This is a free browser tool on circuits.fit.
Record who decided an incident was material, and count four business days to the Item 1.05 date.
Since the SEC adopted its cybersecurity disclosure rules on July 26, 2023, a public company that determines a cybersecurity incident is material must file a Form 8-K under Item 1.05. The SEC’s release says the filing is generally due four business days after the company determines the incident is material, not four days after it is discovered. The release also allows a delay if the US Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the Commission in writing.
That design puts weight on one moment: the materiality determination. Auditors, regulators and plaintiffs will later ask who made it, when, on what evidence, and against which thresholds. Most companies keep that record in email threads and meeting notes. This page turns it into one dated record you can print, save as PDF and attach to the incident file.
Not legal, tax, insurance, or procurement advice. Inputs stay in your browser. Nothing is uploaded.
Top comments (0)