Guide

Form 8-K Item 1.05, material cybersecurity incidents

Item 1.05 of Form 8-K requires a public company to disclose a cybersecurity incident once it determines the incident is material, within four business days of that determination. The report explains what happened, how far it reached and when, as far as those facts are material, and how the incident has affected the company or is reasonably likely to, including its finances and operating results.

Where the item came from

The SEC adopted Item 1.05 on July 26, 2023, together with a new Item 106 of Regulation S-K that asks for a yearly description of cybersecurity risk management and board oversight in the Form 10-K. According to the SEC's press release, the 8-K disclosures were due beginning December 18, 2023 at the earliest, and smaller reporting companies had an additional 180 days.

Paragraph (b) requires the disclosure in an Interactive Data File, and the press release says the Inline XBRL tagging began one year after the initial compliance date. Foreign private issuers report comparable incidents on Form 6-K.

The clock starts at the materiality decision

Most 8-K items count four business days from the event itself. General Instruction B.1 sets a different start for Item 1.05, the day the company determines it has had a material cybersecurity incident. Instruction 1 to the item says that determination must be made without unreasonable delay after the incident is discovered.

Two delays exist. Under paragraph (c), if the U.S. Attorney General decides that disclosure poses a substantial risk to national security or public safety and tells the SEC in writing, the company may wait up to 30 days, then up to 30 more, and in extraordinary circumstances a final 60 days on national security grounds, with any further delay only by SEC exemptive order. Under paragraph (d), a company subject to the FCC's customer data breach rule at 47 CFR 64.2011 may delay as that rule requires, for no more than seven business days after the required notification, if it tells the SEC through EDGAR by the original due date.

Item 1.05 versus Item 8.01

Some companies announce an incident before deciding whether it is material. In a May 2024 statement, the director of the SEC's Division of Corporation Finance, Erik Gerding, encouraged companies to report those incidents, and incidents they consider immaterial, under a different item such as Item 8.01, keeping Item 1.05 for incidents the company has determined to be material. His reasoning was that mixing the two could lead investors to misjudge which incidents are material. Under that approach, an incident reported only under Item 8.01 is one the company has not determined to be material.

The same statement says that if a company first reports an incident under Item 8.01 and later concludes it is material, it should file an Item 1.05 report within four business days of that later decision. It also noted that materiality is not only a financial question, and listed factors such as harm to reputation, customer or vendor relationships, and the possibility of litigation or regulatory action. The statement is staff guidance and says itself that it has no legal force.

What the filing contains and what it can hold back

Instruction 4 lets a company hold back technical detail about how it plans to respond, or about its systems, networks, devices and possible weak points, when that much detail would hinder its response to the incident or its repair work.

If some of the required information is not yet known when the 8-K is due, Instruction 2 says the company must state that in the filing and then file an amended 8-K within four business days after the information is determined or becomes available. When that amendment comes from a company you follow, the Filing Ahoy 8-K alert opens by saying it is an amendment (Form 8-K/A) to an earlier Form 8-K and then lists the items it reports.

Not financial or investment advice. Filing Ahoy reports what was filed; it does not tell you what to buy or sell. Filing Ahoy is not affiliated with the SEC.