“File an 8-K in Four Days”: Which Date Actually Starts the SEC Clock?
Recover the incident-discovery, materiality-decision, filing, delay and amendment records behind a four-day SEC cyber-disclosure claim.
Signals to watch
- A security team has an incident-discovery timestamp but cannot identify when the registrant determined the incident was material
- A legal or investor-relations discussion treats a request to the Department of Justice as if it automatically paused the Item 1.05 deadline
- The initial filing is approaching while material information remains unavailable and no owner is assigned to the later amendment
The SEC’s four-business-day deadline generally starts when a registrant determines that a cybersecurity incident is material—not when the security team first discovers the incident. Discovery starts a different obligation: the company must make its materiality determination without unreasonable delay. To recover the real filing clock, preserve four separate entries: discovery, materiality determination, the Item 1.05 filing or valid delay, and any later amendment.
This distinction matters to an incident-response and disclosure-advisory sales lead reviewing authorised public-company security, legal and investor-relations Telegram groups. The useful commercial discussion is not a repost saying “SEC gives you four days.” It is a registrant with a missing decision record, an approaching disclosure date or facts still moving between security and disclosure owners. Seeing it a day late can mean missing the meeting where the company assigns outside help for decision records, filing support and later-information tracking.
This article explains source recovery, not whether a particular incident is material or what a registrant should disclose. Those are fact-specific legal and disclosure decisions for authorised company advisers.
The four-day phrase hides four different timestamps
The SEC’s 2023 adopting release and Form 8-K Item 1.05 require a registrant to disclose a cybersecurity incident it determines to be material. The filing describes the material aspects of the incident’s nature, scope and timing, and its material impact or reasonably likely material impact on the registrant.
The workflow fails when one timestamp is copied into every field. The security ticket may record initial discovery. A later authorised record may show when the registrant determined materiality. EDGAR shows when a filing was accepted. A later technical finding may start the amendment clock. These dates answer different questions and should never overwrite one another.
Preserve discovery without starting the filing clock there
First record when and how the registrant discovered the incident or series of related unauthorised occurrences. Save the incident identifier, affected environment, first known facts, source system, time zone and the person who opened the response process.
Discovery does not automatically start the four-business-day filing period. Item 1.05 says the registrant must determine materiality without unreasonable delay after discovery. That phrase prevents a company from postponing the decision simply to postpone filing, while recognising that incident facts may require investigation.
Do not replace the discovery timestamp with “management became aware” unless the source actually supports that event. Also preserve related-incident analysis: SEC C&DI 104B.09 explains that individually immaterial incidents may require disclosure when related incidents are collectively material.
Capture the materiality determination as its own decision record
The filing clock starts on the date the registrant determines that the incident is material. The SEC’s Form 8-K C&DIs restate the traditional materiality standard: whether there is a substantial likelihood that a reasonable shareholder would consider the information important or that it would significantly alter the total mix of available information. The analysis considers all relevant facts and circumstances, including quantitative and qualitative factors.
A useful source record identifies:
- the decision date, time zone and incident scope considered;
- the authorised person or body making the determination under the registrant’s process;
- the facts available, uncertainties retained and material impacts or reasonably likely material impacts considered;
- the record approving the decision and the filing owner who received it.
A board meeting may form part of a company’s process, but the rule does not make a board vote the universal Item 1.05 trigger. A group message saying “board decided” still needs the registrant’s actual decision record. Likewise, consulting the Department of Justice, Federal Bureau of Investigation or another agency does not by itself establish materiality; C&DI 104B.04 expressly permits consultation before the assessment is complete.
Calculate the due date, then test any delay against written evidence
Once the materiality date is established, calculate four business days using the registrant’s filing calendar and document the calculation. Then verify the proposed filing on EDGAR by registrant, form type and accepted timestamp. EDGAR is the public filing record; it does not reveal the private discovery or materiality deliberation that preceded it.
Do not mark the clock paused merely because someone requested a national-security or public-safety delay. SEC C&DI 104B.01 states that the request alone does not change the filing obligation. Delay is available only if the United States Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the SEC in writing before the Form 8-K otherwise would be due.
The initial delay may be up to 30 days. Further periods require the determinations and notifications described in Item 1.05(c). If an additional request is declined or unanswered, C&DI 104B.02 says the filing is due within four business days after the existing delay expires. If the Attorney General ends the delay early, C&DI 104B.03 says the filing is due within four business days after the notification to the SEC and registrant.
Keep the initial filing and later amendment on separate lines
An investigation can continue after the Item 1.05 deadline. If required information is not determined or unavailable when the initial filing is due, Item 1.05(b) directs the registrant to identify that information in the filing. The registrant then files an amendment containing the information within four business days after it determines the information or the information becomes available.
