Voluntary vs Mandatory 8-K Cyber Disclosure: Managing the Item 1.05 / Item 8.01 Choice

When a cyber incident hits a US-listed firm, the first consequential decision is not technical. It is which box on Form 8-K you file under, and that choice carries market, litigation and enforcement weight long before anyone knows the full scope of what happened.

The SEC’s cybersecurity disclosure rules, adopted on 26 July 2023, created Item 1.05 of Form 8-K: a filing that discloses a cybersecurity incident the registrant has determined to be material, due within four business days of that materiality determination. Item 8.01 — “Other Events” — has existed for years as the catch-all for anything a company chooses to disclose. The two have become a fork. And because most incident-response playbooks were written before this fork existed, firms tend to fall into one branch by default rather than choosing deliberately. That default is where the trouble starts.

What the two items actually signal

Item 1.05 is not a voluntary disclosure. The SEC’s Division of Corporation Finance was explicit about this in a statement from its Director, Erik Gerding, on 21 May 2024: Item 1.05 is triggered only once a company has determined an incident is material, so filing under it is, by definition, a declaration of materiality. That declaration is read by the market, by plaintiffs’ lawyers, and by the regulator as the company’s own admission that the incident matters to a reasonable investor.

Item 8.01 signals something different: here is an event we are telling you about, and we are not asserting it is material. Gerding’s statement actively encouraged firms to use Item 8.01 — rather than Item 1.05 — where an incident has occurred but the materiality assessment is either still open or has concluded the incident is immaterial. The regulator’s concern was the reverse of what most people expected: not firms hiding incidents, but firms over-filing under 1.05 for immaterial events, diluting the signal that 1.05 is meant to carry and confusing investors about what is genuinely material.

So the choice is a signalling decision. File 1.05 and you have told the world this is material. File 8.01 and you have disclosed without conceding materiality. Both can be right. Both can be badly wrong.

Why the fork is a governance decision, not a legal formality

The temptation is to hand this to counsel and treat it as a filing-mechanics question. It is not. The materiality determination that gates Item 1.05 is a judgement about impact — financial, operational, reputational — and that judgement is only as good as the engineering and incident data feeding it. A general counsel deciding materiality without knowing which systems were touched, how many records were exposed, whether the intrusion is contained or ongoing, and what the recovery timeline looks like is guessing. The technology function owns the facts on which the legal call depends.

This is why the decision rights need to be settled before an incident, not during one. Who determines materiality? On what evidence? Within what internal clock, given that the four-business-day window starts at determination and the SEC has warned against unreasonably delaying that determination to stop the clock? If the answer is “we will work it out when it happens,” you will work it out badly, under pressure, with incomplete data, at exactly the moment the choice is most consequential.

There is also a scoping trap underneath the timing one. The rule treats a series of related occurrences as potentially a single material incident, which means your incident taxonomy and your disclosure obligation are coupled in ways most tooling was never built for. We have written separately on how aggregating related occurrences breaks the standard incident taxonomy, and that aggregation question feeds directly into whether a run of “minor” 8.01-worthy events has quietly become a material one that belongs under 1.05.

The enforcement and litigation asymmetry

The two branches carry different downside risks, and they are not symmetric. File under 8.01, and if the incident is later determined material, you must then file an Item 1.05 8-K within four business days of that determination — the obligation does not go away, it simply moves. Get the materiality call wrong in the direction of downplaying, and you expose the firm to the charge that its disclosure was misleading.

That charge is not hypothetical. In October 2024 the SEC charged four public companies for disclosures it said downplayed the severity of cyber incidents connected to the SolarWinds compromise, characterising intrusions in vague or minimising terms while the firms knew more. The settlements, carrying civil penalties, turned on how the incidents were described, not merely whether they were disclosed. The lesson transfers directly to the 1.05/8.01 fork: choosing 8.01 to avoid the materiality signal, when your own data supports materiality, is the sort of characterisation the SEC has shown it will pursue.

Over-filing under 1.05 has a cost too — a filing that concedes materiality can move the share price, hand a template to securities plaintiffs, and, if the incident proves immaterial, leave you having spooked the market unnecessarily. Neither branch is free. The point is to choose the one your evidence actually supports.

What engineering has to put on the table

For the materiality call to be defensible, the technology function needs to supply, quickly and in writing: the affected systems and data categories; the volume and sensitivity of exposed records; whether the incident is contained, ongoing, or of unknown status; the operational impact on revenue-generating or customer-facing services; and a credible recovery and cost estimate. If your incident metrics — detection time, containment time, mean time to recovery — are not instrumented, you cannot produce these numbers under a four-day clock. The same discipline that makes you good at instrumenting operational metrics like MTTR is what lets you feed a materiality determination with facts instead of adjectives.

A note on the national-security exception, since it is often misunderstood: disclosure under Item 1.05 may be delayed only if the US Attorney General notifies the SEC in writing that immediate disclosure would pose a substantial risk to national security or public safety. It is a narrow door, granted rarely, and not a general-purpose deferral you can plan around.

The firms that handle this well are not the ones with the cleverest lawyers. They are the ones where the CTO, the general counsel and the disclosure committee agreed the decision rights, the evidence standard and the internal clock while the incident was still hypothetical — so that when it stops being hypothetical, the fork is a decision they make, not one that makes them.