Under the SEC’s final cyber rule, the clock starts at a decision, so the decision needs a record

The week

On July 26, 2023, the Securities and Exchange Commission adopted rules on cybersecurity risk management, strategy, governance and incident disclosure for public companies. The rules added Item 1.05 to Form 8-K, requiring disclosure of a material cybersecurity incident within four business days of the company determining that it is material. A delay was available only if the U.S. Attorney General found that disclosure posed a substantial risk to national security or public safety. The rules also required annual Form 10-K disclosure of processes for assessing and managing cyber risk and of board and management oversight. Compared with the 2022 proposal, the final rules dropped a requirement to disclose board members’ cybersecurity expertise. Incident reporting began on December 18, 2023, with later dates for smaller reporting companies.

Earlier in this series we looked at the 2022 proposal and its demand that boards describe their own oversight of cyber risk. The final rule kept that annual description in lighter form. Its sharper change was elsewhere. The four-business-day clock does not start at discovery of an incident. It starts when the company determines the incident is material, and the SEC said that determination must be made without unreasonable delay. A rule that starts the clock at a decision makes the decision the thing regulators, investors and plaintiffs will examine later. We look at that decision in three parts: who makes it, what record it leaves, and how it fits with the other notification clocks a regulated company already runs.

Who decides

Materiality in securities law is a judgment about what a reasonable investor would consider important in the total mix of information. It weighs qualitative factors such as harm to reputation, customer relationships, litigation and regulatory exposure, not only immediate financial loss. Security teams can scope an incident technically. They are not trained to judge materiality. Lawyers and finance teams can judge materiality but cannot tell how bad an incident is from a forensic report.

The decision therefore needs a defined group. In practice that is a standing disclosure or materiality committee, usually chaired by the general counsel, with the CISO, the CFO or controller, investor relations and the affected business leader. Its trigger should be written down: for example, any incident escalated to severity one, any incident involving regulated personal data above a set volume, or any incident affecting a system that supports a material revenue line. A trigger that depends on someone deciding to call a meeting is a trigger that will be late.

Membership should have named deputies, because incidents do not wait for travel schedules. The board’s role should be defined too. Most companies keep the determination with management and inform the audit or risk committee promptly. Whatever the choice, the incident response plan should say it, so nobody debates authority during the first night of an incident.

The committee also needs agreed criteria before an incident, not during one. Useful criteria include operational disruption measured in days, the share of customers affected, the likely regulatory response, and whether the incident would change how an investor views the company’s risk. The criteria do not make the decision mechanical. They make it consistent, and consistency is what a later reviewer will test.

What the record shows

A company that concludes an incident is not material, or not yet material, should be able to show how and when it reached that view. That means minutes for each committee meeting, the facts known at the time, the criteria applied, the conclusion and the next review date. If the facts change, as they often do when exfiltration is discovered weeks after encryption, the record should show the reassessment and its timing.

Several practical problems follow. Forensic firms are often engaged through outside counsel to preserve privilege, which can make factual findings slow to reach the committee. Companies need a protocol that gets facts to decision makers quickly while preserving privilege where it applies. Counsel should design that protocol in advance. A second problem is incidents at vendors. A company may learn of a vendor incident late and with incomplete facts, yet the materiality question is about impact on the company. The record should show when the company learned what, and what it did to find out more.

The annual 10-K description draws on the same record. Whatever a company says about its process becomes a statement investors may rely on. That includes the committee, its members and its escalation criteria. After an incident, the SEC may compare those statements with practice. Writing the description from the actual process, reviewed by security and legal together, keeps the two consistent. Aspirational language about controls is a liability rather than a reassurance.

How it fits other clocks

Regulated companies faced several notification regimes before this rule. Banking organizations must notify their primary federal regulator within 36 hours of determining that a notification incident has occurred, under the interagency rule that took effect in 2022. HIPAA covered entities and business associates owe breach notifications to individuals and HHS. State breach laws set their own timelines, and contracts with customers and partners add more.

Each regime has a different trigger, threshold and audience. A bank holding company might notify its regulator under the 36-hour rule well before deciding an incident is material for securities purposes. A hospital operator might owe HIPAA notifications for an incident that is never material to investors. Running these as separate processes invites inconsistency, and inconsistency between what a regulator, customers and investors were told is what draws scrutiny.

The answer is a single incident record that lists each regime, its trigger, the date the trigger was met and the deadline, with one owner coordinating what is said to whom. The materiality decision is one row in that record. Treating it that way also guards against a mistake many observers expected: filing an 8-K under Item 1.05 for every incident out of caution. Over-filing dilutes the signal to investors and can itself mislead. The record should show why an incident was or was not disclosed, and under which item.

With hindsight

The rules took effect as scheduled in December 2023, and early filings showed companies unsure where the line sat. Some filed under Item 1.05 before determining materiality. In May 2024 the SEC’s Division of Corporation Finance said Item 1.05 should be reserved for incidents determined to be material, with other disclosures made voluntarily under Item 8.01. The SEC’s enforcement action against SolarWinds and its CISO, brought in 2023 under earlier law, raised fears of personal liability for security leaders. A federal judge dismissed most of the claims in July 2024, and in November 2025 the SEC voluntarily dismissed the remaining claims. Under new leadership in 2025 the SEC reorganized its cyber enforcement unit, but the disclosure rules stayed in force. The Item 1.05 clock still starts at the determination, so the case for a defined decision group with a written record is unchanged.