7.04 The cybersecurity statement reads that threats 'are reasonably likely to affect the company'
Company A · a US-listed consumer leisure company · Drafting slip
In brief
Item 1C must say whether cybersecurity risks have materially affected, or are reasonably likely to materially affect, the company. The sentence used says threats 'have not materially affected or are reasonably likely to affect the company', so read literally its second limb is affirmative and drops the word 'materially'. The same sentence was used in the prior-year report.
The evidence, as filed
What the filing shows, and what the rule requires
| What the filing shows | What the rule requires |
|---|---|
'Cybersecurity threats ... have not materially affected or are reasonably likely to affect the company, including its business strategy, results of operations or financial condition.' | '... have not materially affected, and are not reasonably likely to materially affect, the company, including its business strategy, results of operations or financial condition.' |
The rule
Regulation S-K Item 106(b)(2)
Describe whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the registrant, including its business strategy, results of operations, or financial condition and if so, how.
Version: Text in force at the date of this review · Source: Regulation S-K, 17 CFR 229.106 (Cybersecurity), current eCFR text
Why it applies here. The rule asks for a statement on two limbs, past material effect and reasonably likely material effect, and, if either applies, how. The printed sentence carries the negative only to the first limb; read literally it states that threats are reasonably likely to affect the company, which would then call for a description of how. The context (no incident described anywhere in the report) shows the negative was intended, so this is a wording slip rather than a missing disclosure.
Why it matters
Read literally, the required statement says threats are reasonably likely to affect the company without saying how; the intended negative statement is not made cleanly.
Exposure
Drafting only; a staff reader could ask the company to clarify in future filings.
Management’s best defense, and our reply
The company would say the meaning is obvious from the sentence and from the absence of any reported incident, and that the same sentence passed without comment last year. That is fair on meaning, which is why this is a drafting point. But the sentence is the company's answer to a specific line of the rule, and as printed its second limb says the opposite of what is intended; the correction costs a few words.
The fix
- Reword to: 'Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and are not reasonably likely to materially affect, the company, including its business strategy, results of operations or financial condition.'
Evidence relied on
| # | What it shows | Type | Where |
|---|---|---|---|
| 1 | Negative does not carry to the second limb | Document | Form 10-K 2025, page 20 |
| 2 | Same wording in the prior-year report | Document | Form 10-K 2024 (prior year), page 20 |
Prepared by Pramanex from the company’s public SEC filings, without the company’s involvement, to show how a 10-K Pre-filing Check reads. The company is not named, and nothing on this page is a statement about any identifiable company. Observations are not an audit, review or other attestation or assurance engagement, and not legal advice. An SEC-style question is a question, not a conclusion.
Want this on your own 10-K, before you file?
Start with three free findings on your latest 10-K, or book a fixed-price 10-K Pre-filing Check.
Your next 10-K will be in draft before the audit is done.
Have it read before you file.
Start with three free findings on your latest 10-K, or book a fixed-price 10-K check. Drafts only under NDA, inside your insider trading policy.