# Cyber Incident Disclosure Rule: 2026 Item 1.05 4-Day vs Natural Language Processing

Natalie Fletcher · October 26, 2026

> SEC Item 1.05 sets a four-business-day clock for material cyber incidents; NLP-assisted triage in the first 24 hours decides what reaches counsel.

| Takeaway | Detail |
| --- | --- |
| SEC Item 1.05 sets a four-business-day disclosure clock for material cyber incidents | The clock is a materiality-determination problem, not a drafting problem, under the rule described in the headline and thesis. |
| Every incident must pass documented NLP-assisted materiality triage within the first 24 hours | The reader rule requires triage in the first 24 hours before any Item 1.05 determination. |
| Only the flagged subset goes to human counsel for the Item 1.05 determination | Human judgment remains required for the four-business-day determination after triage. |
| FAIR-MAM and SEC enforcement perspective inform materiality triage | A FAIRCON session introduced FAIR-MAM alongside David Hirsch, the SEC official charged with enforcing new disclosure rules. |

This guide explains how to run SEC Item 1.05 materiality decisions through a documented NLP-assisted triage within 24 hours.

It then routes only flagged incidents to human counsel for the four-business-day determination.

![Cyber Incident Disclosure Rule](https://static.mm-ais.com/article-images-ai/cyber-incident-disclosure-rule-2026-item-ai-5da9586d.jpg)

## How the Item 1.05 clock actually runs

Item 1.05 of Form 8-K is a clock that starts only after a company determines that a cybersecurity incident is material. Discovery of the incident, containment work, and internal escalation do not start the four-business-day period; the filing obligation runs from the materiality determination. That distinction is the core issue: the hard part is deciding materiality under uncertainty, not drafting the disclosure once the decision is made.

The trigger is therefore a judgment event, not an incident timestamp. A company should be able to show when it concluded that the incident was material, who made that conclusion, and what facts supported it. If the determination is made late in the day or outside business hours, the practical count should begin on the next business day, and the filing deadline should be confirmed against the company's own calendar and EDGAR cutoff rather than assumed.

Counting the window means four business days, not four calendar days. Weekends and federal holidays are generally excluded, and the determination date itself is usually treated as day zero. Because the rule is measured in business days, a determination made on a Friday can push the deadline into the following week; counsel should verify the exact date and time rather than rely on a rough mental count.

The enforcement posture also points toward structured materiality analysis. Per fairinstitute.org, David Hirsch, the SEC official charged with enforcing the new disclosure rules, was featured at a FAIRCON session introducing the FAIR Materiality Assessment Model (FAIR-MAM). That does not make FAIR-MAM a safe harbor, but it signals that examiners are comfortable with documented, repeatable materiality frameworks rather than ad hoc judgment.

For compliance, the defensible record is a dated materiality determination memo: incident summary, affected systems or data, known and reasonably likely impacts, the decision maker, and the date and time of the conclusion. The memo should be created when the determination is made, not reconstructed after the filing, because the four-business-day clock is measured from that documented moment.

![How the Item 1.05 clock actually runs — Cyber Incident Disclosure Rule](https://static.mm-ais.com/article-images-ai/cyber-incident-disclosure-rule-2026-item-ai-df6a7111.jpg)

## What the evidence actually shows

The evidence in this section is limited to three named sources: a vendor product page, a framework announcement, and a magazine interview with the SEC chair. Each is useful for what it says about process or posture, but none is an independent measurement of disclosure outcomes.

Kovrr states on kovrr.com that its CRQ platform "automates this assessment process, helping organizations determine cyber materiality clearly and consistently to support compliance and investor transparency." Read as a named vendor claim, that sentence describes intended capability; it does not establish accuracy, false-positive rates, or regulator acceptance.

The FAIR Institute, per fairinstitute.org, introduced the FAIR Materiality Assessment Model (FAIR-MAM) at FAIRCON and tied it to SEC disclosure enforcement through David Hirsch, the SEC official charged with enforcing new disclosure rules. That is a named framework in an enforcement context, not a benchmark or validation study.

Per ACCA's AB Magazine (March 2026), SEC Chairman Paul Atkins is reported to be pursuing an overhaul of Regulation S-K, the rules governing what businesses must disclose as material. Before relying on any specific quotation or comment deadline attributed to that article, verify it against the original AB Magazine piece and the SEC's own comment-request notice, and record the pull date. Those remarks, if confirmed, support a streamlining review; they do not state that the materiality standard itself has changed.

| Source | Specific claim | What it does not establish |
| --- | --- | --- |
| Kovrr (kovrr.com) | CRQ automates cyber materiality assessment for compliance and investor transparency | Independent accuracy or regulator acceptance |
| FAIR Institute (fairinstitute.org) | FAIR-MAM introduced at FAIRCON in SEC disclosure enforcement context | Adoption, validation, or benchmark performance |
| ACCA AB Magazine, March 2026 | Atkins: Regulation S-K has grown from gym-locker to AI-datacentre scale | A change to the materiality determination the rule requires |

The practical check is to record source, claim, and limitation together: Kovrr shows product positioning, FAIR-MAM shows model availability, and Atkins shows regulatory appetite for reducing immaterial disclosure. None of the three shows that a triage tool will correctly classify a particular incident, so the record should treat each as context for human judgment rather than as proof.

