# Materiality Determination in the Cybersecurity Disclosure Stream, March to September 2026

- **Artifact ID:** CHQ-SM-2026-021
- **Version:** v1.0
- **Status:** ISSUED
- **Public record:** https://record.cybersecurityhq.com/memoranda/chq-sm-2026-021
- **Machine-record SHA-256:** `a7569010e92eaa34f4a0237b073be988823a253daed81fa1b720c9fc951cc23e`

## Complete structured record

```json
{
  "id": "CHQ-SM-2026-021",
  "title": "Materiality Determination in the Cybersecurity Disclosure Stream, March to September 2026",
  "descriptor": "Materiality Determination in the Cybersecurity Disclosure Stream, March to September 2026",
  "issued": "2026-09-22",
  "classification": "Analytical",
  "status": "ISSUED",
  "version": "v1.0",
  "memo_type": "SM",
  "authority_level": "ANALYTICAL",
  "referenced_by": [
    "CHQ-P-2026-001",
    "Disclosure-economics Position candidate"
  ],
  "inherits_from": "CHQ-SM-2026-006",
  "related_artifacts": [
    "CHQ-P-2026-001"
  ],
  "doctrine_class": "Structural Memorandum",
  "precedent_constraints": [
    "CHQ-ASC-2026-002"
  ],
  "governs_evidence_for": [
    "Disclosure-economics Position candidate",
    "CHQ-P-2026-001 reinforcement"
  ],
  "citable_assertion": "Disclosure and materiality determination operate as separate events, with materiality governed in practice by consequence logic rather than a financial threshold.",
  "purpose": "This memorandum documents the routing and determination patterns observed in Form 8-K cybersecurity disclosures, so that the disclosure-economics Position candidate rests on a dated population rather than a season.",
  "statement": "",
  "observability": "",
  "boundary": "",
  "reliance_language": "",
  "reliance_boundary": "",
  "revision_history": "v1.0 (September 22, 2026): Initial issuance",
  "structural_sections": [
    {
      "heading": "EVIDENCE RECORD",
      "items": [
        "Routing: in the reviewed set of 31 cyber-incident filings from 1 March to 18 August 2026, 16 used Item 8.01, 13 used Item 1.05, and 2 used Item 7.01. Over the rule's two years, 29 issuers filed under 1.05, 50 under 8.01, and 5 under both, each an 8.01 followed by a 1.05 on determination.",
        "Conversion: Boston Scientific disclosed a global operational disruption under 8.01 on 26 August and filed under 1.05 on 8 September, twelve days later, stating the incident was likely to affect third-quarter and full-year results and that guidance would not be met. This was the first conversion observed in the reviewed set and the sixth in the two-year population.",
        "Determination classes: operational disruption (Boston Scientific, West Pharmaceutical); extortion and exfiltration (iRhythm); and qualitative materiality, in which the filer determined materiality on data sensitivity and consequence exposure while stating no material operational or financial impact (CareCloud, 24 March; Bitcoin Depot, 6 April). Revision within one filer: Trio-Tech, non-material to material in seven days.",
        "Third-party locus: three filings (iRhythm, 8x8 and its vendor, Evertec) placed the incident at a third-party platform; one vendor breach produced filings from two separate issuers.",
        "Regulatory context: the first AI-root-cause 1.05 (CB Financial, May) determined materiality within 48 hours on data sensitivity alone."
      ]
    },
    {
      "heading": "WHAT THE EVIDENCE ESTABLISHES",
      "content": "Disclosure and materiality determination operate as separate events. Materiality is governed in practice by consequence logic rather than a financial threshold, and filers choose the item accordingly. The gap is part of how the regime operates, not noise around it."
    },
    {
      "heading": "RELATIONSHIP TO DERIVED ARTIFACTS",
      "content": "The disclosure-economics Position candidate cites this memorandum for its population base. CHQ-P-2026-001 receives a reinforcement note on the third-party locus filings."
    }
  ],
  "revision_conditions": "Extended each quarter with the reviewed set; revised if the two-year population's conversion rate moves materially or if the qualitative class fails to recur.",
  "attestation": "This memorandum records that what the market learns about cyber incidents is determined by routing and by consequence-based determination, and that the two-year record shows the pattern to be structural."
}
```