How do SEC cybersecurity disclosure rules fit an existing SOX ITGC program?
Regulation S-K Item 106 and Form 8-K Item 1.05 are separate disclosure obligations from SOX 404, and a public company finance or security lead should treat them that way in planning. Item 106 disclosures appear in Form 10-K for fiscal years ending on or after December 15, 2023, and Form 8-K incident reporting applied from December 18, 2023. The company owns both programs: the ICFR assessment under SOX 404 and the cybersecurity risk management, governance and incident disclosure process under the SEC rules. Neither obligation is discharged by the other, even though they draw on the same systems and people.
What changes from one company to the next is its risk profile, its governance structure and how much existing ITGC evidence it can reuse. Item 106 asks the company to describe how it assesses, identifies and manages material cybersecurity risks, whether it engages assessors, consultants or auditors, how it oversees third-party service providers, and which board committees and management roles oversee cybersecurity and what expertise they hold. Much of that description has to match what the company actually does, so the first check is whether the access, change and operations controls already documented for SOX are the same controls the 10-K narrative describes. Where they are, the company can point to existing walkthroughs and test results instead of building new ones.
Form 8-K Item 1.05 runs on a clock that SOX does not have. The filing is generally due within four business days after the company determines an incident is material, so the decision process, the people who make it and the evidence used to reach it need to be settled before an incident happens. Confirm with counsel whether the incident response runbook, the ITGC incident and change records and the audit committee escalation path can supply the nature, scope, timing and material impact the filing requires. Also confirm the process for the national security delay that the Attorney General may invoke in writing, since the disclosure timeline may be affected.
What Item 106 asks registrants to describe each year
Regulation S-K Item 106 asks registrants to describe how they manage cybersecurity risk, how the board and management oversee it, and who does the work. Each element can draw on artifacts a SOX ITGC program already produces, so the annual description stays consistent with what the auditor tested.
Risk assessment and management process
Item 106 asks how the company identifies, assesses and manages material cybersecurity risks. For SOX teams, the useful link is the risk assessment that scopes ITGCs over financially significant applications, databases and infrastructure. Check that the cyber risk process and the ITGC risk assessment describe the same systems, and that the description matches how controls actually run.
Use of assessors, consultants and auditors
The rule asks whether the company engages outside assessors, consultants or auditors as part of its process. Record every external engagement, including penetration tests and independent reviews that touched financial systems. Confirm the disclosure names the type of engagement accurately, and that engagement letters and reports are retained as ITGC-adjacent evidence.
Third-party service provider oversight
Item 106 asks how the company oversees risks from third-party service providers. Financial systems in SaaS, cloud or managed services make this a SOX matter too. Use the same vendor reviews, SOC 1 and SOC 2 report evaluations, and contract security terms that support ITGCs for outsourced IT, and confirm they cover providers that handle financial data.
Board oversight of cybersecurity risk
The disclosure must describe board oversight, including which committees review cybersecurity risk and how often. Audit committee minutes that record ITGC deficiencies, access review results or incident briefings are natural evidence. Confirm that the committee reports named in the description match the minutes and agendas the company can produce.
Management's role and expertise
Item 106 asks which management positions or committees are responsible for assessing and managing cybersecurity risk, and what relevant expertise they hold. Name the owners of the access review, change governance and vendor oversight controls. Confirm each named role has documented responsibilities and that the stated expertise is accurate and current.
Annual 10-K timing
Item 106 disclosures appear in the Form 10-K for fiscal years ending on or after December 15, 2023. The description is therefore tied to each annual report and to the fiscal year-end evaluation. Plan the annual evidence collection so that the cyber governance artifacts for the full fiscal year are complete before the 10-K is drafted.