![What the evidence actually shows — Cyber Incident Disclosure Rule](https://static.mm-ais.com/article-images-pixabay/cyber-incident-disclosure-rule-2026-item-7f71889a.jpg)

## Options compared: manual vs NLP-assisted triage

Three triage designs compete for the same incident queue, and they differ less in tooling than in where judgment is allowed to enter. Option A keeps every incident in front of counsel; Option B lets a model classify materiality; Option C uses the model to flag and draft while counsel still decides. The comparison below names Option C as the workable middle, because it preserves the human determination that Item 1.05 requires while reducing the volume of incidents that need that determination.

| Option | Strength | Weakness | Fit for Item 1.05 |
| --- | --- | --- | --- |
| A — pure manual triage | Highest judgment quality | Slowest clock start; no audit trail of why something was deemed immaterial | Defensible but bottlenecked |
| B — pure NLP triage | Fastest classification | No named source in this grounding validates model accuracy for Item 1.05 determinations | Unsupported as sole decider |
| C — NLP-assisted with human sign-off (winner) | Model flags and drafts; counsel decides | Requires documented handoff and review | Matches FAIR-MAM structured-assessment direction and preserves human judgment |

Option A is the quality-first design: counsel reads every incident, so the materiality call is made by the person who will sign it. The cost is queue time and an absent record of why an incident was deemed immaterial, which makes later review harder when the same facts are revisited.

Option B is the speed-first design: a model classifies materiality and moves the queue quickly. The available sources here does not contain a named source that validates model accuracy for Item 1.05 determinations, so treating the model as the decider would outrun the evidence. Kovrr’s CRQ platform is described as automating the assessment process to help organizations determine cyber materiality clearly and consistently, but that is a process claim, not an accuracy validation for this rule.

Option C is the winner because it splits the work without splitting accountability. The model flags likely material incidents and drafts the first pass; counsel makes the determination and signs it. That structure aligns with the FAIR Institute’s introduction of the FAIR Materiality Assessment Model (FAIR-MAM) at a FAIRCON session that also featured David Hirsch, the SEC official charged with enforcing new disclosure rules, in the sense that both point toward structured assessment rather than ad hoc judgment. It also keeps the human decision in the path that the rule requires.

Practical test: if a design cannot show who decided, on what flagged evidence, and when, it is not yet Option C; it is Option B with a human name attached. The audit trail should record the model’s flag, the evidence it used, counsel’s decision, and the time of sign-off, so the triage can be reviewed without reconstructing the queue from memory.

![Options compared: manual vs NLP-assisted triage — Cyber Incident Disclosure Rule](https://static.mm-ais.com/article-images-pixabay/cyber-incident-disclosure-rule-2026-item-eff9a134.jpg)

## Costs and numbers that matter

Four business days is the outer bound for the Item 1.05 filing, not a target. A determination made on Friday moves the due date to the following Thursday, so the longest calendar gap created by the rule is six calendar days from a Friday determination to a Thursday filing. That gap is a scheduling fact, not extra review time: the same four business days still have to be staffed, documented, and approved.

| Determination day | Four-business-day due day |
| --- | --- |
| Monday | Friday |
| Tuesday | Monday |
| Wednesday | Tuesday |
| Thursday | Wednesday |
| Friday | Thursday |

Weekend incidents can add calendar time before the determination is made, but they do not add business-day time after it. If an incident is discovered on Saturday and the materiality determination is made on Monday, the filing is still due the following Friday; the weekend bought calendar time, not a fifth business day. The practical check is to count business days from the determination date, not from discovery, containment, or escalation.

The nearest dated regulatory checkpoint in this grounding is the SEC comment deadline of 13 April 2026 reported by AB Magazine in its March 2026 article on Regulation S-K. Use that date as the internal deadline for documenting the materiality workflow, assigning owners, and recording the triage steps; it is a checkpoint for process readiness, not a filing date for any incident.

For money, do not reuse an old estimate. Pull any dollar figure for incident cost, remediation, or filing exposure from the current SEC enforcement page or the company's own incident-cost ledger, and record the source and pull date next to the number. If the source is older than the current quarter, re-pull it before the figure appears in a board, audit, or disclosure memo.

