SEC Cybersecurity Disclosure Training Requirements 2026
SEC cybersecurity disclosure training in 2026: Item 106 annual rules, the 4-day Item 1.05 incident clock, and how to build defensible training evidence.
DefendWise
DefendWise
The SEC cybersecurity disclosure rule, effective for fiscal years ending on or after December 15, 2023, doesn't name a training curriculum you must buy — it requires public companies to describe the process they use to identify, assess, and manage cybersecurity risk, and employee training is the first thing examiners ask to see evidence of. The rule has two separate clocks: an annual disclosure under Item 106 of Regulation S-K, and a 4-business-day incident disclosure under Item 1.05 on Form 8-K.
TL;DR
- The SEC cybersecurity disclosure rule sets no named training program — build a paper trail, not a checkbox.
- Item 1.05 forces an 8-K within 4 business days of a materiality determination on a cyber incident.
- Item 106 requires an annual 10-K description of risk management process, governance, and board oversight.
- Smaller reporting companies get a 180-day delay on incident disclosure only, not on the annual Item 106 narrative.
- DefendWise runs sec cybersecurity disclosure training evidence across every subclient for one flat $399/month, no per-seat math.
Why this matters
The SEC's 2023 rule changed what counts as a defensible answer to "what are you doing about cyber risk." Before 2023, a company could describe its posture in vague terms. Now Item 106 asks for specifics: who manages the risk, how often the board reviews it, and what the process looks like day to day.
Training sits inside that process whether or not the rule spells it out by name. An auditor or plaintiff's attorney reading your 10-K will ask where the training records are the moment the narrative mentions "employee awareness" or "phishing simulation." No records, no defensible disclosure — that gap is where enforcement risk lives in 2026.
An MSP managing this for a public-company client or a company preparing its own filing needs one thing: proof the training happened, on a schedule, for every employee, not a sample.
How to meet SEC cybersecurity disclosure training requirements
The fastest way to see what's actually required is to separate the two obligations. They have different triggers, different deadlines, and different evidence needs.
| Requirement | Item 106 (annual) | Item 1.05 (incident) |
|---|---|---|
| Filing | Form 10-K | Form 8-K |
| Trigger | Every fiscal year | Material incident determination |
| Deadline | Annual report deadline | 4 business days after materiality determination |
| What it covers | Risk management process, governance, board oversight | Nature, scope, timing, and material impact of the incident |
| Delay for smaller reporting companies | None | 180 days |
A public company (or an MSP serving one) that wants a defensible answer needs a training program with dated completion records, not a one-time slideshow assigned during onboarding. Meeting sec cybersecurity disclosure training expectations means the Item 106 narrative and the training log tell the same story.
DefendWise runs that log automatically across every subclient under one flat-fee platform, so an MSP managing several regulated clients doesn't rebuild the evidence trail by hand for each one.
Item 1.05 incident disclosure: 4 business days
Item 1.05 gives companies 4 business days from the moment they determine an incident is material, not from the moment they discover it, to file an 8-K describing the incident's nature, scope, timing, and material impact. That distinction — determination date versus discovery date — is where most disclosure timelines actually start slipping in practice, because materiality review itself takes time.
A training program that teaches employees to report suspicious activity fast shortens the gap between discovery and determination. Faster reporting means the materiality clock starts sooner and the 4-day window is easier to hit.
Item 106 annual disclosure: no fixed training mandate, but a paper trail requirement
Item 106 doesn't say "you must run phishing simulations quarterly." It says describe your processes for assessing, identifying, and managing material risks from cybersecurity threats, and describe how the board oversees that risk. Companies that already run structured training point directly to completion rates, phishing simulation results, and remediation training as part of that description.
Companies without that data end up writing a vaguer, more exposed paragraph — and vague Item 106 language is exactly what draws scrutiny in 2026 shareholder litigation and SEC comment letters.
Smaller reporting companies: 180-day delay, incident disclosure only
Smaller reporting companies get 180 additional days before they must comply with the Item 1.05 incident disclosure requirement. That delay applies only to the incident-reporting clock — it does not push back the annual Item 106 narrative, which every filer, regardless of size, has had to include since the rule took effect for fiscal years ending on or after December 15, 2023.
