The SEC cybersecurity disclosure rules — adopted in July 2023 and phased in through late 2023 and 2024 — have now produced their first full disclosure cycle. The rules require both ongoing 10-K disclosure of cybersecurity risk management and governance and Item 1.05 8-K filings for material cybersecurity incidents.
The implementation has changed how companies actually operate around cyber disclosure in six specific ways. This is not a recap of the rule text. The rule text is widely covered. This is what has changed in the practice.
1. The 8-K trigger has reshaped incident-response coordination
The four-business-day disclosure window for material cybersecurity incidents has compressed the cyber-incident response coordination across legal, IT, communications, and IR in ways that matter operationally. The materiality determination — whether the incident requires Item 1.05 disclosure — now drives the incident-response timeline more than the technical remediation does.
The companies that have adapted well have built materiality assessment into the early-stage incident-response workflow rather than treating it as a back-end question. The companies that have struggled have made the materiality call too late and have ended up making 8-K decisions under time pressure that the early-stage prep should have removed.
2. Risk factor disclosure has become more specific
The 10-K cybersecurity risk factor sections in the most recent filing cycle have become substantively more specific than the prior generation of disclosure. The rule's requirements for disclosure of governance, risk management processes, and material risk factors have pushed companies away from boilerplate language and toward specific descriptions of the company's actual cyber posture.
The implications for IR communications are real. Buy-side analysts now have more substantive disclosure to engage with on cyber topics, and the IR team needs to be prepared to discuss cyber risk in the same way that the team discusses other material risk factors.
3. Board-level oversight disclosure is now substantive
The new rules require disclosure of board oversight of cybersecurity risk and management's role in assessing and managing the risk. The disclosure has moved from generic governance language to specific identification of which committees have oversight responsibility, what management roles are involved in cyber risk management, and how often the board engages with management on the topic.
The disclosure has implications for how the board operates. Boards that have not had substantive cyber oversight processes have had to build them quickly to support the disclosure. The disclosure is forward-looking by implication — the board cannot disclose oversight processes that do not actually exist.
4. The "material" threshold for incidents is being tested
The materiality determination for Item 1.05 incidents has been the most operationally challenging part of the rule for most issuers. The rule does not provide a quantitative threshold. The materiality determination uses the existing securities-law materiality framework, which requires judgment about whether a reasonable investor would consider the information important.
The first cycle has produced disclosure across a wider range of incident types than some practitioners expected. The Item 1.05 filings include incidents that involved data exfiltration, operational disruption, ransomware, and various unauthorized-access events. The materiality threshold appears, in practice, to be lower than some early commentary suggested it would be.
The implication for IR teams is that the materiality determination is an active judgment call that should be made with counsel involvement and that should not be decided based on assumptions about precedent that may not hold.
5. The "material aspects" disclosure is shaping investor-Q&A topics
The Item 1.05 filings require disclosure of "material aspects" of the incident's nature, scope, and timing, and disclosure of "material impact" or "reasonably likely material impact" on the registrant. The disclosure language is general enough to allow significant variation in practice, but the disclosure has become a regular topic in earnings calls and analyst engagement.
The IR teams at companies that have filed Item 1.05 disclosures have had to manage follow-on Q&A about the incident, the response, the financial impact, and the remediation status. The Q&A management requires close coordination with legal counsel because additional disclosure beyond the 8-K can create new disclosure obligations and potential liability.
6. The disclosure is becoming a peer-comparison data set
The first full cycle of the new disclosure has produced enough Item 1.05 filings and enough specific 10-K cyber risk factor language that the disclosure is becoming a peer-comparison data set. Investors and analysts are comparing how companies disclose, what they disclose, and what the disclosure implies about the underlying cyber posture.
The implication for the IR function is that cyber disclosure is now a competitive disclosure category in the way that ESG disclosure became one over the past several years. Companies whose disclosure is meaningfully thinner than peers will face questions about why. Companies whose disclosure is meaningfully more substantive may receive credit for governance maturity.
What the IR team should be doing
The IR function in the post-rule environment should be coordinated with legal, IT, and risk management on three workstreams.
The first workstream is incident-response readiness — explicit pre-designated decision-makers for materiality determination, pre-drafted disclosure templates, and pre-agreed coordination protocols across legal, IT, communications, and IR. The readiness work should be exercised through tabletop simulations on a regular cadence rather than treated as a checklist that gets reviewed once.
The second workstream is disclosure benchmarking — periodic review of how peer companies are disclosing under the new rules, what language they are using, and what the disclosure trajectory looks like across the peer group. The benchmarking informs both the 10-K drafting and the IR response framework for cyber-related questions.
The third workstream is investor education — proactive engagement with the largest holders on the company's cyber posture, the governance structure, and the disclosure approach. The engagement work should be done in normal-course rather than after an incident, when the engagement becomes reactive and substantively different.
The trajectory of the disclosure regime
The disclosure regime will probably continue to develop over the coming cycles. The SEC has indicated continued interest in cyber-related disclosure topics, and the staff has produced interpretive guidance that is shaping practice in addition to the rule text itself. The peer-comparison effect will probably push disclosure quality higher over time as investor expectations adjust to the new baseline.
The IR functions that are well-positioned for the trajectory are the ones that have integrated cyber disclosure into the broader disclosure and IR strategy rather than treating it as a separate compliance workstream. The integration is what allows cyber to become a substantive part of the company's investor narrative rather than a defensive compliance topic.
The first cycle has set the baseline. The cycles that follow will sharpen practice. The teams that invest in the readiness, the benchmarking, and the engagement work now will be better positioned for the regime as it matures than the teams that are still treating the rule as a compliance check.
