Cyber disclosures: separate discovery from materiality
A cybersecurity incident has a discovery date, a materiality-determination date and a disclosure date that can differ. Preserve all three, then track the nature, scope and impact separately. A technical containment announcement does not by itself establish that every material business consequence has ended.
Use the specific filing trigger
Form 8-K Item 1.05 and its instructions address material cybersecurity incidents for relevant US domestic issuers. The form generally starts the four-business-day filing period when the issuer determines that it experienced a material incident, and requires that determination without unreasonable delay after discovery. Specified delay provisions and other conditions require their own review. This article does not apply that clock automatically to every incident or jurisdiction.
Copy the issuer’s discovery statement, determination date, affected operations, known impact and any information said to be unavailable. Do not infer the materiality date from a news article’s publication or a customer notification. A company can describe an incident voluntarily under a different item, so read the actual filing classification rather than relying on the headline.
Hypothetical three-clock record
Assume a fictional issuer discovers unusual system activity on Business Day 0. It determines materiality on Business Day 3 and files the relevant report on Business Day 5. These are hypothetical business-day labels, not real calendar dates. The elapsed discovery-to-filing interval is five business-day steps, while determination-to-filing is two.
A mechanical rule counting four days from discovery would answer the wrong trigger question in this example. Nevertheless, the three-day determination interval is not automatically justified merely because filing followed within two days. The separate requirement to determine materiality without unreasonable delay still needs facts the public record may not reveal.
| Clock or state | Hypothetical timing | What to preserve |
|---|---|---|
| Discovery | Business Day 0 | What activity was first identified? |
| Materiality determination | Business Day 3 | What conclusion does the filing state? |
| Filing | Business Day 5 | Which item and information are supplied? |
| Systems contained | Later reported state | Which systems and what residual effects? |
| Impact quantified | Potential later update | New information and its availability |
The record should not invent an exact intraday time where only a date is disclosed. Nor should an analyst certify legal timeliness from a diagram that omits applicable conditions, holidays or delay arrangements.
Keep impact categories from overlapping
Assume direct response costs are 12 million and permanently lost sales are estimated at 20 million. Under a hypothetical 40% contribution-margin assumption, the lost sales imply 8 million of lost contribution, not another 20 million of expense. Adding direct costs of 12 to lost contribution of 8 gives an illustrative 20 million economic effect before other items.
This is an analytical scenario, not an accounting accrual or issuer forecast. Deferred orders that later ship are different from permanently lost sales. Separate response costs, lost contribution, customer credits, legal claims and possible insurance. An unconfirmed insurance expectation should not be silently netted against verified costs as if recovery were already established.
Build the continuing-impact worksheet
Use incident identity, affected systems, operational interruption, restoration status, data scope, direct costs, revenue timing, claims and unresolved information. Link later amendments to the same incident rather than counting each update as a new attack. If multiple incidents are identified, preserve their boundaries and any stated connection.
The form’s instructions address later amendments when specified information initially is unavailable. Track what new fact appeared and when the issuer says it became available. A second filing can quantify an existing event rather than reveal that the incident occurred again.
Review triggers include prolonged disruption after containment, new affected populations, revised impact estimates and additional material consequences. Public disclosure may reasonably omit sensitive technical details; the absence of a vulnerability description does not prove no remediation occurred.
The final memo should distinguish verified timing, operational states and conditional financial scenarios. It can identify the next material update to inspect without asserting an undisclosed attack method, a precise breach cost or a legal deadline violation unsupported by the available facts.
FAQ
Does discovery always start the Item 1.05 four-day clock?
No. The relevant trigger is the materiality determination, alongside the requirement to make that determination without unreasonable delay.
Does containment mean the economic impact is over?
No. Restoration, claims, customer effects and quantification can continue after technical containment.