When a cyber incident hits a public company, the disclosure committee has to answer one question on a tight clock: is it material, and if so, what does the Form 8-K say? This memo gives you the structure to record that decision defensibly — the facts, the quantitative and qualitative factors, the reasonable-investor conclusion, the four-business-day clock, and the draft disclosure.
Educational template — not legal advice. The SEC rules are summarised for orientation and can change; adapt this with qualified securities counsel.
Free · no signup · adapt it in your own doc
Cyber Materiality Assessment & 8-K Decision Memo
Privileged & confidential — prepared at the direction of counsel. This memo records the disclosure committee’s assessment of whether a cybersecurity incident is material under the US securities laws and, if so, the basis and timing for a Form 8-K Item 1.05 filing.
01Incident summary (facts known as of this assessment)
Incident reference
Internal case ID
Date/time discovered
When the company first became aware
Nature of incident
e.g. ransomware with data exfiltration; BEC; third-party/SaaS compromise
Systems / data affected
Systems, data types, record counts — mark estimates as estimates
Status
Contained / ongoing; investigation stage
Third party involved?
Vendor name and the company’s reliance on them for facts, if applicable
Record what is known, what is estimated, and what is still unknown. Materiality is assessed on the information reasonably available — and the duty continues as facts develop.
02Quantitative factors
Estimate the direct and reasonably likely financial impact. There is no SEC bright-line dollar threshold; these figures inform, but do not by themselves decide, materiality.
Factor
Estimate
Basis / assumptions
Direct response & remediation cost
$
Forensics, IR, legal, overtime
Business interruption / lost revenue
$
Downtime × revenue rate
Customer notification & credit monitoring
$
Records × unit cost
Likely legal, regulatory & litigation exposure
$ range
Fines, claims, defense
Effect on revenue, earnings or guidance
$ / %
Period and magnitude
03Qualitative factors
Qualitative factors can make an incident material even where the direct dollar figure looks small. Assess each.
Scale and sensitivity of data exposed (e.g. SSNs, health, payment, credentials)
Reputational and brand harm; customer trust and churn risk
Regulatory and enforcement exposure (SEC, FTC, state AGs, GDPR/other)
Litigation risk (class action, contractual, D&O)
Harm to relationships with customers, partners or suppliers
Effect on the company’s competitive position or operations
Whether the incident is part of a series of related occurrences to be assessed in aggregate
Materiality standard: there is a substantial likelihood that a reasonable investor would consider the information important in making an investment decision, or that it would significantly alter the total mix of information available (TSC Industries v. Northway; Basic v. Levinson).
Determination
MATERIAL / NOT MATERIAL / NOT YET DETERMINABLE
Rationale
Tie the conclusion to the quantitative and qualitative factors above
Who determined
Disclosure committee members present — legal, finance, security
The determination is a cross-functional securities-law judgment, not a purely technical one. It must be made without unreasonable delay after discovery — the determination process must not be used to postpone the filing clock.
05Timing & the four-business-day clock
Date materiality determined
This date starts the Item 1.05 clock
8-K due (4 business days after determination)
Compute business days
National-security/public-safety delay?
Only if the US Attorney General so determines and notifies the SEC — not for remediation concerns
The clock starts at DETERMINATION of materiality, not discovery, and not when the investigation closes.
Operational or remediation concerns do not justify a delay — they justify omitting specific technical detail from the filing, not withholding it.
06Draft Form 8-K Item 1.05 disclosure
Item 1.05 calls for the material aspects of the nature, scope and timing of the incident, and the material impact or reasonably likely material impact on the registrant (including financial condition and results of operations). You need not disclose specific technical detail that would impede response or remediation.
Nature & scope
What happened and what was affected, at a material level
Timing
When discovered / occurring
Material impact or reasonably likely impact
Financial and operational, or a statement that impact is not yet known
Investigation status
State that the investigation is ongoing and aspects remain undetermined, if so
If required information is undetermined or unavailable at filing, say so in the 8-K and file an amendment within four business days after you determine it.
07Ongoing disclosure & controls
Amendment plan for information undetermined at filing (within 4 business days of determination)
Regulation FD discipline — no selective disclosure to investors/analysts before the public filing
Coordinate with other obligations (customer/regulator breach notification, contractual notice)
Annual Regulation S-K Item 106 (10-K) disclosure of cyber risk-management processes and board oversight — separate from this incident 8-K
Preserve documents; maintain privilege; log the decision trail
08Approvals
Disclosure committee chair
Name / date
General counsel
Name / date
CFO
Name / date
CISO
Name / date
Practice the decision
This memo records a call you can rehearse. The free Materiality Call Lab puts you in the disclosure committee and grades you on ~14 of the exact decisions this memo documents — when the clock starts, what the 8-K must cover, when you can delay, and the Reg FD trap.
TL;DR
What this template is
A board-ready memo that records the disclosure committee’s cyber materiality assessment and the basis and timing for a Form 8-K Item 1.05 filing under the SEC cybersecurity disclosure rules.
Sections: facts known, quantitative factors, qualitative factors, the reasonable-investor conclusion, the four-business-day clock, draft Item 1.05 language, and the amendment/ongoing-disclosure plan.
Copy it or download it as Markdown and adapt it in your own document — nothing is uploaded.
Practise the underlying decisions in the free Materiality Call Lab.
Educational template — not legal advice. Use it with qualified securities counsel.
Frequently asked questions
What is this template for?+
It is a decision memo a public company’s disclosure committee can use to document whether a cybersecurity incident is material and, if so, the basis and timing for its Form 8-K Item 1.05 filing. It captures the facts known, the quantitative and qualitative factors, the reasonable-investor materiality conclusion, the four-business-day clock, and draft disclosure language.
When must the 8-K be filed?+
Within four business days of determining that the incident is material — not four days after discovery. The materiality determination must itself be made without unreasonable delay after discovery, and the only available delay is a US Attorney General determination that disclosure poses a substantial risk to national security or public safety.
Can I withhold technical details?+
Item 1.05 asks for the material aspects of the nature, scope and timing and the material impact — not specific technical detail such as system vulnerabilities whose disclosure would impede your response or remediation. You disclose what is material to investors, not a forensic report.
Is this legal advice?+
No. It is an educational template. The SEC rules and the materiality standard are summarised for orientation and can change; confirm current requirements and apply them to your specific facts with qualified securities counsel.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout