SEC Item 1.05 Disclosure Readiness for AI & Agent Incidents
Kriv AI · Cybersecurity & IT
Certification per AWS Marketplace.
Evidence tier Source Confirmed · 4 captures on record
What the publisher says
As described on AWS Marketplace.
SEC Item 1.05 of Form 8-K requires disclosure of material cybersecurity incidents within 4 business days of materiality determination (Release No. 33-11216, live December 18, 2023). SolarWinds / Brown prosecution (filed October 2023; Section 10(b) claim sustained July 2024 on Security Statement framing) is the enforcement anchor. 2024 Corp Fin C&DIs 104B.01–104B.05 clarify scope. 2026 SEC Division of Corporation Finance AI Enforcement Priority announced. Zero AI-specific Item 1.05 readiness SKUs exist on AWS Marketplace today. Kriv AI is first.
GCs / CLOs, Deputy GCs Securities, Corporate Secretaries, CCOs, CFOs, CAOs, CISOs, CROs, Disclosure Committee Chairs, and Audit Committee Chairs at mid-cap ($500M–$2B), large-cap ($2B–$10B), mega-cap ($10B+) Nasdaq / NYSE / NYSE American listed issuers, FPI 20-F filers, REITs, BDCs, post-de-SPAC, recently IPO'd, and emerging growth companies in healthcare, FS, insurance, pharma, biotech, tech, retail, and consumer with material AI deployments face the same obligation: existing 8-K cyber-disclosure playbooks do not contemplate AI-specific incidents. SolarWinds / Brown enforcement chill puts CISOs + GCs + CEOs at personal Rule 10b-5 + Section 17(a) liability. 2024 Corp Fin C&DIs expanded materiality scope. 2026 SEC AI enforcement priority is announced. Disclosure Committees have not rehearsed AI scenarios. CFOs lack quantitative materiality thresholds for AI incidents. Big 4 auditors are probing AI governance in 10-K audits (PCAOB AS 2201 ICFR + AS 1105).
Show the rest of the publisher’s description (5 more lines)
UnitedHealth Change Healthcare (Feb 2024 breach, $1.6B Q1 impact, 6-day 8-K), Clorox (Aug 2023 ~$356M, 15-day Item 8.01 — textbook "should have been Item 1.05"), MGM / Caesars (Sept 2023 divergent disclosure), SolarWinds (Oct 2023 SEC complaint — anchor for individual officer liability). Expected first AI-specific Item 1.05 filing in 2026. Boards and GCs want to be prepared, not the test case.
Kriv is first with a dedicated AI-specific Item 1.05 readiness SKU on AWS Marketplace — Marketplace-transactable, Anthropic CPN-certified, complementary to Customer's Wachtell / S&C / Cravath / Davis Polk / Skadden / Simpson Thacher / Paul Weiss / Gibson Dunn-tier external counsel. Off-Marketplace alternatives: AmLaw 50 readiness $250K–$600K (crisis 8-K $500K–$2M+); Big 4 non-audit-client practices $175K–$500K (PCAOB independence restricts audit clients); tabletop specialists $50K–$150K (none SEC-disclosure-specific).
Engagement methodology (3–5 weeks, under external counsel privilege umbrella). Week 1 current-state disclosure posture review + gap analysis against 2024 Corp Fin C&DIs 104B.01–104B.05. Week 2 AI-incident materiality framework (dual-axis quantitative — data volume, customer count, revenue impact, regulatory exposure, stock-price sensitivity; qualitative SAB 99 + AI overlay — regulated-data category, model-output reliance in MD&A, agent-action reversibility). Week 3 (Foundation closes) role matrix + 4-business-day playbook RACI across GC / Deputy GC Securities / Corporate Secretary / CFO / CAO / CISO / CRO / CEO / Audit Committee Chair / Disclosure Committee / External Counsel / Auditor / IR / External Comms. Week 4 (Standard) Reg S-K Item 106 10-K framework — Item 106(b) Risk Management + Strategy, Item 106(c) Governance, Item 106(d) Material Incidents + DF&A cycle integration. Week 5 (Enterprise) Form 20-F overlay (Item 16K), Rule 10b-5 AI-capability-statement memo (scienter analysis, Caremark / In re Boeing parallels), Dodd-Frank 954 + Nasdaq 5608 + NYSE 303A.14 exec-comp clawback, PCAOB AS 2201 / 2310 / 1105 auditor coordination memo, half-day Audit Committee tabletop (3 injects, after-action CMM 1–5 maturity scoring).