How the four-business-day Form 8-K Item 1.05 clock works
The four-business-day clock starts when the registrant determines an incident is material, not when the incident occurs. Form 8-K Item 1.05 generally requires filing within four business days after that determination, so the period an attacker has access and the period management spends investigating can both pass without triggering a filing. Under Regulation S-K Item 106, a cybersecurity incident is an unauthorized occurrence on or through a registrant's information systems that jeopardizes the confidentiality, integrity or availability of those systems or the information in them. The definition is broad, so a finance team should not wait for confirmed data loss before asking whether an event meets it. The materiality question is what sets the clock, and that question belongs to management and the disclosure committee.
The filing covers the incident's nature, scope and timing, and its material impact or reasonably likely material impact on the registrant. Preparing that content usually draws on the same evidence an ITGC team already keeps: access logs, change records, backup and restore status, and the list of affected financially significant applications and databases. Confirm with counsel which internal records the disclosure committee will need within the first hours, and agree in advance who can authorize the determination. The Attorney General may allow delayed disclosure if immediate disclosure would pose a substantial risk to national security or public safety, but only after making a written determination and notifying the SEC in writing. Do not plan around that exception. Treat it as a government decision that you can neither request nor predict.
The materiality determination is a judgment by management and the disclosure committee, not a result the ITGC analysis produces. A failed access or change control, or a gap in backup coverage, feeds that judgment by showing whether financial data or processing may have been affected and whether the control failure is a deficiency under ICFR. Those are separate questions from whether the incident is material to investors. Record both analyses, the dates on which facts became known, and the reasoning behind each conclusion, because auditors and the SEC will ask how the four-day decision was reached. Bring the ITGC and security teams into the disclosure committee's incident playbook before an incident occurs, so the determination is documented while the facts are still moving.
Compliance dates and what to have ready by each
The sequence below runs from the first Item 106 annual disclosure through the Form 8-K incident clock, so each filer can see which outputs must exist before the relevant filing date. Confirm your filer status and the dates that apply to you with securities counsel before relying on them.
Confirm filer status and applicable dates
Before anything else, establish whether you are a smaller reporting company and which fiscal year end will be your first Form 10-K covered by Item 106. Counsel and the finance team should document the answer, because the Form 8-K timing differs for smaller reporting companies. The output is a short written memo stating your filer category, your first covered 10-K, and the Form 8-K start date that applies to you. Confirm it with counsel rather than inferring it from this page.
Document the cybersecurity risk management process
Item 106 requires a description of how you assess, identify and manage material cybersecurity risks, including whether you use outside assessors, consultants or auditors and how you oversee third-party service providers. Security, IT and the ITGC owners should write down the process as it actually runs, and link it to the existing SOX ITGC risk assessment so the two do not contradict each other. The output is an approved process document with named owners and a third-party oversight section that matches vendor records.
Describe board oversight and management roles
Item 106 also asks who oversees cybersecurity risk at board level and what role management plays, including the positions or committees responsible and their relevant expertise. Governance and legal teams should map this to the board charter, committee minutes and the officers who sign off on IT controls. The output is a board oversight description that a reviewer can check against meeting records, plus a named management owner for each responsibility. Keep it consistent with the officer certifications and the audit committee's ICFR oversight.
Prepare the first Item 106 10-K disclosure
For fiscal years ending on or after December 15, 2023, the Form 10-K must include the Item 106 disclosure. Legal and the disclosure committee draft the section from the risk process and governance documents, then reconcile it with the risk factors and the ICFR section of the same filing. The output is a reviewed disclosure with a sign-off trail showing each statement traces to a document the company holds. Ask your auditor to read the drafts for consistency with the ITGC evidence.
Set up the incident escalation path for Form 8-K
Form 8-K Item 1.05 generally requires filing within four business days after you determine a cybersecurity incident is material, and that filing covers nature, scope, timing and material impact. Security operations should define how an incident reaches the disclosure committee, who makes the materiality call, and what facts must be gathered within that window. The output is a written escalation runbook with named decision makers, contact lists, and a record of how the determination date is captured. Note the separate national security delay mechanism exists, but plan on the standard path.
