Cybersecurity Briefing — SEC proposes rapid cyber incident disclosure
On 9 March 2022 the U.S. SEC proposed rules requiring public companies to disclose material cybersecurity incidents within four business days and to describe governance and risk management practices in annual filings.
The U.S. Securities and Exchange Commission issued a proposal on 9 March 2022 to standardize how registrants report cybersecurity incidents and governance. The draft rule would mandate Form 8-K disclosures within four business days of determining materiality, with detailed information on incident nature, scope, and timing.
Public companies would also need to describe board oversight, management roles, and risk management processes in periodic reports. The proposal signaled regulator expectations for mature detection, escalation, and documentation practices, reinforcing the need for tested playbooks and cross-functional materiality assessments.
- SEC press release outlines the rationale and key disclosure timelines.
- Proposed rule 33-11038 details Form 8-K Item 1.05 requirements and governance disclosures.
Continue in the Cybersecurity pillar
Return to the hub for curated research and deep-dive guides.
Latest guides
-
Cybersecurity Operations Playbook — Zeph Tech
Use Zeph Tech research to align NIST CSF 2.0, CISA KEV deadlines, and sector mandates across threat intelligence, exposure management, and incident response teams.