Leadership1 publisher2 min readPublished
Item 1.05 starts its four-day clock when someone declares the incident material
The SEC's 2023 rules tie the 8-K deadline to the registrant's own determination that an incident is material, a judgment the compliance guide says must come without unreasonable delay. It names no officer to make it.
The Board Room · Leadership desk
What happened
- The SEC adopted its cybersecurity disclosure rules on July 26, 2023, covering both material incident reports and annual disclosure of risk management, strategy and governance.
- Item 1.05 of Form 8-K is due within four business days of a domestic registrant determining that an incident is material, and the deadline runs from that determination, not from discovery.
- Item 1.05 leaves out technical detail about the planned response, cybersecurity systems, networks and devices, or vulnerabilities where that detail would impede remediation.
- The rules reach domestic registrants and foreign private issuers reporting under the Exchange Act, and business development companies defined under the Investment Company Act of 1940.
Compiled by The Board RoomSomething wrong?How this is made
Why it matters
- decision The guide leaves the decider to the registrant, so the board choice that sets filing dates is the one made before any incident: which officer or committee holds the authority to declare materiality.
- constraint The only delay the guide describes requires a finding by the Attorney General. An incomplete forensic picture leaves the filing deadline where it is.
- exposure Timing becomes reviewable after the fact, and the record of when facts reached the authorized decider is what can be tested against the instruction not to delay unreasonably.
- capability Counsel can draft and file before root cause is settled, because the item's carve-out means the 8-K does not have to wait on the technical detail of the investigation.
A materiality determination is a securities judgment, and the SEC's small entity compliance guide states the test in investor terms [17]. Information is material if "there is a substantial likelihood that a reasonable shareholder would consider it important" in making an investment decision. It is also material if it would have "significantly altered the 'total mix' of information made available" [7]. Registrants are told to make that evaluation through the lens of the reasonable investor, on all relevant facts and circumstances [8].
The four business days run across weekends. A determination reached on a Thursday leaves Friday, Monday, Tuesday and Wednesday, so the 8-K falls due six calendar days after the call [18].
The guide describes the determination as the registrant's own and does not identify the officer, committee or function that makes it [19]. The authority is assigned inside the company, either in advance or in the moment. If it sits with a disclosure committee that meets on request, the day it convenes is the day the clock starts. If it sits with the general counsel, the clock starts when the facts reach that desk, and the escalation path out of the security operations centre sets the filing date.
Item 1.05 calls for the material aspects of the nature, scope and timing of the incident. It also calls for the material impact or reasonably likely material impact on the registrant, including on financial condition and results of operations [12]. That drafting sits downstream of the trigger.
One delay is available, and it comes from outside the company. Item 1.05 permits limited delay where the Attorney General determines that disclosure poses a substantial risk to national security or public safety and notifies the Commission in writing [9]. The guide directs registrants to work with the Department of Justice where they believe those interests are implicated [10].
The annual half of the regime is a drafting cycle: Item 106 of Regulation S-K [13]. Domestic registrants disclose it on the 10-K, foreign private issuers on the 20-F [3], and the disclosures are tagged in Inline XBRL [15]. Foreign private issuers also run on a different incident trigger, furnishing a Form 6-K promptly after the incident is disclosed or otherwise publicized in a foreign jurisdiction, to any stock exchange, or to security holders [14].
That difference is why the four-day clock is the item that needs a name attached to it this quarter. It is the only one of these disclosures whose deadline begins with a judgment somebody has to be authorized to make.
What to watch
- Any SEC enforcement matter that turns on how long a company took to determine materiality, which would put a measurable bound on without unreasonable delay.
- Board charters and disclosure committee mandates that name a single officer as the materiality decider, and what the fallback is when that person is unreachable.
- Staff guidance or comment letters addressing what documentation supports the timing of a determination.