2026 breach rule: Securities & Exchange Commission (SEC) Form 8-K Item 1.05 4-day file/not

This guide explains how public companies can make defensible SEC Form 8-K Item 1.05 disclosure decisions for cybersecurity incidents in 2026.

It clarifies when the four-business-day filing clock starts, how to document materiality determinations, and how to separate investigation from disclosure timing.

The two clocks inside Item 1.05

Public companies operating under the SEC’s cybersecurity disclosure rules in 2026 should run two distinct clocks. The incident-response clock begins when the organization detects a cybersecurity event and starts containment, scoping, and fact gathering. The materiality-determination clock begins only when the company makes and timestamps a formal determination that the incident is material. Treating these as separate clocks keeps operational urgency from being confused with the regulatory trigger for Form 8-K Item 1.05.

The SEC's cybersecurity disclosure rules establish two distinct regimes: Form 8-K Item 1.05 governs disclosure of cybersecurity incidents, while the annual disclosure requirement covers cybersecurity risk management, strategy, and governance. Before relying on any specific Code of Federal Regulations citation, verify it against the SEC's adopting release (Rule 33-11216) on sec.gov. A practical check is to classify each event at intake.

If the issue is a specific cybersecurity incident, route it into the Item 1.05 assessment workflow; if the issue concerns program design, board oversight, or recurring risk processes, handle it through the Item 106 annual disclosure process rather than an incident filing.

The Item 1.05 obligation is event-driven, but it does not attach to every alert or vulnerability. According to josefkamara.com, secportal.io, and Decryption Digest, a cybersecurity incident must be assessed for materiality, and the filing obligation attaches to the company’s materiality determination rather than to the mere discovery of a vulnerability. The rule for disclosure committees is straightforward: record detection immediately for response purposes, but start the Item 1.05 filing clock only when the committee documents its materiality decision.

Once that determination is made, the company must file a Form 8-K within four business days, as described by josefkamara.com and Decryption Digest. The filing must describe the nature, scope, and timing of the incident and its material impact or reasonably likely material impact on the company (Decryption Digest). Before filing, verify that the draft addresses each required element and that the timeline distinguishes what was known at detection from what supported the materiality determination.

A defensible process preserves evidence for both clocks. Maintain a contemporaneous log that captures the detection timestamp, investigative steps, decision participants, facts available at each stage, and the exact time of the materiality determination.

This record allows the company to show that it investigated promptly from detection while starting the Item 1.05 disclosure clock only at the documented determination, consistent with the four-business-day-from-determination framework described by josefkamara.com and Decryption Digest.

What the record converges

Independent sources describing SEC cybersecurity disclosure practice in 2026 converge on the same operational deadline: Item 1.05 of Form 8-K is triggered by a materiality determination, and the filing window runs from that determination. This alignment matters because disclosure teams often receive high-severity alerts faster than they can establish material impact, and the record separates alert intake from the filing clock.

As the table above shows, all three sources converge on the same trigger: the four-business-day window runs from the materiality determination, not from the first alert or the start of investigation.

This record kills a common myth: a critical CVE notification starts the 8-K clock. A critical notification may demand immediate technical review, but the sources tie the 4-business-day deadline to the materiality determination, not the notification date. As josefkamara.com states, the filing obligation arises within four business days of determining materiality; secportal.io and Decryption Digest describe the same post-determination clock. Treating a notification as the automatic start of the filing clock confuses urgency with disclosure timing.

A practical check follows from that convergence. When a critical alert arrives, the intake record should capture the notification time, the affected systems under review, and the owner responsible for escalation. Separately, the disclosure record should capture the committee’s materiality determination timestamp and the basis for that decision. If no determination is made, the 4-business-day Item 1.05 clock is not started by the alert alone; if a determination is made, the team can count four business days from that documented moment and prepare the Form 8-K accordingly.

File, defer, or document no-file

When a critical vulnerability notification reaches a public company, disclosure committees typically default to one of three postures. This section compares those three disclosure postures and names the documented-determination posture as the winner because it aligns the filing decision with the trigger the SEC actually requires under Item 1.05 of Form 8-K.

