Deception is moving at machine speed. Learn to keep pace.
Portal LoginSupportBlogContact
Search
Portal LoginSupportBlogContact
Search
Get a Demo
Start for Free
HomeCybersecurity 101
SEC Cybersecurity Disclosure Rules: A Practical Guide

SEC Cybersecurity Disclosure Rules: A Practical Guide

Written by: Lizzie Danielson

Published: 10/12/2026

Hands typing at a keyboard in a dark security workstation
ChatGPT logoChatGPTOpens in new tabClaude logoClaudeOpens in new tabPerplexity logoPerplexityOpens in new tabGoogle Gemini logoGoogle AIOpens in new tab
On This Page

Speed is one of the core challenges for public companies that need to comply with SEC cybersecurity disclosure rules. When a material breach happens, teams are forced to juggle damage control, ongoing threat hunting, and the pressure of a tight four-day disclosure deadline. According to the SEC, the disclosure decision must occur without unreasonable delay. Because of this, meeting the timeline requires coordinated cross-functional efforts across cybersecurity, legal, and finance teams.

This article breaks down what you need to know to stay SEC compliant, including core disclosure rules, enforcement realities, and investigation readiness.

Key Takeaways

  • Every public company must file Form 10-K with the Securities and Exchange Commission (SEC) annually to detail governance of cyber risks.
  • Public companies must disclose any cybersecurity incident that will have a serious impact on their financial health or stock value to the SEC via Form 8-K within four business days of determination.
  • Fast investigations, centralized logs, and cross-functional team collaboration are essential to meeting that tight four-day deadline.
  • Clear documentation of governance and cybersecurity threat tracking remain critical components of risk management, regardless of broader regulatory changes.

What "material" actually means & why it matters

Understanding materiality cybersecurity SEC guidelines is the key to knowing when a company must report an incident. Under longstanding securities law, information about a cybersecurity incident is “material” if there is a substantial likelihood that a reasonable investor would consider it a factor in deciding whether to buy or sell the company’s securities. This can include large monetary losses (such as major ransom payments or business interruption), as well as qualitative harms like loss of key customers or increased litigation and regulatory risk. Nonmonetary damages can include things like severe reputational harm or lost customer trust.

The cross-functional process behind a defensible materiality determination

Because deciding the materiality of an incident is so important, companies can’t leave it to just one department. They need security, legal, and financial working together:

  • The IT and security team identifies who attacked the company, how long the threat actors were inside, and what systems they broke into.
  • The legal team evaluates the findings to decide if the incident crosses the line into something the company must legally tell investors about.
  • The finance team assesses the monetary damage, like lost sales or stolen funds, so the company doesn’t accidentally underreport to the government and face heavy fines.

At the end of this collaboration, public companies produce a final document based on their findings and estimates. If the incident doesn’t meet the material threshold, the company can keep internal documentation or disclose voluntarily under Item 8.01. If the attack is material, they must submit Form 8-K within four business days. In either case, the company needs a structured incident response workflow for handling these instances. Informal conversations and ad-hoc collaboration could lead to second guessing, missed deadlines, and noncompliance.

What the SEC cybersecurity disclosure rules actually require

Once a company determines that an incident is material, it must manage these core reporting obligations.

Form 8-K cybersecurity incident disclosure

For material breaches, U.S.-based companies must file Item 1.05 on Form 8-K within four business days. Foreign private issuers handle this using Form 6-K. This document must include the nature, scope, and timing of the incident, as well as the material impact. If the company doesn’t have exact details at the time of filing, they must state that the investigation is ongoing and submit an amendment later.

Companies can only delay filing if the U.S. Attorney General provides written notification that disclosure poses a substantial risk to national security or public safety. For example, AT&T used this exception to delay a July 2024 filing by 84 days.

Form 10-K annual governance disclosure

In addition to handling individual incidents, all public companies must detail their cybersecurity processes once a year. U.S.-based companies do this using Form 10-K, while foreign private investors use Form 20-F to satisfy the same requirement. This form includes processes for identifying and managing cyber threats, board-level oversight, and how cyber risks affect overall business strategy.

It’s important to note that merely stating the process isn’t enough for SEC cybersecurity compliance. Companies must provide specific information and details like third-party vendor oversight. However, there’s no need to specify technologies, as the focus is more on the process than your infrastructure or tech stack.

What SEC enforcement has looked like so far

The SEC has actively penalized public companies for failure to properly disclose cyber breaches, with penalties totaling over \$8 million across major sweeps. This included a breach at SolarWinds, a prominent U.S. software company.

SolarWinds

In October 2024, the SEC hit four companies with penalties for minimizing the impact of breaches connected to the 2020 SolarWinds Orion compromise:

  • Unisys paid a \$4 million penalty for framing cyber risks as purely hypothetical while experiencing active instructions.
  • Avaya also paid a \$1 million fine for describing their cyber risks using vague, hypothetical language even though they already knew a breach had happened.
  • Check Point Software Technologies faced \$995,000 in fines for disclosing “half-truths” that downplayed how deeply threat actors had accessed their systems.
  • Mimecast Limited paid \$990,000 in fines for minimizing the seriousness of login credentials stolen during a breach.

