SEC CYBER 8-K DISCLOSURE GUIDES
SEC cyber 8-K disclosures, by sector
Every material cybersecurity incident at a US public company is disclosed on Form 8-K, usually under Item 1.05, filed to SEC EDGAR within 4 business days of determining a cybersecurity incident is material. What that means in practice differs by sector, because each carries its own overlapping notification rules. These guides break it down.
- TECHNOLOGY
Software, cloud, and hardware companies whose incidents often cascade downstream to the customers and vendors that depend on them.
Technology disclosure rules → - FINANCIAL SERVICES
Banks, broker-dealers, insurers, and fintechs sitting under the densest cyber-notification regime of any sector.
Financial Services disclosure rules → - HEALTHCARE
Providers, payers, and health-tech companies where a cyber incident is usually also a regulated health-data breach.
Healthcare disclosure rules → - RETAIL & CONSUMER
Retailers and consumer brands where payment-card and loyalty data exposure drives contractual and state obligations.
Retail & Consumer disclosure rules → - INDUSTRIAL & ENERGY
Manufacturers, utilities, and energy operators where cyber incidents intersect with critical-infrastructure rules.
Industrial & Energy disclosure rules →
SEC cyber disclosure FAQ
- What is an SEC Item 1.05 cybersecurity 8-K?
- The SEC adopted its cybersecurity disclosure rules in 2023. Item 1.05 of Form 8-K requires a public company to disclose a material cybersecurity incident within 4 business days of determining a cybersecurity incident is material. Companies sometimes file non-material or precautionary cyber disclosures under Item 8.01 instead of Item 1.05.
- What is the difference between Item 1.05 and Item 8.01?
- Item 1.05 is the mandatory disclosure for a cybersecurity incident the company has determined is material. Item 8.01 is a catch-all companies sometimes use to voluntarily disclose an incident that is precautionary or not yet determined material.
- Where are cyber 8-K filings published?
- Every Form 8-K is filed to SEC EDGAR and is public. You can search EDGAR full-text yourself, or subscribe to same-day alerts filtered by sector and ticker.