Cyber incident reporting requirements, answered from one cited set of facts, with the General Counsel deciding
Every regulator clock met, from one cited set of facts the committee signed.
See one case, screen by screen ↓Cyber Incident Reporting helps the General Counsel and CISO work through each cyber incident reporting requirement — SEC Form 8-K Item 1.05, NIS2, DORA and GDPR — from one cited set of facts. Seven agents map who reports to whom, keep a timeline of what was known and when, weigh materiality on a scale where every factor cites its source, draft each notice and re-check them against each other. The disclosure committee votes, the General Counsel records the determination and named signers submit.
How to choose AI solutions for back-office and enterprise work →
Updated
One incident at a US-listed group with EU businesses starts several legal clocks, each from a different trigger. NIS2 runs from awareness of a significant incident: a 24-hour early warning, a 72-hour notification and a one-month final report. DORA runs from classifying the incident as major at a financial entity. GDPR runs from awareness of a personal-data breach. Form 8-K Item 1.05 is due four business days after the company determines the incident is material — and that determination is the General Counsel's to make and defend.
Meanwhile the facts arrive piecemeal from the forensic firm, the plants and finance, and they keep changing. The disclosure committee argues materiality from a slide deck, the basis of the decision is rarely recorded, and four authors write four notices from four versions of the facts. A German notice says no data was taken, and two hours later forensics confirm 412 GB left the network. In October 2024 the SEC penalised four companies for describing known breaches more softly than the facts they had.
Estimated split for one significant incident at a listed group with EU entities, by hand and with the solution.
Seven agents map, keep the facts, weigh, draft and re-check blind; the committee votes and the General Counsel decides.
Friday night, ransomware encrypts the plant servers at Ghent, Genk and Duisburg and production stops for 41 hours; a directory outage takes down the merchant portal of the group's Dutch payment institution. By Monday afternoon the early warnings are sent, forensic update 7 says 412 GB were copied out, and the disclosure committee has voted. Here is the afternoon, screen by screen, in the working solution.
Maria's home screen says it plainly: 1 incident needs her decision, the CCB notification is due in 9 h 12 m, and 4 disagreements between notices are waiting. Below it, each agent that ran overnight and this morning has left one message with its proposal, its citation and one button — open the scale, review the four fixes, open the CCB notice, review the triage of a new phishing case.
Materiality agent: “INC-2026-0917 leans material, 12 to 6. The committee voted 4 of 4 ‘material’ at 13:40. Your determination starts the SEC clock.”
Above the scale, seven clocks — one per regulator, each from its own trigger. The SEC clock reads “Starts at the decision”; the CCB 72-hour notification shows 9 h 12 m; the BSI notification says “Update needed”. On the scale, operations, data taken, customers, public attention and regulators weigh 12 towards material; revenue, cost, containment and payments weigh 6 against. The agent explains: on the numbers alone it would not be material — $8.2M is 0.36% of group quarterly revenue — but the qualitative factors decide it.
“The SEC asks for both kinds of factor.”
She clicks Data taken. The weight is 3, heavy, and it rests on three facts from forensic update 7: 412 GB copied out from Ghent file server GNT-FS-02, personal data of 6,180 employees in Belgium and Germany, and engineering drawings belonging to two customers. The passage is highlighted. A weight can be changed here, but only with a reason, and the change goes on the record.
Materiality agent: “Personal data and customers’ drawings; a reasonable investor would want to know. Weight 3.”
Maria asks the question her board will ask. The agent takes Data taken off the scale and the beam re-tilts to 9 to 6: still material, on operations and customers. Without the leak-site claim as well, it would be 7 to 6, close to balanced, and the agent would advise “not yet determinable”. Nothing is saved; the what-if resets.
“This what-if is not saved; reset it any time.”
The facts agent keeps 24 facts from 13 updates, each with when it happened and when it was known, its source and its status; an early estimate of 2,900 merchants is marked superseded by the confirmed 3,420. Maria replays the case as of 09:40 Monday, when the BSI notice went out, and every fact learned later fades. It is how she will show, a year from now, what the company knew when it decided.
“Replay. Showing the case as it was known at Mon 12 Oct 09:40. Facts learned later are faded.”
The 8-K Item 1.05, the CCB 72-hour notification, the BSI update and the DORA intermediate report are drafted from fact set v9. Every sentence carries a chip for the fact it rests on. The 8-K draft waits for the determination; when it is recorded, the drafter adds the date and the SEC clock starts. The GDPR notice is the privacy team's and stays read-only.
Drafter agent: “I write; I never submit. Each notice goes to its named signer.”
