◦ Reference · Framework
SEC 8-K
SEC Form 8-K Item 1.05, the US material-cyber-incident disclosure rule for public companies. A four-business-day clock runs from materiality determination, not from incident detection, and the disclosure must describe the nature, scope, timing, and material impact of the incident along with remediation status. Attention is triggered by materiality-scope debates after a partial restoration, by incomplete remediation disclosures, by unnamed executive accountability for the response, and by the parallel discovery of related incidents that may in retrospect be material.
/sec-8k