What Item 1.05 of Form 8-K actually requires you to disclose

Most of the dread around Item 1.05 of Form 8-K attaches to the wrong part of it. The content requirement is narrower than the reputation suggests, the SEC's own compliance guide draws a line around the technical detail everyone worries about leaking, and the form then expects a registrant to come back once the facts arrive.

Knowing that shape before an incident is most of the value, because the drafting happens on the worst day of the quarter. The companion question — when the four-business-day clock starts, and who owns the judgement that starts it — is covered separately in a breach is a financial reporting problem now. This article is about what goes on the page.

The two requirements, and the four buckets inside them

The SEC's small entity compliance guide states the Item 1.05 content requirement in two parts: "The material aspects of the nature, scope, and timing of the incident; and The material impact or reasonably likely material impact on the registrant, including on the registrant's financial condition and results of operations."

That unpacks into four things a reader should be able to find in your filing:

• Nature. What kind of incident it was, at a level an investor can understand.
• Scope. What it reached — systems, data, operations, geographies.
• Timing. When it happened and over what period, which is not the same as when you found it.
• Impact, actual or reasonably likely. Including on financial condition and results of operations.

The fourth bucket does the most work and gets the least attention. "Reasonably likely material impact" is forward-looking: on day four you often know what was touched and very little about what it will cost. The requirement is still to address it, which means describing the exposure and the expected effects rather than asserting a number nobody has yet.

In our view, that last bullet is where the discipline matters. Both items the guide describes are framed around material aspects and material impact — and how it started, who was behind it and what is being patched pull a first draft elsewhere.

What the form does not require

This is the part worth printing out. The compliance guide is explicit that "Item 1.05 does not require the registrant to disclose specific or technical information about its planned response to the incident or its cybersecurity systems, related networks and devices, or potential system vulnerabilities in such detail that would impede its response or remediation of the incident."

Read that sentence to the end. In our view the condition it closes on reads as a limit on how deep a filing has to go, not as a clean subject-matter exclusion, and where the line sits is a judgement to make with counsel.

In our view, most first drafts fail in the opposite direction from the one the general counsel fears. The instinct under pressure is to write a reassuring engineering narrative, which sits outside the requirement and is liable to be wrong by the time the amendment lands. The filing an investor needs is about effect, not about method.

The filing you make before you know everything

Item 1.05 is a two-step disclosure, and treating it as one is where the trouble starts.

The initial report is due within four business days of the registrant determining that a cybersecurity incident is material, and that determination has to be made without unreasonable delay. Where required information is not determined or is unavailable at the time of that filing, the adopting release requires an amended Form 8-K "within four business days after the registrant, without unreasonable delay, determines such information or within four business days after such information becomes available."

So the structure is: file what you know, flag what you do not, and carry a live obligation to come back. That obligation needs an owner and a tracking mechanism, because it outlives the war room.

Two staff interpretations matter here. Where a registrant determined the incident was material, the staff's Form 8-K interpretations say "the subsequent ransomware payment and cessation or apparent cessation of the incident does not relieve the registrant of the requirement to report the incident under Item 1.05 of Form 8-K." An incident that is over is still reportable. The interpretations also address a series of smaller intrusions over time, asking whether related incidents, "collectively, were material" rather than testing each one alone.

If it is not material, do not file it under Item 1.05

Companies sometimes want to get ahead of a story before the materiality analysis is finished. The Division of Corporation Finance has told them where to put it: for an incident not yet determined material, or determined not material, the Division "encourages the company to disclose that cybersecurity incident under a different item of Form 8-K (for example, Item 8.01)."

The reason is clean. The same staff statement puts it this way: "Item 1.05 is not a voluntary disclosure, and it is by definition material because it is not triggered until the company determines the materiality of an incident." Filing an undetermined incident under 1.05 tells the market you reached a conclusion you did not reach.

Incidents on systems you do not own

This is the question most relevant to anyone who has spent a year on vendor reviews. The adopting release puts the materiality test plainly: "Whether an incident is material is not contingent on where the relevant electronic systems reside or who owns them." On that wording the test runs on effect, not on where the hardware sits.

The release separately addresses how hard a registrant has to dig. It says registrants "should disclose based on the information available to them," and that the final rules "generally do not require that registrants conduct additional inquiries outside of their regular channels of communication with third-party service providers pursuant to those contracts."

Read those sentences together and the practical consequence is a contracting problem, not a forensics problem. Your regular channel is whatever your contract and your relationship actually produce, which is why notification timing belongs in the agreement. The questions worth asking are in vendor risk assessment questions.

