SEC Cyber Disclosure Rules

Try it out loud first. Then check yourself:

1. Form 8-K Item 1.05: disclose a material cyber incident within 4 business days of determining it is material.
2. Materiality must be determined without unreasonable delay after discovery; the clock starts at the determination.
3. Form 10-K Item 106: annually describe cyber risk management processes and board and management oversight.
4. Delay only if the US Attorney General says disclosure poses a substantial risk to national security or public safety.
5. Needs a documented materiality process with legal, finance and security, plus quantified impact to support decisions.

If the interviewer pushes back

• How would you design an incident escalation path so the materiality determination is neither premature nor late?
• How do the SEC rules interact with ransomware negotiation and law enforcement coordination?