8-K Item 1.05 template library (7 scenarios). Shadow-AI exfil; vendor GenAI breach cascade; agentic unauthorized action; prompt-injection production incident; deepfake wire fraud (BEC 2.0); model poisoning; hallucination-driven public misstatement. Add-ons (+$20K each): MCP / A2A vulnerability; agentic lateral-movement; vendor-AI provider cascade; model-theft / weight-exfil.
Important disclosures. Kriv does NOT provide legal advice. Customer GC + external securities counsel retain ALL materiality determinations, ALL filing decisions, ALL Item 1.05(c) delay determinations, ALL Reg FD coordination, ALL Rule 10b-5 scienter, ALL Form 20-F harmonization. Engagement under external counsel privilege umbrella — Customer's external securities counsel must engage Kriv as privileged-communications support. Kriv does NOT make SEC filings; all filings signed by Customer's authorized officers (Section 302 / 906). No SEC / shareholder-suit / Rule 10b-5 / PCAOB / D&O / ISS / Glass Lewis / Caremark outcome guarantee. NOT an auditor / SOC 2 / ICFR provider. NOT a law firm; no attorneys on staff. Ongoing post-engagement program → N2 AI Governance-as-a-Service. PCAOB auditor independence preserved. Anthropic CPN-certified partner, not Anthropic-authorized reseller.
Highlights
Highlighted by the publisher on AWS Marketplace.
First AI-specific SEC Item 1.05 disclosure readiness SKU on AWS Marketplace. SolarWinds / Brown prosecution (Section 10(b) sustained July 2024 on Security Statement framing). 2024 Corp Fin C&DIs 104B.01–104B.05 clarified scope. 2026 SEC Division of Corp Fin AI Enforcement Priority announced. PCAOB auditor-independence rules block Big 4 from audit-client disclosure work. AmLaw 50 charges $250K–$600K off-Marketplace; 12–24 month first-mover window before AmLaw 50 / Big 4 list Marketplace SKUs..
AI-incident materiality framework (dual-axis quantitative + SAB 99 qualitative + AI-specific factors), 7-scenario 8-K Item 1.05 template library (shadow-AI exfil; vendor GenAI cascade; agentic unauthorized action; prompt-injection; deepfake BEC; model poisoning; hallucination misstatement), 4-business-day playbook + RACI, Reg S-K Item 106 framework, Form 20-F overlay, Rule 10b-5 memo, Dodd-Frank 954 + Nasdaq 5608 / NYSE 303A.14 clawback, PCAOB AS 2201 / 2310 / 1105, Audit Committee tabletop.
$45K Foundation (3 wks; materiality + 8-K library + playbook + RACI + D&O update) / $85K Standard (4 wks; + Item 106 10-K framework + DF&A) / $140K Enterprise (5 wks; + 20-F + Rule 10b-5 memo + clawback + PCAOB + half-day Audit Committee tabletop). +$20K per extra scenario or tabletop. Conducted under external counsel privilege umbrella (Wachtell / S&C / Cravath / Davis Polk-tier). Anthropic CPN-certified. Complementary to outside counsel; not legal advice.
Agent build and provenance
See the full provenance
The layer-by-layer build, the evidence behind each claim, the risk basis and the cross-marketplace links are open to any account. Some rows are disclosed, some the source leaves Unknown; a free account shows you which.
Compliance
- FedRAMPConfirmedNot listed90%, registry-checkedNo FedRAMP Marketplace entry matched this vendor's domain, checked 2026-08-27registry recordas observed 2026-08-27
Confirmed means matched to a public authoritative registry. Claimed means the vendor or its listing states it, not yet cross-checked. A framework not shown was not found in any source we hold, which is not evidence against it. Not listed means a scoped registry check found no match for this vendor's domain: a No is a scoped registry check, not a compliance judgment. Confidence bands: 95% domain-verified, 90% registry-checked, 80% self-attested, 70% weak signal. Self-attested items marked “vendor's site” are gathered from the vendor's own website and are not verified by us.
Vendor
External enrichment · as of 2026-08-29
Sources
Publisher resources
3 linksLinked repositories
Unknown means this listing does not publish a repository. It is not a statement that the code is closed, and a linked repository is not a claim that the publisher wrote it: the registry computes that relationship privately and does not publish it.
Evidence risk is the share of the build you cannot see before you deploy, not a security rating. Sign in to see the layer-by-layer basis for this band.