Lion Cipher Lab

Determine materiality and file an SEC cyber incident disclosure (Form 8-K Item 1.05)

• GRC / Compliance
• Advanced
• ~110 min
• Free · no account required

Why it matters

There is a question that lands on security people who are not qualified to answer it and cannot get out of answering it: is this incident MATERIAL? Since the SEC's 2023 cybersecurity rule took effect, a US-listed company that determines it has experienced a material cybersecurity incident has four business days to say so in public, on Form 8-K under Item 1.05. Almost everyone gets the clock wrong in the same direction: they believe it runs from discovery. It does not. It runs from the DETERMINATION — and the rule closes the obvious loophole by requiring the determination itself to be made…

What you'll learn

• the single most misunderstood clock in US cyber regulation: Form 8-K Item 1.05 is due four BUSINESS days after the DETERMINATION of materiality, not four days after discovery
• the rule that stops you gaming it: the determination itself must be made 'without unreasonable delay' after discovery, so the two rules interlock and neither alone is the deadline
• materiality as the FEDERAL SECURITIES LAW standard -- a substantial likelihood a reasonable investor would consider it important, or that it would significantly alter the total mix of information -- and why that is not a CVSS score, a P1 label, or a GDPR/NIS2/HIPAA trigger
• why a dollars-only materiality test is the classic failure, and how quantitative and qualitative factors are weighed together
• the aggregation rule that is easy to state wrongly: a series of RELATED unauthorized occurrences is one incident, while the proposal to aggregate UNRELATED immaterial incidents was not adopted
• writing the six artefacts that make a determination defensible two years later: a materiality memo, a disclosure-controls escalation runbook, an occurrence (aggregation) register, an impact register, a clock ledger, and the drafted filing itself
• drafting an Item 1.05 filing that carries the material aspects of the nature, scope and timing without handing the attacker a status report
• Item 106 of Regulation S-K in the 10-K: risk management and strategy, board oversight, management's role -- and the board-cybersecurity-expertise requirement that was proposed and NOT adopted
• the delay provisions and their real mechanics: the Attorney General national-security determination (30 + 30 + 60 days) and the FCC-regulated-carrier accommodation
• Item 1.05 versus a voluntary Item 8.01 filing, and why SEC staff have publicly encouraged the latter for incidents that are immaterial or not yet determined

Steps in this lab

1. Read this first: what this lab is, and how it differs from every other governance lab here
2. The vocabulary, defined once, in plain words
3. The backbone: four business days from the DETERMINATION, and 'without unreasonable delay' before it
4. Open a terminal and make a working folder (zero-assumption setup)
5. The registrant and the incident — a scenario built on the knife edge
6. Artefact 2: the disclosure-controls and escalation runbook — the control the SEC actually cares about
7. Artefact 3: the materiality framework — and why a dollars-only test is the classic failure
8. Artefact 4: the occurrence register — the standing aggregation ledger
9. Artefacts 5 and 7: the impact register and the clock ledger
10. Artefact 6: the determination record — a dated decision with six deliberate defects
11. Artefact 8: the first Item 1.05 draft — saying too much and too little at the same time
12. Artefact 9: the Item 106 annual disclosure — and the board-expertise myth
13. Write the measuring script — business-day arithmetic implemented, not hand-waved
14. Check the holiday calendar, then do the four-business-day count by hand
15. Run the report — six findings, and a deadline that is not where you left it
16. The six findings, one at a time — each is a real failure mode
17. Fix the record, re-run, and watch the deadline move into the past
18. The delay provisions — the Attorney General, and the FCC carrier accommodation
19. Item 1.05 versus Item 8.01 — and the trap of filing voluntarily under 1.05
20. When a security person should escalate rather than decide
21. When this lab does not apply — and the variations that matter
22. How a pro does it differently
23. Clean up, and the six sentences worth keeping

Open the full interactive lab →