Filing on every critical CVE confuses a technical severity rating with a disclosure obligation. Under the SEC’s cybersecurity disclosure rules, codified at 17 CFR Parts 229 and 249, Item 1.05 requires disclosure when a company determines that a cybersecurity incident is material, not when a scanner or vendor labels a flaw “critical.” A severity-driven default produces filings that lack a clear determination record and makes it harder for investors to distinguish routine vulnerability management from events with a reasonably likely material impact.

Waiting for full attribution fails in the opposite direction. Attribution, root-cause certainty, and complete forensic scoping are valuable investigative goals, but they are not the legal trigger for Item 1.05. Once the committee determines that an incident is material, Rule 33-11216 requires the company to file a Form 8-K within four business days of that determination. A posture that postpones judgment until every technical question is answered can leave the company without a defensible explanation for when the determination was made and why the filing followed.

The documented-determination posture gives the committee a repeatable control: convene the disclosure decision-makers, record the facts available at the time, timestamp the materiality decision, and document whether the decision is “material,” “not yet material,” or “not material.” If the answer is material, prepare the Item 1.05 filing within the four-business-day window. If the answer is no-file, preserve the contemporaneous rationale, participants, and evidence reviewed so the company can show how it applied its materiality framework rather than relying on hindsight.

The numbers that move the decision

In 2026, the scale of vulnerability intelligence makes triage a disclosure-control problem, not a severity-scoring exercise. According to Decryption Digest, Project Glasswing, Anthropic’s coordinated vulnerability disclosure program powered by Claude Mythos, generated more than 10,000 high- or critical-severity findings across 200-plus partner organizations. For a public company receiving a Glasswing coordinated vulnerability disclosure notice, that volume is the first decision input: a critical-severity label identifies technical risk, but it does not by itself establish that a cybersecurity incident has occurred or that the company has reached a materiality conclusion requiring Item 1.05 disclosure.

The practical check is to separate intake volume from disclosure volume. A disclosure committee should ask whether the finding maps to an affected asset in the company’s environment, whether the vulnerability was exploited or reasonably likely to have caused a business-relevant impact, and whether the available facts support a committee-level materiality judgment. Decryption Digest notes that a critical vulnerability in software embedded in core infrastructure can compress the decision window for the general counsel, CISO, and CFO; the committee’s job is to convert that pressure into a documented decision path rather than an automatic filing.

The cost of error runs in both directions. Over-filing treats every high- or critical-severity alert as if it were a disclosable material incident. That posture can impose market and reputational costs, consume management attention, and create a public record that is disconnected from a contemporaneous materiality analysis. Before authorizing a Form 8-K, the committee should confirm that the file contains the specific facts, business context, and reasoning that support the materiality conclusion, not merely the vendor severity rating.

Under-filing carries the opposite exposure. SEC guidance summarized by Josef Kamara and the practical framework described by SEC Portal explain that Item 1.05 requires a Form 8-K within four business days after the company determines a cybersecurity incident is material. If the committee delays memorializing a materiality determination, or treats a material event as an unresolved technical alert, the company risks missing the filing deadline that attaches to that determination. The control is to preserve the evidence reviewed, the date and substance of the committee’s conclusion, and the rationale for filing or not filing.

Use the Glasswing-scale numbers as a triage threshold for process design: when inbound critical findings number in the thousands across an ecosystem, the committee cannot review each alert as a presumptive disclosure event. Instead, require a severity-to-materiality intake memo that records the affected system, exploitation status if known, potential business impact, decision owner, and the committee’s next action. That record lets the company move quickly on investigation while reserving Item 1.05 disclosure for the moment the facts support a defensible materiality determination.

Where the rule stops and judgment starts

The rule’s hard edge is procedural: Item 1.05 attaches to a materiality determination, not to the arrival of a critical alert. The reviewed guidance contains no quantitative materiality threshold—no loss figure, percentage, or score that automatically converts a cyber event into a filing obligation. That absence is the point: the committee must document why this event, at this time, is material or not.

A critical vulnerability notice is a trigger to investigate, not a filing event. If the committee equates “critical” with “material,” it risks filing on noise and diluting the record; if it records how the vulnerability affects operations, customers, or financial exposure, the same notice becomes useful evidence.

Absence of confirmed data theft does not end the inquiry. The rule breaks when the committee delays until attribution is perfect; it still wins when it evaluates reasonably likely impact based on available facts, including scope, affected systems, and business dependence.

