Governance Disclosure Lab
Your annual 10-K has to describe how you manage cyber risk and how the board oversees it under SEC Regulation S-K Item 106. The hard part is the craft: describe the process and the oversight meaningfully, without publishing specific controls, vulnerabilities or a response playbook that would hand an attacker a roadmap — and without over-committing to things you do not actually do. Sit on the disclosure committee and make each call the way SEC staff and a short-seller would read it. Each decision shows you why.
Pair this drill with the free Cyber Governance Disclosure Template (Item 106) — the document that records the disclosure you practise here. Educational drill, not legal advice.
The real job. More noise, a tighter clock.
You sit on the disclosure committee drafting your public company’s annual 10-K cyber governance disclosure under SEC Regulation S-K Item 106. Work 10 board-room decisions — describe the process and the board’s oversight meaningfully, without handing attackers a roadmap or over-committing to things you do not do — then see why each call is defensible. You are graded on how many you get right against the clock.
What this lab is
- A free, browser-based decision drill on the US SEC Regulation S-K Item 106 annual cybersecurity disclosure: work ~14 board-room decisions about what your 10-K must say about your cyber risk-management PROCESS and your governance.
- Item 106 lives in the annual 10-K (Item 1C) and is separate from the Form 8-K Item 1.05 incident report: it describes your processes for assessing, identifying and managing material cyber risks, plus the board’s oversight and management’s role.
- You practise the real craft: disclosing the process and oversight meaningfully WITHOUT publishing specific controls, vulnerabilities or a response playbook that would help an attacker — and WITHOUT over-committing to specifics you do not actually do.
- It also covers the traps: the 2023 final rule DROPPED the proposed cyber-expert-director requirement, third-party provider oversight, integration into ERM, the impact disclosure, and staying consistent with your 8-Ks and proxy.
- Educational decision drill — not legal advice. Pair it with the free Item 106 governance disclosure template.
Frequently asked questions
What is the Governance Disclosure Lab?
A free, in-browser decision simulation that puts you on a public company’s disclosure committee drafting the annual 10-K cybersecurity disclosure under SEC Regulation S-K Item 106. You work through board-room decisions — what the process paragraph must cover, what the board-oversight paragraph must say, how much technical detail is safe, whether to name a cyber-expert director — and each one has a single board-defensible answer, revealed after you lock in your call.
How is Item 106 different from the 8-K Item 1.05 incident report?
Item 1.05 is a Form 8-K filed within four business days of determining a specific cybersecurity incident is material. Item 106 is an annual, process-level disclosure in the Form 10-K (surfaced as Item 1C): it describes your ongoing processes for assessing, identifying and managing material cyber risks, your board’s oversight of those risks, and management’s role — not any single incident.
Is this legal advice?
No. The lab is an educational drill and the regulatory references (SEC Regulation S-K Item 106, the July 2023 final rule, Form 8-K Item 1.05) are summarised for orientation and can change. Always confirm the current requirements and apply them to your specific facts with qualified securities counsel.
Who is it for?
CISOs, general counsel, CFOs, disclosure-committee members and board directors of public (or soon-to-be-public) companies — anyone who helps draft or approve the annual cyber governance disclosure and wants to describe the program meaningfully without over-disclosing a roadmap for attackers or over-committing to things the company does not do.