Item 8.01 versus Item 1.05: when a cyber incident moves between them

The short answer

This guide reads one SEC staff statement and one company's two Form 8-K filings. It answers a narrow question: when does a cyber incident go under Item 8.01, and what leads a company to file again under Item 1.05? Every sentence that states a fact is followed by the passage that supports it, in double brackets.

The statement is from Erik Gerding, Director of the Division of Corporation Finance, and is dated May 21, 2024. He states that the rules adopted on July 26, 2023 require public companies to report material incidents under Item 1.05. The rest of the question follows from that one test: has the company determined the incident to be material?

When Item 8.01 is the better fit

The statement covers two situations: the company has not yet decided whether the incident is material, or it has decided the incident is not material. In both, the statement says the Division encourages the company to use a different item, and it names Item 8.01 as the example.

The statement gives its reason for steering these incidents away from Item 1.05. The reason is investor confusion. It adds that if every incident went under Item 1.05, investors could misread the severity of what they see.

The statement does not ask companies to say less. It says the clarification is not meant to discourage voluntary disclosure of incidents with no materiality determination yet. The choice of item is therefore about labeling. An Item 8.01 filing tells the reader that the company has not designated the incident as material under the rule. An Item 1.05 filing tells the reader that it has.

What moves an incident from Item 8.01 to Item 1.05

The trigger is a later materiality determination. The statement says a company that disclosed under Item 8.01 and then decides the incident is material should file under Item 1.05 within four business days of that decision.

The Item 1.05 filing does not need to repeat the whole earlier filing, but it must stand on its own. The statement says the new filing may refer back to the Item 8.01 report. It also says the company must make sure the new filing satisfies Item 1.05.

Filing under Item 8.01 does not pause the materiality question. A footnote to the statement says a company that disclosed under Item 8.01 without a determination must still decide whether the incident was material, and must do so without unreasonable delay.

In short, what changes is the company's own conclusion. New facts about the incident matter only because they feed that conclusion.

Cases that skip Item 8.01

The statement describes one case where a company goes straight to Item 1.05 before it knows the full impact. It says an incident can be so significant that a company determines it to be material even though the impact is not yet determined.

For those cases the statement lays out the steps. So an Item 1.05 filing can itself be amended later. That is a different path from an Item 8.01 filing followed by a new Item 1.05 filing, and a reader of the log should not mix the two.

A worked example: Crimson Wine Group

Crimson Wine Group's two filings show the Item 8.01 path from start to finish. The first is a Form 8-K that lists June 30, 2024 as the date of the earliest event reported. Under Item 8.01, the company says it determined it had experienced an incident in which an unauthorized third party gained access to some of its systems.

That filing says plainly that no materiality call had been made. The chief executive officer signed the report and dated it July 5, 2024.

The second filing is under Item 1.05, titled "Material Cybersecurity Incidents," and is dated July 25, 2024. It says the company reached a conclusion that day. This is the change the Gerding statement describes: an earlier Item 8.01 filing, a later determination, and a new Item 1.05 filing.

The company's second filing also gives the new facts it describes. It says the incident involved unauthorized access to part of its internal systems and the taking of certain files. It says that shutting down systems to isolate operations from the Internet disrupted its business.

The wording of the determination is narrow, and it is worth reading closely. The company says it has likely had a material impact on its business operations. In the same filing it says it does not believe the incident has had a material impact on its overall financial condition or results of operations. The filing is a useful reminder that the Item 1.05 trigger is the company's determination, as the company words it. Our log records that wording as filed.

What the statement is and is not

The Gerding statement is staff guidance. It says so itself: It does not change the text of Item 1.05, and it describes the Division's encouragement, not a new rule. Readers of the log should treat the Item 8.01 route as the Division's stated preference for incidents without a materiality determination, and they should treat Crimson's two filings as one company's documented sequence.