Tracker record · Federal · Final rule
SEC cybersecurity disclosure rules
The SEC's cybersecurity disclosure rules for public companies: material incident reporting on Form 8-K, periodic-report governance disclosure, and the materiality analysis that drives both, with permitted reporting-delay mechanics.
Status
- Legal status
- In effect (Adopted July 26, 2023; 8-K compliance December 18, 2023 (smaller reporting companies June 15, 2024); Item 106 for fiscal years ending on or after December 15, 2023)
- Allegation or finding
- Operative law
- Applicability
- Public reporting companies
- Enforceability
- Binding on parties within scope
- Law checked through
- October 12, 2026
- Citation
- Form 8-K Item 1.05; Regulation S-K Item 106
- Source
- SEC Release No. 33-11216 (July 26, 2023); Form 8-K Item 1.05; Regulation S-K Item 106
Related guides
- Public Company and Sector Cybersecurity Disclosure
- Policies, Risk Oversight, Training, and Audit Evidence