Glossary
What is Regulation S-K Item 106? The SEC's annual cyber governance disclosure
Item 106 requires US public companies to describe cyber risk management, board oversight and management's role in Item 1C of Form 10-K. What it asks, and omits.
By Hadass Liza Bitton · Published October 19, 2026 · Last reviewed October 19, 2026 · 2 min read
Regulation S-K Item 106 is the SEC rule that requires US public companies to describe, in Item 1C of their annual report on Form 10-K, how they assess, identify and manage material cybersecurity risks, how the board oversees those risks, and which management positions are responsible and with what expertise. It applies to fiscal years ending on or after 15 December 2023.
What the rule asks
Item 106 has three working parts. Paragraph (b), risk management and strategy, asks a company to describe its processes for material cybersecurity risks in enough detail for a reasonable investor to understand them. It also asks whether those processes sit inside enterprise risk management, whether outside assessors or consultants are engaged, and how risks from third-party service providers are overseen.
Paragraph (b)(2) asks whether cybersecurity risks, including from past incidents, have materially affected the company or are reasonably likely to. Paragraph (c), governance, asks for the board's oversight, any responsible committee and how it is informed, and then management's role: which positions are responsible, their expertise, how they monitor incidents, and whether they report to the board.
The rule's own instructions say relevant expertise may include prior work experience, degrees or certifications, and other cybersecurity knowledge or background. Disclosures must also be tagged in Inline XBRL, from fiscal years ending on or after 15 December 2024 according to the SEC's compliance guide. Foreign private issuers give comparable disclosure in Item 16K of Form 20-F.
What the SEC left out
The final rule, adopted on 26 July 2023, was narrower than the proposal. The SEC did not adopt a requirement to say whether the company has a designated CISO, reasoning that naming the responsible positions would typically show it. It dropped a proposed requirement to disclose how often the board discusses cybersecurity. And it declined to adopt proposed Item 407(j), which would have required disclosure of directors' cybersecurity expertise.
Why it matters to a CISO
Item 1C turns the CISO's role into a statement in the annual report. The positions named, the expertise described and the board reporting claimed are all read by investors and by the SEC, so they need to match how the program works. A 10-K also describes governance as of its filing date: a CISO who leaves a month later is still the one the filing describes.
Where it appears on CISO Tribune
- Item 1C disclosures: companies' own Item 1C text stored word for word, searchable by sector, reporting line and committee.
- SEC cybersecurity disclosure rules for CISOs: Item 1C next to Item 1.05.
- Reporting lines report: what the filings say the top security role reports to.
Related terms
Frequently asked questions
- What is the difference between Item 106 and Item 1C?
- Item 106 is the rule in Regulation S-K that sets the content. Item 1C is the section of the annual report on Form 10-K where a company furnishes that content. Foreign private issuers give comparable disclosure in Item 16K of Form 20-F.
- Does Item 106 require a company to name its CISO?
- No. It asks which management positions or committees are responsible for cybersecurity risk and what expertise they bring, not for the individual's name. The SEC dropped a proposed element that would have asked whether the company has a designated CISO.
Sources
- 17 CFR 229.106 (Item 106) Cybersecurity · Electronic Code of Federal Regulations (eCFR), August 4, 2023
- Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure (Release No. 33-11216, final rule) · U.S. Securities and Exchange Commission, July 26, 2023
- Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure (small entity compliance guide) · U.S. Securities and Exchange Commission, September 10, 2024
Writer
Hadass Liza Bitton is a writer at CISO Tribune covering security leadership: the people who take the top security seat, the ones who leave it, and what each move signals. Reach her at hadass@cisotribune.com.
Cite this definition as “CISO Tribune glossary” with a link to this page. Corrections: /corrections. All terms: /glossary.
The Briefing
Every verified CISO move of the week, in your inbox Friday.
Every verified CISO move and one piece of analysis, weekly.
Unsubscribe any time. See the privacy policy.