Public companies must disclose a material cybersecurity incident on Form 8-K Item 1.05 within four business days of determining it is material, and describe their risk management and governance each year in the 10-K. The legal team owns the disclosure; engineering owns the facts it needs, fast. What those facts are and how to have them ready.
Since December 2023, SEC registrants report material cybersecurity incidents under Form 8-K Item 1.05, within four business days of determining that an incident is material, and describe cybersecurity risk management, strategy and governance annually under Regulation S-K Item 106. The materiality decision must be made without unreasonable delay after discovery.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Agree an escalation path from the on-call engineer to the disclosure committee, with thresholds for when to escalate.
Keep security logs in a separate account that production credentials cannot alter.
Run a tabletop exercise with legal, finance and engineering together at least once a year.
Record decisions and their timing during incidents. The timeline will be scrutinized afterwards.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
The EU Cyber Resilience Act and AI Act in 2027: What Software and Connected-Device Teams Need to Do
CRA vulnerability reporting has applied since September 11, 2026; its main obligations apply on December 11, 2027. AI Act high-risk obligations moved to December 2, 2027. A practical, engineering-side reading of what each means for software products and connected devices sold in the EU, and what to have in place a year early.
Read
The New AWS Security Hub: Pricing per Resource, What It Bundles and What to Enable First
Security Hub relaunched at the end of 2025 as one console over GuardDuty, Inspector, Macie and what is now called Security Hub CSPM, with exposure findings and per-resource pricing that includes Inspector scanning. How the bill works and a sensible order for turning things on.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.