SEC's New Cybersecurity Rules

When the SEC adopted its cybersecurity disclosure rules on July 26, 2023, many security teams treated them as a legal matter. Counsel would handle the filing and the board would sign off on the annual text. Three years later, that split no longer works.

The rules have now been tested by real incidents. SEC staff have issued guidance on which Form 8-K item to use, examiners have made cyber and AI a standing part of their reviews, and the first incident blamed on AI software has been filed. Meanwhile, a loud campaign to repeal the rules has made some teams think they can relax. They can't. The rule text on the SEC's website today is the same text adopted in 2023.

This guide covers what the rules require, what changed in 2025 and 2026, and where data security fits in. It also shows how Strac helps security and compliance teams answer the questions regulators and boards now ask.

What the SEC cyber disclosure rules require

The rules give public companies two jobs: report material incidents fast, and explain how they manage cyber risk every year. Foreign private issuers have matching duties on Form 6-K and Form 20-F.

Item 1.05 of Form 8-K: material incidents

Once a company decides an incident is material, it has four business days to file. The clock starts at that decision, not at discovery. The SEC expects the materiality call to be made without unreasonable delay after the incident is found.

The filing must describe the material aspects of the incident's nature, scope and timing, plus its material impact or reasonably likely impact on the company, including its finances and operations. It does not need technical details that would help an attacker or slow down the response.

A delay is possible only if the U.S. Attorney General decides that disclosure poses a substantial risk to national security or public safety and tells the SEC in writing. As information changes, companies update the record with an amended 8-K.

Item 8.01: incidents not yet judged material

In May 2024, SEC staff clarified that Item 1.05 is for material incidents only. Companies that want to disclose an incident before reaching a materiality decision should use Item 8.01 instead, then move to Item 1.05 within four business days if the incident later proves material. Since that statement, voluntary 8.01 filings have clearly outpaced 1.05 filings.

Item 106 of Regulation S-K: annual risk disclosure

Every Form 10-K must describe the company's process for assessing, identifying and managing material cyber risks. It must also explain how the board oversees those risks and which managers are responsible for them. In practice, this means your written program has to match what your security team actually does.

✨ What changed in 2025 and 2026

The rules themselves have not changed, but almost everything around them has. Here are the shifts that matter for security and compliance teams.

The push to repeal the rules, and why it changes nothing today

In May 2025, SIFMA, the American Bankers Association, the Bank Policy Institute, ICBA and the Institute of International Bankers petitioned the SEC to rescind Item 1.05. They argued that public disclosure clashes with confidential reporting to other agencies and forces companies to release early, incomplete facts.

On January 13, 2026, SEC Chairman Paul Atkins opened a broad review of Regulation S-K, with comments due in April. Trade groups and Business Roundtable used it to ask the SEC to drop Item 106 and Item 1.05, or at least narrow them. Comment letters were still arriving in October 2026.

As of now, no change has been proposed or adopted. Both requirements remain binding. Plan for the four-day clock until the SEC formally says otherwise, and if relief comes, you will be glad you built the habits anyway.

SolarWinds ended, but the duty did not

The SEC dismissed its case against SolarWinds with prejudice on November 20, 2025. Some read that as a retreat on cyber enforcement. It was a single case. Item 1.05 and Item 106 still apply, and misleading statements about security remain an enforcement risk under existing securities law.

Regulation S-P is now live for every covered firm

The SEC's 2024 amendments to Regulation S-P apply to brokers, investment advisers, investment companies and transfer agents. Larger entities had to comply by December 3, 2025 and smaller ones, with less than $1.5 billion in assets under management, by June 3, 2026.

Covered firms now need a written incident response program that can detect, contain and recover from unauthorized access to customer information. They must notify affected customers as soon as practicable and within 30 days of becoming aware of the incident. Service providers must be contractually required to report incidents to the firm within 72 hours. The definition of customer information is also broader than before.

If you can't say quickly which customer records were exposed, you can't meet a 30-day notice window.

