Different tests answer each question. Companies that blur them tend to file late, under-disclose, or reserve on instinct. In October 2024, the SEC charged four companies over misleading cyber disclosures, with penalties from $990,000 to $4 million.
This guide is for US public company boards, audit committees, CFOs, controllers, general counsel, CISOs, and risk leaders. It is educational, not legal or accounting advice. Your counsel and auditors own those conclusions.
Key Takeaways
- SEC materiality and ASC 450 use different tests. Document each separately.
- Conclusions change as facts, claims, estimates, and insurance positions develop.
- Keep one decision record: facts, owners, dates, estimates, and reassessment triggers.
- Boards need clear decision rights and fast escalation that survive a real incident.
SEC Cybersecurity Disclosure Rules Public Companies Need to Understand
The current framework
The SEC adopted its final cybersecurity rule on July 26, 2023, effective September 5, 2023. It added two pieces:
- Form 8-K Item 1.05: current reporting of material cybersecurity incidents.
- Regulation S-K Item 106: annual disclosure of risk management, strategy, and governance, reported in Form 10-K Item 1C (Form 20-F Item 16K for foreign private issuers).
Incident reporting began December 18, 2023 for most registrants and June 15, 2024 for smaller reporting companies. Foreign private issuers report material incidents on Form 6-K. Form 40-F was not amended.
One current development: a May 2025 rulemaking petition asked the SEC to rescind Item 1.05. It is a petition, not an adopted amendment. Item 1.05 remains in the SEC's Form 8-K, but confirm status with counsel before relying on it.
The older 2011 Corporation Finance guidance still helps on one point: cyber risks can trigger existing disclosure and accounting obligations. The 2018 Commission guidance on controls and insider trading also remains relevant for topics outside the new rules. Neither substitutes for Item 1.05 or Item 106.
Materiality and the filing clock
Materiality follows the long-standing "total mix" standard from TSC Industries and Basic v. Levinson: would a reasonable investor consider the information important? Financial effects count. So do qualitative ones:
- Operational disruption
- Reputation and customer or supplier relationships
- Legal exposure
- Competitive position
The 8-K is due four business days after the company determines the incident is material. That determination must be made without unreasonable delay after discovery. An ongoing investigation does not justify waiting.
Delay is possible only if the US Attorney General determines disclosure poses a substantial national security or public safety risk. That allows up to 30 days, another 30, and in exceptional national security cases another 60. A request alone does not suspend the deadline.
If information was unavailable at filing, an 8-K/A is due within four business days after it is determined or becomes available.
What the disclosure should say
Item 1.05 calls for the material nature, scope, and timing of the incident, plus its material or reasonably likely material impact, including on financial condition and results. Technical detail that would impede response or remediation is not required.
Specific beats generic. The SEC's actions show where companies went wrong:
- Avaya described access as "limited" while omitting at least 145 accessed files.
- Check Point used generic risk language despite a known intrusion.
- Mimecast left out the nature of exfiltrated code.
State what is known, say what remains under investigation, and skip the exploitable roadmap.
ASC 450 Contingent Liabilities After a Cybersecurity Incident
The ASC 450-20 framework
ASC 450-20 sorts loss contingencies by likelihood. The codification uses words, not percentages:
| Category | Meaning | Treatment |
|---|---|---|
| Probable | Likely to occur | Accrue if reasonably estimable; disclose |
| Reasonably possible | More than remote, less than likely | Disclose nature and estimate or range; no accrual |
| Remote | Slight chance | Generally no disclosure |
Accrual requires that the liability was incurred at the financial statement date and the amount is reasonably estimable. A probable loss that cannot be estimated is not accrued, but material ones still require disclosure, including a statement that no estimate can be made.
Management should record the evidence behind each classification and revisit it as claims, regulator inquiries, customer demands, and cost estimates develop.
Which cyber costs fall under ASC 450
Likely loss contingencies include:
- Litigation and regulatory proceedings
- Contractual claims, warranties, and indemnification obligations
- Customer remediation, notification, and monitoring commitments
- Service credits and other third-party losses
Other costs sit under different guidance:
- ASC 350-40: internal-use software and security improvements
- ASC 360: long-lived asset impairment
- ASC 606: customer consideration, which generally reduces revenue
- ASC 855: subsequent events, recognized or not depending on when conditions existed
- Ordinary operating expenses for incident response
SEC staff guidance from 2011 specifically points to ASC 450-20 for asserted and unasserted cyber-related claims.
Estimating and updating
When a liability is probable, accrue management's best estimate. If a range exists and no amount is better, accrue the minimum, not automatically the midpoint. Disclose any reasonably possible exposure above the accrual.
Insurance and indemnities matter, but they do not erase the underlying loss. Assess the recovery separately, as probable and reasonably estimable. The liability and recovery asset are generally presented gross. A recovery above a recognized loss follows gain contingency rules and waits for realization.
How SEC Disclosure and ASC 450 Conclusions Interact
Two tests, overlapping facts
| Factor | SEC materiality | ASC 450 |
|---|---|---|
| Question | Would a reasonable investor find it important? | Is a loss probable and estimable? |
| Scope | Whole incident, including qualitative effects | Specific loss contingencies |
| Output | Form 8-K, annual disclosure | Accrual and footnote disclosure |
A company can owe an Item 1.05 filing with no ASC 450 accrual. Outages and reputational harm may be material to investors before any claim is probable. VF's January 2024 8-K/A, which reported data theft affecting approximately 35.5 million consumers, did not state an ASC 450 conclusion.
The reverse also happens. A probable, estimable loss from a customer claim may need recognition even if the broader incident never required an Item 1.05 filing.
