The SEC’s cybersecurity disclosure rules have been in effect since December 2023. We now have over a year of real-world implementation experience, real 8-K filings from companies responding to material cybersecurity incidents, and a clearer picture of where organizations are falling short. The answer, in my observation, is consistently the same place: they are treating this as a legal and communications problem when it is fundamentally a security operations and governance problem.

I want to be specific about what the rules actually require, where I see the gaps in how organizations have responded, and what a genuinely compliant programme looks like in practice. Not in theory – in the reality of how incidents unfold and how disclosure decisions get made under pressure.

What the Rules Actually Require

The SEC’s final cybersecurity risk management, strategy, governance, and incident disclosure rules have two principal components. The first is Item 1.05 of Form 8-K, which requires public companies to disclose any cybersecurity incident that is determined to be material within four business days of making that determination. The second is Item 106 of Regulation S-K, which requires annual disclosure in the 10-K of the company’s processes for assessing, identifying, and managing material cybersecurity risks, and of the board’s oversight of those risks.

The four-day clock starts not when the incident occurs, but when the company determines that the incident is material. This distinction is significant and it is consistently misunderstood.

Materiality in the SEC context follows the longstanding Supreme Court standard from Basic Inc. v. Levinson – information is material if there is a substantial likelihood that a reasonable investor would consider it important in making an investment decision. Applied to cybersecurity incidents, this requires a forward-looking assessment: will this incident, in its anticipated scope and impact, affect the company’s operations, financial results, reputation, or customer relationships in a way that a reasonable investor would consider significant?

This is a legal and business judgment, not a technical security determination. And it has to be made in real time, under uncertainty, while the incident is still being investigated.

Where Organizations Are Getting It Wrong

The first mistake I see is treating materiality determination as something that happens at the end of incident response rather than during it. By the time most organizations are thinking about materiality, they are deep in containment and remediation. The disclosure decision becomes an afterthought. That is backwards. Materiality assessment needs to begin as soon as an incident is identified as potentially significant, and it needs to run in parallel with the technical response – not sequentially.

The second mistake is not having a defined materiality framework before an incident occurs. The materiality determination under the SEC rules is not formulaic, but it is not entirely subjective either. Organizations should define in advance the factors they will assess – estimated financial impact, operational disruption, customer data exposure, regulatory notification triggers, potential litigation exposure – and the thresholds that would indicate materiality. That framework should be reviewed and tested through tabletop exercises. Discovering that you do not have a materiality determination process while managing a live incident is a serious problem.

The third mistake is underestimating the speed requirement. Four business days from determination sounds like enough time. It is not, if the determination is made late in the incident lifecycle, if the legal and communications approval process is slow, or if the 8-K drafting has to happen from scratch. Organizations need pre-drafted 8-K templates, pre-approved disclosure language for common incident categories, and a disclosure approval process that can move within hours if necessary.

The fourth mistake is the board expertise disclosure in the 10-K. The rules require companies to describe the board’s oversight of cybersecurity risks and whether any board members have cybersecurity expertise. Many companies have responded to this with generic language about the board receiving periodic briefings. The SEC has issued comment letters to companies whose disclosures it viewed as boilerplate. Specific, concrete disclosure of how the board actually engages with cybersecurity risk – which committee has oversight, how frequently the CISO reports, what information the board receives – is what the rules contemplate.

What a Genuinely Compliant Programme Looks Like

Genuine compliance with the SEC cybersecurity disclosure rules requires changes to how security operations, legal, finance, communications, and board governance interact – not just a new disclosure policy.

On the materiality determination side, the programme should include a written materiality assessment framework with defined criteria and thresholds. It should include a cross-functional disclosure committee – typically CISO, General Counsel, CFO, and Chief Communications Officer – with a defined convening trigger and decision-making process. It should include tabletop exercises that specifically practice materiality determination under realistic incident scenarios. And it should include integration between the incident response process and the disclosure process so that the disclosure question is being actively considered from the moment an incident is identified as potentially significant.

On the four-day clock side, the programme should include pre-drafted 8-K disclosure templates for the most likely incident categories – ransomware, data exfiltration, third-party vendor breach, unauthorized access. It should include a streamlined legal and board notification process that can be executed in hours. And it should include a clear protocol for requesting a disclosure delay from the Department of Justice on national security grounds, which the rules permit in limited circumstances.

On the board governance side, the programme should ensure that at least one board member or committee has specific cybersecurity expertise and is designated as such in the 10-K disclosure. It should ensure that the board receives regular, substantive cybersecurity reporting – not just incident summaries but programme metrics, risk posture assessments, and strategic updates. And the 10-K disclosure should describe these governance arrangements with specificity, not with boilerplate.

The CISO Liability Question

The SEC brought enforcement action against the former CISO of SolarWinds Corporation in 2023, alleging that he misled investors about the company’s cybersecurity practices. The action was partially dismissed in 2024 but put individual CISO liability firmly on the agenda for security leaders.

The practical implication for CISOs is not paranoia, but it is heightened attention to accuracy and documentation. What is disclosed to investors about the organization’s security posture needs to be accurate. What is represented to auditors about security controls needs to be accurate. And the CISO’s role in the disclosure process – and the limits of that role – needs to be clearly defined and documented.

CISOs who want to protect themselves should ensure that their security programme assessments are honest and documented, that they communicate risks clearly and in writing to executive leadership and the board, and that they are not the sole author of investor-facing cybersecurity disclosures without review by Legal and the CFO. The disclosure process should have multiple checkpoints, not a single sign-off.

The SEC disclosure rules changed the stakes of cybersecurity governance. Security leaders who understand that change – and who have built their programmes to meet it – will be better positioned as a result.

References

1. Securities and Exchange Commission. (2023). Cybersecurity risk management, strategy, governance, and incident disclosure: Final rule. 17 CFR Parts 229, 232, 239, 240, and 249. https://www.sec.gov/rules/final/2023/33-11216.pdf
2. Basic Inc. v. Levinson, 485 U.S. 224 (1988). Supreme Court of the United States.
3. Securities and Exchange Commission. (2023). SEC charges SolarWinds and its chief information security officer with fraud and internal controls violations (Press Release No. 2023-227). https://www.sec.gov/news/press-release/2023-227
4. United States District Court, Southern District of New York. (2024). SEC v. SolarWinds Corp. and Timothy G. Brown, No. 23-cv-9518. Opinion and Order on Motion to Dismiss.
5. Securities and Exchange Commission. (2024). Sample letter to companies regarding cybersecurity disclosures. https://www.sec.gov/divisions/corpfin/guidance/cfguidance-topic2.htm
6. National Institute of Standards and Technology. (2012). Computer security incident handling guide (SP 800-61 Rev. 2). https://doi.org/10.6028/NIST.SP.800-61r2
7. Kaminsky, A. L. (2024). Material cybersecurity incidents under the SEC’s new disclosure rules: Practical guidance for in-house counsel. Business Lawyer, 79(2), 445–478.
8. (2024). SEC cybersecurity disclosure rules: One year in review. PwC Insights. https://www.pwc.com/us/en/services/consulting/cybersecurity-risk-regulatory.html