SEC Cyber Disclosure Rules
In force United States (Federal) · In force Sep 5, 2023 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Public companies must disclose a material cybersecurity incident on Form 8-K Item 1.05 within four business days of determining it is material (foreign private issuers use Form 6-K), and describe cybersecurity risk management, strategy and governance annually in Form 10-K (Item 106) or Form 20-F (Item 16K).
- Who it applies to
- SEC registrants filing Exchange Act reports, including smaller reporting companies and foreign private issuers. Disclosure delay is available only if the U.S. Attorney General determines immediate disclosure poses a substantial risk to national security or public safety.
- Penalties
- No fixed fine schedule; violations enforced under the federal securities laws (civil penalties, disgorgement, injunctions, officer and director bars).
- Enforced by
- U.S. Securities and Exchange Commission
- Official name
- SEC Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure (Release No. 33-11216)
- Citation
- Release No. 33-11216; 88 FR 51896 (Aug. 4, 2023); Form 8-K Item 1.05; Regulation S-K Item 106
- Topics
- cybersecurity, breach-notification, financial
Research notes
Industry petitions (e.g. April 2026 comment letters) ask the SEC to rescind Item 1.05; no proposed rescission had appeared in the Federal Register as of 2026-09-22. In June 2025 the SEC withdrew its separate 2022/2023 cybersecurity risk management proposals for investment advisers/funds and for broker-dealers and other market entities.
Related
CIRCIAQuestions about SEC Cyber Disclosure Rules
- What are the SEC Cyber Disclosure Rules compliance deadlines?
- Dec 15, 2023: Annual cybersecurity disclosures begin (Item 106 / 16K). Dec 18, 2023: Form 8-K Item 1.05 incident disclosure begins. Jun 15, 2024: Smaller reporting companies: Item 1.05 compliance. Dec 15, 2024: Inline XBRL tagging of annual cybersecurity disclosures. Dec 18, 2024: Inline XBRL tagging of Item 1.05 disclosures.
- When does SEC Cyber Disclosure Rules take effect?
- SEC Cyber Disclosure Rules took effect on Sep 5, 2023.
- Who does SEC Cyber Disclosure Rules apply to?
- SEC registrants filing Exchange Act reports, including smaller reporting companies and foreign private issuers. Disclosure delay is available only if the U.S. Attorney General determines immediate disclosure poses a substantial risk to national security or public safety.
- What are the penalties under SEC Cyber Disclosure Rules?
- No fixed fine schedule; violations enforced under the federal securities laws (civil penalties, disgorgement, injunctions, officer and director bars).