The clock starts when the company determines the incident is material, not when it is discovered. That determination must be made without unreasonable delay after discovery. The company then has four business days to file Form 8-K Item 1.05. Incidents that are not material, or not yet assessed, should be disclosed voluntarily under Item 8.01 instead.
The SEC's 2023 rules created Item 1.05 of Form 8-K. A registrant must disclose a material cybersecurity incident within four business days of determining it is material. The determination itself must be made without unreasonable delay after discovery. It has applied since 18 December 2023, and since 15 June 2024 for smaller reporting companies.
So there are two clocks. The four-day clock is fixed. The first one, from discovery to determination, is a judgement the company owns, and it is the one regulators will reconstruct afterwards from emails and meeting notes.
| Step | Timing |
|---|---|
| Discovery | Starts the duty to assess |
| Materiality determination | Without unreasonable delay after discovery |
| Form 8-K Item 1.05 | Within 4 business days of the determination |
| AG delay (if granted) | 30 + 30 days, then 60 more in extraordinary cases |
| Amendment for new information | Within 4 business days of determining it |
The test is the ordinary securities-law one: is there a substantial likelihood a reasonable investor would consider it important? That includes qualitative factors, not just cost: harm to reputation, customer and vendor relationships, competitiveness, and the possibility of litigation or regulatory action.
In May 2024 the SEC's Corporation Finance Director clarified that Item 1.05 is for incidents the company has determined are material. Companies wanting to disclose an immaterial incident, or one still being assessed, should use Item 8.01, so investors are not left guessing what an Item 1.05 filing means.
The US Attorney General can tell the SEC that disclosure poses a substantial risk to national security or public safety. That delays filing by up to 30 days, extendable by another 30, and in extraordinary circumstances a further 60. A company's own investigation or a ransom negotiation is not a reason to delay.
If information was not available at filing, the company files an amendment within four business days once it is determined. Separately, Item 106 of Regulation S-K requires annual 10-K disclosure of cyber risk management and how the board oversees it.
Industry groups have petitioned the SEC to rescind Item 1.05 and return to principles-based disclosure. As of 1 October 2026 the rule is in force and no amendment has been adopted. Plan for the rule as written, and watch the SEC's regulatory agenda.
Board reporting, AI governance, DPDP readiness or CMMC. Tell me which and what the constraint is.
me@sarfarazchougule.com →