You are the CISO of a US-listed company and just concluded a ransomware incident is material. What does the SEC expect and when?

This question checks whether you know the disclosure clock and its trigger, not just that "we must disclose".

What the SEC requires

The SEC's 2023 rules require registrants to disclose material cybersecurity incidents on Form 8-K Item 1.05, generally due four business days after the registrant determines the incident is material. The filing must describe the material aspects of the incident's nature, scope and timing, and its material impact or reasonably likely material impact on the registrant.

The only delay

Disclosure may be delayed only if the U.S. Attorney General determines immediate disclosure would pose a substantial risk to national security or public safety and notifies the Commission in writing. Legal convenience or ongoing investigation alone does not qualify.

Annual disclosure is separate

Regulation S-K Item 106 requires companies to describe in the annual Form 10-K their cybersecurity risk assessment processes, board oversight and management expertise. A strong CISO program has this governance evidence ready before an incident.

Why the wrong answers fail

The clock runs from the materiality determination, not from discovery, so "four business days from discovery" is inaccurate. Waiting for the next quarterly report ignores the 8-K deadline, and customer notification does not replace SEC disclosure.

What interviewers want

The trigger, the four-day clock, the narrow delay, and the CISO's role driving a documented, timely materiality assessment with legal.