The annual governance disclosure describes processes and oversight; it cannot stand in for an incident-specific determination. It remains valuable as context—showing who decides, what evidence is gathered, and how the company escalates—but the incident decision must be separate and timestamped.

Before closing any no-file decision, the record should show the committee asked: what is affected, how likely is impact, what is the business consequence, and what evidence would change the answer. If those answers are documented, the absence of a numeric threshold is not a gap; it is the reason judgment must be explicit.

A useful test is whether a later reviewer can reconstruct the decision from the record without asking the committee what it meant. If the record only says “not material,” it fails; if it identifies the affected systems, the likely business effect, and the reason that effect is not material, it succeeds.

Glasswing notice to 8-K

This section alone walks a hypothetical public company through exact timestamps and produces a reusable materiality worksheet for a Project Glasswing coordinated vulnerability disclosure (CVD) notice. PublicCo, a 2026 SEC registrant, receives a Glasswing CVD notice at 09:00 Tuesday, 2026-03-03, reporting a critical vulnerability in software embedded in its core billing infrastructure. Anthropic’s Project Glasswing has generated more than 10,000 high- or critical-severity findings across 200-plus partner organizations, so the notice should be treated as a decision trigger, not an automatic filing trigger.

At 09:15 Tuesday, 2026-03-03, the CISO opens the incident ticket and assigns owners for containment, scoping, and evidence preservation. The disclosure committee meets Wednesday, 2026-03-04, at 14:00 with the general counsel, CISO, and CFO to review confirmed facts: affected systems, data exposure, service disruption, customer or contractual impact, and remediation status. The committee records a materiality determination at 15:30 Wednesday, 2026-03-04. Under SEC Item 1.05 of Form 8-K, codified in 17 CFR Parts 229 and 249, the filing obligation runs from that determination.

Use these checkpoints as the working record: detection 2026-03-03 09:00; committee determination 2026-03-04 15:30; Item 1.05 due date, assuming no intervening federal holiday and verified against the SEC calendar, is 2026-03-10 15:30 (four business days after Wednesday: Thursday, Friday, Monday, Tuesday). The draft Form 8-K should be ready for legal, finance, and executive review at least one business day before the deadline, with a final go/no-go check that the disclosure states the nature, scope, and timing of the incident and its material impact or reasonably likely material impact without revealing technical details that would impede remediation.

Complete the worksheet at the meeting, attach supporting evidence, and store it with the Form 8-K draft or the no-file memorandum. A timestamped, source-attributed record gives the company a defensible basis for its 2026 disclosure decision if regulators, auditors, or investors later test the timing and substance of the Item 1.05 determination.

Worked Example: Run the Numbers

Illustration inputs (hypothetical): Acme Corp., a U.S. public company, receives a Project Glasswing coordinated vulnerability disclosure notification on Monday, March 2, 2026. The notification describes a critical-severity vulnerability in software embedded in Acme’s core infrastructure, consistent with the type of finding described by Decryption Digest in its analysis of Anthropic’s Glasswing program. Acme’s security team detects and logs the alert the same day, and the disclosure committee (general counsel, CISO, and CFO) begins gathering facts to support a materiality decision.

Step 1 — Record the determination timestamp (illustration): After reviewing scope, exploitability, and potential business impact, the committee documents a materiality determination on Wednesday, March 4, 2026, at 3:00 p.m. Eastern Time.

Under SEC Rule 33-11216, Item 1.05 of Form 8-K is due within four business days of determining that a cybersecurity incident is material, as summarized by Decryption Digest and josefkamara.com; confirm the current CFR codification against the rule text on sec.gov before relying on it.

In this illustration, March 4, 2026 is the trigger date because it is the timestamped determination, not the March 2 detection date.

Step 2 — Count the filing window (illustration): Counting four business days from the March 4, 2026 determination yields the following: business day 1 is Thursday, March 5; business day 2 is Friday, March 6; business day 3 is Monday, March 9; and business day 4 is Tuesday, March 10. Arithmetic check: 1 (Thu) + 1 (Fri) + 1 (Mon) + 1 (Tue) = 4 business days. The Form 8-K Item 1.05 deadline in this illustration is Tuesday, March 10, 2026. The contemporaneous record should preserve the detection log, the committee’s analysis, and the exact determination timestamp used to start the count.

