What is cybersecurity materiality? The SEC's test for disclosing cyber incidents

Cybersecurity materiality is the securities-law test a public company applies to decide whether a cybersecurity incident or risk must be disclosed to investors: whether a reasonable investor would likely consider it important, or whether it would significantly alter the total mix of information available. The SEC applies its ordinary materiality standard to cyber events; there is no separate cybersecurity definition.

How the test works

In its final rule of 26 July 2023, the SEC declined to write a cyber-specific standard, saying that would depart from current practice. It restated the test from securities case law: information is material if "there is a substantial likelihood that a reasonable shareholder would consider it important" in making an investment decision. Companies should apply it through the lens of the reasonable investor, weighing quantitative and qualitative factors together.

For a data breach, the release told companies to consider both the immediate fallout and longer-term effects on operations, finances, brand perception and customer relationships. A statement of 21 May 2024 from the director of the Division of Corporation Finance added harm to vendor relationships and competitiveness, and the possibility of litigation or regulatory action, as factors to weigh.

No number settles it. Staff Accounting Bulletin No. 99, issued on 12 August 1999, warns that exclusive reliance on any percentage or numerical threshold has no basis in accounting literature or the law, and that qualitative factors can make small amounts material.

The timing rule

For incidents, Form 8-K Item 1.05 requires the materiality determination without unreasonable delay after discovery. The four-business-day filing clock then runs from that determination.

Why it matters to a CISO and the board

Getting the call wrong carries its own cost. On 22 October 2024 the SEC settled charges against Unisys, Avaya, Check Point and Mimecast for misleading disclosures about intrusions linked to the SolarWinds Orion compromise, with penalties from $990,000 to $4 million. In two cases, risk factors were written as hypothetical when the risks had already materialized. The companies neither admitted nor denied the findings.

What it is not

Materiality is not a severity score. A technically critical incident can be immaterial to investors, and a modest one can be material because of what it does to customers, regulators or reputation. The security team rates severity; the materiality judgment belongs to the company's disclosure process, with the CISO supplying the facts.

Where it appears on CISO Tribune

• SEC Item 1.05 materiality decision guide: the decision step by step.
• SEC cyber incident disclosures: every Form 8-K Item 1.05 filing, read from SEC EDGAR's search index and linked to the filing.

Related terms

• Form 8-K Item 1.05
• Regulation S-K Item 106