SEC Cyber Incident Disclosure: The 8-K Item 1.05 Four-Business-Day Clock, Explained

Key takeaways

• Item 1.05 of Form 8-K is the disclosure vehicle. A registrant that determines a cybersecurity incident is material must file an 8-K describing it within four business days of that determination.
• The clock runs on materiality, not discovery. The four business days start when the company determines the incident is material, and the SEC requires that determination be made without unreasonable delay.
• The disclosure has required content and a safety valve. Describe the nature, scope, timing, and material impact or reasonably likely material impact. You may omit technical incident detail whose public disclosure itself poses a substantial risk, and the Attorney General can order a delay for national security or public safety.
• Annual cyber governance disclosure is separate. Regulation S-K Item 106 requires yearly disclosure of cyber risk management, strategy, and governance in the 10-K. Incidents deemed immaterial individually can be aggregated there.
• Your incident documentation is now a disclosure input. The timeline, scope, and impact evidence your IR team and retained firms produce is what the materiality determination and the filing stand on.

The rule and its clock

The SEC adopted its cybersecurity disclosure rules in July 2023, and they took effect in December 2023. The incident-disclosure half lives in Item 1.05 of Form 8-K. When a registrant determines that a cybersecurity incident it experienced is material, it files an 8-K within four business days and describes the incident: its nature, its scope, its timing, and its material impact or its reasonably likely material impact on the company's financial condition and results of operations.

Two timing details do the real work in practice.

Materiality, determined without unreasonable delay. The four-day clock does not start at discovery. It starts at the materiality determination. But the SEC requires registrants to make that determination without unreasonable delay after discovery, so the clock is closer to discovery than it looks. A company that spends six weeks deciding whether an incident is material will have to explain the weeks.

The business-day count. Four business days, not four days. An incident determined material on a Thursday afternoon gives the company through the following Wednesday, and the practical planning window is shorter once drafting, board communication, and disclosure counsel review are real.

This is a plain-English explainer of a legal obligation, not legal advice. The materiality call belongs to the company with its counsel; what follows is what the process demands from your incident response.

What the filing has to say, and may not

Item 1.05 asks for a description of the incident's nature, scope, timing, and material impact or reasonably likely material impact. It does not ask for a forensic report. The SEC deliberately shaped the rule so the filing itself does not create a blueprint for attackers: registrants may omit technical incident detail whose public disclosure poses a substantial risk, without needing to justify the omission in the filing.

There is also a formal delay mechanism. If the Attorney General determines that public disclosure poses a substantial risk to national security or public safety, the registrant delays the filing and notifies the SEC of the determination within 120 days of the filing's due date. Companies do not control this valve; the government does. The working assumption for planning is that the four-business-day clock runs.

The four business days are a deadline, not a target. An 8-K filed at hour 95 of 96 says things about response maturity that the content cannot undo.

The annual half of the rule

Item 1.05 covers incidents. Regulation S-K Item 106 covers the program. Every year, in the 10-K, registrants disclose their processes for assessing, identifying, and managing material cyber risks, whether cyber threats have materially affected or are reasonably likely to materially affect them, and the board's and management's oversight of cyber risk.

Item 106(b)(2) is where small incidents go. Incidents that were not material individually can be aggregated and addressed in the annual disclosure if a pattern of them becomes material in combination. This is why the immaterial-incident log matters: the annual filing needs the record to make that judgment honestly.

What the rule demands from your incident response

The filing is drafted by counsel and approved by the board. It stands on evidence the incident response produces.

• A defensible timeline. Discovery date, escalation path, materiality determination date, and what was known at each point. This is the incident commander's documentation job, and the four-business-day clock reads it first.
• Scope evidence. What systems, data, and counterparties were affected, established by forensics rather than assumption. Scope is what the materiality call and the "reasonably likely" impact language rest on.
• Impact analysis. Financial, operational, legal, and reputational impact, expressed in the language investors read. Your IR firm's interim reports feed this.
• The incident log for everything else. Incidents you determined were immaterial, with the reasons, feeding the annual aggregation judgment.

If your response is retainer-backed, this is part of what the retainer buys: firms that document to claims and regulatory standards produce filings-ready material. The economics of retaining one, including what insurers cover, are in our retainer cost guide and the insurance and retainer overlap.

How Item 1.05 fits with the other notification clocks

A material incident can trigger several clocks at once. The SEC's four business days are the newest and, in practice, the fastest for public companies. They sit alongside the state breach notification laws, HIPAA's 60-day rule for covered entities (explained here), and, for organizations with EU data subjects, GDPR's 72-hour supervisory notification (explained here). The 8-K and the regulatory notifications are different documents for different audiences, drafted in parallel, and the timeline evidence is shared. Teams that plan the notification set together (counsel, IR, communications) do not relitigate the facts three times.

Frequently asked questions

Does every cyber incident require an 8-K Item 1.05 filing? No. Only incidents the registrant determines are material. Immaterial incidents may appear in the annual Item 106 disclosure, individually or aggregated, if the pattern is material.

When exactly does the four-business-day clock start? On the materiality determination, which the SEC requires be made without unreasonable delay after discovery. The gap between discovery and determination is where the judgment and the scrutiny both live.

What if we still do not know the full scope at day four? File with what is known. Item 1.05 asks for the information material to investors at filing, and registrants provide updates in later filings as understanding improves. Waiting for perfect scope is not an option the rule offers.

Do private companies have to file? No. Item 1.05 applies to SEC registrants. Private companies face state breach laws and contractual notification duties, but not the 8-K regime, which is one reason their buyers (public companies) ask hard questions about vendor incident process.

What did enforcement look like before the rule existed? The SEC charged SolarWinds and its CISO with fraud in October 2023, alleging gaps between public statements about cyber practices and known conditions. That action predates Item 1.05 and rests on the anti-fraud rules. The lesson companies took is broader than the rule: cyber statements to investors, incident-related or program-related, are made under the securities laws.