SEC cyber disclosure: Form 8-K Item 1.05, S-K Item 106 and the 36-hour bank rule

Two SEC obligations, one governance story

The SEC adopted its cybersecurity disclosure rules in July 2023. They created two obligations that are read together by investors and, increasingly, by enforcement staff:

• Form 8-K Item 1.05: current disclosure of a material cybersecurity incident within four business days of determining it is material.
• Regulation S-K Item 106: annual disclosure in Form 10-K (Item 1C) of how the company manages cybersecurity risk and how the board oversees it.

Foreign private issuers have equivalent requirements on Form 6-K and Form 20-F (Item 16K). The two filings have to tell a consistent story. A 10-K that describes mature incident response, followed by an 8-K filed weeks late, invites questions.

Form 8-K Item 1.05: what triggers it

Item 1.05 applies when a registrant experiences a cybersecurity incident that it determines to be material. A cybersecurity incident is an unauthorized occurrence, or a series of related unauthorized occurrences, on or conducted through the registrant's information systems that jeopardizes the confidentiality, integrity or availability of those systems or the information on them.

Three points catch companies out:

1. Third-party systems count. "Information systems" include systems used by the registrant, not only those it owns. A breach at a cloud or SaaS provider can trigger Item 1.05.
2. Series of related events. Individually minor intrusions by the same actor can together be material.
3. Unknowns are not a reason to wait. If required information is not determined or available at filing, the 8-K says so and an 8-K/A follows within four business days after the information becomes available.

Materiality in practice

The SEC applies the traditional securities law test: information is material if there is a substantial likelihood a reasonable investor would consider it important, or if it would significantly alter the total mix of information available. Both quantitative and qualitative factors count, including:

• Harm to reputation, customer or vendor relationships, and competitiveness.
• The possibility of litigation or regulatory investigation, including by state, federal and non-US authorities.
• Operational disruption, data loss and remediation cost.

Materiality is a legal judgment, but it rests on technical facts: what was accessed, for how long, what was exfiltrated, which operations were affected, whether the attacker is still present. Counsel cannot assess impact that has not been scoped. The quality and speed of the investigation therefore determines whether the "without unreasonable delay" standard is defensible.

The 4-business-day timeline

The four days are business days. An incident determined material on a Thursday must be disclosed by the following Wednesday. Boards should expect the determination to be documented: who decided, when, and on what facts. A long gap between detection and determination is exactly what an enforcement inquiry will examine.

Practical consequences for the detection and response function:

• Escalation criteria from the SOC to the disclosure committee must be written down and tested.
• Investigation output should be framed in business impact, not only indicators of compromise.
• The incident timeline must be reconstructible from logs you control, for the 8-K, the 8-K/A and later scrutiny.

Regulation S-K Item 106 and the 10-K

Item 106 requires annual disclosure, in Form 10-K Item 1C, of cybersecurity risk management, strategy and governance. It has applied to annual reports for fiscal years ending on or after December 15, 2023.

The disclosure must describe processes "in sufficient detail for a reasonable investor to understand" them. Boilerplate is a risk in itself: the SEC's 2024 enforcement actions targeted disclosures that described risks as hypothetical when incidents had already happened.

Banks: the 36-hour notification rule

Since May 1, 2022, the OCC, the Federal Reserve and the FDIC require banking organizations to notify their primary federal regulator as soon as possible and no later than 36 hours after determining that a notification incident has occurred.

A notification incident is a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the bank's:

• ability to carry out banking operations or deliver products and services to a material portion of its customers;
• business lines whose failure would result in a material loss of revenue, profit or franchise value; or
• operations whose failure would pose a threat to the financial stability of the United States.

Bank service providers must notify each affected banking customer as soon as possible when an incident has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services for four or more hours.

Other financial-sector clocks

A single ransomware event at a listed bank holding company can trigger up to four of these, once CIRCIA takes effect. The determinations differ, but they all draw on the same incident facts.

Enforcement and outlook

In October 2024 the SEC settled charges with four technology companies over misleading cybersecurity disclosures, with penalties totalling about $7 million. The theme was consistent: risk factor language that described an incident as hypothetical after it had occurred, or minimized known impact.

The current SEC has signaled a lighter regulatory touch. Industry groups petitioned to rescind Item 1.05 in May 2025, and the SEC opened a broad review of Regulation S-K in January 2026. Until a rule change is proposed and adopted, Item 1.05 and Item 106 remain in force, and the anti-fraud provisions that underpinned the 2024 cases are unaffected.

Executive audit checklist

Questions an audit committee can put to the CISO and general counsel:

• Is there a written escalation path from security operations to the disclosure committee, with time targets?
• Who determines materiality, and how is the date and basis of that determination recorded?
• Can we scope an incident (systems, data, duration, business impact) within 48 hours, including nights and weekends?
• Do we retain the logs needed to reconstruct an incident timeline months later, under our own control?
• Does our 10-K Item 1C description match how detection and response actually operate today?
• Are third-party and SaaS incidents routed into the same materiality process?
• For banking entities: is the 36-hour regulator notification owned by a named role, with a template ready?
• Have we run a tabletop that ends with a draft 8-K, not just containment?