Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

When do we…

When do we have to disclose a cyber incident to the SEC as a listed company?

4 decision pointsThe pack behind this answer: Regulatory Incident Notification & Reporting

Add to board memo

The short answer

Recommendation
Name, in advance, who determines whether an incident is material, make that determination without unreasonable delay on the facts known, and file within four business days of it, saying what is not yet determined.
Reasoning
The SEC starts the clock at the materiality determination, not at discovery, so the only way to lose days is to be slow to decide. It expects the decision without unreasonable delay after discovery, and it expects what is known to be filed, with the gaps stated, rather than a filing held back until the picture is complete. Information is material if there is a substantial likelihood that a reasonable shareholder would consider it important, or if it would have significantly altered the total mix of information; harm to reputation, relationships or competitiveness and the possibility of litigation or regulatory action can all be a material impact.
Considerations
  • Four business days skip weekends and days the SEC is closed. A determination made on a Saturday starts the count on the next business day.
  • The Attorney General can delay disclosure only on a written determination of a substantial risk to national security or public safety, for the period it specifies (a short separate delay exists under the FCC breach rule, Item 1.05(d)); the pack logs every request.
  • The filing does not need technical detail about the response, the systems or vulnerabilities that would impede the response. A ransom payment or insurance cover does not by itself settle materiality (SEC staff, Form 8-K questions 104B.05 to 104B.09).
  • The status of Item 1.05 may change: the SEC asked for comment on Regulation S-K on 13 January 2026, industry groups have asked it to rescind Item 1.05, and the note was read on 20 October 2026. Check sec.gov before you rely on it.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
  • Loop back
StartA cybersecurity incident is under way at a listed companyStepName who determines materiality, and their deputyStepGather the facts the decision needsDecisionCan the committee decide on the facts known?StepRecord why not yet, set a decide-by time and a checkpointDecisionIs the incident material?StepCount four business days from the determinationDecisionHas the Attorney General delayed disclosure in writing?StepDelay only as long as the Attorney General saysStepDraft Item 1.05 from the one fact baseDecisionIs any required information not yet determined?StepSay what is not determined, and promise the amendmentOutcomeFile on time, and amend as the facts arriveOutcomeNot material today: keep the reasons and revisit

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one. A code beside a source, such as RR-17, is the number of a rule in that pack document; the document lists its rules.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 14 steps.

  1. Start

    A cybersecurity incident is under way at a listed company

    The SEC's clock does not start at discovery or at declaration: it starts when the company determines the incident is material. That makes the speed of the decision your responsibility. Record the time of discovery now, and open the materiality question in the first four hours.

    In the pack

  2. Step

    Name who determines materiality, and their deputy

    In the pack's default the disclosure committee, or the chief financial officer with the General Counsel, determines it, and the audit committee is informed. Name them in the applicability profile, with a deputy, and check that they can meet within a day. A determination that waits for one person to return is a delay you chose.

    In the pack

  3. Step

    Gather the facts the decision needs

    Collect what is known about the nature, scope and timing of the incident and its impact: systems and data affected, operations disrupted, costs so far and likely, legal and regulatory exposure, effects on customers and relationships. Record what is unknown and who is finding it out. The decision is made on the facts known at the time.

    In the pack

  4. Decision

    Can the committee decide on the facts known?

    Information is material if there is a substantial likelihood that a reasonable shareholder would consider it important, or if it would have significantly altered the total mix of information, and doubts are resolved in favour of investors. Qualitative impact such as reputation, customer relationships or the possibility of litigation or regulatory action can count, not only money.

    In the pack

  5. Step

    Record why not yet, set a decide-by time and a checkpoint

    Record the facts missing, who is finding them out and the time the committee will decide, and repeat it at each incident update. Item 1.05 requires the determination without unreasonable delay after discovery. Agree a checkpoint in advance, and if there is no determination by then, escalate to the audit committee chair or the board's equivalent, and to counsel. The pack sets no number: Item 1.05 asks only that there is no unreasonable delay.

