Your Incident Response Plan Has the Wrong Trigger. Here's What Starts the SEC's 4-Business-Day Clock.

TL;DR

• The SEC’s 4-business-day Item 1.05 clock starts at materiality determination — not discovery, not containment, not forensic completion.
• Two years of filings show the gap clearly: companies are using Item 8.01 as a holding pattern while they figure out if something is material, and some never make it to 1.05 at all.
• UnitedHealth filed its Item 1.05 8-K the day after the Change Healthcare attack. Halliburton disclosed under Item 8.01 in two days, then moved to Item 1.05 about two weeks after discovery. AT&T’s 84-day gap came from a Justice Department-authorized delay, the main legitimate way to pause the clock.
• The enforcement theory isn’t “you didn’t file” — it’s “you minimized what you already knew.” That’s harder to defend.
• Your IR plan probably has the wrong trigger. Here’s how to fix it.

The incident response plan your company built in 2023 was probably designed around the wrong question.

Most IR playbooks ask: When does containment begin? When do we notify law enforcement? When do we call outside forensics? These are legitimate operational questions. They’re also secondary to the question the SEC actually cares about: When did you determine this incident was material?

That’s the clock. Not the breach date. Not the discovery date. The materiality determination date — and it starts a four-business-day filing countdown the moment it happens.

Two years into the SEC’s cybersecurity disclosure rule, the data from actual filings shows that companies are still getting this wrong. Some are taking weeks or months to reach a formal materiality determination. Some are using the voluntary Item 8.01 bucket indefinitely. A few have disclosed incidents that, on the facts, sound material — and never filed under Item 1.05 at all.

The SEC’s Division of Examinations made incident response programs a fiscal 2026 priority for advisers and broker-dealers under amended Regulation S-P, and Corporation Finance reviews public companies’ cyber disclosures. If you can’t show a clear trigger and a defensible timeline when someone asks, you’ve got a problem whether or not a formal enforcement action ever materializes.

What the Rule Actually Says

The SEC’s cybersecurity disclosure rule required Item 1.05 compliance starting December 18, 2023 for all registrants other than smaller reporting companies, and June 15, 2024 for smaller reporting companies.

Under Item 1.05 of Form 8-K, a registrant must disclose within four business days of determining that a cybersecurity incident is material — with required content covering:

• The nature, scope, and timing of the incident
• The material impact or reasonably likely material impact on the registrant’s financial condition and results of operations

The word “reasonably likely” matters. You don’t need certainty about the impact. You need a reasonable basis to believe the impact could be material to a reasonable investor. If you’re waiting for forensics to close before making that determination, you’re probably waiting too long.

The materiality determination itself must be made “without unreasonable delay” after discovery. This creates a two-part clock: first, make the determination on a reasonable timeline; second, once made, file within four business days.

Two Years of Filings: What the Data Shows

As of May 21, 2026 — exactly two years after the SEC issued clarifying guidance — Debevoise’s Form 8-K tracker showed:

• 29 issuers had filed Item 1.05 8-Ks (material incident, clock ran, full disclosure filed)
• 50 issuers had filed under Item 8.01 (voluntary, materiality undetermined or non-material)
• Only 5 issuers had filed under both — all of them initially disclosed under 8.01, then later determined the incident was material and filed under 1.05

That pattern is telling. The 8.01/1.05 sequence suggests companies are using the voluntary disclosure bucket as a holding pattern: “we had something happen, but we’re not ready to call it material yet.” In five cases, they eventually did. In 45 cases — presumably — they concluded it wasn’t material.

The problem isn’t using Item 8.01. The rule contemplates that use. The problem is treating it as an open-ended parking lot while the materiality analysis runs in the background with no documented deadline.

That split is by design. In May 2024 guidance, the SEC’s Division of Corporation Finance clarified that Item 1.05 is reserved for incidents the company has affirmatively determined to be material, and that voluntary disclosures of incidents not (or not yet) determined material belong under Item 8.01. Early filers had been using 1.05 for incidents still under investigation; after the guidance, voluntary disclosures shifted to 8.01.

The 84-Day Problem

AT&T learned of a breach of call and text records on April 19, 2024 and filed its Item 1.05 8-K on July 12, 84 days later, because the Justice Department twice determined (May 9 and June 5) that a delay was warranted under Item 1.05(c). Halliburton disclosed under Item 8.01 two days after discovery and moved to Item 1.05 about two weeks after discovery. UnitedHealth Group filed the day after the Change Healthcare attack.

The lesson from that range: a long gap is defensible when the paper trail shows a documented DOJ delay. A long gap with no documented reason is the one you’ll have to explain.

The SEC hasn’t taken enforcement action specifically over the speed of the determination, but it has stated clearly that the determination must happen “without unreasonable delay.” The SEC’s 2023 adopting release says that while the determination “need not be rushed prematurely, it also cannot be unreasonably delayed in an effort to avoid timely disclosure.” The exposure is real even without a settled case naming it explicitly.

What Enforcement Has Actually Looked Like

No SEC enforcement action has yet been brought under Item 1.05 itself. The closest precedent is the October 2024 sweep: Unisys ($4 million), Avaya ($1 million), Check Point ($995,000) and Mimecast ($990,000), about $7 million combined, for minimizing SolarWinds-related intrusions in 2020-2021 disclosures.

The theory in all four cases was not “you failed to file.” It was “you minimized what you already knew.” In each case, the company’s public disclosures (risk factors that framed known intrusions as hypothetical, or incident descriptions that understated what it knew) fell short of what its own teams had found.