The fixed internal budget is the 24-hour triage rule described above: every incident goes through the documented NLP-assisted materiality triage within the first 24 hours, and only the flagged subset is routed to human counsel for the four-business-day determination. That keeps review cost concentrated where the clock is running and prevents a full manual review of every alert from consuming the same four business days.

If a cost or penalty figure is missing, leave it as a documented check rather than filling the gap with a remembered number: name the source to pull, the owner, and the date by which it must be refreshed. A section with no invented figures is more useful than one with a precise but unsupported estimate.

![Costs and numbers that matter — Cyber Incident Disclosure Rule](https://static.mm-ais.com/article-images-pixabay/cyber-incident-disclosure-rule-2026-item-54e19139.jpg)

## What the evidence does NOT establish

The available sources set does not contain a benchmark, validation study, or measured error rate for NLP materiality classification under Item 1.05. It contains product and framework descriptions and commentary on disclosure posture, not a test of whether a model correctly identifies material cyber incidents. The rule should therefore be presented as a control and routing practice, not as a performance claim. Any stated accuracy percentage, false-negative rate, or time saved would be invented.

The rule breaks when materiality depends on a fact outside the incident record. If a ticket describes a contained intrusion but omits an unreported downstream customer impact, a model reading only the ticket has no signal to elevate the case. The failure is not a wording problem; it is an information-boundary problem. The model cannot flag what it cannot see, and a clean triage result can be wrong for reasons no prompt or classifier can detect.

That limit means the triage output must be treated as a routing aid, not as a determination. Counsel still has to ask what is missing from the record, who else was affected, and whether the incident changes a prior disclosure. The documented triage should record the inputs reviewed and the gaps identified, so the later human determination can see what the model did not have.

The rule still wins in high-volume, low-severity streams, where the model's job is to clear noise rather than make the call. In that setting, the value is not a precise materiality answer; it is consistent first-pass sorting, deduplication, and escalation of cases that match defined patterns. Human judgment remains reserved for the flagged subset, while routine events are documented and closed without consuming counsel time.

| Where the rule helps | Where it does not |
| --- | --- |
| Clearing high-volume, low-severity noise and routing defined patterns | Incidents whose materiality depends on facts absent from the ticket |
| Documenting a consistent first pass for counsel review | Replacing the human materiality determination required by Item 1.05 |

![What the evidence does NOT establish — Cyber Incident Disclosure Rule](https://static.mm-ais.com/article-images-pixabay/cyber-incident-disclosure-rule-2026-item-1f1f038c.jpg)

## 24-hour triage in practice

At T+0h, open the incident ticket and run the NLP triage before anyone drafts a disclosure. The model ingests the ticket text, tags severity, and returns a materiality flag with cited ticket fields—affected systems, data types, customer impact, and containment status—so the first record is the model's stated reason rather than a later reconstruction. Log the ticket ID, open timestamp, model version, and cited fields in the same record.

At T+8h, route only flagged incidents to human counsel with the model's rationale attached. For unflagged incidents, log the model's stated reason for the immaterial call and the reviewer who accepted it. This keeps the human review queue narrow and preserves an audit trail for both branches. If the cited fields are incomplete or conflict with the ticket, escalate to counsel regardless of the flag.

At T+24h, counsel records the materiality determination in writing. That written timestamp—not the ticket-open time—starts the four-business-day clock. The record should state the determination, the evidence relied on, and whether the incident was flagged or unflagged at triage.

| Worksheet field | What to record | Why it matters |
| --- | --- | --- |
| Incident ID and open time | Ticket number and T+0h timestamp | Anchors the triage timeline |
| Source ticket | Original incident text or link | Preserves the model's input |
| NLP severity tag | Model's severity label | Shows the first-pass screen |
| Materiality flag | Flag plus cited ticket fields | Makes the triage explainable |
| Model rationale | Stated reason for flag or no flag | Supports later review |
| Routing decision | Flagged to counsel or logged as immaterial | Documents the handoff |
| Reviewer | Name or role accepting the triage | Assigns accountability |
| Counsel determination | Written timestamp and determination | Starts the filing clock |
| Final disposition | Filed, monitored, or closed | Closes the loop |

Keep the worksheet with the incident file rather than in a separate disclosure draft, and treat it as the single record of who decided what and when. Kovrr describes its CRQ platform as automating cyber materiality assessment, and FAIR-MAM is another framework introduced for this purpose; either way, the worksheet should capture the model's cited fields and the human determination separately.

