Chapter 8 of 12 · Before any incident (listed companies)
Q8: Who Decides If an Incident Is Material?
- When do we have to tell investors about an incident?
- Who makes that call?
If your company is listed in the United States, there is a specific rule to know. The SEC requires a company to determine whether a cybersecurity incident is material without unreasonable delay after discovery. If it is material, the company must file a Form 8-K under Item 1.05, generally within four business days of that determination. The clock starts at the materiality decision, not at the attack. Disclosure can be delayed only in narrow cases where the US Attorney General decides immediate disclosure would pose a substantial risk to national security or public safety.
Companies outside the US, or not listed, may have other reporting duties to regulators or customers. Ask your counsel which apply.
What you should hear
- A named group that makes the materiality decision, usually including legal, finance and the CISO.
- How the CISO's facts reach that group, and how quickly.
- A written record of how each decision was reached.
Red flags in the answer
- Nobody is sure who decides.
- The process starts only once the investigation is complete.
- Materiality is treated as purely a technical question.
The question you might not ask out loud
Is materiality a security decision?
No. It is a business and legal judgement about whether a reasonable investor would consider the incident important. The CISO supplies the facts. Legal and executive leadership make the call.
Follow-up
"Walk me through the last time we had to consider whether something was material. Who was in the room?"
Why this matters: the decision is made under pressure, with incomplete facts. A group that has never practised it will be slower and less consistent than one that has.
Rule of thumb:The four business days start when you decide. Make sure you know who decides.