Test the escalation path with a tabletop exercise
A written runbook does not show it works under time pressure, so run a tabletop exercise that walks a hypothetical incident through detection, scoping, the materiality determination and the draft Form 8-K. The exercise should include finance, IT controls owners, legal and the audit committee chair where practical. The output is a dated exercise record listing gaps, owners and fixes, and evidence that the team can reach the decision makers. Label the scenario as illustrative and keep the record for the auditor and disclosure file.
Reuse ITGC evidence for disclosure and ICFR
Access reviews, change approvals, backup restores and incident tickets already produced for SOX ITGC testing can support the cybersecurity disclosure and the incident assessment. Map each disclosure statement to the ITGC control and evidence that backs it, and agree with the external auditor which items they will read. The output is a cross-reference index that shows where each claim in the Item 106 disclosure and each incident record comes from, kept current for each fiscal year and each reported incident.
Refresh the program each fiscal year
Item 106 disclosures and the Form 8-K process should be reviewed at each fiscal year end, when the risk process changes, when a material incident occurs, and when governance roles change. Assign an owner to recheck the filer status, the board description and the escalation contacts, and record what changed. The output is an annual review memo tied to the 10-K cycle, so the next filing reflects the program as it currently operates rather than the version drafted for the first filing.
Which ITGC evidence supports Item 106 and which does not
Access reviews, provisioning approvals and privileged account reviews are among the most reusable records a SOX program produces. They show that the organization identifies who can reach financially significant systems and checks that access stays appropriate. Item 106 asks a different question: how the registrant assesses, identifies and manages material cybersecurity risks, and how its board and management oversee them. Access evidence can illustrate the operation of a process, but it does not describe that process on its own.
- Reusable: Periodic user access reviews, privileged account inventories and review sign-offs can show that access risk is assessed on a recurring basis.
- Add for disclosure: A description of how access risk feeds the broader cybersecurity risk process, including who sets the review cadence and how findings reach the board or a committee.
- Add for disclosure: Descriptions of the relevant expertise of the officers responsible for identity and access governance.
- Keep separate: Whether a specific account was entitled to a financial application at a point in time is an ICFR question. It does not answer whether a cyber risk is material.
- Confirm: Whether your access review reports identify security-relevant events, such as failed privileged logins, that the disclosure process will need to escalate.
Before relying on access records in a filing, check that the review scope matches the systems named in the risk description.
Change records show that modifications to financially significant applications and infrastructure were authorized, tested and approved. For cybersecurity disclosure, the same records can show that the organization has a working process for changing systems in response to risk, such as patching or configuration hardening. Item 106 does not ask for a change log. It asks how the company manages material risks, so change evidence is supporting material rather than the disclosure itself.
- Reusable: Approved change tickets, emergency change logs and post-implementation reviews can demonstrate that security fixes move through a controlled process.
- Add for disclosure: A narrative of how security patches and vulnerability remediation are prioritized, and how that prioritization is governed.
- Add for disclosure: Evidence that management reports change-related security risks to the board or a designated committee, with the reporting frequency documented.
- Keep separate: Pure functional change approvals for financial reports answer whether reported figures remain reliable, which is an ICFR question.
- Confirm: Whether emergency changes made during an incident are captured so the incident materiality process can see them.
Review whether the change population includes security tooling and cloud configuration, since those changes often fall outside traditional ITGC scope.
Computer operations controls cover job scheduling, backups, recovery and incident handling for financially significant processing. Their incident logs and recovery tests are often the closest existing evidence to a cybersecurity incident process. The key distinction is that Item 106 defines a cybersecurity incident as an unauthorized occurrence that jeopardizes the confidentiality, integrity or availability of systems or information, and Form 8-K Item 1.05 turns on a separate materiality determination. An ITGC incident log does not record that determination.
- Reusable: Incident tickets, escalation records, and backup and restoration test results can support the description of how incidents are detected, triaged and recovered.
- Add for disclosure: Documented materiality assessment records for each cybersecurity incident, showing who made the determination, when, and on what facts.
