Cybersecurity Crisis PR: The 4 Business Day SEC Clock

A U.S. public company must file a Form 8-K within four business days after it determines a cybersecurity incident is material, under rules the Securities and Exchange Commission (SEC) adopted on July 26, 2023. Public relations supports that process by coordinating facts, legal review and audience messages, so the filing, customer notices and employee updates say the same thing. Communications does not decide materiality. Executives and counsel do.

Updated on Oct 22, 2026.

Ronn Torossian is the founder and chairman of 5W.

This guide extends my piece on cybersecurity PR in the first 24 hours and belongs to the crisis communications hub. I am a communications professional, not a lawyer, and nothing here is legal advice.

What is the SEC four business day rule?

The SEC four business day rule requires a public company to disclose a material cybersecurity incident on Form 8-K within four business days after the company determines the incident is material. The clock starts at the materiality decision, not at the moment the incident is discovered.

The SEC announced the rules on July 26, 2023. Its press release says the rules require registrants to disclose material cybersecurity incidents they experience, and to describe their cybersecurity risk management, strategy and governance each year.

A law firm summary from Vorys says the Form 8-K is generally due four business days after the determination, and that the determination itself must be made without unreasonable delay after discovery. It also says the SEC treats the materiality test the same way it does for other securities law purposes.

The same SEC release says disclosure may be delayed if the United States Attorney General decides that immediate disclosure would pose a substantial risk to national security or public safety and tells the Commission in writing. That exception is narrow, and a communications team should not plan around it.

What does public relations do in a cybersecurity incident?

Public relations in a cybersecurity incident keeps every outside message consistent with the verified facts, the legal filing and what employees and customers have been told. The role is coordination and clarity, not investigation or legal judgment.

Three groups make the key decisions. Security and forensic staff establish what happened. Legal counsel and executives decide whether the incident is material and what must be filed. Communications turns those decisions into plain language for each audience.

The risk to avoid is a gap between documents. If the 8-K says one thing, a customer email another and a spokesperson a third, reporters and regulators will notice. I treat the filing as the anchor, and I write every other message so that it can sit beside the filing without contradicting it.

What should communications do in the first days of an incident?

In the first days of a cybersecurity incident, communications should confirm the facts it can share, name one approver, prepare a holding statement and set a time for the next update. Speed matters less than accuracy, because a correction is more damaging than a short delay.

1. Join the incident response group and ask for a written list of confirmed facts, updated each time facts change.
2. Name one person who approves every outside statement, with counsel in the loop.
3. Draft a holding statement that says an incident occurred, what is being done and when the next update will come.
4. Prepare separate notes for employees, customers, partners and regulators from the same fact sheet.
5. Ask legal what the company must file and by when, and map the communications calendar around that date.
6. Log every media inquiry, with the reporter, the outlet and the time, and answer from approved language only.

My 24 hour guide for security leaders goes through the first day in more detail.

Who needs to hear what, and when?

Employees, customers, regulators, investors and reporters each need a different message, and each should receive it from the same verified fact base. The table shows the audience, what each needs and who owns the message.

Public companies should also remember that selective disclosure rules exist. My article on the IPO quiet period shows how securities rules can limit what a company says, and the same discipline applies when an incident touches investors.

What should a company avoid saying during an incident?

A company should avoid saying anything it has not verified, including the cause, the attacker, the number of people affected and any promise that data was not accessed. Unverified statements are the easiest to contradict later.

Three phrases cause the most trouble. The first is a flat denial before forensic work is finished. The second is a precise number before the count is confirmed. The third is a promise about timing that depends on other parties. Replace each with what is confirmed now and when you will update.

The second source of risk is the privacy promise. If a company has told customers it protects their data, its statements during an incident will be compared with that promise. My article on privacy promises in app marketing explains why those claims need checking before they are made.

How should a company prepare before an incident?

A company should prepare by writing a communications plan, naming approvers, drafting template statements and rehearsing a scenario with legal and security staff. Practice finds the slow steps before a real incident does.

• Agree who can declare an incident and who decides on materiality.
• Keep a current contact list for the board, counsel, forensic firms and key customers.
• Pre-draft holding statements for employees, customers and media, with blanks for facts.
• Run a tabletop exercise that includes a mock filing deadline.
• Review public privacy and security claims so none promises more than the company can prove.

My technology companies PR page covers how these practices fit a software or hardware business. Companies that want outside support can speak with a cybersecurity PR agency, and the preparation steps above work either way.

The decision I would put to any board is simple. Decide in advance who determines materiality, who writes each message and who approves it, because the four business day clock leaves little time to decide those things during an incident.

Frequently asked questions

What is Form 8-K Item 1.05?

Form 8-K Item 1.05 is the SEC disclosure item for material cybersecurity incidents. A public company must file it within four business days after determining the incident is material.

When does the four business day clock start?

The clock starts when the company determines the incident is material, not when it discovers the incident. The determination itself must be made without unreasonable delay.

Can the SEC filing be delayed?

The filing can be delayed only if the U.S. Attorney General decides that disclosure would pose a substantial risk to national security or public safety and notifies the SEC in writing. The exception is narrow.

Does public relations decide whether an incident is material?

Public relations does not decide materiality. Executives and legal counsel make that decision, and communications turns the outcome into consistent messages for each audience.

Should a company name the attacker publicly?

A company should not name an attacker or state a cause until forensic work and counsel confirm it. An unverified claim is easy to contradict later.

Do private companies face the same rule?

The SEC rule applies to companies that report to the SEC. Private companies may face other notification duties, so they should ask counsel which laws apply to them.