The consistency agent re-read 5 notices without seeing who wrote them, against each other and the 24 facts. Two are high: the BSI notice says “There is no indication of data exfiltration at this stage” while forensic update 7 says 412 GB were copied out, and the 8-K names the remote-access gateway and its unpatched flaw, detail Item 1.05 Instruction 4 says need not be disclosed. Two are medium: the 8-K says operations were “temporarily disrupted” where the CCB notice says “stopped for 41 hours”, and the DORA draft counts 3,240 merchants where the facts say 3,420. Each comes with a proposed fix to accept or reject, with a reason.
“A softer description in the SEC filing than in an EU notice is the pattern the SEC penalised in October 2024.”
Five voting members, quorum four, Maria in the chair. Rachel Thornbury: “Small against the group's revenue, but the customer penalties and the drawings are not small.” Henrik Aalto, Luis Ferreira and Nadia Brecht vote material too, each with a comment the minutes keep; outside counsel's memo is marked privileged, and the agents have no access to it. The drafter writes the minutes, and decision record D-0917-01 waits for the General Counsel.
Three outcomes are offered — material, not material (no Item 1.05 filing; she may disclose under Item 8.01) or not yet determinable, with a next review. She chooses material with reason codes M1 operational disruption, M2 data taken and M3 customer and contract impact, and a note for the record. She ticks the statement and signs. The SEC clock starts: the 8-K is due Fri 16 Oct, 17:30 ET.
“I, Maria Lindqvist, General Counsel, record this determination for Kestrel & Vane Group on the facts known at 14:05.”
The filings screen lists every notice with its regulator, portal, signer, due time and receipt: the CCB and BSI early warnings, the DORA initial notification, the GDPR notification and the BSI notification, five sent, every one on time. The CCB notification is ready for Henrik Aalto's signature with 9 h 12 m left; the 8-K, now determined material, is due Fri 16 Oct, 17:30 ET, and three open items are watched for the 8-K/A. The clock keeper reminds and escalates, but never submits.
“7 regulator clocks, none missed · 5 notices sent, every one on time · agents never submit: the named signer does.”
The same incident, seen by five of the people who carry it — what the first days looked like, and what they look like now.
Seven agents map, keep the facts, weigh, draft and re-check blind; the committee votes and the General Counsel decides.
Reads each SOC case, finds the affected legal entities from the entity register and tests which reporting regimes may apply — SEC, NIS2 per country, DORA, GDPR — with the reason and the clock for each.
Reads forensic, operations, finance and threat-intelligence updates and keeps one timeline of facts, each with when it happened, when it was known, its source passage and its status; a fact that replaces another marks the old one superseded.
Tests NIS2 significance per entity and country, DORA major per financial entity under RTS 2024/1772, and GDPR personal-data breaches, and starts each clock from its own trigger.
Weighs the quantitative and qualitative factors on the scale with the company's materiality playbook, SEC guidance and anonymised comparable filings, cites the facts for each weight, and states its confidence and which single fact would change the result.
Drafts the 8-K Item 1.05, the NIS2 notices, the DORA reports, the committee minutes and the final reports from one set of facts, says plainly what is not yet determined, and cites the fact behind every sentence.
Re-reads every notice blind against the others and the timeline, finds contradictions, numbers that drifted, softer wording in one notice than another and detail that would impede remediation, and proposes a fix.
Keeps one clock per regulator and notice, reminds the owner at 50%, 75% and 90%, escalates to the General Counsel and the CISO 6 hours before a due time, and starts the 8-K/A clock when an open item is answered.
The committee votes; the General Counsel records; named signers submit. The agents propose; a named person decides.
Ask in plain words, or tell the agents what to do. Every answer points to its source, and opens the screen it is about.
Why does the scale lean material?
On the qualitative factors, not the numbers. The $8.2M revenue impact is 0.36% of group quarterly revenue, inside the playbook's low band. What tips it: 412 GB taken, including two customers' drawings, production stopped 41 hours, and $1.1M of penalty rights reserved. Material 12, not material 6.
What changed since we sent the BSI notice?
The BSI notice went at 09:40 saying there was no indication of data exfiltration. At 11:52 forensic update 7 confirmed 412 GB copied out, including personal data of employees in Germany. The consistency agent drafted a correction for Jonas Albrecht to sign.
What will the 8-K say is not yet determined?
Three items, each watched for the 8-K/A: the full financial impact for Q4 (finance close), the total recovery cost net of insurance, and whether the copied drawings are published. When one is answered, the 8-K/A is due four business days later.
Remind Henrik 2 hours before the CCB deadline
Done. Henrik Aalto gets a reminder at 21:17 on e-mail and mobile, and you are copied. The CCB notification is due at 23:17; the draft is ready to sign.
13 screens from the working solution, on its sample data. Pick one to see it large.
