Living in a Material(ity) World
summary
Reviews SEC rules that force rapid public disclosure once an incident is judged material: four business days for an 8‑K after a reasonably likely materiality determination, with required disclosure of nature scope and timing. Shows filings (Marriott, First American, UnitedHealthcare/Change Healthcare), a semiconductor supplier causing about $250 million in lost shipments, a SaaS misconfiguration exposing passwords with no known exploit, and recommends cross‑functional tabletops, preapproved statements, and counsel coordination.
AI-written summary · about
chapters (15)
- 0:00Welcome
- 0:43Speaker intro
- 2:08Materiality in cybersecurity
- 3:39SEC requirements on materiality
- 7:11New SEC cyber rules
- 9:17New York DFS cybersecurity regulation and materiality
- 11:49State breach laws
- 13:58Legal precedents
- 17:07Assessing materiality factors
- 19:39SEC cyber filing cases
- 27:54Interactive exercise
- 33:00Supreme Court ruling
- 37:15Scenario discussions
- 47:29Key takeaways
- 49:34Q&A
related talks
42mPreparing for the New Era of Cybersecurity Disclosure
49mCybersecurity in the Boardroom - The Impact of the Latest SEC Proposal
32mDisclosures and Regulatory Framework for WEB3 Companies
58mPanel Discussion - The Risks of Requiring Premature Vulnerability Disclosures
45mKEYNOTE 2 - A Risk Assessment of Logo Disclosures
35mMeasuring change: Responding to cyber material risk
13mNavigating the complex and rapidly evolving world of product and application security regulations
51mDo Better: Board-Level Accountability in Cybersecurity