SEC 8-K Item 1.05 Materiality Workbook

Three years into Item 1.05, the enforcement record says something most disclosure programmes are not built for: the SEC has never penalised a registrant for filing late. The October 2024 settlements — roughly $8M across four issuers — were about wording. Companies described a breach's impact as hypothetical, or as limited, when what they knew at the time did not support the sentence.

So this kit's centre of gravity is the words, not the countdown. The clock still gets proper treatment, because you cannot evidence "without unreasonable delay" after the fact — but the file that saves you is the one that stops a true-sounding sentence going into an 8-K.

Two clocks, kept apart. Discovery to determination has no fixed length, and that is exactly why it needs a timestamped log: "without unreasonable delay" is a standard you evidence step by step or not at all. Determination to filing is four business days, computed to the 5:30 pm ET deadline. Conflating them is how programmes either panic early or drift late.

01 Materiality Determination Framework (DOCX) — the policy itself: the standard, definitions, escalation triggers, an 8-step process, the factors, what "without unreasonable delay" means in practice, the Attorney-General delay provision, what actually goes in the 8-K, consistency requirements and records.

02 Materiality Assessment Workbook (XLSX) — 12-factor scoring with Known / Unknown flags, because most of what matters on day one is unknown and saying so is a defensible position. Produces an indicated posture, a quantitative benchmark, and the computed 8-K deadline from your determination date. Carries the Clock Log (discovery through filing, timestamped) and an amendment tracker that computes 8-K/A deadlines as unknowns resolve.

03 Disclosure Committee Charter & RACI (DOCX) — membership with alternates, quorum, triggers, cadence, authority, a 17-activity RACI, blackout handling and minutes. The committee that has never met is the one that cannot convene at 9pm on a Friday.

04 Form 8-K Item 1.05 Draft & Amendment Templates (DOCX) — the initial 1.05, the 8-K/A, the Item 8.01 alternative for voluntary disclosure, drafting checklists, and a language-to-avoid table. "No evidence of exfiltration" is only true if your logging would have shown exfiltration — that table is a list of sentences that have cost other companies money.

05 Form 10-K Item 1C Narrative Template (DOCX) — Item 106(b) and (c) paragraphs, each carrying a "basis" line naming the evidence that makes the sentence true. If the penetration test was skipped this year, the basis line is empty and the sentence comes out. Aspirational control language in Item 1C is exactly what enforcement has targeted.

06 Board Oversight Evidence Log (XLSX) — every board and committee cyber event, with an annual summary that auto-counts by body, plus a management-expertise register. Item 106(c) asks what your board actually does; this is the record that answers it.

07 Disclosure Interaction Map (XLSX) — 17 regimes against the SEC clock, with a sequencer computing every deadline from discovery and determination. The confidential CIRCIA report usually precedes the public 8-K, and getting that order wrong is its own problem.

08 Practitioner Guide (PDF) — the rule, three years of practice and enforcement, the two clocks, materiality, the committee, drafting, amendments, Item 1C, board evidence, multi-regime sequencing, a 60-day build and an FAQ.

A note on durability. The Commission has publicly discussed revisiting Item 1.05. The rule stands as of this edition, and a documented materiality process is good governance whether or not the item survives in its current form — but the changelog carries a slot for any amendment, and updates are free within your licence window.

Pairs with CIRCIA 72/24 for the confidential federal report that usually comes first, and the TPRM Program Kit for the evidence behind the third-party oversight paragraph.

Disclosure process support, not legal advice. Securities counsel owns every filing.