The materiality playbook, each regulator's clock rule with its legal source, and the reminders are settings, and every change goes on the audit trail.
| Setting | Default | Choose from |
|---|---|---|
| Revenue impact bands | Low below 1% · review from 1% · high above 5% | Set as a share of group quarterly revenue |
| Default weights of the qualitative factors | Operations 3 · Data taken 3 · Customers, public attention, regulators and litigation 2 | 1 · 2 · 3 for each factor |
| Committee quorum | 4 of 5 voting members | 3 of 5 · 4 of 5 · 5 of 5 |
| Records the determination | General Counsel | General Counsel · Chief Financial Officer |
| SEC · Form 8-K Item 1.05 | 4 business days from the materiality determination | US federal holidays; EDGAR 17:30 ET |
| NIS2 · CCB Belgium and BSI Germany | 24 h · 72 h · 1 month from awareness | Calendar hours, per country and entity |
| DORA · DNB Netherlands | 4 h from classification as major (at most 24 h from awareness) · 72 h · 1 month | Weekend rule for the initial notice |
| Reminders and escalation | At 50%, 75% and 90% of each clock; escalate 6 hours before | Escalate 3 · 6 · 12 hours before; daily digest at 07:00 or 08:00 |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample incident · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures and rules (SEC Form 8-K Item 1.05, Release 33-11216 — four business days after the materiality determination; Directive (EU) 2022/2555 Art. 23 — NIS2 24-hour early warning and 72-hour notification; Regulation (EU) 2022/2554 (DORA) with Delegated Regulations (EU) 2024/1772 on classifying major incidents and (EU) 2025/301 on reporting time limits — the 4-hour initial notice; Regulation (EU) 2016/679 Art. 33 — GDPR 72 hours; SEC orders of 22 October 2024 — penalties of $4M, $1M, $995K and $990K). Companies, people, incidents and receipts named on this page are fictional — characters and sample data in the working solution.
Cyber Incident Reporting helps the General Counsel and CISO work through each cyber incident reporting requirement — SEC Form 8-K Item 1.05, NIS2, DORA and GDPR — from one cited set of facts. Seven agents map who reports to whom, keep a timeline of what was known and when, weigh materiality on a scale where every factor cites its source, draft each notice and re-check them against each other. The disclosure committee votes, the General Counsel records the determination and named signers submit.
Several clocks, each from its own trigger. Form 8-K Item 1.05 is due four business days after the company determines the incident is material. NIS2 asks for an early warning within 24 hours of awareness of a significant incident, a notification within 72 hours and a final report within a month. DORA asks a financial entity for an initial notice 4 hours after classifying an incident as major, no later than 24 hours after becoming aware of it, and GDPR asks for a notice to the data protection authority, where feasible within 72 hours of awareness of a personal-data breach.
The materiality agent places each quantitative and qualitative factor — operations, data taken, customers, public attention, regulators, revenue, cost, containment — on a material or not-material side, with a weight from your playbook and the facts it rests on. It gives its confidence and says which single fact would change the result, and you can ask what-if questions and watch the scale move. It never makes the determination.
The drafter agent writes every notice from the same fact set, with each sentence citing its fact. The consistency agent then re-reads every notice blind against the others and the timeline, and flags contradictions, drifted numbers, softer wording in one notice than another and remediation-sensitive detail. A person accepts or rejects each proposed fix, with a reason.
Yes. Every fact carries when it happened and when it was known, with its source passage, and superseded facts stay linked to the update that replaced them. The case replays as of any moment — NIS2 awareness, DORA classification, a notice sent, the committee meeting — and the decision file exports the timeline as of each decision.
Yes. The agents read, propose and draft; they never decide materiality, sign or submit a notice, contact a regulator, edit a signed notice or move a clock. The committee votes, the General Counsel records the determination with reason codes and a signature, and each notice is signed and submitted by its named person.
The 8-K states what is not yet determined, and the clock keeper watches each open item — in the sample incident, the full Q4 impact, the recovery cost net of insurance and whether the copied drawings are published. When one is answered, it opens the 8-K/A, due four business days later, and the drafter writes it.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your entity register, materiality playbook, committee and regulators — and it goes live once every quality gate has passed. First-time setup ends with a tabletop drill, so you see the clocks and drafts work before a real incident.
Exceptions found before the auditor finds them, and one evidence set for both audits.
1-min demoNIS2 ComplianceEvery EU entity scoped, registered and evidenced per country, with the board signing off.
1-min demoCMMC ComplianceEvery one of the 320 objectives proven before an executive signs the affirmation.
1-min demoWe'll run Cyber Incident Reporting as a tabletop drill on your own entities, playbook and a past incident.