SEC cyber disclosure for Canadian firms

If your company files with the SEC, cybersecurity is a disclosure obligation with a four business day clock on material incidents and an annual description of how the board oversees cyber risk. If you are a Canadian private company selling into the United States, none of it binds you and all of it reaches you anyway, through your customers' diligence.

Last reviewed 2026-09-01Written by Jacob Masse, TrazTech Inc.

The SEC's cybersecurity rules do two things. Item 1.05 of Form 8-K requires a domestic registrant to disclose a cybersecurity incident it has determined to be material within four business days of that materiality determination, describing the nature, scope and timing and the material impact or reasonably likely material impact. Regulation S-K Item 106 requires an annual description of the processes for assessing and managing material cyber risk, board oversight of that risk including which committee holds it, and the role and relevant expertise of the management people responsible.

Canadian companies fall into three groups with very different obligations.

The four day clock does not start where people think

It starts on the determination of materiality, not on discovery, and the rule says that determination must be made without unreasonable delay. That distinction is the whole compliance problem. Deciding slowly to buy time is the failure mode the rule was written to catch, and a timeline showing three weeks between "we knew" and "we determined" draws attention.

Materiality is the ordinary securities standard: would a reasonable investor consider it important. It is not a record count and there is no volume threshold, which frustrates security teams who want one. An incident touching a small number of records in a critical system can be material and a large volume of low-sensitivity data may not be. What a company needs, and what most do not have, is a written process saying who convenes, on what evidence, within what window, and how the decision is recorded. Building that process is normal vCISO work and it belongs next to the incident response plan rather than in a separate legal binder nobody opens during an incident.

What Item 106 forces a board to be able to say

The annual disclosure is short, which makes it revealing. It has to describe processes, board oversight and management expertise, and none of those can be invented in the week the filing is drafted. The disclosure has to be accurate and the audit committee signs off on it.

Processes for assessing and managing material cyber risk

A described risk process, not a list of tools. It has to connect to the company's overall risk management. This is what a risk register is for.

Whether risks have materially affected or are reasonably likely to materially affect the business

An honest statement about strategy, operations and financial condition. Boilerplate here is what draws comment letters.

Board oversight, and which committee

Naming the committee is the easy part. Being able to show it received something four times a year, with minutes, is the part companies fail. See CISO board reporting.

Management's role and relevant expertise

Who is responsible, what their background is, and how they inform the board. A company with no named security leader has to write that sentence, and it reads exactly as badly as it sounds.

The last item is the one that turns a disclosure rule into a hiring decision. It does not require a full-time employee, a CISO title or any certification. A named accountable executive supported by a fractional security leader is disclosable and defensible, provided the accountability sits inside the company and the expertise is real. Describing an outside retainer as your management expertise, with nobody internal accountable, is not.

Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.

What Canadian securities law asks in parallel

Canada has no equivalent prescriptive cyber disclosure rule. What it has is the general continuous disclosure obligation: a material change is disclosed promptly by news release and material change report, and CSA staff have published guidance expecting cybersecurity risk disclosure to be specific to the issuer rather than generic risk factor boilerplate. In practice a cross-listed Canadian issuer ends up running to the stricter of the two, because disclosing in Canada triggers furnishing in the United States, and because investors compare the two documents.

For a federally regulated financial institution there is a third clock entirely, since OSFI expects prompt notification of reportable technology and cyber incidents to your lead supervisor. Those criteria are different again, and running three notification tests during an incident is why they get written down in advance. See vCISO work for OSFI regulated institutions.

What to actually build

1. Write the materiality determination process before you need it: who convenes, how fast, what evidence they see, and how the decision and its timing are recorded. One page.
2. Put the securities clock inside the incident plan, beside the PIPEDA and Law 25 assessments and the contractual notification windows. Four separate documents guarantee one gets missed.
3. Fix the board cadence now. Four sessions a year with minutes that show what was presented is the evidence Item 106 rests on, and it cannot be created retroactively.
4. Name the accountable executive and be able to describe their expertise in two sentences that survive reading by an investor.
5. Read your customer contracts for the notification windows you have already agreed to. Most companies have signed shorter clocks than any regulator imposes and have never counted them.
6. Rehearse it. A tabletop that includes the disclosure decision, not just the technical response, is the only way to find out that your general counsel and your security lead disagree about what material means.

What this adds to a security budget

Common questions