The ledger therefore needs one line for the initial 8-K and another for the 8-K/A amendment. Record exactly which required fact was unavailable, who owns its investigation, when it became available and the amendment due date. “Investigation ongoing” is not a reason to erase the initial filing entry or to postpone every known material fact.
For source recovery from a screenshot or forwarded claim, use the official-source ladder before relying on a third-party summary. The regulatory-update briefing check handles the adjacent problem of separating an official update from an internal interpretation.
Worked example: turn one urgent message into a clock ledger
Consider this composite fragment, written for explanation and not taken from a company or real incident:
“Cyber incident found Friday. Legal says material, 8-K in four days. DOJ delay requested.”
The sales lead should not calculate a deadline from this sentence. Friday has no date or time zone. It is unclear whether legal made the registrant’s final determination, when that occurred, whether the affected company is a registrant, whether related incidents exist, or whether the Attorney General sent the required written notification.
The recovered ledger could look like this:
- Discovery entry: dated incident record; facts and scope then known.
- Materiality entry: separately dated authorised determination; facts considered and filing owner.
- Deadline entry: four-business-day calculation from entry two; EDGAR submission status.
- Delay entry: request time plus the Attorney General determination and SEC written-notification evidence, or
no qualifying notice found. - Amendment entry: information unavailable at filing, availability date, owner and 8-K/A deadline.
Only after those entries are sourced can an adviser scope decision-record recovery, drafting support or amendment tracking. The ledger does not decide materiality and does not certify compliance.
Key facts
- The SEC adopted the cybersecurity disclosure rule on 26 July 2023.
- Item 1.05 generally requires a Form 8-K within four business days after the registrant determines the incident is material.
- The materiality determination must be made without unreasonable delay after discovery.
- Requesting a Department of Justice delay does not by itself change the deadline.
- Missing required information is identified in the initial filing and added by amendment within four business days after determination or availability.
- EDGAR proves the public filing and accepted timestamp, not the registrant’s private discovery or decision history.
TOP Prospect can filter and group incomplete discussions from Telegram groups a user deliberately connects and is authorised to access, retain source text and time, remove obvious duplicates and rank candidates for human review. It cannot access incident systems or board records, determine materiality, calculate a legal deadline for a registrant, contact participants, draft legal advice or file with the SEC. Pricing and access options describe that discovery layer.
FAQ
Does the four-business-day clock start when a cyber incident is discovered?
No. Item 1.05 generally requires filing within four business days after the registrant determines that the incident is material. The registrant must make that determination without unreasonable delay after discovery.
Must the board make the Item 1.05 materiality determination?
The SEC rule places the obligation on the registrant and does not make a board vote the universal trigger. The company should preserve who made the determination under its authorised disclosure process and when it was made.
Does asking the Department of Justice for a delay stop the filing clock?
No. SEC C&DI 104B.01 says a request alone does not change the obligation. Delay is available only when the Attorney General makes the required determination and notifies the SEC in writing before the Form 8-K otherwise would be due.
When is an Item 1.05 amendment required?
If information required by Item 1.05(a) is not determined or unavailable when the initial Form 8-K is filed, the registrant must identify the missing information and file an amendment containing it within four business days after determining it or when it becomes available.
The useful handoff is not “Friday plus four.” It is a ledger in which discovery, materiality, filing, delay and amendment each retain their own source and timestamp.
Frequently asked questions
Does the four-business-day clock start when a cyber incident is discovered?
No. Item 1.05 generally requires filing within four business days after the registrant determines that the incident is material. The registrant must make that determination without unreasonable delay after discovery.
Must the board make the Item 1.05 materiality determination?
The SEC rule places the obligation on the registrant and does not make a board vote the universal trigger. The company should preserve who made the determination under its authorised disclosure process and when it was made.
Does asking the Department of Justice for a delay stop the filing clock?
No. SEC C&DI 104B.01 says a request alone does not change the obligation. Delay is available only when the Attorney General makes the required determination and notifies the SEC in writing before the Form 8-K otherwise would be due.
When is an Item 1.05 amendment required?
If information required by Item 1.05(a) is not determined or unavailable when the initial Form 8-K is filed, the registrant must identify the missing information and file an amendment containing it within four business days after determining it or when it becomes available.
Sources and further reading
- SEC Release Nos. 33-11216 and 34-97989, Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, 26 July 2023
- SEC Form 8-K, Item 1.05 Material Cybersecurity Incidents, accessed 13 August 2026
- SEC Compliance and Disclosure Interpretations, Exchange Act Form 8-K Section 104B, accessed 13 August 2026
- SEC EDGAR Search, accessed 13 August 2026
How a Signal worth attention is found
See how Top Prospect finds and organizes Signals worth checking, keeps the original Telegram context, removes duplicates, and helps you decide what to review first. You decide whether to follow up and what to do next.
