The SEC’s small-entity guide says domestic registrants disclose a material cybersecurity incident on Form 8-K within four business days after they determine the incident is material. Item 1.05 asks for the material aspects of nature, scope, and timing, and the material impact or reasonably likely material impact. The annual Form 10-K, under Regulation S-K Item 106, is a different duty: processes, board oversight, and management’s role.
The clock
Do not start the four days at the first alert. The Commission’s guide starts them at the materiality determination. That only helps if someone is authorized to make the determination, and if the facts they need are not trapped in a vendor’s ticket queue. Discovery without a decision is how the week vanishes.
What to rehearse
- Name the person who can call an incident material, and the counsel they call. A committee that meets monthly will miss four business days.
- List the facts Item 1.05 points at: what happened, what it touched, when, and what it does to the business. Practice filling those from logs you already keep.
- If you are the vendor, write the notice you can send in one business day: systems, data types, what you turned off, what you do not yet know. “Promptly” in a contract is slower than a customer’s 8-K.
- Keep the annual Item 106 description current. The incident form and the annual description answer different questions. The Commission did not require disclosure of a director’s cybersecurity expertise. Do not add that as if it were Item 106.
FAQ
We are private. Why rehearse?
Because a public customer’s counsel will ask you for the facts in their filing window. Your own Form 8-K is not the only clock in the room.
Does insurance decide materiality?
No. An underwriter’s question and Item 1.05 are different documents. Answer both from the same facts. Do not let one substitute for the other.