Introduction
Your security team is working with incomplete facts, and the clock is already running. Meanwhile, executives and the board must decide whether a reasonable investor would consider the incident important.
That decision doesn't come from a dollar figure or a technical severity score. It requires weighing the incident's actual and reasonably likely financial, operational, legal, strategic, reputational, and stakeholder effects. Get it wrong in either direction and you invite scrutiny.
This article covers the Form 8-K and Form 10-K obligations, the qualitative factors that drive materiality, cross-functional decision-making, and documentation that holds up later. It is educational, not legal advice. Confirm specifics with qualified securities and privacy counsel.
Key Takeaways
- Materiality follows the reasonable-investor test and turns on your company's specific facts.
- Quantitative indicators speed up triage but never create a safe harbor.
- Assess current effects and reasonably likely future harm, even if financials show nothing yet.
- Define roles across security, legal, finance, communications, and the board before an incident.
What the SEC Cybersecurity Rules Require
The SEC adopted its cybersecurity disclosure rules on July 26, 2023 (Release Nos. 33-11216; 34-97989). They require timely disclosure of material incidents and annual disclosure of risk management and governance.
Verify any later amendments, staff guidance, or applicability changes with counsel. A May 2025 petition asks the SEC to rescind Item 1.05, but it is not an adopted amendment.
Form 8-K Item 1.05
A registrant must disclose the material aspects of an incident's nature, scope, and timing, plus its material or reasonably likely material impact. The filing is due within four business days after determining the incident is material. If required information isn't yet available, the filing must say so, and an amendment follows once it is.
Form 10-K and Regulation S-K Item 106
Item 1C of the Form 10-K incorporates Item 106. It covers:
- Processes for assessing, identifying, and managing material cyber risks
- Material effects of cyber risks, including previous incidents
- Board oversight and how the board or committee is informed
- Management's roles and relevant expertise
Two timing points people confuse
The four-business-day period starts at the materiality determination, not at discovery. The determination itself must be made "without unreasonable delay" after discovery, according to the SEC's final rule.
The release treats these as unreasonable delay:
- Postponing a committee meeting beyond its normal timing
- Changing response deadlines to push the decision out
Ongoing investigation does not justify waiting. A narrow Department of Justice delay exists for substantial national-security or public-safety risk, but a request does not pause the clock.
How to Understand Materiality Under the SEC Rules
What "material" means in cybersecurity
The SEC applies the long-standing securities-law standard from TSC Industries v. Northway and Basic v. Levinson. Information is material if there's a substantial likelihood a reasonable investor would consider it important, or would see it as significantly altering the total mix of available information. No cybersecurity-specific formula exists.
Materiality also differs from technical severity. A contained event can still matter to investors, for instance when it touches a core product's trust promise. A technically severe event may prove immaterial once you look at business context.
Why no universal threshold exists
What the same event means depends on context such as:
- Company size and industry
- Business model and customer dependencies
- Data handled and prior risk disclosures
Revenue loss, outage hours, record counts, insurance deductibles, and internal severity ratings can inform an initial view. None is an automatic reporting trigger.
SEC Staff Accounting Bulletin 99 rejects exclusive reliance on a 5% or other numerical threshold, though its scope is financial statements rather than cyber incidents.
Current and reasonably likely future impact
Look beyond what has already happened. Item 1.05 expressly covers reasonably likely material impact. Factors to weigh include:
- Likely litigation and regulatory action
- Customer loss and intellectual property misuse
- Remediation costs and strategy changes
- Continuing disruption
Illustrative example, not legal guidance: Two companies suffer the same ransomware event with five days of downtime.
- Company A is a diversified manufacturer with redundant plants; orders shift and recover.
- Company B runs a single billing platform for a few large customers who have contractual uptime penalties and competitors ready to take them.
Same incident, potentially different conclusions.
Recovery doesn't settle it either. SEC staff interpretations say that paying a ransom, restoring data, or receiving insurance reimbursement doesn't automatically make an incident immaterial or remove a filing obligation.
Qualitative Factors That Can Make a Cyber Incident Material
Gerding's May 2024 staff statement makes clear that financial impact isn't the sole consideration. The adopting release names harm to reputation, customer and vendor relationships, and competitiveness. Those qualitative harms can make an incident material even when financial loss is still uncertain.
Reputational and stakeholder impact
Trust damage can sway an investor before losses show up. Decision-makers should ask:
- Which customer, supplier, partner, or employee relationships are affected?
- Does the incident contradict our public value proposition?
- Are customers likely to leave, delay purchases, or demand new assurances?
Operational and business-model impact
Assess disruption in business terms:
- Revenue platforms and supply chains
- Financial reporting, internal controls, and safety operations
- Duration, scope, recoverability, and effects on strategic initiatives
A single unpatched system that halts customer onboarding for 48 hours can matter more than a hundred compromised laptops.
Data sensitivity and intellectual property
Quantity alone misleads. Weigh the data's sensitivity (health, financial, authentication data), misuse potential, contractual obligations, and competitive value. Source code or trade secrets may matter more than a larger pile of low-value records.
Legal, regulatory, and litigation exposure
Evaluate investigations, enforcement, lawsuits, contractual claims, and allegations that disclosures or controls were inadequate. Keep standards separate: a breach-notification trigger under state or sector law doesn't automatically satisfy SEC materiality, and the reverse holds too.
Competitive, strategic, and market-value effects
Consider product launches, M&A, market access, pricing power, financing, and insurance. Then ask the SEC-oriented question: would this change how a reasonable investor sees our prospects, risk profile, or valuation?
