Materiality of a cybersecurity incident depends on its impact and the magnitude of compromised information.
For example, leaked personal health information (PHI) or personally identifiable information (PII) could be a material event for an organization that relies on protecting their customers’ sensitive information.
In the cases mentioned above, the SEC defined materiality broadly and the companies defined it narrowly.
Narrow means looking myopically at the impact of a cybersecurity incident
Broad means looking at all known facets of a cybersecurity incident including the impact to the registrant’s reputation, customer or vendor relationships, or a registrant’s competitive position
Generally, assessing the materiality of a cybersecurity incident is an assessment of the potential impact to the company’s reputation, financial performance, customer and vendor relationships, possibility of litigation, and possibility of regulatory investigation. If the impact is great enough to cause an investor to make a buy or sell decision, then the incident is material.