SEC Cyber

SEC Cyber — common questions

What does the SEC cybersecurity disclosure rule require?

Public companies must disclose material cybersecurity incidents on Form 8-K Item 1.05, generally within four business days of determining that an incident is material, describing its nature, scope and timing and its material impact or reasonably likely material impact. Annual reports must also describe processes for assessing, identifying and managing material risks from cybersecurity threats, and describe board oversight and management's role. Foreign private issuers have comparable obligations on their own forms.

When does the four-business-day clock start?

It starts on the determination that an incident is material, not on discovery of the incident. That determination must be made without unreasonable delay, so a company cannot postpone the assessment to postpone the filing. The practical consequence is that when you knew what, and when materiality was assessed, become facts you need contemporaneous records for.

What makes a cybersecurity incident material?

Materiality follows established securities-law principles rather than a special cyber definition: information is material if there is a substantial likelihood a reasonable shareholder would consider it important, or it would significantly alter the total mix of information available. That means qualitative factors — reputational harm, customer or vendor relationships, litigation and regulatory exposure — count alongside quantitative loss, so a purely financial threshold is not a sufficient test.

Can disclosure be delayed?

There is a narrow delay mechanism where the United States Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the Commission in writing. It is exceptional. Companies should not plan on it, and the default expectation is timely disclosure once materiality has been determined.

Does the SEC rule cover incidents at a third-party provider?

Yes. The rule contains no exemption for an incident that happens on a third party's systems — if it is material to you, it is disclosable by you. The adopting release was explicit that registrants disclose based on information reasonably available to them, and are not expected to conduct additional inquiries beyond their regular course of engagement with the provider. The practical consequence is contractual rather than technical: your ability to make a timely materiality determination about a vendor incident depends on notification terms you negotiated before it happened, which is why vendor breach-notification windows have become an SEC-driven diligence item rather than only a privacy one.

How does the SEC cybersecurity rule apply to ransomware?

There is no separate ransomware provision — the ordinary materiality analysis applies, and that is the point people miss. Paying a ransom does not resolve the question: an incident whose operational effects were contained by payment can still be material through business interruption, data exfiltration, remediation cost, regulatory exposure or reputational harm. Nor does recovery end the obligation, because materiality is assessed against the total mix of information a reasonable shareholder would consider important, not against whether systems are back online. Encryption events therefore need the same documented, timestamped determination as any other incident.

What is the difference between Item 1.05 and Item 8.01?

Item 1.05 is the mandatory disclosure for an incident determined to be material. Item 8.01 is the general 'other events' item. SEC staff have encouraged registrants that want to disclose an incident which is immaterial, or whose materiality has not yet been determined, to do so under Item 8.01 rather than Item 1.05 — so that Item 1.05 continues to signal a material incident and investors can rely on that signal. Filing an undetermined incident under 1.05 dilutes it for everyone, including you the next time you file.

Do SEC cybersecurity disclosures have to be tagged in Inline XBRL?

Yes. Both the Form 8-K incident disclosure and the annual Regulation S-K Item 106 disclosure are subject to structured-data tagging in Inline XBRL, phased in after the initial compliance dates. In practice the tagging is performed by your EDGAR filing agent, so what matters on your side is producing the disclosure as structured content keyed to the specific items rather than as prose someone then has to reverse-engineer into tags.

Does the SEC require the board to have a cybersecurity expert?

No — and this is a common misreading. The proposed rule would have required disclosure of board cybersecurity expertise, and that requirement was not adopted in the final rule. What survives is Item 106(c): describe the board committee or subcommittee responsible for oversight of material cybersecurity risks, the processes by which they are informed, and the role and relevant expertise of the management positions responsible for assessing and managing those risks. The disclosure obligation sits on management expertise and on the oversight process, not on board composition.

What happens if information about an incident was unavailable when we filed?

The rule anticipates it. An initial Item 1.05 filing made when information is unavailable or has not been determined is amended once that information becomes available, rather than delayed until the picture is complete. That is a deliberate structure: it separates the four-business-day obligation from the investigation, so a company is never choosing between filing on time and filing something it cannot yet stand behind.

What does Talarity actually produce for an SEC filing?

Two structured exports, and it is worth being precise about the boundary. The 8-K pack maps to Form 8-K Item 1.05(a), (b) and (c) — the incident, its material or reasonably likely material impact, and updates amending a previously filed report. The annual pack maps to the items of 17 CFR §229.106. Both are emitted as Inline-XBRL-ready structured payloads stably keyed to those items, so a registrant’s EDGAR filing agent can tag from them directly. Neither invents content: a narrative that was not authored maps to null rather than to plausible prose. Talarity does not file with EDGAR and does not replace securities counsel — it produces the record and the structured disclosure content that counsel reviews and the filing agent submits.