What is Form 8-K Item 1.05? The SEC's material cybersecurity incident item, defined

Form 8-K Item 1.05, titled Material Cybersecurity Incidents, is the item a company registered with the US Securities and Exchange Commission (SEC) uses to report a cybersecurity incident it has determined to be material. The report describes the incident's nature, scope and timing and its material or reasonably likely material impact, and is generally due four business days after that determination.

How the item reads in a filing

The clock runs from the materiality decision, not from discovery, but the Form 8-K instructions add a limit: the decision itself must be made without unreasonable delay after the incident is discovered. When facts are still missing at filing time, the company says so and files an amended 8-K within four business days of determining them.

The item does not ask for a forensic report. A registrant need not give technical detail about its response or its vulnerabilities that would impede remediation. Delay runs mainly through the United States Attorney General, who can certify a substantial risk to national security or public safety, in steps of up to 30 days, 30 more days and, in extraordinary circumstances, a final 60 days. Registrants subject to 47 CFR 64.2011 have a separate delay of no more than seven business days.

What the item number tells a reader

Item 1.05 is reserved for incidents the company has called material. On 21 May 2024 the SEC's Division of Corporation Finance encouraged companies disclosing an incident they have not determined to be material to use another item, such as Item 8.01, so investors can tell the two apart.

Under the SEC's adopting release, the item applied from the later of 90 days after Federal Register publication or 18 December 2023, and smaller reporting companies had 180 more days. Earlier cyber 8-Ks in this record sit under Item 7.01 or Item 8.01 for that reason.

What it is not

It is not the annual program disclosure. That is Item 106 of Regulation S-K, which asks registrants to describe their processes for assessing, identifying and managing material cybersecurity risk, and the board's oversight, in the annual report on Form 10-K. It is also not the notice a state statute requires a company to send affected people; see breach notification law.

Where it appears on cisonews.net

The Item 1.05 filings tracker lists every 8-K and 8-K/A that EDGAR codes under the item, including filers this site has not yet written up. The full explainer, with the decision-date logic, is What is SEC Form 8-K Item 1.05. The two-year review reads what companies said, and breach outcomes pairs filings with later class actions.

Related terms

SEC enforcement action, ransomware, breach notification law.