{"object_type":"business_agent","schema_version":1,"title":"SEC disclosure of material cybersecurity incidents","core":{"id":"agent:us:business:sec-cyber-incident","jurisdiction":"us","domain":"financial","question":"When must a listed company disclose a cyber incident?","affected_business":["Public company"],"applies_when":"Registrants filing reports with the SEC.","decision":"Yes, a cybersecurity incident determined to be material must be disclosed on Form 8-K Item 1.05.","obligation":"Determine materiality without unreasonable delay and file Form 8-K; describe cyber risk management annually.","action":["Assess materiality after discovery","File Form 8-K Item 1.05","Amend when information becomes available","Describe risk management in the annual report"],"deadline":"Within 4 business days after determining the incident is material.","sources":[{"provision":"Form 8-K, Item 1.05","url":"https://www.sec.gov/files/form8-k.pdf"},{"provision":"17 CFR 229.106","url":"https://www.ecfr.gov/current/title-17/section-229.106"}],"read_at":"2026-10-15"},"sha256":"16ddba1e9bc155191ae05b2ed0e5e211cf09434ce4a5b27d115678c6e7c5e852","fields":["affected_business","decision","obligation","risk","action","deadline","verification"],"affected_business":["Public company"],"applies_when":"Registrants filing reports with the SEC.","decision":"Yes, a cybersecurity incident determined to be material must be disclosed on Form 8-K Item 1.05.","obligation":"Determine materiality without unreasonable delay and file Form 8-K; describe cyber risk management annually.","risk":{"risk_level":"not_in_register","risk_factors":[]},"action":["Assess materiality after discovery","File Form 8-K Item 1.05","Amend when information becomes available","Describe risk management in the annual report"],"deadline":"Within 4 business days after determining the incident is material.","verification":{"sha256":"16ddba1e9bc155191ae05b2ed0e5e211cf09434ce4a5b27d115678c6e7c5e852","read_at":"2026-10-15","sources":["https://www.sec.gov/files/form8-k.pdf","https://www.ecfr.gov/current/title-17/section-229.106"],"source":"Source: NovaCopilot"},"next_questions":["Must a non-bank financial firm report a data breach to the FTC?","What must a financial entity report after a major ICT incident?","What is needed before offering a crypto-asset to the public in the EU?","Do I need a licence to provide crypto-asset services in the EU?","What is required to issue an asset-referenced token in the EU?"],"related":[{"id":"agent:eu:business:aml-customer-due-diligence","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:aml-customer-due-diligence"},{"id":"agent:eu:business:aml-suspicious-transaction-report","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:aml-suspicious-transaction-report"},{"id":"agent:eu:business:dora-ict-incident","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:dora-ict-incident"},{"id":"agent:eu:business:mica-asset-referenced-token","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:mica-asset-referenced-token"},{"id":"agent:eu:business:mica-casp-authorisation","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:mica-casp-authorisation"},{"id":"agent:eu:business:mica-e-money-token","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:mica-e-money-token"},{"id":"agent:eu:business:mica-white-paper","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:mica-white-paper"},{"id":"agent:us:business:glba-safeguards-notice","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:glba-safeguards-notice"},{"id":"case_kit:us:sec:avaya-2024","type":"case_kit","url":"https://legal.exploreworldai.com/api/public/v1/case-kit?id=case_kit%3Aus%3Asec%3Aavaya-2024"},{"id":"case_kit:us:sec:mimecast-2024","type":"case_kit","url":"https://legal.exploreworldai.com/api/public/v1/case-kit?id=case_kit%3Aus%3Asec%3Amimecast-2024"}],"related_count":11,"page":"https://legal.exploreworldai.com/en/business-agents/us-sec-cyber-incident","version":"16ddba1e9bc15519","updated_at":"2026-10-15","first_published":"2026-10-14","changes_url":"https://legal.exploreworldai.com/api/public/v1/business-agent-changes","note":"Not legal advice. Verify each answer against the cited provision. Missing facts are not_in_register.","attribution":"Source: NovaCopilot","versions":{"model":"1.0","agent_version":"c4bce25b81213bc8","risk_version":"ce4f350740d6638f","decision_version":"e333c1defa9888dc","package_version":"e7530772b916b655","change_score":0,"changed_dimensions":[],"changed_at":"2026-10-14","verified_at":"2026-10-15","next_check":"2026-10-22","is_current":true,"supersedes":[],"verify_url":"https://legal.exploreworldai.com/api/public/v1/versions/verify?id=agent%3Aus%3Abusiness%3Asec-cyber-incident","changes_url":"https://legal.exploreworldai.com/api/public/v1/living-versions","note":"change_score measures freshness only, never ranking.","impact":"not_in_register"},"withheld":{"links_full":11,"risk_model":3},"access":{"status":"partner_key_required","header":"x-partner-key","contact":"https://legal.exploreworldai.com/kontakt","note":"Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."},"access_class":"decision","access_view":"public","freshness":{"freshness_class":"live","as_of":"2026-11-05T06:31:16.485Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent%3Aus%3Abusiness%3Asec-cyber-incident","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":1655}}