SEC cybersecurity risk management and incident disclosure rules for public companies (Form 8-K Item 1.05; Regulation S-K Item 106)
A public company must disclose a cybersecurity incident it determines to be material within four business days of that determination, and describe annually its processes for assessing and managing cybersecurity risk and the board's oversight of them.
Draft mapping. Drafted by the Register's agents from the rule's text and not yet confirmed by a person. It is the Register's reading, not legal advice: whether and how the rule applies to you is a question for counsel.
Controls this rule maps to
Required by the text The rule's text requires a measure that is this control, or plainly includes it. Implied A binding rule whose purpose needs this control, but whose text does not name it. The Register's reading. Recommended A voluntary standard or guidance recommends it; nothing binds you to it. Proposed Appears in a proposed rule or proposed provision that is not yet in force.
| Control | Strength | Where in the rule, and why | Confidence | Missing or failed in |
|---|---|---|---|---|
| Reporting integrity C-V2 | Required by the text | Item 1.05: disclosure of a material cybersecurity incident within four business days of the materiality determination | high | 1 case |
| Organizational recovery process C-R4 | Implied | Item 106: annual description of risk management processes and board oversight | medium | 1 case |