BADAI.RED

SEC Form 8-K Item 1.05: the four-business-day clock

The clock starts at the materiality determination, not at discovery — which makes the speed and documentation of that determination the thing your incident process has to optimize.

BadAI ResearchPublished 3 min read

#What the rule requires

ElementRequirement
TriggerA cybersecurity incident the registrant determines to be material
DeadlineForm 8-K within four business days of the materiality determination [1]
ContentMaterial aspects of the nature, scope and timing of the incident, and its material or reasonably likely material impact
DeterminationMust be made without unreasonable delay after discovery
DelayPermitted where the U.S. Attorney General determines disclosure poses a substantial risk to national security or public safety
EffectiveCompliance began December 18, 2023 for most registrants [1]

#The materiality question

Materiality is a legal judgment based on the total mix of information a reasonable investor would consider, and it includes qualitative factors — reputational harm, customer and vendor relationships, litigation and regulatory risk — not just immediate financial impact. Security teams don't make the determination, but they supply most of its inputs: what data was affected, which systems, how long the attacker had access, whether operations were disrupted, whether the incident is contained. The faster and more defensible those facts are, the faster the determination can be made "without unreasonable delay".

Annual disclosure also applies: Regulation S-K Item 106 requires registrants to describe their processes for assessing and managing cybersecurity risk and the board's oversight of it in the annual report.

#What incident response must produce

  1. A timestamped record of discovery and of every input to the materiality assessment.
  2. A named decision-maker and a documented materiality determination time — that is T+0 for the four days.
  3. A draft 8-K maintained during the incident, updated as scope becomes clear.
  4. A disclosure committee path that can convene within a day.

Nightwatch maintains the incident timeline and drafts the disclosure narrative from evidence as the investigation runs, so counsel reviews rather than reconstructs.

#Sources

  1. [1] Troutman Pepper, “SEC Adopts Final Cybersecurity Rules,” July 31, 2023
  2. [2] KPMG, “SEC finalizes cybersecurity rules”

Talk to an operator.

Thirty minutes, no slides. We'll show you what bad AI finds in one of your systems.

Book a briefing