Your Incident Response Plan Has the Wrong Trigger. Here's What Starts the SEC's 4-Business-Day Clock.

TL;DR

• The SEC’s 4-business-day Item 1.05 clock starts at materiality determination — not discovery, not containment, not forensic completion.
• Two years of filings show the gap clearly: companies are using Item 8.01 as a holding pattern while they figure out if something is material, and some never make it to 1.05 at all.
• Halliburton determined materiality in 2 days. AT&T took 84 calendar days. The SEC is watching that gap.
• The enforcement theory isn’t “you didn’t file” — it’s “you minimized what you already knew.” That’s harder to defend.
• Your IR plan probably has the wrong trigger. Here’s how to fix it.

The incident response plan your company built in 2023 was probably designed around the wrong question.

Most IR playbooks ask: When does containment begin? When do we notify law enforcement? When do we call outside forensics? These are legitimate operational questions. They’re also secondary to the question the SEC actually cares about: When did you determine this incident was material?

That’s the clock. Not the breach date. Not the discovery date. The materiality determination date — and it starts a four-business-day filing countdown the moment it happens.

Two years into the SEC’s cybersecurity disclosure rule, the data from actual filings shows that companies are still getting this wrong. Some are taking weeks or months to reach a formal materiality determination. Some are using the voluntary Item 8.01 bucket indefinitely. A few have disclosed incidents that, on the facts, sound material — and never filed under Item 1.05 at all.

The SEC’s Division of Examinations called cybersecurity incident response plans a 2026 examination priority. Enforcement may still be restrained, but examiners are asking to see your documented decision process. If you can’t show them a clear trigger and a defensible timeline, you’ve got a problem whether or not a formal enforcement action ever materializes.

What the Rule Actually Says

The SEC’s cybersecurity disclosure rule became effective December 18, 2023 for large accelerated filers and June 15, 2024 for smaller reporting companies.

Under Item 1.05 of Form 8-K, a registrant must disclose within four business days of determining that a cybersecurity incident is material — with required content covering:

• The nature, scope, and timing of the incident
• The material impact or reasonably likely material impact on the registrant’s financial condition and results of operations

The word “reasonably likely” matters. You don’t need certainty about the impact. You need a reasonable basis to believe the impact could be material to a reasonable investor. If you’re waiting for forensics to close before making that determination, you’re probably waiting too long.

The materiality determination itself must be made “without unreasonable delay” after discovery. This creates a two-part clock: first, make the determination on a reasonable timeline; second, once made, file within four business days.

Two Years of Filings: What the Data Shows

As of May 21, 2026 — exactly two years after the SEC issued clarifying guidance — Debevoise’s Form 8-K tracker showed:

• 29 issuers had filed Item 1.05 8-Ks (material incident, clock ran, full disclosure filed)
• 50 issuers had filed under Item 8.01 (voluntary, materiality undetermined or non-material)
• Only 5 issuers had filed under both — all of them initially disclosed under 8.01, then later determined the incident was material and filed under 1.05

That pattern is telling. The 8.01/1.05 sequence suggests companies are using the voluntary disclosure bucket as a holding pattern: “we had something happen, but we’re not ready to call it material yet.” In five cases, they eventually did. In 45 cases — presumably — they concluded it wasn’t material.

The problem isn’t using Item 8.01. The rule contemplates that use. The problem is treating it as an open-ended parking lot while the materiality analysis runs in the background with no documented deadline.

The 84-Day Problem

AT&T discovered a data breach in April 2024. It made its materiality determination — and filed its Item 1.05 8-K — 84 calendar days later. Halliburton, responding to a different incident, made its determination in two days. UnitedHealth Group, navigating the Change Healthcare ransomware attack, made its determination in one day.

The range from 1 to 84 days tells you the industry hasn’t converged on a standard process. And the variance isn’t explained by incident complexity alone — AT&T’s breach involved 110 million customer records. That’s not a fact pattern that supports a slow materiality walk.

The SEC hasn’t taken enforcement action specifically over the speed of the determination, but it has stated clearly that the determination must happen “without unreasonable delay.” SEC staff guidance from 2023 notes that a company cannot “delay assessing materiality to avoid triggering the disclosure obligations.” The exposure is real even without a settled case naming it explicitly.

What Enforcement Has Actually Looked Like

The only settled enforcement actions under the SEC’s cybersecurity disclosure framework remain the October 2024 four-company sweep: Unisys ($4 million), Avaya ($1 million), Check Point ($995,000), and Mimecast ($990,000) — approximately $7 million combined.

The theory in all four cases was not “you failed to file.” It was “you minimized what you already knew.” Each company had disclosed a cybersecurity incident in investor-facing documents — risk factors, 10-Ks, 8-Ks — and those disclosures significantly understated the scope of what the company’s own internal teams had documented.

That’s a harder enforcement theory to defend against than a late filing. A late filing has a paper trail: here’s when we discovered it, here’s when we made the materiality determination, here’s why the timeline was reasonable. A minimization claim attacks the accuracy of what you wrote — and “our lawyers reviewed it” is not a complete answer when the draft included known facts that didn’t make it into the final text.

