Ninety-six hours.
One filing. Permanent record.
The SEC's four-business-day disclosure window — codified in Item 1.05 of Form 8-K — is the shortest crisis communications cycle in the modern corporate playbook. Every hour is structured. Every decision is documented. Every word in the final filing was drafted, debated, and signed off by named individuals whose decisions are now part of the historical record.
Here is what happens in those 96 hours when the discipline is in place.
Hour 0–8: Materiality determination
The clock does not start at the moment of compromise. It starts at the moment the company determines the incident is material.
That determination is the most important decision of the cycle. It is also the most legally consequential. The SEC and plaintiff's bar both look at when material facts became known versus when the materiality determination was made. A long gap invites scrutiny.
The materiality call sits with a defined committee — typically the CISO, CIO, General Counsel, CFO, and CEO. Communications and Investor Relations should be in the room as advisors. The decision is documented. The reasoning is documented. The supporting facts are documented.
The first eight hours are spent answering three questions. Is the incident material under the TSC Industries standard? When did materiality become determinable? Who needs to know now versus later in the cycle? See: Materiality Standard Under Item 1.05.
Hour 8–24: Forensic alignment with legal
The forensic firm — Mandiant, CrowdStrike, Unit 42, Kroll, Stroz Friedberg — is engaged. The forensic team operates under privilege managed by outside counsel. Every fact that will appear in the 8-K must be validated against forensic findings.
Hours 8–24 are spent reconciling what the company knows, what it suspects, and what it can defensibly say. The communications team works in parallel with legal — not after legal. The drafting framework is built off facts the forensic team has confirmed. See: Mandiant vs. CrowdStrike: How Forensic Vendor Selection Shapes Breach Narratives.
The work product at hour 24 is a fact base, a draft 8-K skeleton, and an initial list of unresolved questions.
Hour 24–48: Stakeholder preparation
The 8-K cannot land cold. Multiple stakeholders need pre-positioned communications.
Board. Full board notification with the draft 8-K and the materiality determination memo. Special meeting scheduled if not already held.
Insurers. Cyber insurance carrier notified per policy terms. Notice of circumstance documented even where claim is not yet asserted. See: Why Cyber Insurance Carriers Now Vet Your Communications Plan.
Customers. Tiered notification plan. Largest customers receive direct outreach from named relationship leads. Mid-tier receive a structured customer letter. Smaller receive published notices.
Employees. Internal communications drafted to land minutes after the 8-K files. Talking points distributed to managers. Q&A document prepared.
Regulators beyond the SEC. Depending on industry — FTC, HHS for healthcare, state attorneys general, sector regulators, international authorities for GDPR-relevant data.
Press. Reporter list compiled. Pre-briefings considered for the most critical relationships under embargo. Executive availability windows set.
Sequencing matters. Reg FD concerns dominate. Material information cannot be selectively disclosed before the 8-K is filed. The pre-positioning is logistical, not substantive.
Hour 48–72: Drafting the 1.05 8-K
The language committee meets. Outside counsel chairs. Inside counsel, communications, IR, CFO, CISO contribute.
Every sentence is drafted, redlined, and validated. The structural elements: nature of the incident, scope, timing, material impact or reasonably likely material impact, status of investigation, expected remediation. Each element is supported by forensic evidence and signed off by the contributing functions.
The communications team's role in this room is specific. Read the second-day story before it lands. What will Bloomberg lead with from this filing? What will The Wall Street Journal pull as a quote? What language will the plaintiff's bar excerpt? Adjust the draft to land the disclosure cleanly.
By hour 72, the filing is in final draft. CFO, CEO, GC, and CISO sign off. Audit committee chair is briefed.
Hour 72–96: Filing and distribution
The 8-K is filed with EDGAR. Distribution kicks off within minutes.
Press release issued through PR Newswire or BusinessWire. Wire pickup is monitored in real time. Customer notifications go out per the tiered plan. Employee notifications follow. Partner and vendor notifications follow.
The CEO or CISO is available for press. Pre-scheduled briefings happen in the window from filing time plus two hours to filing time plus eight hours. The first wave of trade press calls, business press calls, and analyst calls is fielded.
The dark site — pre-built and held in reserve — goes live. Customer-facing FAQ is published. The 8-K and the press release are linked from the corporate news center.
Day 5–14: The second-disclosure question
The cycle is not over at hour 96. The most likely amendment scenario is new information from the forensic investigation that requires updating the original filing.
The amendment threshold needs to be set in advance. New facts that change the materiality picture trigger an amended 8-K. The drafting process repeats — faster, because the framework is in place, but with the same discipline.
Two amendments inside 30 days is the structural signal that the original filing was rushed or incomplete. The recovery curve takes a hit each time. The drafting discipline on the first filing determines how often the amendment is needed.
The runbook
The companies that execute this cycle well have a runbook drafted before the incident. Templates. Decision trees. Pre-approved language frameworks. Pre-aligned stakeholders. Pre-trained executives. Pre-built dark sites. See: The Crisis Comms Playbook for the AI-Compressed Attack.
Most public companies do not have this runbook. Most plan to build it during the next breach. That is the wrong moment.
Ninety-six hours is too short to draft from a blank page. The drafting happens before the alert fires — or it happens too late.
