Materiality

The SEC’s four-day disclosure clock in practice: materiality is the hard part

Public companies must disclose material cyber incidents within four business days. The deadline is simple; deciding what counts as material is not.