SEC cyber disclosure: material incidents on Form 8-K in 4 business days
Since 18 December 2023 companies listed in the US must disclose a material cybersecurity incident on Form 8-K Item 1.05 within four business days of deciding it is material. Annual reports on Form 10-K and 20-F must describe cyber risk management, strategy and board oversight for fiscal years ending on or after 15 December 2023. Foreign private issuers report on Form 6-K. Smaller reporting companies got 180 extra days for the 8-K duty. The rule is still operative in 2026.
Ticks are kept in this browser only. Sign in to the client portal to share them with your team.