SEC gives you 4 business days. NIS2 gives you 24 hours. DORA gives you 4 hours. If you're writing disclosure templates during an active incident, you've already lost. This kit gives you pre-built, regulation-specific report templates, evidence management tools, and tabletop exercise scenarios - ready before the crisis.
Version 2.2, updated 19 October 2026. Instant download by email after payment. Licensed to one organization, every employee included. Licence terms. 14-day refund, any reason. How refunds work. Download a sample (PDF), the opening pages of one document.
Regulators don't wait for you to get organized. These are your disclosure deadlines.
Public companies must disclose material cybersecurity incidents within 4 business days of materiality determination. The SEC has already rejected filings for being too vague. Your 8-K draft needs to be ready before the incident.
Essential and important entities under NIS2 must submit an initial notification within 24 hours, intermediate report within 72 hours, and final report within 30 days. Three separate templates, three different content requirements.
Financial entities under DORA must submit an initial ICT incident report within 4 hours of classification. That's not enough time to figure out what to write - only enough time to fill in the blanks.
Built by an ISSM at a DoD contractor, with CISSP and CISM certifications. Not a compliance vendor recycling boilerplate.
Incident classification matrix (5 severity levels, 9 categories), materiality assessment framework for SEC determination, reporting obligations reference across 10 regulatory regimes, and stakeholder contact template (CSV).
4 files including CSVPre-built disclosure templates for SEC 8-K (Item 1.05), NIS2 staged reports (24hr/72hr/30-day), DORA staged reports (4hr/72hr/final), state breach notifications, HIPAA breach notifications, GDPR breach notification, and a board executive summary with a filled-in example. Fill in the facts, not the format.
12 files across 6 regulatory regimesEvidence index (CSV) with chain-of-custody fields, incident timeline builder, chain-of-custody log for legal admissibility, and decisions log for post-incident review. Keep your evidence organized from hour one.
4 files including CSVFull tabletop exercise runbook with facilitator guide and 140-point scoring, plus three complete scenarios: ransomware attack, customer data breach, and third-party vendor compromise. Each with 5 escalating injects and discussion questions.
5 filesWhen an incident hits, these are the people who need templates ready - not blank pages.
You own the incident response program. These templates ensure your team can execute disclosure obligations under pressure without reinventing the wheel.
You need to prove the organization is prepared for regulatory reporting. This kit gives you the templates and the tabletop exercises to demonstrate readiness.
You'll be reviewing every disclosure before it goes out. Start with regulation-aligned drafts instead of blank pages under time pressure.
You need confidence that the organization can respond within regulatory timelines. The executive summary template and tabletop runbook deliver that assurance.
This kit was built by a security professional, not a compliance vendor.
Created by an Information System Security Manager at a Department of Defense contractor, with CISSP and CISM certifications. Incident response isn't theoretical - it's operational.
Covers SEC, NIS2, DORA, HIPAA, GDPR, state breach laws (CA/NY/TX/FL/IL), PCI DSS, GLBA, CIRCIA, and DFARS 252.204-7012. One reporting obligations reference to rule them all.
Three complete tabletop scenarios with 5 escalating injects each - ransomware, data breach, and third-party compromise. Built from real-world incident patterns.
Already bought another Solas AI product? Use code SOLAS20 for 20% off.
If you handle CUI under DoD contracts, pair incident disclosure readiness with full CMMC Level 2 documentation. SSP, POA&M, policies, and evidence mapping.
Prospects asking about your incident response capabilities? Pre-drafted answers for SIG, CAIQ, and 200 common enterprise security questions.
25 documents. 10 regulatory frameworks. Crisis-ready before the crisis.
Instant download. 23 Word documents (.docx) and 2 Excel workbooks (.xlsx), with the Markdown and CSV source of each in a markdown-source folder for Notion, Confluence, or a wiki.
No. This kit covers disclosure and reporting - what you tell regulators, the board, and affected parties after an incident. It complements your IR plan by handling the regulatory communication side that most IR plans don't address in enough detail.
SEC (8-K Item 1.05), NIS2, DORA, HIPAA, GDPR, state breach notification laws (CA, NY, TX, FL, IL), PCI DSS, GLBA, CIRCIA, and DFARS 252.204-7012. The reporting obligations reference covers all 10 with timelines, content requirements, and penalties with timelines, content requirements, and penalties.
Each scenario includes 5 escalating injects based on real-world incident patterns - from initial detection through recovery and regulatory fallout. They're designed for 2-3 hour exercises with cross-functional teams.
If you're not SEC-reporting, skip the 8-K template. You still need state breach notifications, and if you operate in the EU, NIS2 or DORA templates. The kit covers all bases so you're ready regardless of which regime applies.
No. These are compliance framework templates based on publicly available regulatory requirements. We recommend having your legal team review completed documents before filing any regulatory notifications.
David A. Moline, CISSP | CISM
Your AI automation, built by someone who secures DoD systems.
The clock starts the moment you classify an incident. Have your templates ready before that moment.
Hi! I'm the Solas AI assistant. I can answer questions about our services, pricing, and how we help service businesses save time with AI automation. What can I help you with?