- Add for disclosure: A description of the incident response team's expertise and the reporting line to the board, as Item 106 requires for management's role.
- Keep separate: Whether processing was completed accurately after an outage is an ICFR question about the reliability of reported numbers. Whether the incident was material to the company is a disclosure question.
- Confirm: Whether incident records capture the nature, scope and timing details that a Form 8-K filing would need to describe.
Agree in advance who owns the materiality decision, because the four-business-day clock runs from that determination.
Service provider oversight is a core ITGC concern when financial systems are hosted or managed by a third party. SOC 1 reviews, contract reviews and provider monitoring show that the company understands what it has outsourced. Item 106 specifically requires disclosure of how the company oversees risks from third-party service providers, and it asks whether the company engages outside assessors, consultants or auditors. ITGC provider evidence supports these statements but does not answer them alone.
- Reusable: Reviews of provider SOC reports, complementary user entity control assessments and provider incident notifications can show how third-party risk is monitored.
- Add for disclosure: A description of how cybersecurity requirements for providers are set, monitored and enforced across the provider base, not only for financially significant ones.
- Add for disclosure: A statement of whether the company engages assessors, consultants or auditors for cybersecurity purposes, and a description of their role.
- Keep separate: Whether a provider's controls operate for financial reporting purposes is an ICFR question. A provider breach that affects non-financial data may still be material for disclosure.
- Confirm: Whether provider contracts require timely notice of incidents, since that notice affects when the company can make its own materiality determination.
Check that the provider inventory used for ITGC scoping matches the one used for cybersecurity third-party risk.
What to check before the first disclosure cycle
Before the first Item 106 disclosure and any Form 8-K incident decision, management should confirm that the cybersecurity process, governance, escalation and provider oversight can be shown to work. Each check below ties back to the ICFR risk assessment and ITGC evidence the company already keeps, so the disclosure cycle reuses existing records instead of creating a parallel program.
Documented cybersecurity risk process
Confirm there is a written process for assessing, identifying and managing material cybersecurity risks, and that it links to the ICFR risk assessment. Check whether the process states which systems feed financial reporting, which assessors or consultants the company uses, and how often the process is reviewed. Ask the CISO to attest that the written process matches what the team actually does, and ask the CFO or controller to confirm the link to the ICFR scoping. The process must be written down before the first 10-K that describes it.
Board oversight charter with named roles
Check that the board or a committee charter assigns cybersecurity oversight and names the positions responsible for managing risk, including their relevant expertise. Item 106 asks for this detail, so vague references to management will not hold up. The general counsel or corporate secretary should attest that the charter and committee minutes match the roles described in the filing.
Incident escalation path to disclosure committee
Map how a suspected incident moves from the security operations team to the disclosure committee. The company sets the internal timeframe, but it must be short enough to leave room for a materiality decision within the four business days that Form 8-K Item 1.05 allows after materiality is determined. Test the path with a sample alert and confirm that the security lead, controller and general counsel each receive it. The incident response lead should attest to the path.
Evidence of third-party provider risk review
Item 106 asks how the company oversees risks from third-party service providers, so collect current review evidence for providers that host or process financially significant data. This includes security reports, contract terms on incident notice, and the date of the last review. Owners of each provider relationship should attest that their reviews are current, and the vendor management lead should confirm the inventory is complete.
Tabletop test of the 8-K decision path
Run a tabletop exercise on a hypothetical incident that tests the full path from detection to the materiality decision and the Form 8-K draft. Record who decided, what information they had, and how long each step took. Include the possibility of a delayed filing if the Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety. The disclosure committee chair should attest to the exercise results and the follow-up actions.
ITGC owner sign-off on incident impact
Create a mapping that shows which ITGC owners must confirm whether an incident affected access, program changes, computer operations or program development for financially significant systems. Each owner signs off on the impact to the systems they control, which feeds the ICFR deficiency evaluation and the 8-K materiality analysis. The controller should attest that the mapping covers every financially significant application in scope.
