Skip to main content
Policy Authority
Category: Regulatory Disclosure

Cybersecurity Disclosure

Also known as: SEC Cybersecurity Disclosure, Cybersecurity Risk Management, Strategy, and Governance Disclosure
Simply put

Cybersecurity disclosure refers to the information that public companies are required to report about how they handle cybersecurity risks and about significant cyber incidents affecting them. In the United States, rules adopted by the Securities and Exchange Commission (SEC) require companies to describe their approach to managing cybersecurity risk and to report material cybersecurity incidents to investors. The aim is to give investors consistent, comparable information about cybersecurity matters that could affect a company.

Formal definition

Cybersecurity disclosure denotes the reporting obligations established under the SEC's 2023 final rules (Release No. S7-09-22) requiring registrants to make disclosures in two principal areas. First, registrants provide periodic (typically annual, within the Form 10-K) disclosures regarding their processes for assessing, identifying, and managing material cybersecurity risks, as well as their cybersecurity strategy and governance. Second, registrants disclose material cybersecurity incidents, with the SEC rules requiring such disclosure within four business days of determining that an incident is material; under the final rule, a 'cybersecurity incident' is defined broadly to include occurrences that jeopardize information systems. The requirements apply to companies subject to SEC reporting and should be distinguished from internal cybersecurity risk-management controls themselves; disclosure is a compliance reporting obligation and does not, on its own, address the adequacy or effectiveness of the underlying controls. Scope and specific applicability may vary by registrant type, and this entry does not address implementation specifics or constitute legal advice.

Why it matters

Cybersecurity disclosure addresses a longstanding gap in the information available to investors about how public companies manage cyber risk and how they respond when significant incidents occur. Before consistent reporting requirements, disclosures about cybersecurity matters varied widely in timing, content, and depth, making it difficult for investors to compare companies or assess how a given incident might affect an investment. The SEC's 2023 final rules seek to provide more consistent and comparable information by requiring both periodic disclosures about cybersecurity risk management, strategy, and governance and timely disclosure of material cybersecurity incidents.

For compliance and governance professionals, the significance lies in the fact that this is a securities-law reporting obligation rather than a technical control requirement. The rules create a compliance-driven trigger tied to a materiality determination, requiring incident disclosure within four business days of concluding that an incident is material. This places pressure on organizations to establish clear internal processes for identifying incidents, escalating them, and making timely and defensible materiality judgments. The disclosure obligation intersects governance because it also calls for reporting on how cybersecurity risk is overseen and managed at an organizational level.

It is important to note that disclosure does not, by itself, improve the underlying security posture; it reports on it. A company can meet its disclosure obligations while still carrying significant residual cyber risk. The value to investors comes from transparency and comparability, not from any assurance that the disclosed processes are adequate or effective. Observations from surveys of early disclosures suggest wide variation in length and detail among companies, reflecting differing approaches to satisfying the requirements.

Who it's relevant to

Compliance officers
Compliance teams are responsible for ensuring the organization meets the SEC's periodic and incident-based disclosure obligations, including establishing processes to assess materiality and to meet the four-business-day disclosure window following a materiality determination. Their focus is on the accuracy, timeliness, and defensibility of the reporting rather than on the technical controls themselves.
Governance professionals and boards
Because the rules call for disclosure about cybersecurity governance and how cyber risk is overseen and managed, those responsible for board oversight and governance structures have a direct interest in how that oversight is described and evidenced. This spans the governance pillar, as it concerns the roles and decision rights around cybersecurity risk.
Risk managers
Risk managers contribute to the processes for assessing, identifying, and managing material cybersecurity risks that the periodic disclosure describes. They help inform materiality judgments for incidents, though the disclosure decision ultimately rests with the reporting obligation rather than with risk-treatment activities alone.
Legal and securities counsel
Counsel advise on the interpretation of materiality, the scope and applicability of the rules to a given registrant type, and the content and timing of filings. Given that the rules are grounded in securities law and applicability may vary, legal input is commonly central to disclosure decisions. This entry does not constitute legal advice.
Internal auditors and assurance functions
Independent assurance functions may evaluate whether the processes supporting disclosure decisions are designed and operating as described, while maintaining objectivity from the management activities they review. Their role is to assess the disclosure and materiality-determination processes, not to perform them.

Inside Cybersecurity Disclosure

Material Incident Disclosure
The reporting of cybersecurity incidents that are determined to be material to investors or stakeholders. Materiality assessments typically consider both quantitative and qualitative factors, and the specific triggers and timelines vary by jurisdiction and applicable regulatory regime.
Risk Management and Strategy Disclosure
Descriptions of the processes an organization uses to assess, identify, and manage cybersecurity risks, and how these processes relate to overall business strategy. This is a governance-oriented element focused on describing structures and processes rather than confirming their effectiveness.
Governance Disclosure
Information about board-level and management oversight of cybersecurity risk, including roles, responsibilities, and reporting lines. This element addresses decision rights and accountability structures rather than the technical controls themselves.
Materiality Determination Process
The methodology by which an organization decides whether an incident or risk rises to the level requiring disclosure. Determinations commonly weigh the nature, scope, and potential impact of an event, and the threshold may differ across legal frameworks.
Disclosure Controls and Procedures
The internal processes intended to ensure that cybersecurity information is collected, evaluated, and reported accurately and on a timely basis. These are management controls whose design and operation may be subject to independent assurance.

