thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

SEC Cybersecurity Disclosure Rules

2023 SEC rules requiring public companies to disclose material cybersecurity incidents and describe cyber risk management and governance.

Definition

Form 8-K Item 1.05 requires disclosure within four business days after determining an incident is material, with possible delay if the US Attorney General finds a substantial risk to national security or public safety. Regulation S-K Item 106 requires annual 10-K disclosure of cybersecurity risk management processes, strategy, and board and management oversight.

Example

A company files an 8-K four business days after concluding a ransomware attack is material.

Exam tip

The four-day clock starts at the materiality determination, not at discovery.

Related terms