The SolarWinds case, which the SEC pursued aggressively through 2024 before it was dismissed with prejudice in November 2025, showed the limit of the CISO-accountability theory. But the dismissal of that case doesn’t diminish the minimization theory. The four-company sweep survived, settled, and stands as precedent.

The New First-Filing: AI as Root Cause

One development from 2026 worth noting: CB Financial Services became the first SEC registrant to file an Item 1.05 8-K naming artificial intelligence as the root cause of a cybersecurity incident. The filing described unauthorized AI software that exposed personal information.

This isn’t just a curiosity. As financial institutions deploy AI tools — including AI-assisted monitoring, document processing, and customer communication — incident response plans need to address scenarios where the vector is an AI system rather than a traditional attack. The classification of AI-related data exposure as a material cybersecurity incident is now established by at least one 8-K filing.

What’s Wrong With Most IR Plans

Most incident response plans are built around the operational response lifecycle: detect, contain, eradicate, recover, document. That’s the right framework for technical response. It’s missing a parallel track that most compliance teams haven’t built:

The materiality assessment track.

A materially correct IR plan runs two parallel streams from the moment of discovery:

1. Technical response — contain the incident, preserve forensics, bring in external counsel and investigators
2. Materiality assessment — gather quantitative and qualitative facts against the SEC’s materiality standard, involve legal and disclosure controls, set a deadline for the determination

The second track doesn’t wait for the first to complete. You make the materiality assessment with the facts available to you at the time, and you update it as new facts develop. If the assessment changes from “likely not material” to “material,” the clock starts at that update.

The Debevoise guidance on the two-year tracker reinforces this: if a company discloses under Item 8.01 and later determines the incident was material, the Item 1.05 8-K must be filed within four business days of that subsequent materiality determination — not within four days of the original discovery.

Building the Right Trigger

Here’s what a functional materiality assessment trigger looks like:

Trigger 1: Quantitative threshold A presumed-material trigger kicks in automatically when: (a) confirmed or estimated financial impact exceeds a defined dollar threshold relative to recent period revenue, assets, or earnings; (b) confirmed records affected exceed a defined volume; or (c) the incident affects a system critical to ongoing operations (core banking, payment processing, trading platform).

Trigger 2: Qualitative threshold A presumed-material trigger also kicks in for: (a) incidents involving sensitive PII for a significant customer population; (b) incidents involving material third-party service providers; (c) incidents likely to attract significant media, regulatory, or law enforcement attention; (d) incidents that could trigger regulatory reporting obligations (FDIC notification rules, OCC notification rules, SEC’s Regulation S-P).

When a trigger fires: Legal counsel, Chief Compliance Officer, and Chief Information Security Officer convene — within 24 hours — to make a formal materiality determination. That determination is documented with: the trigger event, the facts considered, the standard applied, and the conclusion (material / not material / assessment ongoing with next review in 48 hours).

If “assessment ongoing”: The 48-hour review cycle continues until a final determination is made. No item remains in “ongoing” status for more than five business days without escalation to the General Counsel and Chief Executive Officer.

The Annual Governance Disclosure Connection

The materiality process matters beyond the 8-K trigger. Under Item 106 of Regulation S-K, your 10-K must describe:

• Processes for assessing, identifying, and managing material cyber risks
• The board’s oversight of those processes
• Management’s role in assessing and managing cyber risks

If your 10-K describes a robust cybersecurity risk management program, but your actual materiality assessment process is ad hoc, you’ve got a disclosure accuracy problem on top of a response problem. SEC examiners reviewing your cybersecurity program are looking at both filings simultaneously.

So What?

The SEC’s enforcement posture on cybersecurity disclosure is restrained right now — five cases over three years. But the examination posture is not. The 2026 examination priorities explicitly flag incident response plans, and examiners are asking for the documented process, not just the policy.

The question isn’t “did we file the 8-K on time?” The question is “can we show, in writing, how we determined this incident was material or not material, and when?” If your IR plan doesn’t have a documented materiality assessment track with a clear trigger and a defined decision-making process, the absence of enforcement exposure today doesn’t mean you’re covered tomorrow.

Your IR plan is due for an update. The trigger is the materiality determination. Build that track now, before the incident that tests it.

Resources:

• SEC Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure — SEC.gov Compliance Guide
• Debevoise Data Blog: Cybersecurity Incident Disclosure Form 8-K Tracker (Two-Year Update)
• Cherry Hill Advisory: SEC Cybersecurity Disclosure Rule Two-Year Review
• vaquill.ai: SEC Cybersecurity Disclosure 2026 Enforcement Update — Lessons from Item 1.05
• Cleary Gottlieb: The Shifting SEC Enforcement Landscape — 2025 Year in Review

Related reading:

• Your Reg S-P Compliance Deadline Passed in June. Now the SEC Is Examining for It.
• Cyber Incident Forensic Evidence Preservation: The First Four Hours
• OCC and NIST CSF 2.0: The Govern Function and What Examiners Are Asking For

If your IR playbook doesn’t include a materiality assessment track with a defined decision-making process, the Incident Response & Breach Notification Kit includes templates built specifically around the SEC timeline requirements, FDIC and OCC 36-hour notification rules, and Reg S-P’s 30-day customer notification clock.