// resources · topic
SEC cyber disclosure and OT materiality
A public manufacturer has four business days to file an 8-K once it decides a cyber incident is material. When the incident stops a plant, the CISO has to show the board what the outage costs before forensics finish.
These posts cover how to build that materiality evidence ahead of time and how to brief the CFO and the board on it.
Field notes (10)
-
· Chuck Tommey
The Enterprise Hat: When Cyber Risk Reaches the Boardroom
How NIS2 Article 20, SEC Item 1.05, and the SOCI Act moved cyber risk to the board, from turnover-based fines to management bans, and three moves to make.
-
· Roger Hill
The Competitive Advantage of Disclosure Readiness: Why the Best Manufacturers Will Embrace Transparency
How OT disclosure readiness wins manufacturers better insurance terms, investor confidence, and customer trust, and five steps that start with materiality.
-
· Roger Hill
Building a Board-Ready OT Materiality Framework Before You Need It
Pre-define OT incident materiality across five dimensions (production, safety, environment, regulatory, insurance) with a four-level escalation protocol.
-
· Roger Hill
Incident Forensics vs. Disclosure Timelines: The Manufacturing Double Bind
OT forensics take weeks, but the SEC expects materiality calls without undue delay. Learn five steps to prepare now, from PLC baselines to forensic retainers.
-
· Roger Hill
The OT Disclosure Gap
Why most manufacturers' 10-K Item 1C omits OT risk, a sample OT-inclusive disclosure, and five steps to close the gap before your next annual filing.
-
· Roger Hill
The Clock Nobody Planned For
Why the SEC's four-business-day Form 8-K clock breaks on OT incidents, and how to score production, safety, environmental, regulatory, and insurance impact.
-
· Roger Hill
The OT Risk the CFO Can’t See
Why patch counts and scan stats fail at the executive table, how one contractor credential caused a $3.1 million outage across four sites, and what to report.
-
· Roger Hill
Passing the Audit Does Not Mean the Plant Will Keep Running
A plant can pass every cyber audit and still stop when cloud identity or a VPN fails. Map IT-OT dependencies, test failover, and ask the board three questions.
-
· Roger Hill
What CFOs Wish CISOs Knew
How CISOs keep OT security funded in a recession: show downtime cost per facility tier and day 1, 3, and 10 exposure, and pitch uptime risk reduction instead.
-
· Hillstrong Group Security
How to Communicate OT Risk and Compliance to the Board
Boards fund OT security when audit findings read as business risk. Put a dollar figure on inaction, rank fixes by impact, and shape the message for CFO and CEO.
Talk it through with a practitioner
Book a 30-minute consultation with a senior OT security practitioner about your plants.