Who owns the disclosure, the controls and the evidence
Management owns the internal control over financial reporting, the cybersecurity risk management processes described in Item 106, and every disclosure the company files. The disclosure committee, typically drawn from finance, legal, security, and IT leadership, is where the company decides whether an incident is material and when a Form 8-K Item 1.05 filing is required. Those determinations belong to the company and cannot be delegated to a vendor or consultant. The board's oversight role and the description of management's expertise in Item 106 also come from the company's own governance records.
- Controls ownership: Management designates control owners for each ITGC area and keeps the operating evidence that proves those controls ran.
- Materiality decisions: The disclosure committee documents its materiality analysis for each incident, including the timing of the four-business-day clock.
- Item 106 content: The company describes its risk assessment processes, whether it engages assessors or consultants, and how it oversees third-party service providers.
- Board and management roles: The company identifies the responsible positions or committees and their relevant expertise.
- Certifications: Officers sign the Section 302 and 906 certifications based on their own review of controls and disclosures.
Check that your disclosure committee charter names who decides materiality and that the minutes capture that decision for each incident.
An implementation partner such as DeployOpen works inside the company's environment to prepare the systems, documentation and evidence that management relies on. For a SOX ITGC program, that can mean configuring access reviews, change approval workflows, logging, backup records and incident tickets so the evidence exists in a form management and the auditor can examine. The partner does not own the controls, does not decide what counts as a cybersecurity incident for disclosure purposes, and does not sign off on any filing. DeployOpen does not issue reports, attestations or certifications and does not make materiality determinations.
- Systems preparation: Configuring self-hosted open-source platforms so access, change and operations records are generated and retained.
- Documentation support: Drafting control descriptions and procedures that management reviews and approves.
- Evidence packaging: Organizing logs, tickets and approvals by control so reviewers can trace each sample.
- Incident tooling: Preparing ticketing and alerting workflows that surface events to the disclosure committee quickly.
- Written scope: Agreeing deliverables, boundaries and responsibilities in writing before work begins.
Confirm in the statement of work that every deliverable is an input to management's review and that the partner has no role in signing or certifying anything.
The independent external auditor is the only party that issues the ICFR attestation report required under Section 404(b) for applicable filers, tested under PCAOB AS 2201. Auditors also assess IT risks under AS 2110 when planning the audit. Legal counsel advises on the content and wording of Form 10-K and Form 8-K filings, including whether a disclosure is accurate and complete. Counsel does not certify controls, and the auditor does not write the company's disclosures. Both roles check the company's work but do not replace it.
- Auditor attestation: An independent CPA firm tests ICFR and issues the attestation report, where it applies.
- Auditor independence: The auditor cannot design or operate the controls it tests, so the company must keep that work in-house.
- Counsel review: Attorneys review Item 106 descriptions and Form 8-K language before filing.
- Filing deadlines: Counsel and the disclosure committee coordinate the four-business-day timeline after materiality is determined.
- Reference text: The rule text is at 17 CFR 229.106, which counsel and the committee should read together.
Confirm with your auditor and counsel early which deliverables they will rely on and what they need from management to test them.
Where disclosure programs stall and how to avoid it
Item 106 disclosures and Form 8-K incident reporting sit on top of controls that already exist for SOX. Most stalls happen where those two programs stop sharing records, owners or decision points. The cards below cover five points where teams usually lose time and the step that prevents it.
Treating Item 106 as a one-time drafting
Item 106 asks how the company assesses, identifies and manages material cybersecurity risk, and that description must match what actually happened during the year. A disclosure written once and reused without evidence drifts from practice quickly. Before each 10-K, ask the control owners for dated records of risk assessments, assessor engagements and board or committee reporting, and check that the description still matches them.
Defining materiality after an incident
Form 8-K Item 1.05 requires filing generally within four business days after the company determines an incident is material, so the determination itself is the critical step. Teams that decide who makes that call, what they review and how it is documented during an incident often lose the days needed to file. Write the workflow now, rehearse it with legal, finance, IT and the disclosure committee, and record each determination with its time stamp.