Related occurrences and third-party incidents
The rule defines an incident to include a series of related unauthorized occurrences. Item 1.05 can apply when impact is spread across related intrusions that are each immaterial alone. SEC staff address collective materiality in C&DI 104B.09. Look for repeated exploitation of one vulnerability or the same threat actor.
For cloud, managed-service, or software vendors, materiality depends on impact to your company, not on who owns the system. Don't assume the vendor's conclusion controls yours.
How to Build a Defensible Materiality Determination Process
The release says that adhering to normal internal practices and disclosure controls will suffice to demonstrate good-faith compliance. So build those practices before you need them.
Prepare before an incident
- Write playbooks for ransomware, business email compromise, data exposure, IP theft, cloud compromise, and third-party incidents. State first-hour actions, evidence to preserve, and who approves major steps.
- Set decision rights, escalation thresholds, named roles with alternates, and triggers for outside advisers.
- Create a method for spotting related occurrences.
Collect facts in a usable format
Keep a dated single source of truth that labels what is known, suspected, and unknown. Record affected systems, data, operations, and response actions.
By day two, connect technical findings to business reality: data types, operations at risk, expected costs, customer and vendor consequences, legal exposure, and forecast changes.
Convene the right group
- CISO or CIO: technical facts and confidence levels
- General Counsel: legal exposure and disclosure review
- Finance and accounting: cost estimates and reporting effects
- Operations and business owners: dependency and recovery
- Communications and investor relations: message consistency
- Senior management and, as needed, the audit committee or board
Counsel can help structure the process, and outside counsel is worth involving early.
Weigh quantitative and qualitative evidence together
Financial estimates, outage data, record analysis, and insurance information are inputs, not tests. Add a written analysis of reputation, relationships, regulatory exposure, strategy, intellectual property, future harm, and consistency with prior disclosures.
Document, decide, and monitor
Record participants, information reviewed, assumptions, alternatives considered, the conclusion, rationale, time of determination, and open questions. Documentation supports accountability. It doesn't promise privilege or legal protection.
- If material: coordinate the Form 8-K and required updates with counsel.
- If not material: preserve the rationale, keep monitoring, and reassess as facts change.
Enforcement shows the risks. In 2023, Blackbaud paid $3 million after personnel failed to escalate that sensitive data had been accessed, leaving a later filing incomplete.
In October 2024, the SEC settled with Unisys, Avaya, Check Point, and Mimecast over SolarWinds-related disclosures it called misleading. Those cases involved earlier disclosures, not Item 1.05, and the companies neither admitted nor denied findings. Two commissioners dissented, criticizing hindsight review.
Practical cautions:
- Keep customer, investor, and regulator statements consistent
- Watch insider transactions
- Never leave a non-materiality conclusion undocumented
Consistency doesn't mean reporting every incident. Staff have pointed to Item 8.01 for voluntary disclosure of immaterial or still-being-assessed incidents.
What Boards and Executives Should Operationalize
Board and committee oversight
Boards and audit or risk committees should oversee:
- The materiality framework
- Reporting lines and escalation criteria
- Quality of management's information
- Annual Item 1C disclosures
- Lessons from exercises and incidents
Directors do not need to run the investigation. They need clear accountability, informed challenge, and timely escalation.
In Gibson Dunn's survey of S&P 100 filings, 66% assigned primary oversight to a committee or subcommittee, and 61% disclosed an escalation process.
Reporting that reduces noise
Use one stable dashboard instead of disconnected technical metrics. Separate:
- Current incidents
- Emerging material risks
- Control weaknesses
- Trends
- Open decisions, with owners and expected dates
"We closed 97 percent of critical vulnerabilities" reports activity, not exposure. Translate those metrics into customer impact, operational dependency, financial exposure, legal risk, and strategic consequence, then name the decision needed.
Building capability during transition or uncertainty
When leadership is changing, an incident has occurred, or modernization is underway, decision rights often blur. An independent board advisor or interim CISO can set escalation thresholds, credible reporting, and a measurable 90-day plan with owners.
Tyson Martin works with boards and executive teams on this: decision rights and escalation thresholds that hold in real incidents, and reporting that shows trends rather than trivia, without slowing the business. His work is advisory and not legal counsel.
Frequently Asked Questions
What is materiality under the SEC cybersecurity rules?
Information is material if there is a substantial likelihood a reasonable investor would consider it important, or would view it as significantly altering the total mix of available information. Materiality depends on all relevant facts, both quantitative and qualitative.
What qualitative factors does the SEC expect companies to consider?
Key factors include reputation, customer and vendor relationships, operations, competitiveness, legal and regulatory exposure, intellectual property, strategic effects, and reasonably likely future harm.
Does a cybersecurity incident need to cause actual financial loss to be material?
No. Item 1.05 covers reasonably likely material impact, and staff have said financial effects aren't the sole consideration. Materiality can be determined before impact is fully known.
When does the four-business-day Form 8-K deadline begin?
It generally starts after the company determines the incident is material. That determination must come without unreasonable delay after discovery. Confirm current SEC guidance with counsel.
Do companies need to aggregate related cybersecurity incidents?
Yes, where related. Incidents involving the same threat actor, vulnerability, systems, or pattern of harm may need collective evaluation, even if each looks immaterial alone.
Who should participate in a cybersecurity materiality determination?
Security and IT, legal, finance, risk and compliance, operations, communications or investor relations, senior management, and appropriate board representatives, with outside counsel where appropriate.
