Great news! The Cybersecurity Disclosure (CYD) taxonomy is now available within the Workiva platform!

As noted in a prior blog post, SEC filers will be required to tag Cybersecurity disclosures with Inline XBRL beginning December 2024.

XBRL Tagging Requirements

For Regulation S-K Item 106 (in Form 10-K, Item 1C) and Form 20-F (Item 16K), all registrants must begin tagging disclosures in Inline XBRL beginning with annual reports for fiscal years ending on or after December 15, 2024.

For Form 8-K Item 1.05 and Form 6-K, all registrants must begin tagging disclosures in Inline XBRL beginning December 18, 2024.

For filers currently using the US GAAP 2024 or IFRS 2024, the new CYD 2024 taxonomy has been automatically released and updated to be included within these combination taxonomies. Please note the CYD 2024 taxonomy is only compatible with taxonomies of the same version year per the SEC and will require migration to the 2024 taxonomy if an older version of the US GAAP or IFRS taxonomy is currently in use.  

Tabbed XBRL Outline

This release is the latest taxonomy to be included as combination taxonomies, that includes the tabbed XBRL outline with the CYD taxonomy included on the Static tab. The Static tab includes a view-only XBRL outline for those taxonomies that do not require modification or user maintenance. This simplifies the process and allows you to view concept details, drag and drop concepts onto your facts for tagging, and quickly review tagging in your document by highlighting tagged data when the corresponding concepts are selected in the outline.  

Custom Concepts

The Cybersecurity (CYD) Taxonomy Guide provides guidance (in Section 8 of the guide) that numeric values should also be tagged if included in the cybersecurity disclosures. The CYD taxonomy does not include any qualitative standard concepts, therefore custom concepts will be required for the information that is included as separate values.

In order to tag these numeric values (if included in your disclosure), you will need to map the custom concepts to the correct taxonomy section as follows:

• 10-K or 20-F will select Cybersecurity Risk Management and Strategy Disclosure
• 8-K or 6-K will select Material Cybersecurity Incident Disclosure as shown below:

Should you want to discuss support options available in meeting the new SEC tagging requirements for Cybersecurity, please don't hesitate to reach out to your Account Rep, CSM or PSM.

Additional Resources

• Final Rule: Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure
• SEC Fact Sheet
• SEC Cybersecurity Small Entity Compliance Guide
• SEC Announcement
• Cybersecurity Taxonomy Guide
• SEC FAQs for Cybersecurity