Securities Exchange Act · USA
Väsentliga cyberincidenter, Form 8-K Item 1.05
En cyberincident som bolaget bedömer som väsentlig ska rapporteras på Form 8-K inom fyra arbetsdagar efter bedömningen. Bedömningen ska göras utan oskäligt dröjsmål efter upptäckten.
Krav
Form 8-K Item 1.05(a) Disclose a material cybersecurity incident
If the registrant experiences a cybersecurity incident that is determined by the registrant to be material, describe the material aspects of the nature, scope, and timing of the incident, and the material impact or reasonably likely material impact on the registrant, including its financial condition and results of operations.
Form 8-K Item 1.05, Instruction 1 Materiality determination without unreasonable delay
A registrant shall make a materiality determination regarding a cybersecurity incident without unreasonable delay after discovery of the incident.
Form 8-K, General Instruction B.1 Filing within four business days of the materiality determination (summary)
The Item 1.05 Form 8-K is due within four business days after the registrant determines that the incident is material, not four business days after discovery.
Sammanfattning, inte ordagrann text.
Form 8-K Item 1.05(c) Delay for national security or public safety (summary)
Disclosure may be delayed only if the U.S. Attorney General determines that it poses a substantial risk to national security or public safety and notifies the Commission in writing; the initial delay is up to 30 days.
Sammanfattning, inte ordagrann text.
Form 8-K Item 1.05, Instruction 2 Amend when information was not available (summary)
Where required information is not determined or is unavailable at the time of filing, the registrant states so and files an amendment within four business days after the information becomes available.
Sammanfattning, inte ordagrann text.
Frister
Fyra arbetsdagar efter att bolaget bedömt incidenten som väsentlig, inte efter upptäckten.
Sanktioner
Exchange Act §21B(b), 15 U.S.C. §78u-2(b): per överträdelse USD 5,000 till USD 100,000 för fysisk person och USD 50,000 till USD 500,000 för bolag. Beloppen räknas upp med inflationen; de uppräknade beloppen är inte införda ännu.
Exchange Act §32(a), 15 U.S.C. §78ff(a): vid uppsåtlig överträdelse böter upp till USD 5,000,000 och fängelse upp till 20 år för fysisk person, böter upp till USD 25,000,000 för bolag.
SEC-ärenden med officiell källa (5)
These cases concern conduct before Item 1.05 took effect (December 2023) and were brought under the periodic reporting and disclosure controls rules; they show how the SEC assesses cyber disclosure.
- First American Financial Corporation, 2021-06-15, USD 487,616.
Disclosure controls failed to ensure that information about a known vulnerability exposing customer data reached the executives responsible for the Form 8-K and press statement.
- Unisys Corp., 2024-10-22, USD 4,000,000.
Materially misleading risk disclosures in periodic reports about cybersecurity intrusions, plus disclosure controls violations.
- Avaya Holdings Corp., 2024-10-22, USD 1,000,000.
Negligently minimized a cybersecurity incident in public disclosures.
- Check Point Software Technologies Ltd, 2024-10-22, USD 995,000.
Described cybersecurity risks in generic terms although intrusions had already occurred.
- Mimecast Limited, 2024-10-22, USD 990,000.
Omitted material information about the nature of the code exfiltrated and the number of encrypted credentials accessed.
- Agent:
- agent:us:sec:agent-sec-8k-1-05
- Noder:
- SEC-rapportering som noder
- Källa:
- Form 8-K Item 1.05 (17 CFR 249.308), läst 2026-10-10
Kopplingen mellan ärenden, krav och kontroller är redaktionell och finns i NovaCopilot med partnernyckel. Source: NovaCopilot.