SEC Cyber Disclosure: What B2B Vendors Get Asked
The SEC’s cybersecurity disclosure rules apply to covered public-company registrants, but their suppliers may be asked for incident facts and security evidence. Vendors should prepare an escalation path and a defensible incident timeline. A customer’s disclosure duty does not automatically make every private supplier an SEC registrant or create the same filing obligation.
Key Takeaways
- •Distinguish the registrant’s filing duty from a supplier’s contractual duties.
- •Prepare an incident timeline and named escalation contacts.
- •Give customers reviewed facts and identify what remains uncertain.
For implementation support, review CAIQ definition and SIG questionnaire definition. Confirm scope and operating responsibilities before choosing an engagement.
When does the SEC incident disclosure clock start?
It generally starts when the registrant determines that an incident is material, rather than at every initial alert. SEC Release 33-11216 generally requires the filing within four business days of that determination, with the rule’s specified exceptions and procedures.
A vendor should avoid making the materiality decision on the customer’s behalf. Its job is to escalate accurate information through the agreed channels so the customer can make its own legal and reporting decisions.
What information might a public-company customer request?
Expect questions about what happened, when it was discovered, the systems involved, the information affected, and the operational impact. The scope and timing of a vendor’s notification also depend on its contract and other applicable law.
| Customer question | Internal preparation |
|---|---|
| When did the event begin and when was it discovered? | A dated timeline with confidence levels |
| Which services and information are affected? | System and data owners who can confirm scope |
| What is contained and what remains uncertain? | Reviewed technical status and open questions |
| Who can coordinate updates? | A named incident contact and backup |
| What supports the answer? | Preserved logs, records, and approved evidence |
How should vendors answer security questionnaires?
Use approved statements and evidence rather than promises that exceed current practice. Keep a reviewer for incident response, business continuity, access controls, and the assurance documents provided.
A security questionnaire service can organize responses, while the technical owner still needs to approve material facts. Compare SOC 2 support where independent assurance is part of the buyer’s diligence request.
How should suppliers prepare an incident handoff?
Agree the contacts, evidence preservation, update cadence, and approval process before an event. During an incident, distinguish confirmed facts, working hypotheses, and unanswered questions. Avoid waiting for a final root-cause report before escalating facts required under the contract.
This is a practical vendor operating approach. It does not replace the public company’s determination of materiality or counsel’s assessment of applicable notification duties.
Frequently Asked Questions
Does every B2B vendor file a cybersecurity Form 8-K?
Does the filing period start from every security alert?
What should a vendor prepare before an incident?
Tyler Carbone
Managing Director and Cofounder
Tyler Carbone is a Managing Director and Cofounder of Agency and one of the industry's leading voices on governance, risk, and compliance. He holds degrees from Harvard and a JD/MBA from the University of Virginia, and previously worked in cybersecurity at Deloitte. Tyler has helped hundreds of companies operate SOC 2, ISO 27001, HIPAA, and GDPR programs.
LinkedIn
