Cybersecurity is now a board disclosure issue: what the SEC rules require
Since December 2023, a material cyber incident at a US-listed company has a four-business-day disclosure clock. That has moved security from an IT budget line to a board agenda item.
For years, the case for security spending rested on avoiding losses. US securities rules now add another reason: public companies have to tell investors about material cyber incidents quickly, and describe how they manage cyber risk every year.
What the SEC requires
The SEC adopted the rules in July 2023. They have two parts.
| Requirement | Where it's filed | What it covers |
|---|---|---|
| Incident disclosure (Item 1.05) | Form 8-K | A material cybersecurity incident, generally within four business days after the company determines it is material |
| Annual disclosure (Regulation S-K Item 106) | Form 10-K | Processes for assessing and managing cyber risk, board oversight, and management's role and expertise |
Annual disclosures began with fiscal years ending on or after December 15, 2023. Incident disclosures began on December 18, 2023, with smaller reporting companies given an extra 180 days. Disclosure can be delayed only if the US Attorney General decides that immediate disclosure would pose a substantial risk to national security or public safety.
Why it matters beyond public companies
The rules apply to SEC registrants, but their effects spread. Public companies now ask suppliers and service providers more about their security, because a supplier's incident can become the customer's material incident. Private companies preparing for an IPO or acquisition face the same questions in due diligence.
What the four-day clock demands
The clock starts when the company decides an incident is material, not when it is discovered, but the SEC expects that decision to be made without unreasonable delay. In practice, that means a company needs a defined process before an incident: who assesses materiality, what information they need from the security team, and how legal, finance and communications are brought in.
The security team's job is to give decision-makers facts fast: what systems are affected, what data may be involved, and what the business impact is likely to be.
What boards now ask
Annual disclosure has made boards ask how cyber risk is managed and who on the board oversees it. Security leaders should be ready to report risk in business terms, such as likely impact on operations and revenue, rather than counts of blocked attacks.
What IT teams should do
- Agree with legal and finance who decides materiality, and add it to the incident response plan.
- Run a tabletop exercise that ends with a mock disclosure decision.
- Prepare a one-page cyber risk summary in business terms for the board.
- Expect security questionnaires from public-company customers, and keep answers current.