Your annual 10-K has to describe how you manage cyber risk and how the board oversees it under SEC Regulation S-K Item 106. This template gives you the structure to do it defensibly — the process paragraph, the material-impact statement, and the board-oversight and management-role paragraphs — while keeping you from publishing a roadmap for attackers or over-committing to things you do not actually do.
Educational template — not legal advice. Item 106 and the SEC rules are summarised for orientation and can change; confirm the current SEC requirements and adapt this with qualified securities counsel.
Free · no signup · adapt it in your own doc
Cyber Governance Disclosure Template (Item 106)
A drafting template for the annual cybersecurity disclosure required by US SEC Regulation S-K Item 106 in the Form 10-K (Item 1C): the processes for assessing, identifying and managing material risks from cybersecurity threats (106(b)), and the governance of those risks — board oversight and management’s role (106(c)). It is separate from the Form 8-K Item 1.05 incident report. The craft is to describe the process and the oversight meaningfully WITHOUT disclosing specific controls or vulnerabilities that would aid an attacker, and WITHOUT over-committing to specifics you do not actually do.
01Risk management & strategy — process (Item 106(b))
Describe the PROCESS, at a level an investor can understand — not a tool inventory and not a configuration map. Item 106(b) asks how you assess, identify and manage material risks from cybersecurity threats, whether that is integrated into your overall risk management, and whether you engage third parties in the process.
How material cyber risks are assessed & identified
The recurring process — e.g. periodic risk assessments, threat intelligence, asset/data criticality rating — described without naming specific tools or configurations
How material cyber risks are managed / mitigated
The program at a process level — governance, prioritisation, remediation workflow, testing cadence as a practice (not a promise of scope you do not meet)
Integration into overall / enterprise risk management (ERM)
Whether and how cyber risk sits within the company’s broader ERM system and processes
Engagement of third parties in the process
Whether you use assessors, consultants, auditors or other third parties — described where material
Oversight of third-party service-provider risk
Your processes to oversee and identify material risks from vendors / SaaS / service providers
Describe the process as it actually operates. A recurring practice can be stated as a practice; do not phrase an aspiration as a current capability.
02Material impact of cyber risks (Item 106(b)(2))
Item 106(b)(2) requires you to describe whether any risks from cybersecurity threats — including as a result of previous incidents — have materially affected or are reasonably likely to materially affect your business strategy, results of operations or financial condition.
Impact statement
Whether cyber risks / prior incidents have materially affected, or are reasonably likely to materially affect, strategy, results of operations or financial condition — and if so, how
Keep this consistent with your MD&A, risk factors and any Item 1.05 incident 8-Ks filed during the period.
03Board oversight (Item 106(c)(1))
A bare "the Board oversees cybersecurity risk" is non-responsive. Identify who is responsible and describe how and how often they are informed.
Responsible board / committee
Which board or committee (e.g. Audit Committee, Risk Committee) is responsible for cyber oversight
How the board/committee is informed
The reporting channel — e.g. periodic reports from the CISO / management to the committee
Cadence
How often cyber risk is on the agenda — quarterly, each meeting, etc. — stated accurately to your records
State only a cadence and reporting line your board minutes and records can actually evidence — a claimed cadence you cannot support is a comment-letter and liability risk.
04Management’s role (Item 106(c)(2))
Describe the management positions or committees responsible for assessing and managing material cyber risk, their relevant expertise, how they are informed about and monitor incidents, and whether they report to the board or a committee.
Responsible positions / committees
e.g. CISO, a security/risk committee — the roles, not individual names where not needed
Relevant expertise
The nature of the relevant cybersecurity expertise of those positions, described functionally
How they are informed & monitor incidents
The process by which management stays informed about and monitors prevention, detection, mitigation and remediation
Reporting to the board
Whether and how management reports cyber information to the board or a committee
05Specificity guidance — process, not a roadmap
This is the craft of Item 106. Disclose enough for an investor to understand the program, and no more.
Describe PROCESSES, not specific security controls, tool configurations, network architecture or current vulnerabilities — the adopting release confirms you need not disclose detail that would compromise your defenses.
Do NOT attach or summarise an incident-response playbook, a vulnerability list, or penetration-test findings — these are a roadmap for attackers.
