8-K Item 1.05: How Companies Disclose Cybersecurity Incidents

Item 1.05 is the newest numbered item on Form 8-K, added by the SEC's cybersecurity disclosure rules so that investors learn about material cybersecurity incidents on a predictable timeline rather than waiting for a company's next quarterly report. The rule's defining feature is that the clock starts at a determination, not at the incident itself, which trips people up more than any other part of the item.

What counts as a cybersecurity incident

The SEC's rule defines a cybersecurity incident broadly: an unauthorized occurrence, or a series of related occurrences, on or through a company's information systems that jeopardizes the confidentiality, integrity, or availability of those systems or of the information they hold. That covers ransomware, data breaches, denial of service attacks, and incidents at a third party service provider that affect the company's systems or data.

Not every incident is reportable under Item 1.05. Only an incident the company determines to be material triggers the item. Materiality here follows the same general securities law standard used elsewhere: whether there is a substantial likelihood that a reasonable investor would consider the information important, considering both quantitative harm like remediation costs and qualitative harm like reputational damage or litigation risk.

The two step clock

Item 1.05 works in two stages, and understanding both is the key to reading the item correctly:

1. Discovery to determination. Once a company becomes aware of an incident, it must determine whether the incident is material without unreasonable delay. The SEC deliberately avoided a fixed number of days for this step, so it can vary by company and by incident.
2. Determination to filing. Once the company determines an incident is material, it has four business days to file the Item 1.05 8-K describing it.

What the filing has to say

An Item 1.05 disclosure describes the material aspects of the incident's nature, scope, and timing, along with its material impact or reasonably likely material impact on the company, including its financial condition and results of operations. The SEC's rule does not require companies to disclose specific technical details that could help an attacker, such as exact system vulnerabilities, if disclosing them would itself create further risk.

Amendments when the picture changes

If a company files an Item 1.05 8-K before it has all the facts, and later learns information that was not available or determined at the time of the original filing, it must file an amendment within four business days of that new information becoming available.

The national security delay

There is exactly one basis for delaying an Item 1.05 filing past the four day deadline: the Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety, and notifies the SEC of that determination in writing. This exception is narrow and does not apply to run of the mill ransomware or data theft incidents. It is handled through a formal notification process, not a company's own judgment call.

Material versus non-material: Item 1.05 and Item 8.01

Companies often file a cybersecurity incident under Item 8.01 first, while they are still assessing scope, and follow up with an Item 1.05 filing once the materiality determination is made. Both filings end up associated with the same underlying event, so comparing filing dates across the two items can show how long an assessment took.

Why this item exists

Before the SEC added Item 1.05, cybersecurity incidents were reported inconsistently: some companies disclosed quickly under the general Item 8.01 "other events" category, some waited for the next periodic report, and some said very little at all. Item 1.05 standardizes the trigger and the timeline so that investors do not have to guess whether a given incident was material enough to matter.

Working with Item 1.05 filings in code

SecFeed has a dedicated feed for every Item 1.05 filing, including the disclosed incident text:

curl "https://secfeedapi.com/v1/form-8k/cybersecurity-incidents?startDate=2026-07-01&endDate=2026-09-30" \
  -H "Authorization: Bearer YOUR_API_KEY"

Each result includes the company, the filing date, and the disclosed text:

{
  "cik": "1045810",
  "companyName": "EXAMPLE SEMICONDUCTOR INC",
  "formType": "8-K",
  "item": "1.05",
  "filedAt": "2026-08-14",
  "text": "On August 10, 2026, the Company determined that a cybersecurity incident..."
}

To find every company that disclosed a material cybersecurity incident across a sector in Python, pair the item filter with a SIC code:

from secfeed import Client

sf = Client("YOUR_API_KEY")
filings = sf.filings('formType:"8-K" AND items:"1.05" AND filedAt:[2026-01-01 TO 2026-09-30]')
for f in filings:
    print(f["companyName"], f["filedAt"], f["cik"])

See our full 8-K item list for how Item 1.05 fits with the rest of the form, and the API docs for the other item-specific feeds.

Frequently asked questions

Does Item 1.05 apply to incidents at a vendor or third party?

Yes, if the incident affects the company's own systems or data, including through a third party service provider, and the company determines it is material.

What if a company never determines an incident is material?

If a company reasonably concludes, after an appropriate assessment, that an incident is not material, Item 1.05 is not triggered. The company may still choose to disclose the incident voluntarily under Item 8.01.

Can a company delay disclosure just because an investigation is ongoing?

No. An ongoing investigation does not, by itself, justify delaying an Item 1.05 filing once materiality has been determined. The only recognized delay is the Attorney General's national security determination.

Does paying a ransom remove the disclosure obligation?

No. SEC staff guidance states that a ransomware payment, or an attack appearing to stop, does not on its own make a previously material incident immaterial, and does not remove an existing Item 1.05 obligation.

Where can I see a company's full incident response timeline?

The original Item 1.05 filing, any Item 8.01 filing that preceded it, and any later Item 1.05 amendment together usually show the timeline from discovery through materiality determination to final disclosure.