The SEC cybersecurity disclosure rules: What they mean for training and incident response

In July 2023, the U.S. Securities and Exchange Commission adopted new rules requiring public companies to disclose material cybersecurity incidents within four business days and to describe their cybersecurity risk management, strategy, and governance in annual filings. The rules, which took effect in December 2023, marked a significant shift in how the SEC treats cybersecurity. For the first time, public companies faced clear, enforceable timelines for incident disclosure and detailed expectations for board-level oversight. Here is what the rules mean and how security awareness training fits into compliance.

What the rules require

The new rules established two core obligations. First, companies must disclose material cybersecurity incidents on Form 8-K within four business days of determining the incident is material. Second, companies must annually describe, in Form 10-K, their processes for assessing, identifying, and managing material cybersecurity risks, the board's oversight of those risks, and management's role in implementing cybersecurity policies. The rules were designed to bring consistency to what had been inconsistent, voluntary disclosure.

Why the four-day clock matters

The four-business-day requirement was a major change. Previously, companies had wide discretion over when, or whether, to disclose incidents. The new rules created a hard deadline tied to a materiality determination, which itself is a judgment call that organizations must make quickly under pressure. This put a premium on having an incident response process that could rapidly assess impact, determine materiality, and produce the disclosures required. Organizations without a tested incident response plan suddenly faced real regulatory risk.

The emphasis on governance

The annual disclosure requirements signaled the SEC's belief that cybersecurity is a board-level issue, not just an IT concern. Companies must now describe who at the board and management level is responsible for cybersecurity, how they are informed of risks, and how they oversee the program. This has driven boards to ask harder questions about security controls, including whether employees are trained and whether that training is documented. Security awareness training, once a line item buried in IT, became a governance topic.

Where training fits in

Documented security awareness training supports SEC compliance in two ways. First, it is evidence of a functioning risk management process, which the rules require companies to describe. Second, and more importantly, it reduces the likelihood of the human-error incidents that trigger disclosure obligations in the first place. A well-trained workforce is less likely to fall for phishing, mishandle data, or fail to report a suspicious event. The rules do not explicitly mandate training, but they strongly incentivize it.

Incident response and the human element

The four-day disclosure clock depends on fast, accurate incident reporting. Employees are often the first to notice something is wrong, whether it is a suspicious email, unusual system behavior, or a device that has gone missing. If employees hesitate to report, the clock starts later, and the organization loses precious time. Training that emphasizes prompt incident reporting, and removes the fear of blame, is essential to meeting the rules' timeline requirements.

What organizations should do

The practical response to the SEC rules is to formalize the cybersecurity program. That means: documenting security awareness training with completion records; implementing and testing an incident response plan; establishing clear materiality assessment procedures; and ensuring board and management oversight is real and documented. Organizations that treat these as formal, documented programs will find compliance with the SEC rules far more manageable than those that treat them as informal activities.