Published May 2026, by the Ransomnews Research Team. This piece is editorial analysis, not legal advice. Consult counsel for jurisdiction-specific obligations.
In December 2023 the US Securities and Exchange Commission’s amended disclosure rules, most consequentially the new Item 1.05 of Form 8-K, became effective for most US-listed companies. The headline requirement: when a public company experiences a cybersecurity incident it determines to be material, it must file an 8-K disclosing that incident within four business days of the materiality determination. The rule was controversial when proposed and remains controversial in 2026, but it has been live long enough to draw operational lessons from. This is a 2026 retrospective on what CISOs and boards have actually learned about disclosing under Item 1.05.
What the rule actually requires
The headline four-day window is widely misunderstood. The clock does not start when the incident occurs. It starts when the registrant determines the incident is material. The Commission’s adopting release was explicit on this point: materiality determinations must be made without unreasonable delay, but the clock for filing begins at the moment of that determination, not at the moment of detection.
The 8-K must disclose the nature, scope, and timing of the material aspects of the incident, along with the material impact (or reasonably likely material impact) on the registrant. It does not require disclosure of specific technical details that would impede an active response, a “no compromise of incident response” provision built into the rule.
One narrow national-security delay provision permits the US Attorney General to grant a public-disclosure delay of up to 60 days (extendable in 30-day increments) when immediate disclosure would pose a substantial risk to national security or public safety. In practice, that mechanism has been invoked very rarely.
How disclosures have actually played out
Over the eighteen-plus months of operational experience with Item 1.05, a few clear patterns have emerged in how registrants are filing.
- Initial filings are usually thin. First-issued 8-Ks under Item 1.05 are typically short, three to five sentences, describing detection, scope-in-progress, and engagement of external counsel and IR firms. Detail comes later via amendments or the Form 10-Q / 10-K disclosures in the subsequent quarter.
- Amendment cadence varies dramatically. Some registrants file a single initial 8-K and don’t amend until they incorporate findings into the next quarterly. Others amend the 8-K repeatedly as scope clarifies. The Commission has not explicitly preferred one cadence over the other.
- Materiality is being treated as a real determination, not a checkbox. A meaningful share of filings have followed scenarios where the registrant initially believed the incident was not material, later determined it was, and disclosed at that point. Several enforcement-themed speeches from senior SEC staff have signalled that “we didn’t think it was material at first” is a defensible posture only if the materiality analysis was performed contemporaneously with the relevant facts.
- Ransomware drives a disproportionate share of filings. Through 2024–2026, ransomware and data-extortion incidents account for the majority of Item 1.05 disclosures. Operators have noticed; several Russian-language threat-actor postings have explicitly referenced SEC pressure as a negotiation lever.
- “Material impact” language has been carefully drafted. Most filings hedge, “may have”, “is reasonably likely to”, to preserve flexibility before scope is fully understood. The SEC has not pushed back materially on this phrasing in the cases that have reached enforcement, suggesting the hedged-language approach is currently defensible.
Enforcement signals so far
The SEC’s Division of Enforcement has made several public statements about Item 1.05 expectations and has brought administrative proceedings against firms whose disclosures it considered inadequate. The cases that have reached public conclusion through early 2026 point to three repeated concerns from the Commission:
- Internal controls over disclosure decisions. Charges that have alleged failures focus less on the substance of what was disclosed and more on whether the registrant had the internal process, escalation paths, materiality-determination workflow, board-level oversight documentation, to make the right call at the right time. The SEC has consistently signalled that the process matters at least as much as the outcome.
- Misleading negative statements. Several cases have been brought against firms that affirmatively described their security posture (in 10-K filings or investor materials) in ways the Commission alleged were materially false in light of incidents already in progress at the time. The lesson: standing security-posture disclosures need to be reviewed contemporaneously with active incidents.
- Inconsistent disclosures across audiences. Where a registrant has disclosed one thing to the SEC, a different thing to insurance carriers, and a third thing in customer communications, the Commission has shown interest in the consistency question. The takeaway is operational: have one set of facts, one tracker, one narrative, and let the differences across audiences be in level of detail, not in substance.
The practical playbook the better-prepared CISOs now run
Talking to CISOs and outside counsel through 2024 and 2025 surfaces a consistent set of operational practices that distinguish the firms whose Item 1.05 process has held up under scrutiny:
- A pre-defined materiality framework, owned by the disclosure committee. The framework specifies factors (data volume, regulated-data type, operational disruption, reputational exposure, regulatory exposure, vendor dependency) and a threshold structure mapping combinations of factors to “potentially material, escalate” status. The framework lives in writing and gets reviewed annually.
- A standing disclosure committee with defined membership. Typically the General Counsel, CFO, CISO, head of IR, and outside counsel. The committee can be convened on no-notice basis to make a materiality determination; the convening process is on file with after-hours numbers and authority delegations for everyone in the chain.
- A “scope tracker” maintained from the moment an incident is declared. A single document, owned by counsel, recording: what is known, what is suspected, what is unknown, when each fact was learned, and who learned it. This becomes the basis for both SEC disclosure and any subsequent litigation discovery.
