Dark Reading Confidential: The CISO and the SEC is Episode 1 of Dark Reading’s Dark Reading Confidential podcast. Published May 10, 2024, the approximately 51-minute episode examines what happens when a public company’s cybersecurity incident may become a securities-disclosure event—and why the chief information security officer (CISO) cannot manage that decision alone.
The episode is useful background, but it is not current regulatory guidance. As of August 16, 2026, the operative framework remains the SEC’s 2023 cybersecurity-disclosure rule: a domestic registrant generally files Form 8-K Item 1.05 within four business days after determining that a cybersecurity incident is material, while annual reports describe cybersecurity risk management, strategy and governance.
What is Dark Reading Confidential: The CISO and the SEC?
Dark Reading’s page is both the episode listing and a transcript of the inaugural episode of its podcast. It identifies the program as Episode 1 and gives a runtime of about 51 minutes. The page was published May 10, 2024; a third-party Amazon Music listing shows May 9, 2024. You can read the transcript and episode details at Dark Reading.
Participants
- Frederick “Flee” Lee, then chief information security officer of Reddit
- Ben Lee, Reddit’s chief legal officer
- Beth Burgin Waller, a cybersecurity attorney
- Dark Reading editors Kelly Jackson Higgins and Becky Bracken
The discussion is executive, legal and governance-oriented rather than a technical tutorial. Its central question is how security leaders should operate when an incident, or a pattern of incidents, could affect investors and trigger SEC reporting.
#1 Best Overall
What the SEC cybersecurity rule requires
The SEC adopted its cybersecurity disclosure rules on July 26, 2023; the final rule became effective September 5, 2023. The SEC’s announcement is at SEC Release 2023-139, with compliance information at the SEC rule page.
Material incidents: Form 8-K Item 1.05
A domestic registrant generally must file Form 8-K Item 1.05 within four business days after it determines that a cybersecurity incident is material. The trigger is not automatically the first alert or discovery. The company must make the materiality determination without unreasonable delay, then count four business days from that determination.
The filing describes the incident’s nature, scope and timing, and its material impact or reasonably likely material impact. The SEC’s small-entity compliance guide explains the rule and covered disclosures at the SEC compliance guide.
Annual risk-management and governance disclosure
Regulation S-K Item 106 requires a Form 10-K to describe the company’s processes for assessing, identifying and managing material cybersecurity risks; material risks and their effects; board oversight; and management’s role and relevant expertise. Those statements should match the company’s actual governance. A filing that portrays a mature process can invite difficult questions if the incident record shows no clear escalation, ownership or board reporting.
Recommended Free Tools
Foreign private issuers and other timing questions
Foreign private issuers use Form 6-K for comparable incident disclosures and Form 20-F for annual cybersecurity risk-management, strategy and governance disclosures. The final rule also contains special compliance timing provisions for smaller reporting companies; companies should verify the applicable date and current SEC instructions rather than assume the standard domestic-registrant timetable. The final rule is available at the SEC’s final-rule PDF.
When delay is permitted
There is a narrow national-security and public-safety exception. Delay may be available when the U.S. attorney general makes the required determination that immediate disclosure would pose a substantial risk and provides written notice to the SEC. A company cannot create its own indefinite extension because investigators are still working.
Incomplete facts and later amendments
A filing may be due while the forensic investigation is incomplete. The company should identify what is known, what is reasonably concluded and what remains undetermined. If required information is unavailable, later developments may require an amendment. SEC staff guidance on incident disclosures is at the SEC’s May 21, 2024 guidance page.
If a company first reports an event under Form 8-K Item 8.01 before deciding whether it is material, it still must make that determination without unreasonable delay and file under Item 1.05 if the event is material. Item 8.01 is not a way to avoid the Item 1.05 obligation.
What “material” means
Materiality asks whether there is a substantial likelihood that a reasonable shareholder would consider the information important, or whether it would significantly alter the total mix of information available to investors. The SEC did not set one dollar, downtime or record-count threshold.
Factors a cross-functional team should evaluate
- Actual or expected financial loss, cost or effect on results of operations
- Revenue interruption and disruption to critical operations
- Customer, employee or user impact
- Theft or exposure of sensitive information
- Regulatory, contractual and litigation exposure
- Effects on products, services, market access or strategic initiatives
- Reputational consequences
- Effects on financial condition and the information available to investors
- Whether related incidents should be assessed together
A ransomware payment alone does not decide materiality. A small payment may accompany a material outage or data theft, and a large payment is not automatically material. Similarly, a resolved incident can still require Item 1.05 reporting if the company determined it was material. SEC staff interpretations are available at the Form 8-K interpretations page.
Several individually minor, related attacks may become material collectively. The analysis should therefore consider the series, not only the latest alert.