Do NOT name a "cybersecurity-expert director": the SEC removed that proposed board-expertise requirement from the 2023 final rule, so volunteering one over-discloses and can over-commit.
Do NOT over-commit to specifics you do not perform (e.g. "quarterly third-party pen tests of every application", "24/7 monitoring of all systems", "100% phishing-resistant MFA on all accounts") — a precise promise you cannot meet is a misstatement and a provable gap.
Describe practices you actually run; phrase aspirations, if mentioned at all, clearly as plans rather than current capabilities.
Item 106 is a statement in a securities filing. Over-disclosure aids attackers; over-commitment and overstatement create liability. Meaningful but measured is the target.
06Consistency checklist (10-K vs proxy vs 8-K vs reality)
SEC staff and investors read your filings together. Reconcile before you file.
The Item 106 process description matches what the company actually does today.
Board oversight and management-role descriptions are consistent with the proxy statement’s governance disclosure.
The disclosure is consistent with any Form 8-K Item 1.05 incident reports filed during the period (don’t claim a maturity your incident disclosures contradict).
The impact statement is consistent with risk factors and MD&A.
Claimed cadences, committees and reporting lines are supported by board and committee minutes.
The disclosure is tagged in Inline XBRL as required and placed under Item 1C of the Form 10-K.
07Review & sign-off
CISO / security lead
Name / date — confirms the process description is accurate
General counsel / securities counsel
Name / date
CFO
Name / date
Disclosure committee chair
Name / date
Board committee acknowledgement
Committee / date reviewed
Not legal advice. Item 106 and the SEC rules are summarised for orientation and can change; confirm the current SEC requirements and apply them to your specific facts with qualified securities counsel.
Practice the decision
This template records a disclosure you can rehearse. The free Governance Disclosure Lab puts you on the disclosure committee and grades you on ~14 of the exact calls this template documents — what the process paragraph must cover, what the board-oversight paragraph must say, how much detail is safe, and the traps (the dropped cyber-expert-director requirement, third-party oversight, and over-committing).
TL;DR
What this template is
A drafting template for the annual SEC Regulation S-K Item 106 cybersecurity disclosure in the Form 10-K (Item 1C): the risk-management process and the governance — board oversight and management’s role.
Sections: the 106(b) process paragraph (assessing/identifying/managing material cyber risks, ERM integration, third parties), the material-impact statement, the 106(c) board-oversight and management-role paragraphs, specificity guidance, and a consistency checklist.
The craft it enforces: describe the process and the oversight meaningfully WITHOUT disclosing controls or vulnerabilities that would aid an attacker, and WITHOUT over-committing to things you do not actually do — and you need not name a cyber-expert director (that proposed requirement was dropped).
Copy it or download it as Markdown and adapt it in your own document — nothing is uploaded.
Educational template — not legal advice. Confirm current SEC requirements with qualified securities counsel.
Frequently asked questions
What is this template for?+
It is a drafting template for the annual cybersecurity disclosure required by SEC Regulation S-K Item 106 in the Form 10-K (Item 1C). It structures the process paragraph (how you assess, identify and manage material cyber risks, including ERM integration and third-party oversight), the material-impact statement, and the governance paragraphs covering board oversight and management’s role — plus guidance on how much detail is safe and a consistency checklist.
How is Item 106 different from the 8-K Item 1.05 incident report?+
Item 1.05 is a Form 8-K filed within four business days of determining a specific cybersecurity incident is material. Item 106 is the annual, process-level disclosure in the Form 10-K: it describes your ongoing processes for managing cyber risk, your board’s oversight and management’s role — not any single incident. Both can apply to the same company in the same year.
Do I have to name a cybersecurity expert on the board?+
No. The SEC’s original proposal would have required disclosure of individual board members’ cybersecurity expertise, but that requirement was removed from the July 2023 final rule. Item 106 asks about the board’s oversight and management’s role and expertise, not about naming a cyber-expert director — and volunteering one can over-commit you.
Is this legal advice?+
No. It is an educational template. Item 106 and the SEC cybersecurity disclosure rules are summarised for orientation and can change; confirm current requirements and apply them to your specific facts with qualified securities counsel.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout