A breach is a financial reporting problem now, not just a security one

For most of the last two decades, a breach was the CISO's problem and the CFO found out at the board meeting. That division is over, and the companies still running on it are the ones that get hurt twice — once by the attacker, and once by the disclosure.

1. The clock runs from your judgement, not from the intrusion

Public companies must disclose a material cybersecurity incident on Form 8-K under Item 1.05. General Instruction B.1 to the form sets the deadline: a report under Item 1.05 "is to be filed within four business days after the registrant determines that it has experienced a material cybersecurity incident."

Read that again, because most summaries get it wrong. The clock does not start when the attacker gets in, or when you find them. It starts when management determines the incident is material.

That is not an invitation to take your time. Instruction 1 to Item 1.05 is explicit: "A registrant's materiality determination regarding a cybersecurity incident must be made without unreasonable delay after discovery of the incident." The adopting release puts it plainly — the determination "need not be rushed prematurely" but "cannot be unreasonably delayed in an effort to avoid timely disclosure." It goes on to give examples of what unreasonable looks like: deferring the committee meeting past the time it normally takes to convene, or amending incident-response procedures so that the deadline moves.

The word generally belongs in any summary of the four days, because there are two codified delay routes: a national-security deferral certified by the Attorney General, and a short deferral for registrants subject to the FCC's telecom breach-notification rule.

One piece of stale advice worth retiring: smaller reporting companies did get an extra 180 days when the rule arrived, and that deferral expired on 15 June 2024. Every category of registrant is in scope now.

What this means for you: the materiality determination is a financial-reporting judgement. It belongs to the disclosure committee and the CFO, informed by the security team — not the other way around. If your incident-response plan has no defined path for it, with named participants and an agreed information set, you do not have a plan that works for a public company. The release's own comfort is that "adhering to normal internal practices and disclosure controls and procedures will suffice to demonstrate good faith compliance" — which only helps if those practices exist in writing before the incident.

What enforcement has actually looked like

Worth being precise here, because this area has moved and a lot of published commentary has not kept up.

In October 2024 the SEC charged four companies — Unisys, Avaya, Check Point and Mimecast — over disclosures it said understated the impact of intrusions connected to the SolarWinds Orion compromise, settling for roughly $7 million in total. The charges concerned disclosures that were incomplete or framed to understate impact, not disclosures that were filed late. We have not found an enforcement action premised on missing the four-business-day clock itself.

Two changes since then matter:

• The Crypto Assets and Cyber Unit, which brought that generation of cases, was replaced in February 2025 by the Cyber and Emerging Technologies Unit, a smaller group framed around fraud and retail-investor protection in emerging technologies rather than public-company disclosure policing.
• In R.R. Donnelley (June 2024) the SEC advanced a theory that weak cybersecurity controls violated the internal accounting controls provision — a charge two commissioners publicly dissented from. A federal court rejected that theory in the SolarWinds case in July 2024, and the case was dismissed with prejudice in November 2025.

None of that reduces the disclosure obligation, which is a rule and remains in force. It does mean you should discount anyone describing an aggressive and expanding cyber-enforcement posture; the record over the past two years points the other way.

2. Ransomware: payment rates falling, disruption rising

Two published figures are worth having, both from free sources you can check yourself.

On volume, Comparitech logged 4,217 ransomware attacks in the first half of 2026, against 3,706 in the first half of 2025 — an increase of roughly 14%, on a leak-site counting methodology.

On payment, Coveware by Veeam reported that in the second quarter of 2026 "the percentage of clients that ultimately choose to pay sank to a new record low," with the data-exfiltration-only payment rate down to 15%. That is the share of Coveware's own incident-response clients, not of all victims globally — a distinction worth keeping, because no one measures the global population.

Fewer payments is good news, and it changes the shape of the risk rather than removing it. When payment is not on the table, the damage is operational and financial: days or weeks of disruption, restoration cost, lost revenue, and — for a public company — the question of whether the books can be closed on time.

Two patterns are worth naming, with the sources that actually measure them:

• Third parties are now involved in about half of breaches. Verizon's 2026 Data Breach Investigations Report puts third-party involvement at 48% of all breaches, up 60% year over year, and reports that vulnerability exploitation has passed stolen credentials as the leading entry point at 31% — the first time in nineteen editions. Your perimeter is your vendors' perimeter.
• Attacker timelines are compressing. The same report describes AI shrinking the window from vulnerability disclosure to exploitation "from months to mere hours," and CrowdStrike reports adversaries moving from initial access to lateral movement in minutes. Detection windows that were adequate two years ago are not adequate now.

What this means for you: the backup and recovery question is not theoretical. Can you restore the general ledger, the billing system, and the identity provider from backups the attacker could not reach, within a time that lets you close the quarter? If you have not tested a full restore in the last year, the honest answer is "we don't know."

3. When a breach touches the books

Here is the part that catches CFOs off guard, and here is where we are going to be careful to separate what the rules say from what we think.