Exams now treat AI and cyber as one topic

The SEC Division of Examinations released its fiscal 2026 priorities in November 2025. Cybersecurity, AI and customer data safeguards under Regulations S-P and S-ID are named as risks across all registrants. Examiners will look at governance, vendor oversight, access controls and incident response.

They will also ask how firms supervise their own use of AI and how they defend against AI-enabled attacks such as polymorphic malware. Claims about AI capabilities will be checked for accuracy. In short, AI oversight is now part of most exams, not a special topic.

The first 8-K blaming AI

In May 2026, CB Financial Services filed what appears to be the first Item 1.05 8-K that named AI as the root cause of an incident. Unauthorized AI software exposed customer names, Social Security numbers and dates of birth.

This is the risk many security teams have warned about. An employee connects an unapproved AI tool, or pastes records into a chatbot, and regulated data leaves the company with no record of where it went. The cost now shows up in a public filing, not just an internal report.

Filing patterns are settling

By May 21, 2026, 29 issuers had filed under Item 1.05 and 50 under Item 8.01 since the SEC's May 2024 clarification. Most 8.01 disclosures never became 1.05 filings. About a third of companies that filed under 1.05 later amended their filing at least once, which shows how often the first version is incomplete.

✨ Why knowing where your data lives decides materiality

A materiality call is mostly a question about data. Lawyers and executives make the decision, but they can only make it as fast as the security team can answer a few basic questions:

• What sensitive data was in the affected systems? Customer records, card numbers, health data, credentials, source code or deal documents?
• How much of it was there, and whose was it?
• Was it shared publicly, sent outside the company, or pasted into an AI tool?
• When did the exposure start, and is it still going on?
• What did we do to stop it, and when?

Most companies struggle here because their sensitive data no longer sits in a few databases. It lives in Slack threads, Google Drive folders, Zendesk tickets, Salesforce notes, laptops, browser sessions and AI chats. If nobody has mapped it, every incident starts with days of manual searching. That is time the four-day clock and the 30-day S-P window don't give you.

The same gap hurts Item 106. If your 10-K says you monitor and control sensitive data, an examiner may ask you to show how. Policies with no evidence behind them are exactly what the 2026 exam priorities are built to catch.

🎥How Strac helps you meet the SEC's expectations

Strac is a data security platform that combines data discovery (DSPM) and data loss prevention (DLP) in one product. It covers SaaS apps, cloud storage, endpoints, browsers and AI tools. Here is how its features line up with what the SEC now asks for.

1. Know what sensitive data you have, before an incident

Strac connects to more than 50 SaaS and cloud apps without agents, including Slack, Google Drive, Gmail, Microsoft 365, OneDrive, Box, Salesforce, Zendesk, Intercom, Jira, Notion, HubSpot, AWS S3 and Postgres. It scans both new content and historical data, so you get a full inventory on day one rather than only what was created after setup.

Strac finds PII, PHI, card data, secrets and API keys, plus custom patterns specific to your business. OCR lets it read text inside images and scanned documents, which is where a lot of regulated data hides.

Why it matters for the SEC: when an incident hits, you already know which systems hold customer data and how much. That shortens the materiality decision and gives you facts for your 8-K and your S-P notices.

2. Fix exposure as it happens, not after a review

Alerts alone don't reduce risk. Strac can redact, mask, block, delete or quarantine sensitive content automatically, and it can revoke public or external sharing on files. For example, it can redact a Social Security number posted in a support ticket, or pull back a Google Drive link that was shared publicly with customer records inside.

Strac is also an official Slack Marketplace app built on Slack's Discovery API. It inspects messages, files, canvases and huddles across Enterprise Grid, and it works on Free, Pro and Business+ plans too.

Why it matters: Regulation S-P asks firms to contain and control incidents, and examiners want to see that controls work. Automatic fixes, each with a timestamp, show that they do.

