SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure

Impact. This rule establishes mandatory cybersecurity incident reporting within four business days on Form 8-K and annual governance disclosures on Form 10-K, fundamentally changing how public companies handle cyber events. Your institution must now implement formal materiality assessment processes for all cybersecurity incidents and ensure board oversight structures meet new disclosure standards.

Risk. The four-day reporting window creates significant examination exposure around incident detection, materiality determination, and disclosure timing. Most institutions lack the rapid-response processes needed to assess materiality, draft disclosures, and coordinate legal review within this compressed timeframe, making late or inadequate filings the primary enforcement risk.

Recommended Action. Legal should immediately audit your current incident response playbook against the new disclosure requirements and establish clear materiality thresholds with defined escalation paths. Work with Cybersecurity to implement detection capabilities that trigger the four-day clock and create template disclosure language for common incident types.

Watch. Monitor SEC enforcement actions for early precedent on materiality standards and disclosure adequacy, particularly around timing calculations and the level of detail required for incident descriptions in Form 8-K filings.