Keeping ITGC and security records apart
Access reviews, change approvals and backup tests often sit in one system for SOX and another for the security team, so the same evidence gets collected twice or cannot be found when needed. Map each cybersecurity control to the ITGC it already supports, such as privileged access reviews or change tickets, and agree on one evidence repository with a shared retention schedule. Confirm that auditors and disclosure reviewers can both reach it.
Underestimating third-party provider evidence
Item 106 asks how the company oversees risks from third-party service providers, and SOX auditors ask for evidence about providers that run financial systems or hosting. Many teams hold contracts but not current SOC reports, bridge letters, or records of exceptions and complementary controls. Build an inventory of providers that touch financial data or systems, request their assurance reports on a set schedule, and log how each gap was followed up.
Assuming ICFR settles the 8-K question
A clean ICFR conclusion under Section 404 answers whether financial reporting controls operated effectively. It does not decide whether a cybersecurity incident is material for Form 8-K, which turns on the nature, scope, timing and impact of the event. A breach can leave ICFR intact and still require a filing. Run the ICFR assessment and the materiality analysis as separate documented steps, and make sure each has its own sign-off.
Questions finance and security leaders ask about SEC cyber rules and SOX
Does Regulation S-K Item 106 replace our SOX ITGC work?
No. Item 106 and SOX ITGC serve different purposes and run as separate programs. Item 106 requires a public description of how the company assesses, identifies and manages material cybersecurity risks and how the board and management oversee them. SOX Section 404 requires management to evaluate whether controls over financial reporting operate effectively, including the IT general controls that keep financially significant systems reliable. Some security controls appear in both, such as access management and change control, so one set of records may support both, but neither rule removes the other's obligations. Finance and security teams should map shared controls once and agree on who owns each piece of evidence.
What does Item 106 require us to disclose each year?
Item 106 is an annual disclosure in the Form 10-K for fiscal years ending on or after December 15, 2023. It covers two areas:
- The company's processes for assessing, identifying and managing material cybersecurity risks, including whether it engages assessors, consultants or auditors.
- How it oversees risks from third-party service providers.
- Board oversight of cybersecurity risk and management's role, including the responsible positions or committees and their relevant expertise.
The content must reflect how the program actually operates, so the description should be checked against the evidence the company keeps. Management and counsel write and approve the text.
How much effort does reusing SOX ITGC evidence save for cyber disclosure?
Reuse can reduce work where the same records answer both questions, such as access review results, change approvals, backup test logs and vendor oversight reviews. The savings depend on how well the existing evidence is organized, how consistently it is dated and owned, and whether the security team can access it without rebuilding it. Effort rises where security controls sit outside the ITGC program, such as threat monitoring, incident response playbooks or third-party security assessments that were never tested for financial reporting. Ask your team to inventory which Item 106 statements already have supporting evidence, which need new records and which need an owner. No general figure for effort applies to every company.
Can an implementation partner write our cybersecurity disclosure?
No. Management owns the Item 106 disclosure and the Form 8-K filing decision, and company counsel typically reviews the wording before filing. An implementation partner can help prepare the systems and records that the disclosure describes, such as documented incident procedures, access reviews and logging configurations, and can help management trace each statement to its evidence. DeployOpen prepares systems, controls and evidence for compliance assessments, and it does not issue reports or attestations. Independent auditors do not write the disclosure either. Confirm the division of responsibilities in writing before work begins.
Do smaller reporting companies get more time to file incident reports?
Yes. Form 8-K Item 1.05 generally requires disclosure within four business days after the registrant determines that a cybersecurity incident is material. Incident reporting applied from December 18, 2023, and smaller reporting companies were given an extra 180 days before the requirement applied to them. Companies should confirm their current filer status with counsel, because the extension is tied to that status. The extra time does not change the materiality analysis or the Item 106 annual disclosure, which applies on the same schedule for all registrants.