3. Control AI tools and shadow AI

The first AI-related 8-K came from unauthorized AI software. Strac addresses that path in three ways:

• Shadow AI discovery shows every AI tool employees are using, so you can approve or block each one.
• Browser DLP checks what employees type, paste or upload into ChatGPT, Claude, Copilot, Gemini and similar tools, and redacts or blocks sensitive data before it is sent.
• MCP DLP covers AI agents that connect to company systems through the Model Context Protocol. These agents can pull records from Drive, Slack, Salesforce, Jira and internal databases in a single workflow, so Strac inspects that traffic too.

Why it matters: examiners will ask how you supervise AI use and how you stop customer data from reaching unapproved tools. Strac gives you both the control and the record.

4. Cover laptops and desktops

Strac's endpoint agent runs on Mac, Windows and Linux. It watches the ways data leaves a device, including uploads, USB drives, typed text and browser activity. Each data type and channel can be set to audit, warn or block. Many teams start in audit mode, then warn on PII and PHI, then block secrets and card data once they trust the results.

Data lineage shows how a file or record moved between apps and devices. After an incident, that history answers the question of where the data went.

5. Build the paper trail regulators expect

Every detection and every action Strac takes is logged. Alerts go to Slack, Microsoft Teams, email or your SIEM, so they fit into your existing incident process. When your 10-K describes how you manage cyber risk, or an examiner asks for proof, you can show actual events, dates and responses.

The same controls support PCI DSS, HIPAA, ISO 27001, SOC 2, GDPR and CCPA, so one program serves several audits.

What Strac does not replace

Strac protects data. It is not your identity provider, your password manager or your multi-factor authentication tool, and it does not make the materiality decision for you. It works alongside those tools and gives your legal and executive teams the facts they need to decide quickly.

Bottomline

The SEC's cyber rules have outlasted a repeal campaign, a major enforcement loss and a full review of Regulation S-K. Regulation S-P has added a 30-day customer notice duty for financial firms, and exam priorities now treat AI and cybersecurity as one risk. The first AI-related 8-K shows where this is heading.

What ties all of this together is simple. You can't disclose, notify or defend what you can't see. Companies that know where their sensitive data lives, stop it from leaking into the wrong apps and AI tools, and keep a clear record of what happened will make faster, calmer decisions when the clock starts.

Strac gives you that visibility and control across SaaS, cloud, endpoints, browsers and AI in one platform.

‍Book a demo to see how it fits your SEC and Regulation S-P program.

🌶️ Spicy FAQs on SEC's New Cybersecurity Rules

Are the SEC cybersecurity disclosure rules still in effect in 2026?

Yes. Despite the Regulation S-K review and several requests to repeal them, Item 1.05 of Form 8-K and Item 106 of Regulation S-K remain in force as adopted in 2023. No amendment has been proposed.

When does the four-business-day clock start?

It starts when the company decides the incident is material, not when it is discovered. The SEC still expects that decision to be made without unreasonable delay.

Should we file under Item 1.05 or Item 8.01?

Use Item 1.05 only for incidents you have determined to be material. If you want to disclose an incident before reaching that decision, or one you believe is not material, use Item 8.01. If it later becomes material, file under Item 1.05 within four business days.

How is Regulation S-P different from the 8-K rules?

The 8-K rules apply to public companies and protect investors. Regulation S-P applies to brokers, advisers, investment companies and transfer agents, whether public or private, and protects their customers. It requires notice to affected individuals within 30 days. A public financial firm may have to deal with both at once.

Can an AI tool cause a reportable incident?

Yes. In May 2026 a public company filed an Item 1.05 8-K after unauthorized AI software exposed customer personal data. AI tools that receive or connect to sensitive data belong in your risk program and your 10-K description.

Does Strac help with the materiality decision?

Strac does not decide materiality, but it gives the people who do a fast, factual answer about what data was exposed, where it went, and what was done about it. That is the information that usually slows the decision down.

How long does Strac take to set up?

SaaS integrations are agentless and typically connect in minutes. The endpoint agent and browser controls can start in audit mode, so you can see results before enforcing anything.