SEC disclosure rules now require publicly traded companies to disclose impactful—or more specifically, “material”—cybersecurity events, leaving many organizations running to both dictionaries and legal teams to learn the definition. “What is material for one company will not be material for another organization, and it’s really fact-dependent. So if you have significant financial impacts, significant operation shutdown, potential massive business interruption: Those are factors that you could consider, but not necessarily determinants of,” said Bankston to IT Brew.