The Securities and Exchange Commission’s cybersecurity disclosure rules, adopted July 26, 2023, are still the clock public companies live on. The Commission’s small-entity guide states the split cleanly. A domestic registrant discloses a material cybersecurity incident on Form 8-K, under Item 1.05, within four business days of determining that the incident is material. Separately, the annual report on Form 10-K describes the company’s processes for cybersecurity risk, and the board’s and management’s roles. The four days run from the materiality determination, not from the moment someone notices a strange login.
This is not legal advice, and it is not a statement that every incident is material. It is the operator reading of a rule that vendors, private companies, and acquirers keep bumping into, because a public customer will ask you for facts on their clock.
What the form actually wants
The Commission’s July 26, 2023 release says Item 1.05 asks for the material aspects of the incident’s nature, scope, and timing, and for the material impact or the reasonably likely material impact. The small-entity guide says the same, and adds that foreign private issuers use Form 6-K when the incident is disclosed or required to be disclosed in another channel. Annual disclosure lives in Regulation S-K Item 106: processes for assessing and managing material cyber risk, the board’s oversight, and management’s role. The Commission did not adopt a requirement to disclose whether a particular director is a cybersecurity expert. Do not let a questionnaire invent that line and call it the rule.
Compliance dates are long past for calendar-year filers. Annual disclosures began with fiscal years ending on or after December 15, 2023. Non-smaller registrants began the 8-K duty on December 18, 2023. Smaller reporting companies had until June 15, 2024. If a playbook still says “the SEC rule is coming,” the playbook is late.
Discovery starts the investigation. Materiality starts the filing clock. Confusing the two is how a week disappears.
What a private company should still write down
You may not file an 8-K. Your customer might. Name, before an incident, who can decide that a customer-facing outage or a data theft is something a public customer must hear, and how fast you can say what systems, what data, and what you have turned off. The SEC’s rule does not draft your contract. It explains why the contract’s notice window of “promptly” will feel slow to a registrant whose counsel is counting business days from a materiality call.
Pair the clock with the insurance questionnaire you already answer. A control that satisfies an underwriter does not decide materiality. A materiality call that nobody has rehearsed will be made by whoever is awake.
A catalog post is not a materiality call
The last week of September gave the calendar a concrete test. CISA’s account posted three known-exploited vulnerabilities: WordPress Core on September 25 (CVE-2026-87902), an Apple bug on September 29 (CVE-2026-86950), and Cisco Catalyst SD-WAN Manager on September 30 (CVE-2026-76504). The catalog, not the post, holds the federal due dates: September 28, October 2, and October 3. Citrix NetScaler rows added September 27 were already due September 30. Fortinet FortiMail was added October 1, due October 4. The piece that walks those rows is CISA listed three bugs attackers are already using.
None of those facts is an Item 1.05 filing. The Commission’s clock starts when the company determines the incident is material, and Item 1.05 asks for the material aspects of nature, scope, and timing, plus the material impact or the reasonably likely material impact. A CVE number trending on a given morning does not, by itself, answer any of those. It can be the moment someone should ask the question. It can also be a bug in a product you do not run.
Write the two dates on separate lines when a public customer calls. One line is the day you patched, or the day you confirmed you do not run the product. The other line is the day, if it ever comes, that someone with authority decided the incident was material to the registrant. Confusing “CISA posted it” with “we have determined materiality” is how a private vendor blows a customer’s four business days, or invents a disclosure the customer did not need.
Rehearse the call with the people who would actually be on it. Who can say which systems were touched. Who can say whether data left. Who is allowed to tell a public customer, and who is allowed only to tell counsel. The annual Item 106 disclosure still has to describe processes, board oversight, and management’s role. It still does not require you to name a director as a cybersecurity expert. A questionnaire that demands that title is asking for something the Commission declined to require.
Foreign private issuers remain on Form 6-K when the incident is disclosed, or required to be disclosed, in another channel. A playbook written only for domestic 8-K filers will miss the parent company that asks for the same facts on a different form. This is still not legal advice. It is the reading that keeps the patching queue and the disclosure queue from sharing a single panicked email.
Sources
- SEC, “SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure,” July 26, 2023
- SEC small-entity compliance guide, Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure
- SEC final rule page, Release 33-11216
- CISA on X, the September 25–30 catalog posts (Apple, Cisco)
- CISA Known Exploited Vulnerabilities catalog, rows read October 1, 2026
Operator page: Before the Form 8-K clock. Related: Cyber insurance is rewriting the IT budget.