## Worked Example: Run the Numbers

Illustration only: this is a hypothetical, not a reported incident. Party: Northwind Logistics, Inc. Scenario: suspected unauthorized data exfiltration identified during routine log review. Discovery time: Monday, 2 March 2026, 08:00 local time. Triage population: 120 incident-related documents and 40 affected systems. The 24-hour triage window and the four-business-day determination window are taken from the reader rule and the Item 1.05 framework; the counts above are illustrative and should not be treated as benchmarks.

## Frequently Asked Questions

**Does discovering a cybersecurity incident start the Item 1.05 disclosure clock?**

Discovery of the incident, containment work, and internal escalation do not start the four-business-day period; the filing obligation runs from the materiality determination.

**Which incidents are routed to human counsel under the triage process?**

Only the flagged subset goes to human counsel for the Item 1.05 determination.

**Is the NLP-assisted triage enough to make the final Item 1.05 determination?**

Human judgment remains required for the four-business-day determination after triage.

**What informs the materiality triage described in the guide?**

FAIR-MAM and SEC enforcement perspective inform materiality triage.

**Where was FAIR-MAM introduced alongside the SEC official charged with enforcing new disclosure rules?**

A FAIRCON session introduced FAIR-MAM alongside David Hirsch, the SEC official charged with enforcing new disclosure rules.

**When does the Item 1.05 clock actually begin?**

Item 1.05 of Form 8-K is a clock that starts only after a company determines that a cybersecurity incident is material.

## Quick answers

| What disclosure clock does SEC Item 1.05 set for material cyber incidents? | A four-business-day disclosure clock. |
| --- | --- |
| When does the Item 1.05 clock start? | Only after a company determines that a cybersecurity incident is material. |
| What must every incident pass within the first 24 hours? | Documented NLP-assisted materiality triage. |
| Which incidents go to human counsel for the Item 1.05 determination? | Only the flagged subset. |
| Who is the SEC official charged with enforcing new disclosure rules introduced alongside FAIR-MAM at a FAIRCON session? | David Hirsch. |

Also worth reading: **Wisconsin MSA NLP: 512-Token Pipeline Tested on 1,240 MSAs**: [Wisconsin MSA NLP: 512-Token Pipeline](https://lawr.io/blog/wisconsin-msa-nlp-512-token-pipeline-tested-on-1240-msas.php) · **NLP for NJ Municipal Defense: 40% Research Gain, Variance & Evidence**: [NLP for NJ Municipal Defense:](https://lawr.io/blog/nlp-for-nj-municipal-defense-40-research-gain-variance-evidence.php) · **NY Car Claims: NLP Liability Scoring Cuts Review Time 38% in 2026**: [NY Car Claims: NLP Liability](https://lawr.io/blog/ny-car-claims-nlp-liability-scoring-cuts-review-time-38-in-2026.php)

### Related reading

- [Non Disclosure Agreement Review: 58% Faster Hybrid vs Manual](https://lawr.io/blog/non-disclosure-agreement-review-58-faster-hybrid-vs-manual.php)
- [AI-Powered Document Analysis Reduces Social Security Disability Case Processing Time by 47% in Baltimore Law Firms](https://lawr.io/blog/ai_powered_document_analysis_reduces_social_security_disabil.php)
- [Technological Evolution in Contract Processing Analyzing Hancock County Solicitor's E-Filing Implementation and AI Integration Potential](https://lawr.io/blog/technological_evolution_in_contract_processing_analyzing_han.php)
- [Why United Processing Phone Scams Target You Understanding Their Deceptive Legal Threats](https://lawr.io/blog/why_united_processing_phone_scams_target_you_understanding_t.php)
- [Hays County Court Records Digital Access and Processing Trends in 2024](https://lawr.io/blog/hays_county_court_records_digital_access_and_processing_tren.php)
- [Latest South Carolina Data Car Accident Rates in Richburg Area Show 43-Minute Incident Pattern Through 2024](https://lawr.io/blog/latest_south_carolina_data_car_accident_rates_in_richburg_ar.php)

### Latest

- [Indemnification Clause Review 2026: Policy Guide for 90% vs 95% Auto-Accept...](https://lawr.io/blog/indemnification-clause-review-2026-policy-guide-for-90-vs-95-auto-accept-threshold.php)
- [AI Content Labels: European Union AI Act Article 50—Label by Aug. 2, 2026](https://lawr.io/blog/ai-content-labels-european-union-ai-act-article-50label-by-aug-2-2026.php)
- [European legal artificial intelligence fines: €15M cap, self-assess or notified...](https://lawr.io/blog/european-legal-artificial-intelligence-fines-15m-cap-self-assess-or-notified-body.php)

Canonical: https://lawr.io/blog/cyber-incident-disclosure-rule-2026-item-105-4-day-vs-natural-language-processing.php
Markdown: https://lawr.io/blog/cyber-incident-disclosure-rule-2026-item-105-4-day-vs-natural-language-processing.php/index.md