The Cyber and Emerging Technologies Unit (CETU)

In February 2025, the SEC launched a specialized investigative group within its Division of Enforcement. The CETU consists of approximately 30 fraud specialists, attorneys, and technical experts. Its primary mission is to protect investors and police fraud across financial markets.

What to watch for with SEC rules

The regulatory landscape has already experienced notable shifts. The SEC previously targeted SolarWinds and its chief information security officer (CISO) Timothy Brown for reportedly submitting misleading disclosures that downplayed the breadth of the breach. However, after a federal court dismissed most of the claims, the SEC voluntarily dismissed the case.

Under Chair Paul Atkins, registrants have generally faced a less aggressive regulatory climate. The Commission has also faced banking petitions aimed at repealing Item 1.05 on Form 8-K. Even with these changes, deceptive or incomplete disclosures that leave investors in the dark remain a primary target for penalties.

Companies should prioritize compliance with current rules and continue to check for updates at SEC.gov.

What faster, more complete investigation looks like in practice

To meet the SEC’s tight four-day deadline, organizations need a streamlined process backed by the right tools and team members to speed up investigations.

Audit-ready logging & reporting

One major bottleneck in any investigation is tracking down scattered data. Using a centralized logging system speeds up the timeline. Huntress Managed SIEM collects security‑relevant logs from endpoints, firewalls, VPNs, identity systems, and other sources into a single platform and keeps them searchable for up to seven years to support investigations and demanding regulatory or audit requirements.

Software alone doesn’t satisfy SEC disclosure rules. But having long-term recordkeeping gives security and legal teams the concrete evidence they need to make smart, defensible decisions. It also helps build your yearly Form 10-K governance report.

Endpoint & identity visibility as supporting investigation inputs

Investigation speed also depends on catching threats early. Huntress Managed EDR provides deep visibility into what’s happening on employee laptops and company servers, using behavior-based detections (like persistent footholds, malicious process behavior, and ransomware canaries) combined with an AI‑centric 24/7 SOC that investigates and remediates confirmed threats with an industry‑leading mean time to respond.

Managed ITDR monitors identity activity in Microsoft 365 and Google Workspace to detect and respond to identity‑based threats such as business email compromise, session hijacking, and rogue OAuth apps—common tradecraft in modern account takeover campaigns.

While these aren’t standalone compliance paperwork tools, they provide vital data points that feed into your centralized logs. When security teams can establish the scope and timeline of an attack faster, it becomes easier to meet that four-day SEC deadline. It also prevents companies from rushing out a vague disclosure that they later have to correct because they underreported the true damage.

ChatGPT logoChatGPTOpens in new tabClaude logoClaudeOpens in new tabPerplexity logoPerplexityOpens in new tabGoogle Gemini logoGoogle AIOpens in new tab
On This Page

FAQs

The clock starts ticking for four business days the moment you determine that the incident is material, not when you first spot the breach. While the SEC expects you to reach that decision without unreasonable delay, the initial discovery period follows a separate timeline.

These SEC rules apply to all registered public companies, including foreign private issuers. While private entities aren’t directly impacted, they face indirect effects when acting as a third-party vendor for registrants. In these cases, a private company’s incident may trigger a mandatory disclosure for partner companies.

The CISO is the primary source of technical truth. Their job is to provide legal and finance teams with an accurate scope of cybersecurity threats. Considering that the SolarWinds case led to the CISO also facing legal claims of fraud and deception, accurate and timely communication is critical. CISOs should also create disclosure protocols with legal and finance before an incident occurs to minimize organizational, professional, and personal risks.

It can take anywhere from days to months to fully dig through the depth of a material breach, and it’s unlikely you’ll have all of that information within four business days. However, you should disclose what you currently know about the nature, scope, and timing of the incident. You can also note in the submission that the investigation is still ongoing. It’s not unusual to submit an amended new item after completing investigations.

Cyber risk is one of the arguments for repealing Item 1.05. Opponents say that threat actors might misuse a public cybersecurity governance disclosure to breach a company again or compromise other systems. Companies can mitigate this by removing technical details that could contribute to this risk while still providing details on material impact. In rare cases where you need an exception, the legal and security team should collaborate to submit a request for an exception to the Attorney General.

Are you ready to see what audit-ready logging and faster incident investigation could look like for your team? Schedule a demo. We’ll show you how Huntress supports compliance with SEC rules.

Additional Resources

Protect What Matters

Secure endpoints, email, and employees with the power of our 24/7 SOC. Try Huntress for free and deploy in minutes to start fighting threats.
Try Huntress for Free