Quick Answer — On July 26, 2023, the SEC adopted its cybersecurity disclosure rule: public companies must file an Item 1.05 8-K within four business days of determining a cybersecurity incident is material — and annually disclose their risk-management and governance posture. The rule turned breach disclosure from a courtesy into a regulated, enforceable disclosure control — with materiality judgment delegated to the very executives whose incentives run the other way, and the four-day clock starting not at detection but at materiality determination, a subtlety that would consume the next two years of compliance debate.
What the rule requires
- Item 1.05 (8-K): File within four business days of concluding an incident is material — describe nature, scope, timing, and material impact or reasonably likely impact. The clock starts at the materiality determination, not attacker entry.
- Item 106 (10-K): Annual description of processes for assessing, identifying, and managing material cybersecurity threats, plus board oversight and management’s role — governance on the record, annually.
- Enforcement: Failure-to-file and misleading disclosures ride existing securities-fraud machinery — the same Enforcement Division that would later charge companies for both concealing and for sloppy post-breach statements.
Materiality: the loaded word
| Question | The rule’s answer | The friction |
|---|---|---|
| Who decides materiality? | Management, with counsel | Self-graded homework under fraud liability |
| When does the clock start? | On determination, absent facts suggesting recklessness | Determination date is re-litigable for years |
| What standard applies? | Existing securities materiality (a substantial likelihood a reasonable investor would care) | Security severity ≠ investor materiality |
| Can you file late? | Yes — delay allowed while determining, if justified | “Determining” becomes the delay strategy |
Timeline
| Date | Event |
|---|---|
| 2022-03 | SEC first proposes cyber disclosure rules after SolarWinds-era pressure |
| 2023-07-26 | Final rule adopted: 4-business-day Item 1.05 8-K + Item 106 annual governance disclosures — our event date |
| 2023-12 | First major test: SolarWinds and its CTO charged with fraud over pre-breach security statements — the disclosure doctrine shows its teeth |
| 2024 → | First Item 1.05 filings roll in; SEC opens investigations into late filers; companies test the rule’s boundaries in court |
| 2025 → | Enforcement pattern matures: charges for both concealment and over-disclosure walk-backs; materiality judgments become case law |
Defensive lessons
- Disclosure is a security control. A four-day filing clock is a harder SLA than most incident-response retainers — the disclosure workstream (legal, comms, finance, security) must be rehearsed like the technical one.
- Materiality judgment needs a documented method. “We felt it wasn’t material” invites enforcement; a written rubric — data classes, record counts, revenue exposure, regulatory overlay — converts a gut call into a defensible process.
- The determination date is evidence. Every materiality meeting, ticket, and email becomes discoverable the moment the SEC asks why the 8-K came when it did — treat the decision trail as litigation-grade from hour one.
- Annual governance disclosure is an attack map. Item 106 answers tell attackers and plaintiffs alike how your program is staffed and overseen; write them honestly, and with an eye on how they read in a deposition.
Why the four days are the easy part
The headline number misses the point: four business days is trivially achievable for an incident already scoped — the hard part sits upstream, in detection latency and materiality process. Companies that failed the rule didn’t fail at filing speed; they failed at deciding — letting determination drift for weeks while forensics iterated, then arguing the clock started late. The organizations that treat the rule well inverted their IR runbooks: materiality assessment now runs parallel to scoping, with legal seated in the war room from the first indicator, draft 8-K language maintained as living documents, and a named decision-maker with authority to file. That reorganization — not the calendar — is what the rule actually bought.
Why it still matters in 2026
The rule is now load-bearing market infrastructure: analysts price breach news in hours, plaintiffs’ firms monitor 8-K feeds like tickers, and the SEC has trained both barrels — charging concealment (SolarWinds) and sloppy disclosure alike. Its transatlantic echo arrived as the EU’s NIS2 reporting clocks, and together they’ve made “regulator-grade incident timeline” a standard deliverable of modern IR. The 2026 consensus the rule catalyzed: disclosure readiness is a measurable security capability — rehearsed, documented, and owned at the executive level, because the alternative is explaining the gap to two audiences at once: the market and the enforcement arm.
What counts as “material”?
The securities-law standard: information a reasonable investor would consider important — a facts-and-circumstances judgment where breach size, data sensitivity, financial impact, and reputational exposure all weigh in. It is deliberately NOT the CVSS scale: a low-severity compromise of earnings systems can out-rank a noisy ransomware event that encrypts nothing that matters.
Does the clock start at breach or at discovery?
Neither, precisely: it starts at materiality determination — unless a company unreasonably delayed determining it. That qualifier is the rule’s enforcement spine and its litigation battlefield: the SEC’s position is that facts suggesting material harm trigger a duty to conclude promptly, not a license to keep studying.
Was SolarWinds charged under this rule?
No — the charges (fraud, for pre-breach misstatements about security posture) rode classic securities-fraud statutes; but the December 2023 action landed as the rule’s unmistakable warning shot: security statements are disclosures, and their accuracy is enforceable regardless of which filing they live in.
Do private companies ignore this?
Mostly — it binds public issuers. But the ripple engages everyone: vendors inherit disclosure-readiness clauses in contracts, cyber-insurers demand the same documented materiality rubrics, and private firms eyeing IPO or acquisition adopt the discipline early, because diligence now asks for it.
Part of the hmmnm.com security-timeline series — one event per month, 2021–2024, indexed here.