- Pre-drafted 8-K skeleton language. Counsel has reviewed and pre-approved boilerplate paragraphs for common scenarios (ransomware, data-extortion, third-party supplier compromise, insider incident). At incident time, the disclosure is a fill-in-the-blank against pre-approved language, not a blank-page exercise.
- Coordination with cyber-insurance carriers. Most cyber-insurance policies have notification provisions independent of the SEC. The disclosure committee structure usually doubles as the insurer-notification path.
- Tabletop exercises with the disclosure committee. Annual at minimum. The exercise includes a deliberate “is this material?” decision moment, so the committee has practised the analysis rather than encountering it for the first time at midnight on a Friday.
The board angle
Item 1.06, the companion annual disclosure requirement on cybersecurity risk management, strategy, and governance, has reshaped the board-level cyber conversation in a quieter but more durable way than the four-day 8-K rule has. Boards now expect, and many have minuted, an annual cyber-oversight briefing with specific factual anchors: tested IR runbook, named individual responsible, frequency of board engagement, escalation criteria, and the supplier-risk methodology.
The 10-K disclosures that result from 1.06 have become a comparative reference point. CISOs at peer firms read each other’s annual disclosures and benchmark practices against them. That horizontal pressure has done meaningful work to standardise expectations even where the rule itself was deliberately principles-based.
Five practical takeaways for the next round of CISO planning
- 1. Treat the materiality framework as a first-class artifact. If you don’t have one in writing, build one. The Commission has been clear that absence of process is itself a problem; a written framework, even an imperfect one, is meaningfully better than ad-hoc determinations.
- 2. Pre-draft disclosure language. Counsel-reviewed boilerplate for the three or four most likely scenarios you’d face. The 8-K filed against a stopwatch reads better when it was 70% drafted in advance.
- 3. Time the start of the disclosure clock deliberately. The clock starts at materiality determination. The decision of when to make that determination needs to be deliberate, documented, and contemporaneous with the relevant facts. Both delaying it (to push out the clock) and rushing it (without adequate factual basis) carry distinct risks.
- 4. Practice the moment. Quarterly tabletop exercises with the disclosure committee specifically. The materiality call is harder than most people expect under real time pressure; the practice translates.
- 5. Cross-reference your standing disclosures. Your 10-K, your customer-facing security pages, your sales-time security questionnaires, and your vendor-due-diligence responses are all SEC-relevant documents in an incident. Keep them in sync. The contradiction between “we have continuously monitored EDR on every endpoint” in your sales deck and “we don’t have central visibility into endpoint-level events” in your incident response is the kind of gap the Commission has explicitly cited in enforcement.
The international dimension
While the SEC rule applies to US-listed companies, several non-US frameworks now run on parallel clocks:
- EU NIS2 directive. Reporting obligations for “essential” and “important” entities, initial notification within 24 hours, detailed notification within 72 hours, final report within one month.
- GDPR Article 33. Personal-data breach notification to the supervisory authority within 72 hours where feasible.
- UK NIS Regulations and the upcoming Cyber Security and Resilience Bill. Equivalent obligations, jurisdiction-specific.
- Various US state-level breach laws. Each with its own notification window and triggering criteria, generally focused on PII rather than enterprise materiality.
The practical effect for a multinational organisation is that the SEC’s four-day window is rarely the binding timeline, one of the regional notification clocks usually expires first, and the disclosure committee needs to be tracking all of them simultaneously. The 2026 best-practice CISO runs a single regulatory-clock matrix that maps every applicable framework’s deadline against the same incident, with the same scope-tracker feeding all of them.
Where this goes
The clearer signal from the SEC through 2024–2026 has been that the Commission is more focused on process than on substance. Did you have a framework? Did you apply it? Did you document the application? Did you make the disclosure call deliberately? Those questions have proved more determinative than whether the resulting 8-K had the right number of sentences or used the right hedging language.
For CISOs and counsel still building out the Item 1.05 muscle, that emphasis is good news. The substantive call (“is this material?”) is genuinely hard and inherently judgement-bound. The process call (“did we have a framework and follow it?”) is fully within your control. Invest there first, and the substantive calls become much more defensible, both to the Commission and to a jury, should it ever come to that.
For the broader incident-response framework into which this disclosure layer fits, see our IR runbook walkthrough, the SEC-facing disclosure path runs in parallel with the technical containment workstream, and the runbook should treat them as one coordinated effort with one owner per workstream.
Further reading
- SEC press release on the adopted rules, official summary of the 2023 amendments.
- Full adopting release (33-11216), the authoritative text including the Commission’s reasoning.
- CISA #StopRansomware Guide, the technical playbook that should be running alongside the disclosure playbook.
- Our double-extortion explainer, particularly useful framing for the board conversation about why disclosure is now a governance issue first and a technical issue second.
The rule has been more useful operationally than its critics predicted and less catastrophic than its early opponents feared. Treat it as another item in the regulatory inventory you maintain anyway, build the process around it deliberately, and the disclosure obligation becomes one workstream of an incident rather than a crisis layered on top of one.