Common questions

Answers to the questions practitioners most commonly ask about Cybersecurity Disclosure.

Does cybersecurity disclosure mean an organization must publish the technical details of its security controls or incidents?
No. Cybersecurity disclosure typically refers to communicating information about an organization's cybersecurity risk governance, risk management processes, and material incidents to investors, regulators, or other stakeholders, not to publishing granular technical specifics such as system configurations, vulnerability details, or control architectures. Many disclosure regimes deliberately allow organizations to withhold specifics whose release could expose them to further harm, and the emphasis is commonly on the materiality and governance dimensions rather than technical detail. The precise scope varies by jurisdiction, sector, and the applicable disclosure framework.
Is cybersecurity disclosure the same as complying with data breach notification laws?
Not exactly; the two are related but distinct. Breach notification obligations commonly require notifying affected individuals or supervisory authorities of specific personal data breaches within defined timeframes, and are often anchored in data protection or privacy law. Cybersecurity disclosure, as used in securities and governance contexts, more commonly concerns communicating material cybersecurity risks, incidents, and oversight practices to investors or markets. An organization may face both types of obligation simultaneously, and they can differ in trigger, audience, timing, and content. The applicable requirements depend on jurisdiction, industry, and organization type.
How does an organization determine whether a cybersecurity incident is material enough to disclose?
Materiality assessments typically weigh whether the incident's nature, scope, and potential impact would be significant to the intended audience, investors, for example, in a securities context. Organizations commonly consider financial, operational, reputational, and legal consequences, both quantitative and qualitative. Because materiality thresholds and the responsible decision-makers vary by framework and jurisdiction, many organizations establish a documented, repeatable process, often involving legal, risk, finance, and security functions, to evaluate incidents consistently. This entry does not provide legal advice; specific materiality determinations should be made with reference to applicable requirements and counsel.
Which internal functions are typically involved in preparing cybersecurity disclosures?
Disclosure preparation commonly draws on several functions. Information security or IT teams (often a first-line function) supply factual details of incidents and controls; legal and compliance functions assess disclosure obligations and materiality; risk management contextualizes the exposure against the organization's risk profile; and finance or investor relations may address the content of external filings. Governance bodies such as the board or an audit or risk committee frequently have oversight responsibilities. The specific allocation of roles depends on the organization's structure and applicable governance model.
What role does the board or a board committee commonly play in cybersecurity disclosure?
In many governance models, the board or a designated committee holds oversight responsibility for cybersecurity risk, which can include reviewing management's disclosure processes and, in some regimes, being described in the disclosures themselves, for instance, how the board oversees cybersecurity risk. Boards typically do not manage incidents operationally; their role is generally oversight and challenge rather than execution, preserving the distinction between governance and management activities. The extent and formality of board involvement vary by jurisdiction, listing requirements, and organizational size.
How can an organization prepare in advance to make timely and accurate cybersecurity disclosures?
Organizations commonly establish disclosure controls and procedures that connect incident detection and response to the materiality assessment and reporting process, so that relevant information reaches decision-makers promptly. Practices frequently include predefined escalation criteria, a documented materiality evaluation methodology, clear roles across security, legal, risk, and finance, and periodic testing or tabletop exercises. Maintaining an accurate inventory of prior disclosures can also support consistency. These are general practices rather than mandated steps; specific expectations depend on the applicable framework and jurisdiction, and this entry does not address particular tooling or provide legal advice.

Common misconceptions

Cybersecurity disclosure is primarily a technical or IT function.
Disclosure spans governance, risk management, and compliance. While technical teams supply input, the obligation to disclose typically rests with governance and management functions, and materiality determinations often involve legal, financial, and executive judgment rather than technical assessment alone.
Every cybersecurity incident must be disclosed.
In many regimes, disclosure obligations are triggered by a materiality or significance threshold rather than by every event. What qualifies as reportable depends on the applicable jurisdiction, sector, and regulatory framework, and thresholds and timelines vary accordingly.
Disclosing that risk management processes exist demonstrates that controls are effective.
Describing a risk management process is a management representation of what the organization does; it is distinct from independent assurance over whether those controls operate effectively. Disclosure of a process should not be read as a guarantee of security outcomes.

Best practices

Establish a documented materiality determination process that incorporates both quantitative and qualitative factors and clearly assigns who makes the final call.
Confirm the specific disclosure triggers, timelines, and content requirements applicable to your jurisdiction, sector, and organization size, as these commonly differ across regulatory regimes.
Coordinate across governance, risk, compliance, legal, and technical functions so that disclosures reflect accurate input while decision rights remain with the appropriate accountable parties.
Maintain disclosure controls and procedures that ensure cybersecurity information is captured, evaluated, and escalated on a timely basis.
Distinguish clearly in disclosures between describing risk management processes and asserting control effectiveness, and consider where independent assurance may add credibility.
Retain contemporaneous documentation of incident assessments and materiality judgments to support the basis for disclosure decisions.
a promotional banner asking how ready are you for PCI DSS 4.0? With a call-to-action to get the checklist now.