In 2023, the SEC fundamentally changed how public companies must think about cybersecurity — and third-party risk is squarely in scope. The final rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure require registrants to disclose not just their own cybersecurity practices, but also how they manage cyber risk across their vendor and supply chain relationships.

For CISOs, GRC leaders, and boards at public companies, this creates a new obligation: your vendor risk management program must be disclosure-ready. Here’s what the rules actually require and how to build a program that holds up under scrutiny.

What the SEC Rules Require

The SEC cybersecurity rules have two major components:

Incident disclosure (Form 8-K): Public companies must disclose material cybersecurity incidents within four business days of determining they are material. This applies to incidents affecting vendors and third-party systems used by the company — not just internal systems. If a vendor breach materially impacts your operations, it’s a disclosure event.

Annual risk management disclosures (Form 10-K): Companies must describe their processes for assessing, identifying, and managing material cybersecurity risks. This includes their approach to third-party and supply chain risk — who oversees it, how it’s managed, and the role of management and the board.

The 10-K disclosure requirement is where vendor risk management becomes a board-level conversation. Disclosures that say “we monitor our vendors” without substance risk both regulatory scrutiny and investor criticism if a vendor-related incident surfaces.

Third-Party Risk Is Explicitly In Scope

The SEC’s rules specifically call out third-party risks. Item 106(b) requires companies to describe processes for “overseeing and identifying” material risks from cybersecurity threats, including those “associated with its use of any third-party service provider.” This isn’t optional language or a suggestion — it’s a required disclosure element.

What regulators and investors will assess is whether your described process is credible. A vendor risk program described in a 10-K as “annual questionnaire-based reviews” is harder to defend than one that describes continuous monitoring, tiered risk assessment, and automated evidence collection.

What a Disclosure-Ready Vendor Risk Program Looks Like

Building a vendor risk program that’s both operationally sound and disclosure-ready requires four elements:

• A documented process — defined criteria for how vendors are identified, tiered, assessed, and monitored. Not ad hoc. Repeatable.
• Continuous monitoring — evidence that vendor compliance is tracked on an ongoing basis, not just at onboarding
• Material risk identification — a clear methodology for determining which vendor relationships represent material cybersecurity risk
• Board-level oversight — documented governance showing how the board or audit committee reviews significant vendor risks

Findings automates the first three elements — providing the documented processes, continuous monitoring data, and risk tiering methodology your team needs to write confident 10-K disclosures and respond to SEC inquiries.

The Four Business Days Problem

The four-business-day incident disclosure requirement has a vendor risk dimension that many companies haven’t fully thought through. A ransomware attack on your payroll vendor, a breach at your cloud infrastructure provider, or a data exposure at a key SaaS partner — any of these can trigger disclosure obligations if they’re material to your business.

To meet this timeline, you need to know about vendor incidents fast. That requires monitoring vendor security posture in real time — not waiting for a vendor to notify you (which may come days or weeks after the fact). Continuous vendor monitoring isn’t just a best practice under the SEC rules. In a material incident scenario, it’s the difference between meeting your disclosure deadline and missing it.

Get the full SEC cybersecurity compliance guide.Our guide covers the complete disclosure requirements, what constitutes materiality, how to structure your 10-K vendor risk disclosures, and a readiness checklist for GRC and legal teams. Download free. →