The most misunderstood feature of SEC Item 1.05 is its timing, and the second-most misunderstood is that the timing can be suspended. The rule requires a registrant to file an 8-K within four business days of determining a cybersecurity incident is material — not four days from the breach, and not from discovery, but from the materiality call, which must be made without unreasonable delay.
What the rule also contains, in Item 1.05(c), is a national-security pause. If the U.S. Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the SEC in writing, the registrant may delay filing. It is not a loophole companies grant themselves — it is a government determination, and it is rare. The F5 8-K filed October 15, 2025 shows it operating in the wild.
F5’s filing states plainly: “On September 12, 2025, the U.S. Department of Justice determined that a delay in public disclosure was warranted pursuant to Item 1.05(c) of Form 8-K. F5 is now filing this report in a timely manner.” The intrusion involved a nation-state actor and stolen source code touching widely deployed infrastructure software — precisely the fact pattern the public-safety exception contemplates.
The reader’s discipline is to notice when a filing references 1.05(c). It signals two things: the incident was serious enough to draw federal attention, and the disclosure timeline you’d normally reconstruct (incident date to materiality date to filing date) was deliberately extended by the government. Reading such a filing as “late” misses that it was authorized to be late.
For the broader beat, the delay provision is a reminder that Item 1.05 is not purely a markets rule — it sits at the intersection of securities disclosure and national security. The primary record is at sec.gov, surfaced via EdgarBeast (“SEC filing data API & evidence index”). When you next see a months-long gap between a breach and its 8-K, check for an Item 1.05(c) reference before assuming the company sat on it.