SEC Cybersecurity

No changes recorded yet — we are watching, and nothing has been published.

1. 2024-12-18 Inline XBRL tagging of Item 1.05 Form 8-K and Form 6-K cybersecurity disclosures begins
2. 2024-12-15 Inline XBRL tagging of Item 106 and Form 20-F Item 16K disclosures begins with annual reports for fiscal years ending on or after this date
3. 2024-06-15 Smaller reporting companies must begin complying with Form 8-K Item 1.05
4. 2023-12-18 Registrants other than smaller reporting companies must begin complying with Form 8-K Item 1.05

1. 2023-08-04
   Release No. 33-11216 (July 2023) Major versionCurrent

   Final rules requiring disclosure of material cybersecurity incidents and annual disclosure of cybersecurity risk management, strategy and governance; effective 5 September 2023. source

   More

   • An Item 1.05 Form 8-K is due within four business days of determining an incident is material.
   • Filing may be delayed if the US Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety.
   • Disclosures must be tagged in Inline XBRL.
2. 2022-03-23
   Proposed rule (March 2022) Draft

   The SEC proposed the cybersecurity risk management and incident disclosure rules. source

The rules apply to public companies that report under the Securities Exchange Act of 1934.

Registrants

Public companies subject to Exchange Act reporting must disclose material cybersecurity incidents and describe their cybersecurity risk management, strategy and governance. source

Annual disclosure

Item 106 requires a description of processes for assessing, identifying and managing material cybersecurity risks, the board's oversight and management's role. source

Third parties

The description should address, among other things, whether the company engages assessors, consultants or auditors and how it oversees risks from third-party service providers. source

Foreign private issuers

Foreign private issuers disclose through Form 20-F Item 16K and Form 6-K. source

Compliance is shown through the company's own filings: an annual report disclosure and an 8-K when an incident is material.

Annual report

Item 106 disclosure appears in annual reports for fiscal years ending on or after 15 December 2023. source

Incident filing

A Form 8-K under Item 1.05 is filed within four business days of determining that an incident is material, describing its nature, scope, timing and impact. source

Amendments

Information not determined or unavailable at the time must be added later by amending the Item 1.05 Form 8-K. source

The SEC enforces disclosure duties under the federal securities laws.

Misleading disclosures

In October 2024 the SEC charged four companies with misleading cyber disclosures under provisions of the Securities Act of 1933 and the Securities Exchange Act of 1934. source

Recent fines

1. 2024-10-22 $4,000,000

   Unisys Corp. – misleading cybersecurity disclosures and disclosure controls violations source

2. 2024-10-22 $1,000,000

   Avaya Holdings Corp. – misleading cybersecurity disclosures source

3. 2024-10-22 $995,000

   Check Point Software Technologies Ltd – misleading cybersecurity disclosures source

4. 2024-10-22 $990,000

   Mimecast Limited – misleading cybersecurity disclosures source

1. Law text Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure (final rule, 88 FR 51896)
2. Law text 17 CFR 229.106 – Regulation S-K Item 106, Cybersecurity
3. Guidance SEC rule page, File No. S7-09-22

1. NYDFS Part 500

   NYDFS Part 500 requires New York-licensed financial firms to run a cybersecurity program and notify the regulator within 72 hours; the SEC rules require public disclosure to investors.

2. NIST CSF

   The NIST Cybersecurity Framework is guidance on managing cyber risk; the SEC rules require public companies to disclose their risk management, governance and material incidents.

3. FINRA Cybersecurity

   FINRA's expectations bind broker-dealers as regulated firms; the SEC disclosure rules govern what public companies tell investors about cybersecurity.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 10 September 2026. Subscribe to SEC Cybersecurity (RSS)