What is Form 8-K Item 1.05? The SEC's material cyber incident filing, defined

Form 8-K Item 1.05 is the item under which a US public company tells investors about a cybersecurity incident it has determined to be material. The filing is due within four business days of that determination, not of discovery, and describes the incident's nature, scope and timing and its material or reasonably likely material impact on the company.

What the item requires

The text of Item 1.05 asks for the material aspects of the incident's nature, scope and timing, and its material impact or reasonably likely material impact, including on financial condition and results of operations. Its instructions add three working rules. The materiality call must be made without unreasonable delay after discovery. Facts not yet known are stated as such and added by amendment within four business days of becoming available. And no technical detail is required that would impede the response or remediation.

The main delay belongs to the US Attorney General, who can find in writing that disclosure poses a substantial risk to national security or public safety. That delay runs up to 30 days, can be extended by 30 more, and in extraordinary circumstances by a final 60. A shorter delay, capped at seven business days after the required notice, applies to companies that must hold back a breach disclosure under the Federal Communications Commission rule at 47 CFR 64.2011.

Companies other than smaller reporting companies have had to comply since 18 December 2023, and smaller reporting companies since 15 June 2024, according to the SEC's compliance guide. Inline XBRL tagging of the filings began on 18 December 2024.

Why it matters to a CISO and the board

The clock starts at a decision, so the speed and record of the materiality assessment become the operational question. The SEC's adopting release reasoned that a company should already hold the facts the item requires as part of conducting that assessment. A CISO who cannot produce scope and impact quickly slows a determination that Instruction 1 requires without unreasonable delay.

What it is not

Item 1.05 is not a place for incidents still under assessment. In a statement of 21 May 2024, Erik Gerding, director of the SEC's Division of Corporation Finance, encouraged companies to disclose those, and incidents judged immaterial, under Item 8.01 instead. If one later proves material, an Item 1.05 filing is due within four business days of that determination. Nor is Item 1.05 a breach notice to regulators or affected people; those duties come from other laws.

Where it appears on CISO Tribune

• SEC cyber incident disclosures: every Item 1.05 filing, read from SEC EDGAR's search index and linked to the filing.
• SEC Item 1.05 materiality decision guide: the decision in order, with real filings.
• SEC cybersecurity disclosure rules for CISOs: Item 1.05 next to the annual Item 1C disclosure.

Related terms

• Cybersecurity materiality
• Regulation S-K Item 106