Winner for this example: The documented-determination approach wins in this illustration because Acme files by March 10, 2026 on the basis of a recorded committee decision, rather than treating the March 2 alert as an automatic filing trigger before the facts are complete. The break-even trigger is the point at which the committee determines materiality on the same calendar day as detection. If the determination had occurred on Monday, March 2, 2026, the four-business-day count would run to Tuesday, March 3 (day 1), Wednesday, March 4 (day 2), Thursday, March 5 (day 3), and Friday, March 6 (day 4), making Friday, March 6, 2026 the deadline and eliminating the two-business-day gap shown in this example.

Five rules for the disclosure committee

The disclosure committee’s job in 2026 is to convert ambiguous cyber signals into a defensible, contemporaneous record. Under the SEC’s cybersecurity disclosure regime in 17 CFR Parts 229 and 249, Item 1.05 of Form 8-K is tied to a materiality determination, not to the mere arrival of an alert. The five rules below implement that decision discipline so the committee can act quickly without treating every critical notification as a filing event.

Rule 1 — Triage before triggering. If a critical vulnerability or incident notification arrives but the committee has not made a materiality determination, then open a dated triage log, assign owners for scoping and impact analysis, and preserve the facts gathered. Do not start the Item 1.05 filing clock at notification; the clock question is answered only when materiality is determined. Rule 2 — Decide, timestamp, and route. If the committee determines the incident is material, then timestamp that determination in the record and file Form 8-K Item 1.05 within four business days, as required by SEC Rule 33-11216. If the committee determines the incident is not material, then record the no-file rationale, the evidence reviewed, and the conditions that would require the committee to revisit the decision.

Rule 3 — Separate attribution from impact. If technical attribution, root cause, or full scope remains incomplete but the committee can assess a reasonably likely material impact, then base the determination on the impact assessment rather than waiting for perfect forensic closure. Item 1.05 calls for disclosure of the nature, scope, and timing of the incident and its material impact or reasonably likely material impact; the committee should document what is known, what is still being investigated, and why the available facts support the determination.

Rule 4 — Disclose facts, protect remediation. If the committee proceeds to an Item 1.05 filing while response work is active, then limit the disclosure to the information the rule requires and avoid technical details that would impede remediation. The committee’s draft should be checked against the contemporaneous triage log so the filing reflects the state of knowledge at the time of the determination, with a clear process for updating the record as facts develop.

Rule 5 — Revisit on defined triggers. If new facts materially change the assessed scope, business effect, or likelihood of harm, then reconvene the committee, document whether the prior determination still holds, and timestamp any new determination. A disciplined revisit trigger prevents a stale no-file rationale from persisting after the evidence changes, and it keeps the committee’s record aligned with the SEC’s determination-based disclosure framework.

What to do next

Frequently Asked Questions

Does receiving a critical cyber alert automatically require a public company to file Form 8-K Item 1.05?

No, a critical cyber alert does not automatically trigger an Item 1.05 filing because materiality must be established through a documented committee determination.

When does the four-business-day filing clock for Item 1.05 begin?

The four-business-day filing clock begins only at the timestamped materiality determination, not at the time of incident detection.

When should a public company start its cybersecurity incident investigation relative to the Item 1.05 filing clock?

A public company should begin investigating at detection but run that incident-response clock separately from the Item 1.05 filing clock.

Is the Item 1.05 filing deadline calculated in calendar days or business days?

The Item 1.05 filing deadline is measured in business days, not calendar days, once the materiality determination is timestamped.

How must a public company establish that a cybersecurity incident is material for Item 1.05 disclosure?

Materiality must be established through a documented committee determination rather than treated as automatic upon detection of a critical alert.

What two separate clocks should public companies run when handling a cybersecurity incident under Item 1.05?

Public companies should run an incident-response clock that begins at detection and a separate Item 1.05 filing clock that starts at the timestamped materiality determination.

Quick answers

Also worth reading: Why we fail to see our own worst judgments: Why we fail to see · Reclaiming Time with Smart Item Locators: Reclaiming Time with Smart Item · When to quit a project: $25,000 kill rule vs open-ended fix: When to quit a project: