Nothing in Item 1.05 stops a registrant from privately discussing a material cybersecurity incident, or giving more information than the Form 8-K contains, to vendors, customers, other companies affected by or at risk from the same incident or threat actor, and law enforcement or national security agencies, including before materiality is determined. Regulation FD still applies unchanged: material nonpublic information shared selectively with market professionals or security holders must be made public unless an exclusion applies, such as a recipient owing a duty of trust or confidence (attorney, investment banker, accountant) or one who expressly agrees to keep it confidential (Director's statement of 20 June 2024; staff guidance without legal force).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.