Can any company delay an incident filing for national security reasons?
No. The delay is available only when the US Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety, and the Attorney General notifies the SEC in writing. A company cannot invoke it on its own judgment, and it should not assume the delay applies because an incident is sensitive or under investigation. Teams should plan the filing timeline from the materiality determination and keep a record of when that determination was made. Counsel should be involved early if a government request for delay is possible.
What should our team confirm before a cyber rule audit or filing review?
Start with the scope of your ITGC program, then compare it with the Item 106 statements and the incident procedures. Confirm which systems hold financially significant data, who approves the materiality decision, how quickly the incident team can escalate to the disclosure committee, and which third-party providers are covered by oversight reviews. Ask the external auditor which records they expect to see for shared controls. Ask your implementation partner for a written list of deliverables and the evidence each one produces. Confirm final wording and timing with company counsel and the audit committee.
When to bring in outside help for disclosure readiness
Bring in outside help when your ITGC program cannot show, on request, the records that support what you disclose. The clearest trigger is missing or scattered evidence: access reviews that exist only as email threads, change approvals stored in a ticket tool that finance never sees, or no written record of who reviewed a security alert and what they decided. Item 106 asks you to describe your risk assessment and management processes, so a partner can help you map what already exists to those processes, identify the gaps and prepare the evidence for your own review. A partner prepares systems and records. It does not decide what your 10-K says about them.
A second trigger is when cybersecurity and finance teams work from different records. If the security team tracks incidents in one system and the controller tracks system changes and access in another, nobody can quickly answer whether an incident touched a financially significant application. Co-sourced internal audit or an implementation partner can build a shared inventory of in-scope systems, agree on incident severity criteria with both teams and set up a single evidence index. Ask any partner for its written scope before work starts, including the systems covered, the deliverables, who at your company approves each step and what the partner will not do. Confirm independence limits in writing before engagement. An external auditor generally cannot design or operate the controls it later tests, so a firm that is also your auditor should not take on that work.
Finally, get help when the board needs to explain its oversight of cybersecurity risk in plain terms. Item 106 asks which committee or position oversees these risks and what expertise those people hold, and the description has to match what the minutes actually show. An adviser can help draft a summary of how reporting reaches the board and check it against meeting records. Outside counsel and your external auditor remain the authorities on filing content and on any attestation. Before you engage anyone, ask your counsel to confirm which statements in the draft will be filed, and ask your auditor which evidence it expects to see.
How DeployOpen prepares ITGC and security evidence for disclosure readiness
DeployOpen is a Chainscore Labs company that plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure. We prepare systems, access controls, change records and incident evidence so management can assess its SOX ITGC program and its cybersecurity disclosure obligations, while the organization keeps ownership of its controls and disclosure decisions and independent auditors issue all reports.
How we scope
- Agree in writing which financially significant systems, access paths and incident sources fall inside the engagement.
- Map which ITGC evidence can also support the Item 106 description of risk management processes and board oversight.
- Confirm with your auditor and counsel which controls and disclosure records they expect us to prepare before work starts.
How we build
- Configure access provisioning, privileged account review and change approval workflows in your own environment.
- Set up logging and ticket records that capture who approved, tested and deployed each change to production.
- Build incident intake and escalation steps so security events reach the people who assess materiality within the four-business-day window.
How we hand over
- Deliver control narratives, walkthrough artifacts and evidence indexes organized by ITGC area for auditor review.
- Document the incident response runbook, including roles for the Form 8-K materiality decision and legal review.
- Transfer administration, runbooks and configuration records so your staff can operate and produce evidence independently.
How we support
- Offer ongoing support, upgrades and continuous testing as a retainer after the initial fixed-scope delivery.
- Update evidence collection when platforms are upgraded, new financial applications are added or the environment changes.
- Support tabletop exercises and post-incident evidence reviews, with decisions on disclosure remaining with your organization.