Coordinating timelines
The typical sequence is:
- Incident facts and containment
- Materiality assessment
- Accounting analysis
- Financial close and auditor review
- Board or audit committee oversight
- SEC filing, then reassessment
Each function contributes something different:
- CISO: technical scope and data affected
- Counsel: legal and regulatory exposure
- Finance: cost estimates and accounting categories
- Operating leaders: business impact
- Board: oversight questions and challenge
A defensible decision record
Keep one centralized, privilege-aware record containing:
- Incident chronology and affected systems and data
- Business impact and claim and cost categories
- Probability assessments and estimate methodology
- Insurance and indemnification analysis
- Disclosure decisions and approval history
Document unresolved uncertainty as uncertainty. Incomplete information is not proof that no disclosure or accounting action is needed.
A hypothetical scenario
This example is illustrative only.
A company detects ransomware. Day 3: systems are down for two days and customers are affected. Finance and counsel assess whether the disruption is material.
If they conclude it is material, the 8-K clock starts. No claims exist yet, so there is no ASC 450 accrual, but disclosure of reasonably possible exposure is still considered.
Week 6: forensics confirm customer data was accessed. The company files an 8-K/A and begins customer remediation. Credits fall under revenue guidance; committed obligations are treated as loss contingencies.
Quarter-end: a customer sends a demand letter. Counsel rates a loss probable with a range. The company accrues the best estimate or the minimum and separately evaluates insurance.
Each new fact (forensic findings, claims, regulator contact) triggers updates to filings, footnotes, management reporting, and board materials.
Disclosure controls
If an incident affects systems that record, process, or report financial data, disclosure controls and procedures need evaluation. Rules 13a-15 and 15d-15 expect timely capture and escalation of cyber information to decision makers, and the SEC links this to CEO and CFO certifications.
In June 2024, RR Donnelley settled for $2.125 million over disclosure and internal accounting control failures, including inadequate escalation.
Practical safeguards:
- Protected logging and evidence preservation
- Alternate communication channels if email is compromised
- Approval workflows for filings
- Validation of financial and incident data before filing
A Practical Cyber Incident-to-Filing Workflow
Immediate triage and fact preservation
- Preserve logs and endpoint images before evidence is overwritten.
- Start a timestamped case timeline that records every material decision.
- Identify affected systems and data so you can scope impact quickly.
- Estimate operational disruption for materiality and disclosure timing.
- Track external notifications already made or still required.
- Assign accountable owners and declare a provisional severity for escalation.
Set escalation thresholds before an incident hits. Waiting for a final forensic conclusion or a complete damages estimate is how the disclosure clock gets missed.
Accounting, legal, and materiality assessment
The cross-functional team should:
- Map actual and potential losses to accounting categories
- Evaluate probability and estimability under ASC 450
- Assess SEC materiality separately
- Identify disclosure-control implications
- Record assumptions
Review insurance, vendor contracts, customer agreements, and regulatory obligations too. They inform the analysis but never replace it. Neither a ransom payment nor insurance coverage settles materiality.
Review, filing, and reassessment
Route conclusions through management, counsel, finance, external auditors, and the audit committee, with the full board as appropriate. Require signoffs and escalate unresolved judgments.
Reassess at each reporting date and whenever a trigger appears:
- New forensic findings
- Litigation or regulator contact
- Customer claims
- Revised loss estimates
- Changes in business impact
Board and Audit Committee Oversight for Cybersecurity Reporting
Roles and decision rights
Item 106(c) asks companies to describe board oversight and management's role. Divide responsibility clearly:
- Management and the CISO supply facts
- The CFO or controller and counsel make judgments
- The audit committee oversees
- Auditors review
- Investor relations aligns communications
A documented RACI should name who can declare an escalation, convene the disclosure team, approve an SEC filing, and update the board.
Reporting what changed
Boards need a stable dashboard in plain English:
- Trend
- Material open risks
- Incident status
- Potential financial exposure
- Decisions requested
- Remediation progress
Useful questions:
- What materiality assumptions are we making?
- How are ASC 450 classifications supported?
- What are the estimate ranges?
- What evidence backs management's conclusion?
Turning oversight into action
Tyson Martin works with boards as an advisor or interim CISO to set escalation thresholds, credible reporting, and time-bound remediation plans. His focus is clear oversight, defensible decisions, stable metrics, and faster escalation without slowing the business. Legal and accounting conclusions stay with counsel and finance.
Common Mistakes to Avoid
- Relying on generic risk language, the 2011 guidance, or a one-time annual assessment instead of current facts.
- Using a single factor as the test. Record count, ransom payment, or no confirmed exfiltration cannot decide materiality or ASC 450 treatment alone.
- Treating an 8-K as proof of an accrual, or an unrecorded liability as proof no disclosure is needed.
- Failing to reassess estimates as facts develop.
- Over-disclosing technical detail that creates a roadmap for attackers.
Frequently Asked Questions
Does every cybersecurity incident require an SEC filing?
No. Item 1.05 applies to incidents determined to be material. The occurrence alone does not trigger it.
What is ASC 450-20?
It is the US GAAP guidance for loss contingencies. It turns on whether a loss is probable, reasonably possible, or remote, and whether it can be reasonably estimated.
How does SEC materiality differ from ASC 450 probability?
Materiality asks whether information matters to investors. ASC 450 asks how likely a loss is and whether it can be estimated for recognition or disclosure.
When must a public company file Form 8-K for a cyber incident?
Within four business days of determining materiality, subject to limited delay provisions. Verify against current SEC rules.
When does a cyber incident become a contingent liability?
When potential claims or losses must be evaluated under ASC 450 based on likelihood and estimability, not simply because an event occurred.
What should the board do after an incident?
Oversee materiality, accounting judgments, disclosure controls, decision rights, and reassessment triggers, without performing management's technical or accounting work.
