Regulatory Standards · United States
SEC Cybersecurity Disclosure Rules
Disclose cyber risk with numbers you can defend.
SEC rules require public companies to disclose material cybersecurity incidents and describe their risk management and governance each year. Astragar provides the evidence and financial view behind both.
Register interest in SEC Cyber RulesComing to Astragar GRC
4 days
Business days to file Form 8-K Item 1.05 after determining materiality
Item 106
Annual 10-K disclosure of risk management, strategy and governance
Board
Oversight of cyber risk must be described
What SEC Cyber Rules requires
The obligations, in brief.
Materiality determination
Assess incident materiality without unreasonable delay.
Incident disclosure
File Form 8-K within four business days of a materiality determination.
Risk management
Describe processes for assessing, identifying and managing cyber risk.
Governance
Describe board oversight and management's role and expertise.
How Astragar helps
From checklist to measurable risk.
01
Requirement → control mapping
Map every SEC Cyber Rules requirement to controls, systems, assets and owners.
02
Evidence, continuously
Collect and maintain evidence, with sign-off from contributor to IT auditor, CISO and executive office.
03
Exposure behind the gaps
See which vulnerabilities and sensitive data put SEC Cyber Rules controls at risk.
04
Risk in financial terms
Prioritise remediation by business and financial impact, not checklist order.
Materiality is a financial question. Astragar quantifies cyber exposure in dollars, giving disclosure decisions a defensible basis.
Sign-off workflow
Evidence Contributor
→IT Auditor
→CISO
→Executive Office
Find the data. Test the controls. Reduce the risk.
SEC Cyber Rules mapping is coming to Astragar GRC. Talk to us about early access and how your existing evidence already applies.
Talk to usAstragar supports compliance programmes with technical evidence and risk analysis. It does not provide legal advice or issue certifications.
See your cyber risk in $ terms, not CVSS scores.
