SEC Item 1.05

What it is

The SEC adopted final cybersecurity disclosure rules on July 26, 2023, effective for larger reporting companies December 18, 2023 and for smaller reporting companies June 15, 2024. The rules amend Form 8-K (Item 1.05), Regulation S-K (Item 106), and Form 20-F for foreign private issuers.

Who it applies to

All public companies subject to the reporting requirements of the Securities Exchange Act of 1934, including foreign private issuers (via Form 20-F amendments) and smaller reporting companies (with delayed effective date).

Key provisions

Form 8-K Item 1.05, Incident disclosure

Public companies must file a Form 8-K within four business days of determining that a cybersecurity incident is material. The disclosure must describe:

• Material aspects of the nature, scope, and timing of the incident
• Material impact or reasonably likely material impact on the registrant, including financial condition and results of operations

Determination of materiality must be made without unreasonable delay. The four-business-day clock starts from the materiality determination, not the initial detection. A narrow national security or public safety delay is available with Attorney General notification.

Amendments are required if the required information was not initially available (Form 8-K Item 1.05(b)), filed within four business days of the additional information becoming available.

Regulation S-K Item 106, Annual disclosure

Item 106 requires disclosure in annual reports (Form 10-K / 20-F) of:

• Item 106(b), Risk management and strategy: Processes for assessing, identifying, and managing material risks from cybersecurity threats; whether any cybersecurity threat, including any previous incident, has materially affected or is reasonably likely to materially affect the registrant
• Item 106(c), Governance: Board oversight of cybersecurity risks; management's role, expertise, and processes for reporting to the board

Foreign private issuers face parallel requirements via Form 20-F amendments.

What is a "material" cybersecurity incident?

The SEC did not define materiality specifically for cybersecurity, deliberately relying on the existing materiality standard (TSC Industries v. Northway), information is material if there is a substantial likelihood that a reasonable investor would consider it important. The SEC clarified that quantitative and qualitative factors matter: financial impact, reputational harm, operational disruption, litigation exposure, and long-term customer relationships all contribute.

Enforcement and safe-harbour considerations

The SEC has increased scrutiny of cybersecurity disclosures. Notable actions include SolarWinds and CISO Timothy Brown (charges filed October 2023) Cybersecurity-related disclosure statements may be subject to Section 10(b) securities fraud liability.

Item 1.05 does not include a safe harbour, but Rule 175 provides some forward-looking statement protections. Companies are encouraged to distinguish between forward-looking statements and historical fact disclosures.

Penalties

SEC enforcement can include civil monetary penalties, disgorgement, officer/director bars, and cease-and-desist orders. Failure to timely disclose can also expose companies to shareholder securities class actions.

Recent amendments

• Jul 2023SEC adopted final cybersecurity disclosure rules (Release No. 33-11216).
• Dec 2023Rules effective for larger reporting companies.
• Jun 2024Rules effective for smaller reporting companies.

How LeakTrace maps to it

An External Cybersecurity Assessment reads what a firm exposes from outside: email settings, the firm’s addresses in monitored breach databases, lookalike domains, exposed services and keys left in the firm's own website code. The Rules and Insurance Briefing that comes with it maps each finding to SEC Item 1.05, with the proof behind it, so the firm can see which obligation a finding touches. The assessment is human-verified before it is released.