A breach is now a
four-day disclosure event.

Almost, but the clock is widely misunderstood. Item 1.05 requires filing within four business days — but those days run from when you determine the incident is material, not from when you discover it. The catch: that determination must be made without unreasonable delay, so you can't postpone the clock by never making the call.

The real work happens before the four days start: a defined, documented process to assess materiality quickly and defensibly. The disclosure must describe the incident's material nature, scope, timing, and impact. A narrow national-security delay exists only if the U.S. Attorney General notifies the SEC in writing. For most companies, the path to compliance is a tested process in place long before an incident.

Materiality uses the same standard as any securities disclosure: information is material if there's a substantial likelihood a reasonable investor would consider it important, or that it would significantly alter the total mix of information. The SEC deliberately did not create a cyber-specific test, so you weigh a broad spectrum of quantitative and qualitative factors — financial impact, operational disruption, reputational harm, legal and regulatory consequences, customer impact.

Importantly, an incident isn't immaterial just because you paid a ransom, recovered quickly, or were insured. Because the judgment is fact-specific and made under pressure, the defensible approach is a documented materiality framework applied consistently, with the analysis preserved as evidence — exactly what regulators and your board will want to see afterward.

Item 1.05 is reserved for incidents you've determined to be material — it's by definition a material-incident disclosure. SEC staff guidance has clarified that companies shouldn't use 1.05 for immaterial incidents or ones where materiality hasn't been determined, because that confuses investors. For those, the SEC encourages voluntary disclosure under Item 8.01 instead.

The sequence matters: if you disclose under 8.01 before a materiality call and later determine it was material, you must then file a 1.05 within four business days of that determination, referencing the earlier filing. Choosing the wrong item, or hedging materiality in a misleading way, is exactly the kind of problem that has drawn SEC enforcement. We build the triage logic so the right item, with the right content, is filed the first time.

The 8-K is only half the rule. The annual Form 10-K (Regulation S-K Item 106) requires describing your cybersecurity risk management and strategy — how you assess, identify, and manage material cyber risks — and your governance, including the board's oversight and management's role. This is a year-round obligation that effectively requires a real program you can describe accurately, because the description is itself a disclosure that must not mislead.

There's also an amendment duty: if required information wasn't available at the original filing, you say so and file an amendment within four business days of obtaining it. Foreign private issuers make comparable disclosures on Forms 6-K and 20-F. In short, the rule rewards companies running a genuine, documented program and penalizes those whose disclosures outrun their reality.