Back your SEC Cyber Rule disclosures with real control evidence

The SEC Cybersecurity Disclosure Rule is a US Securities and Exchange Commission rule adopted on 26 July 2023. It requires public companies to report material cybersecurity incidents on Form 8-K Item 1.05 and to describe, every year under Regulation S-K Item 106, how they assess, identify and manage material cybersecurity risks and how their board and management oversee those risks.

All companies that file periodic reports with the SEC must comply, including smaller reporting companies. Domestic registrants disclose in Form 10-K and Form 8-K. Foreign private issuers make equivalent annual disclosures under Form 20-F Item 16K and furnish material incident information on Form 6-K. Private companies are not directly covered, but are often asked by listed customers to evidence their security.

A company must file Form 8-K Item 1.05 within four business days of determining that a cybersecurity incident is material, and it must make that materiality determination without unreasonable delay after discovery. Disclosure can be delayed only if the US Attorney General decides it would pose a substantial risk to national security or public safety and notifies the SEC in writing.

Item 106 requires a description of the company's processes for assessing, identifying and managing material cybersecurity risks, including whether they are integrated into overall risk management, whether third-party assessors are used and how third-party service provider risks are overseen. It also requires disclosure of board oversight and of management's role, expertise and reporting lines on cybersecurity.

Failure to comply can lead to SEC enforcement action under the federal securities laws, which can include civil penalties, cease-and-desist orders and charges against individuals. The rule itself does not set a fixed fine. Inaccurate or misleading cybersecurity disclosures can also expose a company to shareholder litigation, so disclosures should be supported by evidence of how controls actually operate.

The SEC Cyber Rule is a disclosure requirement and does not prescribe specific controls or a framework. Many companies use ISO 27001, SOC 2 or the NIST Cybersecurity Framework as the risk management programme they describe under Item 106. Evidence collected for those frameworks can support the accuracy of SEC disclosures about risk processes, third-party oversight and governance.

Yes, the rule remains in force as published. Industry groups led by SIFMA petitioned the SEC in 2025 to rescind Form 8-K Item 1.05, and later comment letters asked for Item 106 to be rescinded or narrowed. Companies should keep complying with the current requirements and watch the SEC's rulemaking agenda for any proposed changes.

Yes. The SEC Cyber Rule is supported in OneClickComply today. OneClickComply helps you run and evidence the risk management, vendor oversight and governance processes that Item 106 asks you to describe. It does not file disclosures or make materiality decisions, which remain with your company and its legal advisers.