The SEC sets a deadline of four business days for material cyber disclosures
Public companies needed to connect incident investigations with disclosure decisions. Their technology suppliers became an important source of information for assessing business impact.
A cyber incident can begin as a technical alert and become a securities disclosure problem before the investigation is complete. The SEC’s rules adopted on 26 July 2023 formalised that connection. A domestic reporting company must disclose a material cybersecurity incident on Form 8-K within four business days after determining that the incident is material. It must make that determination without unreasonable delay after discovery.
The trigger is the materiality decision, rather than the first alert or the moment an attacker gained access. For founders supplying public companies, the rules also sharpened a commercial dependency: customers may need reliable information from a young vendor to make their own disclosure decisions. A private startup does not become an SEC reporting company simply because it serves one, but its incident communication can become part of a regulated customer’s response.
Assessing the business impact
The final rule asks for the material aspects of the incident’s nature, scope and timing, together with its material impact or reasonably likely material impact, including on financial condition and results of operations. The assessment uses the established materiality standard in securities law. A technical severity rating can inform that assessment, but it cannot by itself describe the significance of interrupted production, lost customer information or damage to a commercial relationship.
Discover and investigate
Develop the operational and financial facts needed to assess the incident.
Determine materiality
Make the determination without unreasonable delay after discovery.
File the material incident
For covered domestic issuers, file the material incident report within the applicable deadline, subject to the rule's exceptions.
Update missing information
Amend the filing when information required by Item 1.05 becomes determined or available under its timing provisions.
The sequence established by the SEC's final rule, from discovery and a materiality decision to initial disclosure and any required amendment.
This creates a translation task across security, operations, finance and legal teams. Which services are unavailable? Which customers depend on them? What is known about information accessed, and which conclusions remain provisional? An organisation that has already mapped these dependencies can develop a more useful account than one trying to reconstruct its customer and system relationships during an emergency.
The rule recognises that some required information may be unavailable when the initial filing is due. The company must identify that gap and subsequently amend its disclosure under the specified timing requirements. An incomplete investigation therefore does not automatically justify waiting to disclose a material incident. The process must support a clear distinction between confirmed facts, reasonable expectations and questions still being examined.
Suppliers become part of the information chain
The SEC did not generally exempt incidents involving systems run by third parties. A reporting company’s materiality analysis concerns the effect on that company, even when a service provider controls the affected infrastructure. The final release acknowledges that a registrant may lack access to some information held by its suppliers. Good communication therefore matters, including clarity about what the vendor has yet to establish.
For a software startup, the practical response is to agree who receives incident notices, which service dependencies the customer needs to understand and how updates will be delivered. A message that only says an investigation is ongoing gives a customer little basis for assessing its own exposure. A more useful update describes affected functions, observed dates, containment work and material uncertainties, with an accountable contact for further questions.
This is also a procurement consideration. Buyers can examine whether promised notification windows match the supplier’s monitoring and escalation capabilities. Investors can ask how a startup would turn an alert into an assessment of customer impact. A supplier selling compliance software or a security tool needs the same operational discipline, including an understanding of its own dependencies.
Governance disclosure changed between proposal and final rule
The SEC’s proposal included disclosure of cybersecurity expertise among directors. The adopted rule omitted that requirement. Instead, it requires descriptions of the board’s oversight of cybersecurity risks and management’s role and relevant expertise in assessing and managing material risks. Boards therefore had to explain how oversight worked, without a separate disclosure of directors’ cybersecurity expertise.
Annual disclosures also cover processes, if any, for assessing, identifying and managing material cybersecurity risks, and whether such risks have materially affected or are reasonably likely materially to affect the business. Describing a process does not establish its effectiveness. A board evaluating a security company can ask for exercises, incident records and evidence that weaknesses were corrected. These diligence questions go beyond the disclosure requirements.
Compliance deadlines and exceptions
The final rules set annual disclosure compliance for fiscal years ending on or after 15 December 2023. Incident reporting began on 18 December 2023 for registrants other than smaller reporting companies, which received until 15 June 2024 for Item 1.05. Foreign private issuers had related provisions under Forms 6-K and 20-F. Those distinctions prevent a single headline deadline from being applied indiscriminately to every company.
The rule permits a disclosure delay when the US Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the SEC in writing. This exception does not generally allow companies to wait until remediation ends. Preparation required a shared process for the people investigating systems, assessing business impact and approving disclosure, with decision authority established before the clock began.
Sources
- Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure: Final Rule (opens in a new tab)
US Securities and Exchange Commission, Federal Register
- Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure: Proposed Rule (opens in a new tab)
US Securities and Exchange Commission, Federal Register
Published