Why the CISO feels exposed
The episode’s anxiety comes from a real organizational mismatch: a CISO may be expected to understand the security posture and raise urgent risks without controlling the budget, product design, development priorities, risk acceptance, public statements or legal strategy.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11| Role or question | What it usually means |
|---|---|
| Operational responsibility | Running security controls, detection, response and remediation. |
| Information and escalation responsibility | Reporting material facts, uncertainty and unresolved risk to decision-makers. |
| Decision-making authority | Authority to accept risk, fund remediation, suspend operations or change a product. |
| Disclosure approval | Authority to approve SEC filings and coordinated investor communications, normally shared among legal, finance and executive leadership. |
| Personal exposure | Possible witness, investigative, employment or reputational exposure; not automatic personal liability for every company incident. |
The SEC rule does not say that every CISO personally files a report or is automatically liable when a company is breached. Regulators may examine what individuals knew, when they knew it, what they communicated and whether public statements were misleading. The company’s governance documents should make those boundaries explicit.
What the Uber and SolarWinds examples show
The episode discusses former Uber CISO Joe Sullivan’s criminal conviction related to Uber’s 2016 breach and SEC proceedings involving SolarWinds and its CISO Tim Brown concerning cybersecurity disclosures associated with the 2020 supply-chain attack. Dark Reading’s transcript notes that Brown was the only SolarWinds officer charged by the SEC; that qualification matters.
These cases illustrate different forms of exposure—criminal prosecution, civil enforcement, investigation, employment consequences and reputational damage. They do not establish that the 2023 SEC rule automatically makes CISOs personally liable for a company’s incident.
The first four business days: a practical framework
The following is an organizational checklist, not legal advice. Other laws, contracts and insurance policies may impose earlier deadlines.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →| Period | Priority actions |
|---|---|
| First hours | Activate the incident plan; name an incident commander; bring in security, legal, executive leadership, communications, investor relations and affected business owners; preserve evidence; create a controlled fact log; identify potentially affected regulated data, critical operations, financial systems and third parties; check insurance and contractual notice requirements; and consider law-enforcement contact. |
| First business day | Separate confirmed facts from hypotheses. Establish known start and discovery times, affected systems, possible data exposure, operational effects and whether the event remains active. Start a documented materiality assessment and brief the appropriate board or disclosure committee. Decide whether outside counsel should direct portions of the investigation. |
| Days two through four | Reassess materiality as facts develop; characterize operational, financial, legal, regulatory, customer, reputational and strategic impact; draft Form 8-K Item 1.05 if materiality has been determined; state what remains unavailable or undetermined where appropriate; and align SEC, customer, employee, press and investor communications. |
| After filing | Continue the investigation; track facts that could require an amendment; update the board and audit or risk committee; revisit insurance, contractual, regulatory and litigation duties; document lessons and control changes; and evaluate effects on annual risk-management and governance disclosures. |
Do not wait for perfect forensic certainty. At the same time, avoid unsupported claims that there was no impact, no data access or no continuing risk. A filing can be precise about known facts while acknowledging open questions.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Information to disclose—and information to protect
The rule calls for material aspects of nature, scope, timing and impact. It does not require publishing response plans, security architecture, exploitable vulnerabilities or details that would impede remediation. Legal and security teams should decide what is necessary for an investor-facing disclosure without turning the filing into an attacker’s manual.
Privilege is not automatic merely because a lawyer is copied on an email. Protection depends on the communication’s purpose, participants and applicable law. Keep technical fact gathering, legal advice and business decisions clearly identified, and follow counsel’s instructions on preservation and distribution.
Governance changes to make before an incident
Write down ownership
- Define the CISO’s reporting line and right to escalate material risk.
- Identify who may accept cyber risk and who owns remediation deadlines.
- Name the materiality and disclosure committee, including legal, finance, executive, investor-relations and security participation.
- Specify who approves a Form 8-K and who communicates with the board or audit committee.
Make escalation usable
Give the CISO direct access to senior leadership and, where appropriate, the board or audit committee. If a remediation recommendation or escalation is rejected, record the recommendation, decision, rationale, accountable owner and accepted risk through the company’s normal governance process.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteBest Value
Rehearse the decision, not just the breach
Tabletop exercises should include materiality analysis, board escalation, investor relations, communications, customer notices, insurance, law enforcement and a draft filing. Test a scenario in which facts change after the initial report and a later amendment may be needed.
Check annual-report consistency
Compare the actual incident-response process, reporting lines and management expertise with the descriptions in the Form 10-K. Governance language should describe how the organization really works.
What the episode gets right—and leaves unresolved
The episode correctly presents SEC readiness as a coordination problem rather than a task assigned to the CISO. Security operations supply the facts, but finance, business leaders, legal counsel, communications, investor relations, the board, insurers, forensic investigators and sometimes law enforcement all affect the outcome.
It also exposes an unavoidable trade-off:
- Earlier disclosure: better deadline discipline and investor timeliness, but greater risk of inaccurate or overly revealing statements.
- More investigation: better scope and impact analysis, but risk of unreasonable delay, missed deadlines and inconsistent internal narratives.
The practical answer is neither instant speculation nor endless investigation. It is a documented, cross-functional materiality process that distinguishes facts from assumptions and keeps reassessing the decision as the record changes.
Investor takeaway
For shareholders and board members, the important question is not simply whether a company has suffered a breach. Ask whether it has clear authority, reliable evidence, prompt escalation and a repeatable process for deciding what investors need to know. SEC readiness is an organizational-design issue involving responsibility, authority, documentation and decision-making under uncertainty.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
