Incident Materiality

Structure and record a cybersecurity incident materiality determination, and run the disclosure clocks that follow from it. Walks the six factors the judgment turns on — financial impact, operational disruption, data affected, regulatory and contractual triggers, reputational effects, and whether related incidents must be assessed as one series — recording each with its reasoning, the person and the date, and refusing an assessment that has no rationale. Never emits a verdict: no scale, no score, no threshold, because materiality is a legal judgment made with counsel and a generated number would be discoverable alongside the determination it disagreed with. Computes the SEC Item 1.05 window as four business days from the determination — not from discovery, so an incident still under assessment has no window open — and the DORA initial, intermediate and final report windows in clock hours. Keeps every determination as an appended record, so the "what did we know and when did we decide" sequence survives. Use when asked whether an incident is material, whether it has to be disclosed, when the 8-K clock starts or how much of it is left, to record a determination or a disclosure decision, to track DORA reporting windows, or to draft an audit-committee incident update. Not for incident-response runbooks, triage, containment or forensics: this structures the governance decision around an incident, not the response to it.

mkdir -p ~/.claude/skills/incident-materiality
curl -L https://claudskills.com/skills/incident-materiality/SKILL.md \
  -o ~/.claude/skills/incident-materiality/SKILL.md

@misc{incident-materiality-2026,
  author    = {cyberaware-creations},
  title     = {Incident Materiality [Claude Code skill]},
  year      = {2026},
  publisher = {ClaudSkills},
  url       = {https://claudskills.com/skills/incident-materiality/}
}