Item 1.05 of Form 8-K requires a U.S. public company to disclose a cybersecurity incident within four business days after it determines the incident is material. The filing must describe the material aspects of the incident's nature, scope and timing, and its material or reasonably likely material impact on the company.
In July 2023 the SEC adopted rules that added a new item to Form 8-K: Item 1.05, Material Cybersecurity Incidents. Since the rule took effect, a ransomware attack or data breach at a listed U.S. company can surface on EDGAR within days of the company deciding the incident matters to investors. This guide explains what triggers the item, what it requires and how to read the filings.
When did Item 1.05 take effect?
The SEC adopted the final rule on July 26, 2023 (Release No. 33-11216). Item 1.05 disclosures became required beginning December 18, 2023 for most registrants, and June 15, 2024 for smaller reporting companies. The same release added Item 106 to Regulation S-K, which requires annual disclosure in the 10-K about cybersecurity risk management, strategy and governance.
What triggers an Item 1.05 filing?
The trigger has two steps:
- Determination of materiality. After discovering a cybersecurity incident, the company must determine whether it is material “without unreasonable delay”. Materiality follows the familiar securities-law standard: whether there is a substantial likelihood that a reasonable investor would consider it important, or whether it would significantly alter the total mix of information available.
- Four business days. The 8-K is due within four business days after the materiality determination, not after discovery of the incident.
The rule defines a cybersecurity incident broadly, including a series of related unauthorized occurrences. A company cannot avoid disclosure by treating a set of related small intrusions as separate events.
What must the filing say?
Item 1.05 requires the company to describe:
- the material aspects of the nature, scope and timing of the incident; and
- the material impact or reasonably likely material impact on the company, including its financial condition and results of operations.
The release makes clear that the company does not need to disclose specific technical information about its planned response, or about its systems, networks and potential vulnerabilities, in such detail as would impede its response or remediation.
If required information is not determined or is unavailable when the 8-K is due, the company must say so in the filing and then file an 8-K/A amendment within four business days after the information becomes available.
Can disclosure be delayed?
The only delay mechanism in the rule involves the U.S. Attorney General. If the Attorney General determines that disclosure would pose a substantial risk to national security or public safety and notifies the SEC in writing, the company may delay the filing for up to 30 days. The rule allows further extensions in specified circumstances. Ordinary concerns, such as an ongoing internal investigation or negotiations with an attacker, are not grounds for delay under the rule.
Item 1.05 or Item 8.01?
After the rule took effect, a number of companies filed under Item 1.05 to report incidents they had not yet determined to be material, or had determined were not material. In May 2024 the director of the SEC’s Division of Corporation Finance issued a statement saying that Item 1.05 is intended for incidents that are determined to be material, and that companies wishing to disclose other incidents voluntarily could use a different item, such as Item 8.01 (Other Events). If the company later determines such an incident is material, it would then file under Item 1.05.
For readers, this means the item number itself carries information:
| Item on the 8-K | What it usually signals |
|---|---|
| 1.05 | Company has determined the incident is material |
| 8.01 | Voluntary disclosure; materiality not determined or not material |
| 1.05 on an 8-K/A | Update to an earlier material-incident filing, often with impact details |
How do you read an Item 1.05 8-K?
- Check the dates. The narrative often gives the discovery date and the materiality-determination date. The gap between them is part of the story.
- Look for operational impact. Statements that systems were taken offline, that operations were disrupted or that data was taken are the substance.
- Look for what is unknown. Statements that the company has not yet determined the full scope point to a likely 8-K/A.
- Find the 10-Q follow-up. Later periodic reports often quantify costs, insurance recoveries and legal proceedings in the notes and risk factors.
- Read the annual Item 106 disclosure. The 10-K’s cybersecurity section describes how the company assesses and manages risk and how its board oversees it. It is a description of process, not a guarantee of security.
What the filings do not tell you
An Item 1.05 8-K is a disclosure of facts the company has determined to be material. It is not a forensic report, it does not prove the attack is contained, and absence of a filing does not prove no incident occurred. Read it as the company’s official, time-stamped account, and compare it with later filings.
On the Filings Docket, every 8-K from our 100 tracked companies is described by its item numbers in plain English, so an Item 1.05 filing reads as a material cybersecurity incident rather than a routine current report. The Form 8-K explainer lists every 8-K item with its plain-English meaning.
Questions readers ask
- When does the four-day clock for Item 1.05 start?
- When the company determines that the incident is material, not when the incident is discovered. The company must make that materiality determination without unreasonable delay after discovery.
- Can a company delay an Item 1.05 filing?
- Only if the U.S. Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the SEC in writing. The initial delay is up to 30 days and can be extended under the rule's conditions.
- Does every cyber incident get an 8-K?
- No. Item 1.05 is for incidents the company has determined to be material. Companies sometimes disclose other incidents voluntarily, and SEC staff have said Item 8.01 is the appropriate place for incidents not yet determined to be material.
Sources
- SEC, Final Rule: Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, Release No. 33-11216 (PDF)
- SEC press release 2023-139: SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure
- SEC, Form 8-K and General Instructions (PDF)
- SEC, Exchange Act Form 8-K Compliance and Disclosure Interpretations
Sources checked Oct. 15, 2026. Rules change; the linked SEC text is authoritative. This page is general information, not legal or investment advice.