What we think. Where an incident impairs a system relevant to financial reporting — the ERP is encrypted, the billing platform is offline, journal-entry approvals are bypassed during recovery — the right question is not only whether it was a security event. It is whether the IT general controls over that system, particularly access and change management, were operating effectively through the period, and whether any deficiency rises to a significant deficiency or material weakness under the ordinary severity framework. That is a professional judgement we hold, and it follows from an uncontroversial premise: ITGCs are part of internal control over financial reporting, so a breach that compromises them can surface a control deficiency.

What we are not saying. We are not saying regulators treat a breach as an ICFR deficiency as a matter of course. The nearest regulatory theory — that inadequate cybersecurity controls violate the internal accounting controls provision — was advanced against R.R. Donnelley, dissented from by two commissioners, and rejected by a federal court in SolarWinds. Anyone telling you the SEC now treats breaches as control failures is describing a theory that lost.

The practical consequences of the judgement, though, are real:

If the incident…	Then…
Impairs a system behind a key control	The control did not operate for that period; the deficiency has to be evaluated for severity
Forces manual workarounds during recovery	Those workarounds are compensating controls and need evidence, precision, and review
Alters or destroys financial data or logs	Completeness and accuracy of the affected period has to be re-established
Is material	It is disclosed on Form 8-K and considered in the quarterly Section 302 certification and the annual 404(a) assessment

The CISO cannot make those evaluations alone. The controller cannot make them without the CISO. This is why the wall is gone.

What the CFO owns, concretely

1. The materiality determination process. Written, rehearsed, with named participants and a defined information set. This is a disclosure control.
2. The link between the IT asset inventory and the financial control matrix. Which systems support which key controls — so that when the security team says "system X is down," finance immediately knows which controls are affected.
3. Recovery objectives for financial systems. Recovery time and recovery point objectives for the ledger, sub-ledgers, billing, payroll, and identity — set by finance, delivered by IT, tested at least annually.
4. Deficiency evaluation after an incident. A standing agenda item in the post-incident review: which controls did not operate, for how long, what compensated, and what goes to the audit committee.
5. Board and audit-committee reporting that ties security to financial risk. Not a slide of vulnerability counts — a statement of which financial processes are exposed, what the recovery posture is, and what has changed since last quarter.

The uncomfortable summary

The disclosure obligation turns on a judgement that belongs to finance. The recovery question turns on whether the systems finance depends on can be brought back in time to close. And the control question — the one nobody is required to ask you, and every auditor will — turns on whether the controls over those systems were working while the incident ran.

Treating cybersecurity as part of the financial control environment, evidenced the same way and reported to the same committee, is more work for the CFO. It is also the only structure in which a breach is a bad week rather than a restatement.

Common questions

When does the four-business-day clock actually start?

When management determines the incident is material — not when the intrusion happened, and not when it was discovered. Instruction 1 to Item 1.05 requires that determination to be made without unreasonable delay after discovery, so the clock cannot be stopped by simply not deciding.

Does every public company have to comply, or do smaller companies get longer?

Every category of registrant is now in scope. Smaller reporting companies had an additional 180 days when the rule came in, and that deferral expired on 15 June 2024. Any advice suggesting smaller companies still have extra time is out of date.

Is a breach automatically a material weakness in internal control over financial reporting?

No, and nobody should say that it is. The question is whether the IT general controls over the affected system — access and change management in particular — were operating effectively, and whether any deficiency rises to a significant deficiency or material weakness under the usual severity framework. That is a judgement, made case by case.

Has the SEC actually brought enforcement actions over cyber disclosure?

Yes, though not for missing the filing deadline. In October 2024 the SEC charged four companies over disclosures it said understated the impact of the SolarWinds Orion compromise. Its broader theory — that weak cybersecurity controls violate the internal accounting controls provision — was rejected by a federal court in the SolarWinds case, which was dismissed with prejudice in November 2025.

Who should own the materiality determination?

The disclosure committee and the CFO, informed by the security team. It is a financial-reporting judgement about impact, not a technical judgement about severity, and the SEC's adopting release treats adherence to normal internal practices and disclosure controls as evidence of good-faith compliance.

Sources

1. Form 8-K — Item 1.05, Material Cybersecurity Incidents (see also General Instruction B.1) · U.S. Securities and Exchange Commission
2. Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure (Release Nos. 33-11216; 34-97989), 88 FR 51896 · Federal Register
3. Fact Sheet: Public Company Cybersecurity Disclosures; Final Rules · U.S. Securities and Exchange Commission
4. SEC Charges Four Companies With Misleading Cyber Disclosures (Press Release 2024-174) · U.S. Securities and Exchange Commission
5. SEC Announces Cyber and Emerging Technologies Unit to Protect Retail Investors (Press Release 2025-42) · U.S. Securities and Exchange Commission
6. SEC v. SolarWinds Corp. and Timothy G. Brown — Litigation Release No. 26423 (dismissal with prejudice, 20 November 2025) · U.S. Securities and Exchange Commission
7. In the Matter of R.R. Donnelley & Sons Co., Exchange Act Release No. 100365 (18 June 2024) · U.S. Securities and Exchange Commission
8. Ransomware Payment Trends Q2 2026 — Coveware by Veeam · Veeam
9. Ransomware Roundup: H1 2026 stats on attacks, ransoms, and active gangs · Comparitech
10. Vulnerability exploitation top breach entry point, 2026 industry-wide DBIR finds · Verizon