Scope, dates and the annual-report half

A few boundaries that settle recurring arguments:

• Scope is broad, but it has named edges. The compliance guide says the rules apply to "domestic registrants and FPIs subject to the reporting requirements under the Exchange Act," and that they cover business development companies as defined in section 2(a)(48) of the Investment Company Act of 1940. Its footnotes then exclude eligible registrants that file disclosures on Form 40-F under the Multijurisdictional Disclosure System, asset-backed issuers as defined in Item 1101 of Regulation AB, and investment companies registered under the Investment Company Act of 1940. Check which of those you are first.
• The phase-in is over. The compliance guide gives a compliance date for incident disclosure of 18 December 2023 for registrants other than smaller reporting companies and 15 June 2024 for smaller reporting companies, with Inline XBRL tagging for incident disclosure beginning 18 December 2024.
• Foreign private issuers have a parallel route. The guide describes FPIs promptly furnishing "the same information regarding the incident on Form 6-K" when it is disclosed in a foreign jurisdiction or to an exchange or security holders.
• There is a delay valve, and it is not yours to pull. Disclosure can be delayed where the Attorney General determines it poses a substantial risk to national security or public safety, with an initial period of up to 30 days and further extensions available on the required determinations. Where that period applies, the staff's interpretations say the Form 8-K is then due within four business days of the expiration of the delay period.
• The annual report carries the other half. Item 106 of Regulation S-K covers processes for assessing, identifying and managing material risks from cybersecurity threats, board oversight, and management's role — the standing disclosure your 8-K is eventually read against.

On a late filing: the release provides that "untimely filing of an Item 1.05 Form 8-K will not result in the loss of Form S-3 eligibility," and it added Item 1.05 to "the list of Form 8-K items eligible for a limited safe harbor from liability under Section 10(b)." Neither is permission. Treat them as the reason a good-faith four-day filing with gaps beats a polished one filed late.

What to do before you need it

1. Draft the filing now, with blanks. Four paragraphs — nature, scope, timing, impact — with bracketed placeholders and a line that says what has not yet been determined. Review it with counsel while nothing is on fire.
2. Give the amendment an owner. Name the person who tracks open items from the initial report and the date each one is expected to resolve.
3. Decide in advance who drafts, who reviews, and who signs, and write the Item 8.01 alternative into the same procedure.
4. Fix the vendor notification clause in the contracts behind your material processes, since your disclosure quality is capped by what a provider tells you and when.

If you want a structured version of the post-incident control work that sits behind all of this, the breach aftermath control checklist walks the same ground, and the readiness scorecard shows the gaps while they are cheap to close. None of this is legal advice; confirm the application to your own facts with securities counsel.

Common questions

What exactly has to go in an Item 1.05 Form 8-K?

The SEC's small entity compliance guide describes two requirements: the material aspects of the nature, scope and timing of the incident, and the material impact or reasonably likely material impact on the registrant, including on its financial condition and results of operations. In our view a draft that stays on those two items is on firmer ground than one that narrates cause and remediation.

Does Item 1.05 require technical detail about our response or our vulnerabilities?

The compliance guide says Item 1.05 does not require the registrant to disclose specific or technical information about its planned response to the incident or its cybersecurity systems, related networks and devices, or potential system vulnerabilities in such detail that would impede its response or remediation of the incident. That sentence carries a condition at the end, so where the line falls on your own facts is a question for securities counsel.

What if we do not know the impact when the four business days run out?

You file what you have and then amend. The adopting release requires the amended Form 8-K within four business days after the registrant, without unreasonable delay, determines the missing information, or within four business days after that information becomes available. Item 1.05 is a two-step disclosure by design.

Should we use Item 1.05 for an incident we have not finished assessing?

The Division of Corporation Finance encourages companies to use a different item of Form 8-K, for example Item 8.01, for an incident that has not been determined material or has been determined not material. The staff's concern is investor confusion about which filings reflect an actual materiality determination.

Does an incident on a vendor's systems count?

It can. The adopting release says whether an incident is material is not contingent on where the relevant electronic systems reside or who owns them. The release separately says registrants should disclose based on the information available to them, and that the final rules generally do not require that registrants conduct additional inquiries outside of their regular channels of communication with third-party service providers pursuant to those contracts.

What happens if the Form 8-K goes in late?

The rules soften two consequences: the release provides that untimely filing of an Item 1.05 Form 8-K will not result in the loss of Form S-3 eligibility, and Item 1.05 was added to the Form 8-K items eligible for a limited safe harbor from liability under Section 10(b). Neither of those makes a late filing acceptable.

Sources

1. Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure (Release Nos. 33-11216; 34-97989), 88 FR 51896 · U.S. Government Publishing Office (govinfo)
2. Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure — A Small Entity Compliance Guide · U.S. Securities and Exchange Commission, Division of Corporation Finance
3. Compliance and Disclosure Interpretations: Exchange Act Form 8-K (Section 104B, Item 1.05 Material Cybersecurity Incidents) · U.S. Securities and Exchange Commission, Division of Corporation Finance
4. Disclosure of Cybersecurity Incidents Determined To Be Material and Other Cybersecurity Incidents — statement of Erik Gerding, Director, Division of Corporation Finance · U.S. Securities and Exchange Commission