateAmerican Academy of Actuaries BriefDeloitte Heads Up – SEC Cyber Disclosure Rule

• Real‑world examples and industry observations
• Analyses of early filings under Item 1.05 Form 8‑K show variation in the level of detail and approaches to describing impact, illustrating interpretive challenges.American Academy of Actuaries BriefCPA Journal Rule AnalysisZscaler SEC Cyber Rules Overview
• Board‑oriented reports note that cybersecurity is becoming a standing board agenda item, and risk committees are revising charters to address the new disclosure expectations.KPMG Board Lens AnalysisKPMG Summary of SEC Cyber RulesDeloitte Heads Up – SEC Cyber Disclosure Rule

Implementation Best Practices

• Establish a formal incident disclosure playbook aligned to Form 8‑K requirements
• Define clear criteria and processes for materiality assessment, including decision rights (e.g., CISO, CFO, General Counsel) and documentation standards.SEC Final Rule – Cybersecurity Risk Management, Strategy, Governance, and IncidentsKPMG Board Lens AnalysisDeloitte Heads Up – SEC Cyber Disclosure Rule
• Integrate SEC disclosure steps into existing incident response plans, with timelines designed to support the four‑business‑day requirement.Zscaler SEC Cyber Rules OverviewAmerican Academy of Actuaries BriefKPMG Summary of SEC Cyber Rules

• Align with recognized cybersecurity frameworks (e.g., NIST)
• Using frameworks such as the NIST Cybersecurity Framework (CSF) helps structure disclosures around identify, protect, detect, respond, recover and supports describing risk management processes in the Form 10‑K.NIST Cybersecurity Framework (CSF) 2.0NIST Special Publication 800‑53SEC Final Rule – Cybersecurity Risk Management, Strategy, Governance, and Incidents
• Many implementation guides recommend mapping existing controls to NIST CSF and using those mappings to inform the narrative on risk management and governance.Deloitte Heads Up – SEC Cyber Disclosure RuleKPMG Summary of SEC Cyber RulesZscaler SEC Cyber Rules Overview

• Enhance board and management governance structures
• Establish or refine board‑level committees (e.g., risk or technology committee) with explicit cybersecurity oversight responsibilities and regular reporting from management.SEC Final Rule – Cybersecurity Risk Management, Strategy, Governance, and IncidentsKPMG Board Lens AnalysisSidley SEC Cyber Update
• Implement board education programs on cyber risk and regulatory disclosure expectations to support credible oversight descriptions.KPMG Board Lens AnalysisDeloitte Heads Up – SEC Cyber Disclosure RuleZscaler SEC Cyber Rules Overview

• Develop robust documentation and evidence for annual disclosures
• Maintain risk registers, incident logs, and governance records that support statements about risk management processes and past incidents’ effects.SEC Final Rule – Cybersecurity Risk Management, Strategy, Governance, and IncidentsCPA Journal Rule AnalysisKPMG Summary of SEC Cyber Rules
• Use cross‑functional disclosure committees to review cyber‑related sections of Form 10‑K/20‑F for consistency with enterprise risk disclosures and financial reporting.[KPMG Board Lens Analysis](https://kpmg.com/us/en/board-leadership/articles/2023/sec-final-cybersecurity-rules-a

Recent developments

• 2026-07-10 — Article reports a surge in Form 8‑K filings under the SEC Cybersecurity Disclosure Rules as companies disclose recent ransomware and data‑breach incidents, highlighting challenges in making rapid materiality determinations and coordinating legal, IT, and investor‑relations teams within the four‑business‑day window.[5][6] (source)
• 2026-06-25 — Coverage of how the SEC cybersecurity disclosure regime is driving financial‑sector boards to add directors with cyber and technology expertise and to formalize oversight structures, in response to Regulation S‑K Item 106 requirements to describe board oversight and management’s role in cyber risk governance.[2][5][6] (source)
• 2026-06-15 — SEC reminder that **smaller reporting companies** must begin complying with the Form 8‑K Item 1.05 material cybersecurity incident disclosure requirement as of June 15, 2024, marking a key transition milestone for smaller financial registrants under the Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure rules.[6][7] (source)
• 2026-06-12 — Report on U.S. banks and broker‑dealers revising incident‑response playbooks to meet SEC requirements to disclose material cybersecurity incidents on Form 8‑K within four business days, noting concerns that rapid public disclosure could complicate law‑enforcement investigations and negotiations with threat actors.[5][6] (source)
• 2026-05-30 — EY analysis describes how financial‑services issuers are operationalizing the SEC’s cyber disclosure rules, including building cross‑functional disclosure committees, enhancing incident materiality frameworks, and preparing for Inline XBRL tagging of cybersecurity disclosures for fiscal years ending on or after December 15, 2024.[5][6][7] (source)
• 2026-05-18 — SIFMA reiterates industry criticism that the SEC cyber disclosure rule “endangers victims and fails to advance investor protections,” arguing that mandatory rapid public disclosure of material incidents can increase operational risk for financial institutions and customers, and calling for greater flexibility around timing and content of disclosures.[3] (source)
• 2026-04-22 — SEC staff speech reflects on the first months of implementation of the cybersecurity disclosure rules, emphasizing the two core components—four‑business‑day current reporting of material incidents on Form 8‑K and annual disclosure of cybersecurity risk management, strategy, and governance—and noting that consistent, comparable disclosures are becoming critical for investors in the financial sector.[4][5][6] (source)
• 2026-03-29 — Deloitte update highlights practical implementation issues for financial‑industry registrants, including defining “material” cybersecurity incidents, coordinating with the U.S. Attorney General when seeking national‑security related delays, and integrating new Form 8‑K Item 1.05 and Regulation S‑K Item 106 disclosures into existing SEC reporting processes.[1][5][6] (source)
• 2026-03-10 — CPA Journal article, widely cited in 2026 compliance discussions, explains the SEC’s finalized cyber disclosure framework—amendments to Form 8‑K for incident reporting and addition of Regulation S‑K Item 106 for annual cyber risk management and governance disclosures—and notes particular implications for public financial companies with complex technology and third‑party risk profiles.[2][5][6] (source)
• 2026-02-20 — SEC’s final rule document continues to serve as the authoritative reference for financial‑industry compliance, detailing requirements to disclose material cybersecurity incidents, describe processes for assessing and managing cyber risks, explain board and management oversight, and comply with phased‑in Inline XBRL tagging for both incident and annual cybersecurity disclosures.[5][6][7] (source)

Enforcement actions

Related regulations

• NIST AI Risk Management Framework (AI RMF 1.0) — United States, Active, effective 2023-01-26
• Blueprint for an AI Bill of Rights — United States, Active
• COPPA (Children's Online Privacy Protection Act) — United States, Active
• Cybersecurity Maturity Model Certification — United States, Phased, effective 2025-11-10
• Executive Order 14365 - Ensuring a National Policy Framework for Artificial Intelligence — United States, Active, effective 2025-12-11
• TAKE IT DOWN Act — United States, Active, effective 2026-05-19
• SEC Regulation S-P Amendments (Customer Data Incident Response) — United States, Active, effective 2026-06-03
• CIRCIA Cyber Incident Reporting Rule (CISA) — United States, Proposed

Put it into practice

• Generate the policy: SEC cybersecurity policy generator (generatepolicy.com)
• Buy the policy pack: Financial Services Bundle (cyberpolicy.shop)
• Build it yourself: SEC 8-K Item 1.05 Materiality Workbook (ciso.diy)

Browse all regulations · Compliance deadlines · Latest updates