What New SEC Cyber Disclosure Rules Mean for Smaller Public Companies

The SEC's cybersecurity disclosure rules have been on the books long enough that they should feel routine. For a lot of smaller public companies, they still don't. The reason is rarely indifference. It's that the rules ask for something small teams find genuinely awkward: a documented judgment call, made under time pressure, by people who also have a day job running the business.

The good news is that the obligations are narrower than the fear around them. The bad news is that the deadline is triggered by your own conclusion, not by the attacker.

What the rules actually require

Two pieces of the framework matter most for a company without a large legal department.

The first is Item 1.05 of Form 8-K. When you determine that a cybersecurity incident is material, you generally have four business days to file a report describing the material aspects of the incident's nature, scope and timing, and the material impact — or reasonably likely material impact — on your financial condition or results of operations. The filing is filed, not furnished, which means it carries the usual securities-law liability exposure.

There is a national-security and public-safety delay mechanism, but it depends on a determination by the U.S. Attorney General, not on your own discomfort. Treat it as an exception, not a plan.

The second piece is Item 106 of Regulation S-K, which sits in your annual report on Form 10-K. It asks for two things:

• Risk management and strategy: the processes you use to assess, identify and manage material risks from cybersecurity threats, and whether those processes are integrated into your overall risk management.
• Governance: how the board oversees cyber risk, and management's role in assessing and managing it.

Smaller reporting companies were given extra time to comply with the risk-management and governance portions — roughly six months beyond larger filers — and that runway has now closed for essentially everyone with a fiscal year in progress. If your most recent 10-K described oversight in vague terms, the next one is a good place to fix that.

The clock starts with a judgment, not a breach

This is the detail that trips up lean teams. The four-day window does not begin when the intrusion is discovered. It begins when the company determines the incident is material — a facts-and-circumstances call under the ordinary securities-law materiality standard, with no bright-line dollar threshold and no list of approved scenarios.

The practical consequence is uncomfortable: a company that never formally makes the determination also never starts the clock, and has no record of why. That is a harder position to defend than a documented decision that turns out to be wrong. Regulators and plaintiffs both look for evidence that someone actually weighed the question.

Three things make the judgment harder than it sounds. Effects can be qualitative, not just financial — customer loss, contractual penalties, regulatory exposure, reputational damage. Incidents at vendors and service providers count if they materially affect you. And a pure availability event with no data theft can still be material if it halts revenue-generating operations for long enough.

Six steps you can take without a security legal team

1. Name the decision group and write down the trigger. Three to five people: a senior executive, someone from finance, someone from legal or outside counsel, and whoever leads security or IT. Decide in advance who can convene the group and what facts they need before deciding.
2. Pre-draft both documents. A filing skeleton with bracketed placeholders, and a two-page materiality memo template that records what you knew and when, who was consulted, what was considered, and the conclusion. In a real incident, that memo is worth more than eloquence.
3. Give first responders a one-page script. The person who notices the problem is often an engineer, a help-desk technician or a vendor. They need to know who to call, what evidence to preserve, and what should stay out of casual email threads.
4. Line up outside help before you need it. Know your forensic firm, your outside counsel, and who handles conflicts and engagement letters. Setting that up during an incident burns days you don't have.
5. Reconcile every channel. Customer notices, breach notification letters, state attorney general filings, insurer reports and public statements should tell one consistent story. Contradictions between your 8-K and a customer email are where real trouble starts.
6. Rehearse against the clock. Run a tabletop that begins on a Monday morning and forces a materiality answer by Thursday. Most teams discover during the exercise that nobody is quite sure who is allowed to make the call.

Where smaller companies usually slip

• Governance language that describes an aspiration. If the 10-K says the board reviews cyber risk quarterly and it doesn't, that gap is worse than a modest but accurate description.
• Assuming a short outage is automatically immaterial. Availability, data integrity and customer-contract effects can each be material on their own.
• Copying peer risk factors. Generic language raises questions rather than answering them; specifics about your own systems and dependencies read as credible.
• Ignoring the trading question. Consider whether you need policies that keep insiders from trading in the window between discovering an incident and disclosing it.
• Letting the vendor contract set the tempo. Many master service agreements allow several days for notification. Your disclosure obligations don't follow that schedule, so tighten the clause when you next renew.
• Treating cyber as purely technical. If incident information never reaches the people who sign your certifications, that is a disclosure-controls problem, not a communications one.

What to do next week

Pick one owner — often the CFO or general counsel, even part-time — and book ninety minutes with finance, IT, legal and whoever handles communications. The goal is three artifacts, not a program: a one-page escalation sheet, a materiality memo template, and a governance paragraph that reflects what you genuinely do today, not what you'd like to do in two years.

Then run one exercise a year, and update the filing skeleton whenever your business changes materially — a new acquisition, a new cloud dependency, a new regulated product line. The companies that handle this well aren't the ones with the biggest security budgets. They're the ones that decided in advance who would make the call, and wrote down the answer while it was still calm.

This is general information about disclosure practice, not legal advice. Confirm your specific obligations with qualified securities counsel.

Photo: Pexels / Pixabay