Build SEC-ready training evidence
One flat fee, unlimited seats, no per-client billing math for MSPs.
Why SEC cybersecurity disclosure training requirements vary
The rule text is the same for every filer, but what "good enough" looks like in practice depends on a handful of factors:
- Smaller reporting company status — determines whether the 180-day incident disclosure delay applies.
- Industry overlay — a financial services filer is also answering to GLBA and FTC Safeguards Rule training obligations; a healthcare filer is also carrying HIPAA training requirements alongside the SEC narrative.
- Board cybersecurity expertise — Item 106 asks about board oversight, so a board with named cyber expertise writes a stronger, more specific paragraph than one without.
- Maturity of the materiality determination process — a company with a documented, rehearsed process for deciding materiality moves faster inside the 4-business-day Item 1.05 window.
- Whether training is run in-house or through an MSP — an MSP running training across subclients standardizes the evidence format, which matters when outside counsel or auditors ask for it during a filing review.
- Existing framework alignment — a company already meeting SOC 2 security awareness training requirements or working from CISA guidance usually has cleaner Item 106 language because the process already exists.
Does the SEC require security awareness training specifically?
No, the SEC cybersecurity disclosure rule does not name a required training program — it requires a described risk management process, and training is the evidence most companies use to support that description. The gap between "described" and "documented" is where disclosure controls get challenged.
How does training evidence support the Item 106 description?
Item 106 asks companies to describe processes for assessing and managing cybersecurity risk, and dated training completion records, phishing simulation results, and remediation logs are the concrete artifacts that back up that description. Without them, the 10-K paragraph reads as intent rather than practice.
Is SEC cybersecurity disclosure training different from SOC 2 or NIST training requirements?
Yes, the SEC rule is a disclosure requirement tied to public filings, while SOC 2 and NIST are control frameworks with their own training expectations — but the underlying evidence (completion records, phishing results, dated logs) overlaps heavily across all three, which is why many filers build one training program and point to it in multiple contexts.
FAQ
What does the SEC cybersecurity disclosure rule require?
The SEC cybersecurity disclosure rule requires an annual Item 106 description of risk management processes and board oversight in the 10-K, plus an Item 1.05 8-K disclosure of material incidents within 4 business days of the materiality determination. It took effect for fiscal years ending on or after December 15, 2023.
Does the SEC require security awareness training specifically?
No, the rule requires a described risk management process rather than a named training program, but dated training records are the standard evidence companies use to support the Item 106 narrative.
How fast must a public company disclose a material cybersecurity incident?
A public company must file Form 8-K under Item 1.05 within 4 business days of determining an incident is material, not from the date of discovery.
What is Item 106 of Regulation S-K?
Item 106 is the annual disclosure requirement that asks companies to describe their processes for assessing, identifying, and managing material cybersecurity risks, plus how the board oversees that risk, inside the 10-K.
Do smaller reporting companies get more time to disclose incidents?
Yes, smaller reporting companies get an additional 180 days before the Item 1.05 incident disclosure requirement applies to them, though the annual Item 106 narrative requirement is not delayed.
How does security awareness training support SEC disclosure requirements?
Training completion records and phishing simulation results give a company concrete evidence to cite when describing its risk management process under Item 106, rather than relying on general statements.
What happens if a company fails to meet SEC cybersecurity disclosure requirements?
A company that misses the 4-business-day Item 1.05 window or files a vague, unsupported Item 106 description exposes itself to SEC comment letters and shareholder litigation over disclosure controls, as seen in the SEC's 2023 enforcement action against SolarWinds.
One last thing
The SEC's 2023 enforcement action against SolarWinds targeted disclosure controls, not the absence of a training curriculum — the lesson for 2026 filers is that regulators care more about whether your paper trail matches your public statements than about which training vendor you picked. An MSP running sec cybersecurity disclosure training across several regulated clients needs that paper trail generated automatically, not assembled by hand every filing season.