Materiality Call Lab
A cyber incident is confirmed. Now the hard part: is it material, when does the four-business-day SEC 8-K clock start, what goes in the filing, and can you delay? Sit in the disclosure committee and make each call the way a regulator and a court would judge it — the clock starts at determination, not discovery; you file the material aspects you know and amend for the rest; and you never tip a single investor ahead of the public filing. Each decision shows you why.
Pair this drill with the free Cyber Materiality Assessment & 8-K Decision Memo — the document that records the call you practise here. Educational drill, not legal advice.
The real job. More noise, a tighter clock.
You sit in the disclosure committee for a public company that has just confirmed a cyber incident. Work 10 board-room decisions — make the call a court and a regulator would find defensible, then see why. You are graded on how many you get right against the clock.
What this lab is
- A free, browser-based decision drill on the US SEC cybersecurity disclosure rules: work ~14 board-room decisions about whether a cyber incident is material and how to file the Form 8-K Item 1.05.
- The four-business-day clock starts when you DETERMINE the incident is material — not when you discover it, and not when the investigation closes.
- You practise the real traps: the "without unreasonable delay" determination duty, the national-security-only delay, Reg FD before the filing posts, third-party incidents, aggregation of related events, and the amendment duty.
- Each decision reveals why the board-defensible answer is right, and you are graded S–D on how many you call correctly against the clock.
- Educational decision drill — not legal advice. Pair it with the free 8-K materiality decision memo template.
Frequently asked questions
What is the Materiality Call Lab?
A free, in-browser decision simulation that puts you in a public company’s disclosure committee after a cyber incident. You work through board-room decisions — is it material, when does the clock start, what goes in the 8-K, can you delay — and each one has a single board-defensible answer under the SEC cybersecurity disclosure rules, revealed after you lock in your call.
When does the SEC four-business-day clock actually start?
Form 8-K Item 1.05 requires disclosure within four business days of determining that a cybersecurity incident is material — not within four days of discovering it. The materiality determination itself must be made without unreasonable delay after discovery, so you cannot simply postpone the determination to stall the clock.
Is this legal advice?
No. The lab is an educational drill and the regulatory references (SEC Item 1.05, Regulation S-K Item 106, Regulation FD) are summarised for orientation and can change. Always confirm the current requirements and apply them to your specific facts with qualified securities counsel.
Who is it for?
CISOs, general counsel, CFOs, disclosure-committee members and board directors of public (or soon-to-be-public) companies — anyone who would be in the room deciding whether and how to disclose a cyber incident, and who wants to rehearse the call before it is real.