Financial servicesUSA

SEC

Support cyber disclosures with a traceable governance record

Keep risk-management evidence and review responsibilities connected for leadership and disclosure teams.

Full title
Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, SEC Release No. 33-11216
Issued by
US Securities and Exchange Commission
Adopted and effective
Adopted 26 July 2023, effective 5 September 2023. Still in force as of October 2026.
Applies to
Companies that file reports with the SEC under the Securities Exchange Act of 1934, including foreign private issuers
Nature
Binding disclosure rules. They require disclosure, not specific security controls.
Structure
Form 8-K Item 1.05 incident disclosure, Regulation S-K Item 106 annual disclosure, Form 20-F and Form 6-K equivalents, and Inline XBRL tagging

Overview

What the SEC rules require

The SEC’s cybersecurity rules require public companies to disclose two things: material cybersecurity incidents, promptly, and their cybersecurity risk management, strategy and governance, every year. The rules do not tell companies which controls to run. They require companies to describe, accurately, what they do and what has happened, so that investors can judge cyber risk alongside other risks.

Incident disclosure sits in Item 1.05 of Form 8-K. When a company determines that a cybersecurity incident is material, it must file within four business days of that determination, describing the material aspects of the incident’s nature, scope and timing, and its material or reasonably likely material impact. The materiality determination itself must be made without unreasonable delay after discovery. Disclosure may be delayed only where the US Attorney General finds that it would pose a substantial risk to national security or public safety.

Annual disclosure sits in Item 106 of Regulation S-K and is reported in the Form 10-K. Companies describe their processes for assessing, identifying and managing material cybersecurity risks, whether those risks have materially affected or are reasonably likely to materially affect the business, the board’s oversight, and management’s role and expertise. Foreign private issuers make comparable disclosures in Form 20-F and furnish material incident information on Form 6-K.

In January 2026 the SEC Chairman invited public comment on reforming Regulation S-K, and some commenters asked the SEC to rescind Item 106 and the Item 1.05 requirement. As of October 2026 the SEC had not proposed or adopted any change, so the rules apply as adopted. Any change would require its own rulemaking.

Who it applies to

The rules apply to companies that report to the SEC:

  • Domestic registrants filing Forms 10-K and 8-K
  • Smaller reporting companies, which had a later compliance date for incident disclosure
  • Foreign private issuers filing Forms 20-F and 6-K
  • Indian companies with securities registered with the SEC, such as those with US-listed ADRs
  • In practice, the security, legal, finance and board functions that prepare and approve these disclosures

Asset-backed issuers are not subject to the new requirements. The rules are about disclosure, so many companies use a framework such as NIST CSF 2.0 or ISO 27001 to give the processes they describe a clear basis.

Structure

How the rules are organised

Two main disclosure requirements, with equivalents for foreign private issuers and a structured data requirement.

Form 8-K

Item 1.05: material cybersecurity incidents

Trigger
A cybersecurity incident that the company determines to be material. The determination must be made without unreasonable delay after discovery.
Deadline
Within four business days of determining that the incident is material.
Content
The material aspects of the nature, scope and timing of the incident, and its material impact or reasonably likely material impact, including on financial condition and results of operations. Specific technical information that would impede response or remediation is not required.
Updates
Information not determined or unavailable at the time of filing is provided in an amendment to the Form 8-K within four business days after it is determined or becomes available.
Form 8-K

Delays and related guidance

National security or public safety delay
If the US Attorney General determines that disclosure poses a substantial risk to national security or public safety and notifies the SEC in writing, disclosure may be delayed for up to 30 days, extended by up to a further 30 days, and in extraordinary circumstances by up to a further 60 days on a national security finding. Beyond that, SEC exemptive relief is needed.
Telecommunications carriers
Companies subject to the FCC’s customer proprietary network information breach rule may delay for up to seven business days after notifying the US Secret Service and FBI, with written notice to the SEC.
Item 8.01 for other incidents
In May 2024 the SEC’s Division of Corporation Finance stated that Item 1.05 is for incidents determined to be material, and that companies may disclose other incidents voluntarily under Item 8.01.
Regulation S-K

Item 106(b): risk management and strategy

Processes
Describe the processes, if any, for assessing, identifying and managing material risks from cybersecurity threats, in enough detail for a reasonable investor to understand them.
Integration and third parties
Whether and how those processes are integrated into overall risk management, whether assessors, consultants, auditors or other third parties are engaged, and whether there are processes to oversee and identify risks from third-party service providers.
Effects on the business
Whether risks from cybersecurity threats, including previous incidents, have materially affected or are reasonably likely to materially affect business strategy, results of operations or financial condition.
Regulation S-K

Item 106(c): governance

Board oversight
Describe the board’s oversight of risks from cybersecurity threats, including any committee responsible and how the board or committee is informed about those risks.
Management’s role
Describe management’s role in assessing and managing material cybersecurity risks, including which positions or committees are responsible, their relevant expertise, how they are informed about prevention, detection, mitigation and remediation, and whether they report to the board.
Board expertise
The SEC did not adopt a proposed requirement to disclose the cybersecurity expertise of board members.
Foreign private issuers

Form 20-F and Form 6-K

Form 20-F
Annual disclosure on cybersecurity risk management, strategy and governance comparable to Item 106.
Form 6-K
Material cybersecurity incident information that the issuer discloses or makes public in a foreign jurisdiction, to a stock exchange or to security holders.
Data

Inline XBRL tagging

The new disclosures must be tagged in Inline XBRL, beginning one year after the initial compliance date for each disclosure requirement.

Implementation roadmap

How to implement it, step by step

A practical sequence for meeting both the incident and the annual disclosure requirements.

  1. 1

    Define a cybersecurity incident and its owners

    Agree how incidents are classified and who must be told, from the security team through legal and finance to the disclosure committee.

    OutputsIncident classificationEscalation matrix
  2. 2

    Build a materiality process

    Set out how the company assesses materiality, using quantitative and qualitative factors, who decides, and how the decision and its date are recorded.

    OutputsMateriality procedureDecision record template
  3. 3

    Prepare the Form 8-K route

    Draft templates and assign responsibility so that a filing can be made within four business days of a materiality determination, and amended as information becomes available.

    Outputs8-K templatesFiling runbook
  4. 4

    Document the risk management programme

    Record the processes for identifying, assessing and managing cyber risk, how they fit into enterprise risk management, the use of outside assessors and the oversight of third-party providers.

    OutputsProgramme descriptionThird-party risk process
  5. 5

    Set governance and reporting lines

    Confirm which board committee oversees cyber risk, how and how often it is briefed, which management roles are responsible and what expertise they bring.

    OutputsCommittee charterBoard briefing calendar
  6. 6

    Draft and support the Item 106 disclosure

    Write the annual disclosure from records that show the processes actually operate, and have it reviewed by legal and the disclosure committee.

    OutputsItem 106 draftSupporting evidence
  7. 7

    Rehearse and keep records current

    Run tabletop exercises that include the materiality decision and the four-day clock. Keep risk, incident and board records current so that disclosures stay accurate each year.

    OutputsTabletop reportsUpdated records

Audit and evidence guide

What auditors look for, and the evidence to keep

There is no certification. The SEC reviews filings through its Division of Corporation Finance, can issue comment letters, and can bring enforcement action for inaccurate or misleading disclosure. The test is whether disclosures are timely and accurate, and whether they match what the company actually does.

What reviewers look for

  • A documented process for determining materiality, and its date
  • Timely Form 8-K filings within four business days of the determination
  • Amendments when new material information becomes available
  • Use of Item 1.05 only for incidents determined to be material
  • Item 106 descriptions that match the processes actually in place
  • Board and committee oversight shown in minutes and briefing records
  • Management roles and expertise described accurately
  • Third-party service provider risk processes
  • Consistency between risk factors, Item 106 and incident disclosures
  • Disclosure controls and procedures that capture cyber information

Key dates and timelines

Form 8-K Item 1.05 filingWithin 4 business days
Item 106 disclosure in Form 10-KAnnually
Item 106 and Form 20-F first requiredFYs ending from 15 Dec 2023
Item 1.05 and Form 6-K complianceFrom 18 Dec 2023
Item 1.05, smaller reporting companiesFrom 15 Jun 2024
Inline XBRL taggingOne year after compliance
Attorney General delay, initial periodUp to 30 days

Evidence to keep, by area

Examples to guide your evidence library. Your auditor or regulator decides what is sufficient.

Incident response

  • Incident register with discovery dates
  • Escalation records
  • Post-incident reviews

Materiality

  • Materiality assessments
  • Decision records with dates
  • Disclosure committee minutes

Filings

  • Form 8-K and amendments
  • Item 106 drafts and approvals
  • Form 20-F and 6-K, where relevant

Risk management

  • Cyber risk register
  • Enterprise risk integration
  • External assessor reports

Governance

  • Committee charter
  • Board and committee briefing records
  • Management roles and expertise

Third parties

  • Service provider risk assessments
  • Contract and monitoring records

Areas that often need attention

  • No defined process or owner for the materiality decision
  • Materiality decisions not dated, so the four-day clock cannot be shown
  • Immaterial incidents filed under Item 1.05 instead of considered for Item 8.01
  • Item 106 text that describes processes the company does not actually run
  • Board briefings too infrequent or undocumented
  • Third-party risk processes described but not evidenced
  • Incident information that does not reach the disclosure committee

How Netra helps

Where each part of the work lives in Netra

Netra keeps the risk, governance and incident records that SEC disclosures rely on in one traceable place.

Risk management processes that actually run

Task Engine

Requirements arrive as tasks with owners and due dates. Recurring tasks cover risk reviews, testing and board briefings, so the processes described in Item 106 have evidence behind them.

Cyber risk register

Risk Manager

A risk register with inherent and residual heatmaps. Risks come down as the linked tasks are completed.

Board and committee reporting

Dashboard & Reports

A live Posture Score and a one-click board report built from live data.

Programme status across frameworks

Compliance Centre

Status is derived from completed tasks and evidence, never typed in, for the framework the programme is built on.

Third-party service provider risk

Third-Party Risk

Find vendors from what Accounts and Purchase pay, assess them through a vendor portal and record each decision with a rating.

Internal reviews and findings

Audit Centre

Run internal audits end to end, with findings and corrective actions, and evidence in a tamper-evident vault.

Policies behind the disclosure

Policy Hub

A policy library generated at onboarding, with a policy score that rises as the work behind each policy is done.

Netra organises work, evidence and reviews. It does not decide materiality, draft or file SEC disclosures, or act as an EDGAR filing service, and it is not a legal adviser. Materiality judgements and filings remain with the company’s authorised decision-makers and counsel.

Common questions

More questions about Netra

Related frameworks

View all frameworks
Security

NIST CSF 2.0

Connect cyber governance with day-to-day action

Security

ISO 27001:2022 (Security Controls)

Make security controls visible through completed work

Financial services

FTC Safeguard Rule

Keep your information-security programme accountable

See SEC in Netra

See how Netra connects your framework requirements with tasks, evidence and audit follow-up.