Since 2023, American public companies have had four business days to report a material cybersecurity incident to the SEC, and every US state requires notification of individuals whose personal data is breached. Even the failure of information systems is itself subject to a disclosure requirement.