The New Disclosure Landscape
In 2023, the SEC adopted sweeping cybersecurity disclosure rules for public companies. By 2026, enforcement has moved from "guidance" to "expectation" — and the penalty exposure is real. If you're a public company, a SPAC, or a foreign private issuer with SEC reporting obligations, the rules that felt theoretical two years ago are now firmly in your compliance program's crosshairs.
The core framework has two pillars: incident reporting and annual risk management disclosure. Getting either wrong creates material misstatement risk — and, increasingly, SEC enforcement action.
The 4-Business-Day Rule: How Companies Are Getting It Wrong
Form 8-K Item 1.05 requires disclosure of a material cybersecurity incident within four business days of determining materiality. The word "determining" is doing a lot of work here. Companies that treat "determining materiality" as an open-ended investigation window are misreading the rule — and the SEC's Division of Enforcement has said as much in several comment letters.
The SEC's position: once your incident response team has enough information to make a materiality judgment, the four-day clock starts. You don't need forensic certainty. You need enough information to know whether a reasonable investor would consider the incident important to their investment decision.
Common failure modes in 2025–2026 enforcement actions:
- Delayed materiality assessments. Companies waiting for complete forensic reports before convening the board committee responsible for materiality decisions. The SEC expects a structured, time-bound assessment process — not an investigation that meanders for weeks.
- Incomplete disclosure language. 8-K filings that describe an incident in vague terms without the nature, scope, and timing the rule requires. Boilerplate "we experienced a cybersecurity incident and are investigating" language has drawn comment letters.
- Failure to amend. If your initial 8-K was filed before all material facts were known (which the rule allows), you must amend when those facts become known. Several companies discovered this the hard way when the SEC flagged non-amended filings.
Annual Disclosures: What's Under Scrutiny
Form 10-K Item 1C requires a description of your cybersecurity risk management program, governance, and strategy. This is not a checkbox exercise. The SEC's staff has reviewed thousands of these disclosures and issued detailed comment letters on filings that were thin, generic, or inconsistent with actual practices.
What reviewers look for:
- Specificity. "We have policies and procedures" is not adequate. The disclosure must describe the material aspects of your processes — how you assess, identify, and manage cybersecurity risks.
- Board oversight mechanics. The rule requires disclosure of board involvement in cybersecurity oversight. How often does the board or a board committee review cybersecurity risk? What's the reporting structure? Companies with audit committees that receive quarterly briefings describe that. Companies where the CISO has never presented to the board are in a different position.
- Management expertise. If your CFO or CEO has relevant cybersecurity experience, you can — and arguably should — disclose it. If neither does, and your CISO doesn't have a reporting line to the board, that creates both a governance gap and a disclosure gap.
- Third-party risk. Your supply chain is your attack surface. Disclosures that say nothing about how you manage vendor and service provider risk will draw scrutiny — especially in the wake of major third-party incidents.
What "Materiality" Actually Means
The SEC applies the TSC Industries standard: information is material if there is a "substantial likelihood that a reasonable investor would consider it important." For cybersecurity incidents, the SEC has clarified that materiality is not limited to financial impact. Reputational harm, legal liability, regulatory exposure, and operational disruption all factor in.
This means a ransomware attack that takes a production system offline for 48 hours may be material even if the direct financial cost is modest — because the incident reveals vulnerability, triggers regulatory notification obligations, and may affect customer retention.
The practical implication: build a materiality assessment framework before an incident happens. Define who convenes the assessment committee, what inputs they need, what the decision criteria are, and how quickly they can convene. A framework tested in a tabletop exercise is infinitely better than one improvised at 2 a.m. during an active incident.
The CISO Liability Question
One development that reshaped the compliance conversation in 2024–2025: the SEC's charge against a former CISO in connection with an inadequate disclosure following a data breach. While that case had specific facts — including alleged affirmative misrepresentations to auditors — the broader signal was clear. Individual executives, not just companies, can face personal liability for materially misleading cybersecurity disclosures.
This has had a predictable effect on how CISOs approach the disclosure process. Many are now ensuring that their materiality assessment involvement is documented, that they have independent access to legal counsel for disclosure questions, and that their employment agreements address indemnification for securities enforcement actions.
Building a Compliant Disclosure Program
The companies that handle SEC cybersecurity disclosure well have a few things in common. They've built the disclosure workflow into their incident response plan — not as a separate legal process that kicks in after IR, but as a parallel track. They have pre-defined materiality criteria that their team can apply quickly. And they've done at least one tabletop exercise that specifically tested the disclosure process, not just the technical response.
The practical steps:
- Map your incident response plan to disclosure triggers. At what severity level does the IR team notify legal? What's the expected timeframe for a preliminary materiality assessment?
- Define your materiality criteria in advance. Don't negotiate this during an active incident. Build criteria your team can apply under pressure.
- Establish board reporting mechanics. Ensure your audit committee or full board has a defined cybersecurity oversight role with documented meeting frequency and reporting requirements.
- Review your 10-K language annually. Treat it as a live document that reflects your actual program — not boilerplate carried over from last year.
- Run a disclosure-specific tabletop. Simulate an incident and walk through the 8-K filing decision, not just the technical response.
What's Next
The SEC staff has indicated that cybersecurity disclosure quality is a continuing examination priority. Expect comment letters, enforcement action, and — as the case law develops — private litigation risk from shareholder derivative suits alleging that inadequate disclosures concealed material risks.
If your SEC/FINRA compliance program doesn't have a dedicated cybersecurity disclosure module, you're behind. The rules have been final for over two years. The grace period is over.
Use ComplianceStack's SEC/FINRA compliance tools to assess your current disclosure posture and identify gaps in your cybersecurity governance framework.