Cyber Incident Disclosure: The Item 1.05 8-K Clock

Cyber incident disclosure under the SEC's Item 1.05 of Form 8-K means a public company must report a material cybersecurity incident within four business days of determining that the incident is material. The clock starts at the materiality decision, not at discovery, but the SEC requires that decision to be made without unreasonable delay. Compliance began on December 18, 2023 for larger companies.

What does Item 1.05 of Form 8-K require?

Item 1.05 of Form 8-K requires a company to disclose a material cybersecurity incident, including the material aspects of its nature, scope, and timing as well as its material impact, within four business days of the materiality determination. The Securities and Exchange Commission adopted the rule on July 26, 2023, according to law firm summaries from Hunton Andrews Kurth and Perkins Coie.

Larger reporting companies had to comply starting December 18, 2023, while smaller reporting companies received an extension until June 15, 2024, according to Perkins Coie. Updates on any incident disclosed in an initial Form 8-K must appear in a subsequent amendment to that filing.

The incident disclosure rule differs from annual reporting mandates. Item 1C of Form 10-K, added in the same rulemaking, covers a company's cybersecurity risk management, strategy, and board oversight on an annual basis, as explained by sec-api.io. In contrast, Item 1.05 serves as a one-time report of a specific material incident.

The final rule also narrowed the required disclosures. A legal memorandum from Cahill notes that the SEC streamlined Item 1.05 to focus on the operational and financial impacts of an incident, rather than technical details. Hunton Andrews Kurth adds that the SEC dropped proposed requirements to disclose remediation status, whether an incident is ongoing, and whether specific data were compromised.

When does the four-business-day clock start?

The four-business-day clock starts on the date the company determines that an incident is material, rather than the date of discovery. An analysis from Hunton Andrews Kurth highlights the SEC instruction that a materiality determination must occur without unreasonable delay after discovery.

The SEC identified specific actions that constitute unreasonable delay. Examples include delaying board meetings needed for the determination or revising internal policies to postpone severity assessments and management reports, according to Hunton Andrews Kurth. The SEC also clarified that investigating the full technical extent of an intrusion is not a valid reason to delay when known facts already establish materiality.

The standard of materiality follows established securities law. Hunton Andrews Kurth notes that the SEC evaluates whether a substantial likelihood exists that a reasonable investor would consider the information important. Furthermore, sharing technical data with peers or government agencies does not constitute a determination of materiality under the rule.

What did MGM and Caesars file in 2023?

MGM Resorts International and Caesars Entertainment each filed a Form 8-K after cyberattacks in September 2023, demonstrating two distinct disclosure approaches prior to Item 1.05 taking effect. A Mondaq analysis described the MGM filing as brief, relying on an attached press release, whereas Caesars filed approximately seven days after discovery with specific detail regarding compromised data.

Caesars disclosed that unauthorized actors acquired sensitive customer records, including driver's license numbers and Social Security numbers, according to the Mondaq review. Mondaq also reported that Caesars paid a $15 million ransom demand, while Business Insider estimated that MGM experienced losses exceeding $80 million.

The contrast illustrates the operational pressure of communicating during an active investigation. The Mondaq analysis observed that tracking whether MGM amended its disclosure as facts surfaced would mirror the process Item 1.05 now formally mandates.

The practical takeaway for disclosure teams involves sequencing rather than rhetoric. A company with limited confirmed facts on day four can state those limitations plainly and commit to an amended filing, avoiding the risk of unexcused delay. Because both filings occurred in 2023 before Item 1.05 took effect, neither serves as a formal test of the current rule.

What does an amendment history look like?

An amendment history shows how an incident disclosure evolves through successive Form 8-K/A filings as an investigation develops. Documentation from sec-api.io indicates that an initial Item 1.05 Form 8-K filed by River Financial Corp on June 25, 2026, was followed by three separate Form 8-K/A amendments over the subsequent five weeks.

This sequential record provides a baseline for communications planning. An initial filing establishes the baseline disclosure, which disclosure teams then update as forensic investigators verify new findings. Regulators and investors review each amendment against the statements made in the original filing.

SEC filings often reflect separate dates for incident discovery, materiality determination, and regulatory submission, according to sec-api.io. Maintaining a contemporaneous internal record of all three dates protects the organization against claims of unreasonable delay.

How should a communications team prepare for a cyber incident?

A communications team should prepare for a cyber incident by formalizing decision-making protocols, cross-functional drafting procedures, and external message controls ahead of an event. The operational practices below reflect analysis of regulatory guidance and public filings rather than formal legal advice.

• Assign a dedicated disclosure committee with recurring meeting windows so scheduling logistics never cause a reporting delay.

• Maintain an audit-ready log tracking the exact dates of incident discovery, management escalation, and the materiality determination.

• Draft an Item 1.05 filing shell containing sections for incident nature, scope, timing, and material impacts, alongside procedures for Form 8-K/A updates.

• Designate a single corporate spokesperson and holding statement, restricting executive commentary to analysts until regulatory filings are complete.

• Coordinate external statements so customer alerts, employee communications, and regulatory disclosures align across every channel.

Public communications during an active incident remain subject to selective disclosure restrictions, as detailed in the Regulation FD guide for investor relations. The procedural workflow closely parallels the administrative steps described in the guide to earnings release Form 8-K filings.

What does a first week look like for a small company?

A small company's initial week under Item 1.05 requires coordinated timing between internal forensic assessments and required disclosure filings. In a standard timeline, an IT security team detects unauthorized data access on Monday, prompting the disclosure committee to convene on Tuesday. If the committee determines on Wednesday that the incident is material, the four-business-day filing deadline falls on the following Tuesday.

The organization can submit its Form 8-K by Friday, pairing the regulatory filing with a simultaneous customer advisory, while scheduling an amended filing two weeks later. A documented timeline proving the committee convened within 24 hours of escalation provides objective evidence that the decision occurred without unreasonable delay.

Small-cap issuers managing lean internal staff can review strategies in the guide to small-cap investor relations programs, while the investor relations services overview outlines specialized advisory options.

Frequently asked questions

What is Item 1.05 of Form 8-K?

Item 1.05 of Form 8-K is the regulatory disclosure item requiring public companies to report material cybersecurity incidents within four business days of a materiality determination.

Does the four-day clock start at discovery?

The four-business-day clock starts on the date the company determines an incident is material, not on the date the incident is discovered. The SEC requires that companies reach this determination without unreasonable delay, according to law firm summaries of the rule.

What must the Form 8-K include?

The Form 8-K must describe the material aspects of the incident's nature, scope, and timing, along with its actual or reasonably likely material impact on the company.

Do smaller companies have different deadlines?

Smaller reporting companies were granted a 180-day implementation delay until June 15, 2024, but remain subject to the standard four-business-day filing rule once compliance begins.

What happens if a company files late?

An untimely Item 1.05 Form 8-K filing does not cause a company to lose its Form S-3 eligibility, according to Hunton Andrews Kurth. Late filings may still invite regulatory scrutiny, making timely legal review essential.