The Board's Role in a Materiality Determination After an Incident

A serious incident lands, and somewhere in the first days someone asks the question with legal weight: is this material?

The answer determines disclosure obligations, timelines and liabilities. It is not the board's call to make - it belongs to management, made with counsel. But the board owns a different question: do we have a process for that call that we would be comfortable defending a year from now?

That oversight role is worth understanding before the incident, not during it. What follows is general information about governance practice, not legal advice; the specifics of any disclosure obligation belong with your counsel.

TLDR

• Materiality is management's determination, made with counsel - the board oversees, it does not decide.

• The board's job: a documented process, the right people in the room, and a reliable record.

• Ask who weighs the factors, how counsel is involved, and how timing is tracked.

• The decision record matters as much as the decision - what was weighed, when, by whom.

• Rehearse the process before you need it; a first live run during a real incident is a finding.

Where the line sits

For public companies, U.S. securities rules require disclosure of material cybersecurity incidents, and the materiality determination sits with management. The board does not sign the determination. Its oversight questions are simpler and earlier: is there a defined process, does it name the decision-makers, does it involve counsel promptly, and has anyone ever run it?

A board that asks those questions in a calm quarter is doing its job. A board that asks them for the first time on day three of an incident is catching up.

The decision record

Whatever the determination, the record around it is governance gold. The example fields below are illustrative.

Record field (illustrative)	What it captures
Factors weighed	Nature and extent of the incident, data involved, operational impact, remediation state
People involved	Who assessed, who decided, which counsel advised
Timing	When the incident was identified, when the determination was made, what triggered each step
Decision and rationale	The determination itself and the reasoning recorded at the time

The SEC's 2023 cybersecurity disclosure rule is the reference point many companies build this record around. The details of how it applies to any specific company and incident are exactly the territory for counsel.

What the board should ask in peacetime

Three questions, asked once a year, cover most of the oversight duty. Who makes this call and how quickly can they convene? How does counsel get involved and at what trigger? Can I see the record from the last tabletop where we practiced this?

If the third question has no answer, the process has never been exercised - which is itself the answer.

The board's place during a live incident

During a real event the board's job is to be informed, to support the process, and not to crowd the decision. Directors asking good questions about process and timing help; directors drafting the determination do not. For the committee structure that supports this work, see the cyber and AI disclosure committee charter.

Frequently asked questions

Does the board vote on materiality?

Ordinarily no. The determination belongs to management with counsel. Boards oversee the process and are informed of the outcome. Your own counsel should confirm how this applies to your company.

What if management and the board disagree?

Directors can press on process: what was weighed, who advised, what the record shows. Persistent disagreement is a counsel-and-governance question, not one to settle in the heat of an incident.

Does this apply to private companies?

The specific securities-rule obligation applies to public companies, but the governance discipline - a defined process, counsel involvement, a decision record - serves any company facing customers, insurers or regulators after an incident.

How often should the process be rehearsed?

At least annually, ideally inside an existing tabletop exercise, with counsel participating.

A Defensible Next Step

Ask management for the one-page description of your materiality determination process: who decides, how counsel is engaged, and when it was last exercised. If the page does not exist, that is the gap. Book a Decision-Clarity Call if you would like help thinking through the oversight side - and confirm the legal specifics with your counsel.