CyberTwin
Program tier · SEC disclosure

SEC Materiality — The dollar estimate, the 4-day 8-K clock, and the draft — for your disclosure committee.

An incident just hit. Is it material — and by when?

A FAIR-grounded dollar estimate, a comparison against the threshold you set, a business-day clock, and a 10-K narrative draft for counsel. Decision support — never the determination itself.

Start your assessment →See pricing
Decision support · Counsel stays in the loop · Included in the Program tier
The rule, in plain English

What the SEC actually requires.

Three things every public-company buyer needs to keep straight — starting with the one everyone gets wrong: the clock runs from determination, not discovery.

Form 8-K · Item 1.05

The 4-business-day 8-K clock.

Item 1.05 of Form 8-K requires disclosure within four business days — but the clock starts when the registrant determines the incident is material, NOT when the incident is discovered. This distinction is load-bearing. Discovery can precede determination by hours, days, or weeks, and the determination itself is the registrant's call (made without unreasonable delay). The four-business-day count begins the day after that determination.

Source: Form 8-K, Item 1.05, as adopted in the July 26, 2023 Final Rule. The determination-start (rather than discovery-start) framing is the SEC's; the rule and the rule release describe it directly.

Materiality test

What counts as material.

The SEC applies the long-standing federal-securities materiality test: information that a reasonable investor would consider important to an investment decision, or that would significantly alter the total mix of information available. There is no dollar threshold in the rule itself — the test is qualitative, fact-specific, and informed by both the quantitative scale of the incident and its qualitative impact on the registrant's operations, customers, and reputation.

Source: SEC Final Rule on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure (adopted July 26, 2023). The materiality standard is the established federal-securities test — see the rule release and accompanying guidance for the SEC's exact framing.

Reg S-K · Item 106

10-K Item 106(b) and Item 106(c).

Item 106(b) of Regulation S-K requires registrants to describe their processes for assessing, identifying, and managing material risks from cybersecurity threats — and whether and how any risks from cybersecurity threats have materially affected (or are reasonably likely to materially affect) the registrant. Item 106(c) requires disclosure of board oversight of cybersecurity risk and management's role and expertise. Both live in the annual 10-K.

Source: Regulation S-K, Item 106(b) and Item 106(c), as adopted in the July 26, 2023 Final Rule. See the rule release for the SEC's exact wording of the required disclosure elements.

The SEC materiality report surface — the dated determination trail rendered from the seeded demo.
Sample environment (seeded demo) · as of upload · point-in-time snapshot, no live scan
1
Estimate

The twin prices the incident

A FAIR-grounded dollar estimate from the same engine that prices your attack paths — labeled modeled, grounded in your uploads.

2
Compare

Against the threshold you set

The estimate lands next to your declared materiality threshold — directional decision support, never the determination itself.

3
Record

The clock starts on the record

Your recorded determination starts the business-day clock and drafts the 10-K narrative for counsel — dated, with its paper trail.

One module, both moments

The acute decision and every clock it starts.

The annual 10-K posture is the slow half. These are the fast ones — the incident call, grounded in your twin, and every regime clock the same incident starts.

Name the incident, mark what it hit.

Tick the affected assets from your twin. Each one brings its FAIR-derived loss exposure, so the quantitative axis is grounded in your real environment — not a number someone guessed in the room.

Weigh the facts and circumstances.

There is no bright-line dollar threshold; the standard is the reasonable-investor test. Mark the qualitative factors — reputational, litigation, regulatory, operational, data-sensitivity, strategic — and a severe one can point toward material even when the dollars are small.

Get a directional indicator, never a verdict.

The framework aggregates the modeled magnitude with the factors and points a direction, with its reasoning — points toward material, points toward immaterial, or judgment required. It never decides materiality for you, and it says so on the screen.

Start the clock, draft the 8-K, keep the record.

Record the determination date and the four-business-day Item 1.05 deadline computes itself. A DRAFT 8-K narrative and a timestamped documented record — the inputs, the indicator, the moment — give counsel the contemporaneous paper trail the guidance asks for.

The indicator is directional decision support, not a legal determination — materiality is the company’s judgment under the federal securities laws. An incident whose affected assets carry no dollar profile reads unpriced, never a $0 that would look like “immaterial.” The clock runs from your recorded determination, never from the incident date.

Scoring scopeTechnical controls only — governance, policy, and procedural controls need a separate attestation. How is this scored? →

What this is not

Three things we deliberately do not do.

The boundary between decision support and the determination itself matters here. We keep it bright.

We do not make the materiality determination for you.

Materiality is a legal judgment — fact-specific, qualitative as well as quantitative, and the responsibility of the registrant and its counsel. Our FAIR estimate, threshold gap, and clock are decision support. The determination itself stays with your disclosure committee and outside counsel.

We do not pick your materiality threshold.

The threshold is a number you and your committee own. You enter it; it is tenant-scoped; it does not leave your tenant. If you have not set one, the readout simply reads ‘unset’ — we will not nudge a number into place to make the page look fuller.

The narrative is a DRAFT for your counsel.

The 10-K narrative we surface is marked DRAFT on every render. We do not file it for you, we do not edit your final 10-K, and we do not interact with EDGAR. Your counsel takes the draft, revises it, and your filing team handles the submission.

Does the tool decide materiality for us?

No. Materiality is a legal judgment your disclosure committee and counsel own. Our FAIR estimate, threshold gap, and clock are decision support — a directional indicator with its reasoning, never the determination itself.

When does the four-business-day clock start?

From your recorded determination, not from discovery — the distinction everyone gets wrong. Discovery can precede determination by hours or weeks; the four-business-day Item 1.05 count begins the day after you record the determination.

Do you file the 8-K or 10-K for us?

No. Every narrative is marked DRAFT on every render. We do not file, we do not edit your final filing, and we do not interact with EDGAR — your counsel revises the draft and your filing team submits.

Coverage & pricing

The readout lives inside your tenant — open it from your dashboard once signed in.

Included in the Program tier — no add-on, no separate SKU.

The dollar estimate rides the same FAIR engine, over an attack graph cross-stitched from the 15 security tools we support · 26 MITRE ATT&CK techniques · 9,000 automated tests

Full coverage & honesty detail → /features#coverage

ProgramMost Popular
$36,000/yr
Annual only

The deliverables a senior consulting partner would produce — refreshable, sourced, board-ready.

Start your assessment →See pricingDownload the sample report — no signup →
Underinsurance Gap

Your modeled loss vs your declared policy limit — where the limit breaks.

Deep dive →
Un-Reachability Certificate

A signed, dated proof a crown jewel is NOT reachable — re-checkable without trusting us.

Deep dive →
Breach Replay

A CVE is trending. Type its ID — see if it reaches you.

Deep dive →

This supports your materiality determination and disclosure process; it is not legal or financial advice and does not make the determination for you. Consult counsel.