That’s a harder enforcement theory to defend against than a late filing. A late filing has a paper trail: here’s when we discovered it, here’s when we made the materiality determination, here’s why the timeline was reasonable. A minimization claim attacks the accuracy of what you wrote — and “our lawyers reviewed it” is not a complete answer when the draft included known facts that didn’t make it into the final text.

The SolarWinds case, which the SEC pursued aggressively through 2024 before it was dismissed with prejudice in November 2025, showed the limit of the CISO-accountability theory. But the dismissal of that case doesn’t diminish the minimization theory. The four-company sweep survived, settled, and stands as precedent.

The New First-Filing: AI as Root Cause

One development from 2026 worth noting: CB Financial Services filed what appears to be the first Item 1.05 8-K triggered by an unauthorized AI software application rather than an external attack. The May 2026 filing described an internal incident in which non-public customer information was handled using an unauthorized AI-based application; it said customer names, Social Security numbers and dates of birth were exposed and the root-cause investigation was ongoing.

This isn’t just a curiosity. As financial institutions deploy AI tools — including AI-assisted monitoring, document processing, and customer communication — incident response plans need to address scenarios where the vector is an AI system rather than a traditional attack. The classification of AI-related data exposure as a material cybersecurity incident is now established by at least one 8-K filing.

What’s Wrong With Most IR Plans

Most incident response plans are built around the operational response lifecycle: detect, contain, eradicate, recover, document. That’s the right framework for technical response. It’s missing a parallel track that most compliance teams haven’t built:

The materiality assessment track.

A materially correct IR plan runs two parallel streams from the moment of discovery:

1. Technical response — contain the incident, preserve forensics, bring in external counsel and investigators
2. Materiality assessment — gather quantitative and qualitative facts against the SEC’s materiality standard, involve legal and disclosure controls, set a deadline for the determination

The second track doesn’t wait for the first to complete. You make the materiality assessment with the facts available to you at the time, and you update it as new facts develop. If the assessment changes from “likely not material” to “material,” the clock starts at that update.

The Debevoise guidance on the two-year tracker reinforces this: if a company discloses under Item 8.01 and later determines the incident was material, the Item 1.05 8-K must be filed within four business days of that subsequent materiality determination — not within four days of the original discovery.

Building the Right Trigger

Here’s what a functional materiality assessment trigger looks like:

Trigger 1: Quantitative threshold A presumed-material trigger kicks in automatically when: (a) confirmed or estimated financial impact exceeds a defined dollar threshold relative to recent period revenue, assets, or earnings; (b) confirmed records affected exceed a defined volume; or (c) the incident affects a system critical to ongoing operations (core banking, payment processing, trading platform).

Trigger 2: Qualitative threshold A presumed-material trigger also kicks in for: (a) incidents involving sensitive PII for a significant customer population; (b) incidents involving material third-party service providers; (c) incidents likely to attract significant media, regulatory, or law enforcement attention; (d) incidents that could trigger regulatory reporting obligations (FDIC notification rules, OCC notification rules, SEC’s Regulation S-P).

When a trigger fires: Legal counsel, Chief Compliance Officer, and Chief Information Security Officer convene — within 24 hours — to make a formal materiality determination. That determination is documented with: the trigger event, the facts considered, the standard applied, and the conclusion (material / not material / assessment ongoing with next review in 48 hours).

If “assessment ongoing”: The 48-hour review cycle continues until a final determination is made. No item remains in “ongoing” status for more than five business days without escalation to the General Counsel and Chief Executive Officer.

The Annual Governance Disclosure Connection

The materiality process matters beyond the 8-K trigger. Under Item 106 of Regulation S-K, your 10-K must describe:

• Processes for assessing, identifying, and managing material cyber risks
• The board’s oversight of those processes
• Management’s role in assessing and managing cyber risks

If your 10-K describes a robust cybersecurity risk management program, but your actual materiality assessment process is ad hoc, you’ve got a disclosure accuracy problem on top of a response problem. SEC staff reviewing your filings can read both.

So What?

The SEC’s enforcement posture on cybersecurity disclosure is restrained right now: a handful of cases, none yet under Item 1.05 itself. But the examination posture is not. The fiscal 2026 examination priorities flag incident response programs for advisers and broker-dealers under amended Regulation S-P, and disclosure reviewers can compare what your 10-K promises against what your 8-K timeline shows.

The question isn’t “did we file the 8-K on time?” The question is “can we show, in writing, how we determined this incident was material or not material, and when?” If your IR plan doesn’t have a documented materiality assessment track with a clear trigger and a defined decision-making process, the absence of enforcement exposure today doesn’t mean you’re covered tomorrow.

Your IR plan is due for an update. The trigger is the materiality determination. Build that track now, before the incident that tests it.

Resources:

• SEC Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure — SEC.gov Compliance Guide
• Debevoise Data Blog: Cybersecurity Incident Disclosure Form 8-K Tracker (Two-Year Update)
• Cherry Hill Advisory: SEC Cybersecurity Disclosure Rule Two-Year Review
• vaquill.ai: SEC Cybersecurity Disclosure 2026 Enforcement Update — Lessons from Item 1.05
• Cleary Gottlieb: The Shifting SEC Enforcement Landscape — 2025 Year in Review

Related reading:

• Your Reg S-P Compliance Deadline Passed in June. Now the SEC Is Examining for It.
• Cyber Incident Forensic Evidence Preservation: The First Four Hours
• OCC and NIST CSF 2.0: The Govern Function and What Examiners Are Asking For

If your IR playbook doesn’t include a materiality assessment track with a defined decision-making process, the Incident Response & Breach Notification Kit tracks 21 notice clocks, including SEC Form 8-K Item 1.05, the bank regulators’ 36-hour notification rule and Regulation S-P, from the trigger time you enter.