    In the pack

  6. Decision

    Is the incident material?

    Record the decision with its time and the reasons either way. If it is not material today, record why and revisit it at each update and at once when a fact changes: an incident that was not material on Tuesday can be material on Friday, and the clock starts at the later determination.

    In the pack

  7. Step

    Count four business days from the determination

    Weekends and days the SEC is closed are not counted. A Thursday determination with a holiday on the following Monday is due on the next Thursday, not the Wednesday. If the determination falls on a non-business day, the first business day after it is Day 1 of the four. The last safe time is 5:30 p.m. Eastern on the fourth business day. Put the date and time in the calendar of the drafter and the signatory.

    In the pack

  8. Decision

    Has the Attorney General delayed disclosure in writing?

    Disclosure may be delayed only if the United States Attorney General determines it poses a substantial risk to national security or public safety and tells the SEC in writing, for the period the Attorney General specifies, up to 30 days, then a further 30, and in extraordinary circumstances, for a risk to national security, a further 60. Anyone else's request is not a delay, apart from the short delay Item 1.05(d) gives a registrant subject to the FCC's breach rule (47 CFR 64.2011): record the request and take advice.

    In the pack

  9. Step

    Delay only as long as the Attorney General says

    Record who stated the delay, when, in what form and for how long, and file when it ends. The delay moves the filing, not the determination, which stays recorded.

    In the pack

  10. Step

    Draft Item 1.05 from the one fact base

    Describe the material aspects of the nature, scope and timing of the incident and its material impact or reasonably likely material impact, including on financial condition and results of operations. Leave out specific or technical detail about the response, systems or vulnerabilities that would impede the response. Keep it consistent with what you tell New York and the people affected.

    In the pack

  11. Decision

    Is any required information not yet determined?

    If any information the Item calls for is not determined or is unavailable at the filing, the filing says so, and an amendment follows within four business days after you determine it or it becomes available. Do not hold the filing back to complete it.

    In the pack

  12. Step

    Say what is not determined, and promise the amendment

    State which information is missing and that an amendment will follow. Put the amendment's due date in the calendar when the missing information is determined or becomes available.

    In the pack

  13. Outcome

    File on time, and amend as the facts arrive

    Start the filing so that its transmission begins by 5:30 p.m. Eastern time on the fourth business day: a filing whose transmission begins after that is deemed filed on the next business day. Log the time and the EDGAR acknowledgement, and record the next due time for any amendment. Check what the HIPAA, New York and State clocks need beside it: “When do we have to notify a US regulator or the people affected, and under which law?”.

    In the pack

    See also

  14. Outcome

    Not material today: keep the reasons and revisit

    Keep the facts, the reasons and the time of the decision, and revisit at each update. A reasoned decision recorded on the day is the evidence if the question is asked later.

    In the pack

Practical checklist

  1. Name the person or committee that determines materiality, with a deputy, and make sure they can meet within a day.
  2. Record the time of discovery and, at each update, why there is no determination yet. With none at the checkpoint you agreed in advance, escalate to the audit committee chair or the board's equivalent, and to counsel.
  3. Record the determination with its time, the facts and the reasons.
  4. Count four business days from it on a calendar that shows the SEC's closed days, and give the due date to the drafter and the signatory.
  5. File with what is known, state what is not, and amend within four business days of the missing information being determined or available.

Evidence to have ready

  • The determination: its time, who made it, the facts it rested on and the reasons.
  • Each update's record of why the determination was not yet made, if it was not.
  • The filing, the time it was made and the EDGAR acknowledgement.
  • Any amendment, and the time the missing information was determined or became available.

Assumptions

  • You are a registrant that files reports with the SEC. Foreign private issuers furnish a Form 6-K, not a Form 8-K, which the pack does not work through.
  • You have EDGAR access and a filing agent or in-house process that can file within a day, and a calendar that shows the days the SEC is closed.
  • The pack's note on the rule was read on 18 October 2026 from the SEC's Release 33-11216. Confirm the current rule and any SEC guidance with counsel before relying on it.

Not covered here