Skip to main content
Cyber Risk Council
Category: Risk Management

Materiality Assessment

Also known as: ESG Materiality Assessment, Materiality Analysis
Simply put

A materiality assessment is a structured exercise a company uses to identify and rank the environmental, social, and governance (ESG) issues that matter most to its business and its stakeholders. The goal is to focus attention and reporting on the topics that are genuinely significant rather than trying to address everything at once. It commonly supports sustainability reporting and can help an organization meet legal or disclosure requirements.

Formal definition

A materiality assessment is a formal ESG process for identifying, evaluating, and prioritizing sustainability topics based on their significance to the organization and, in many approaches, their importance to external stakeholders. It typically involves engaging stakeholders and analyzing environmental, social, and governance issues to determine which are most critical, thereby informing sustainability strategy and reporting. Note that this ESG-focused meaning of 'materiality' differs from the distinct use of the term in cybersecurity, financial disclosure, or incident-reporting contexts; the sources cited here address only the ESG and sustainability-reporting sense, and cybersecurity frameworks such as NIST CSF or ISO 27001 are not standard inputs to an ESG materiality assessment.

Why it matters

A materiality assessment helps a company avoid the trap of trying to address every possible sustainability concern at once. By identifying and prioritizing the environmental, social, and governance (ESG) issues that are genuinely most significant to the business and its stakeholders, an organization can focus its strategy, resources, and reporting on what actually matters. This targeted approach makes sustainability efforts more credible and more manageable rather than diffuse and superficial.

Beyond internal focus, materiality assessments commonly support sustainability reporting and can help an organization meet legal or disclosure requirements. Engaging external stakeholders as part of the process helps a company understand how important various ESG topics are to the people and groups affected by its operations, which can strengthen the relevance and defensibility of what it chooses to disclose.

It is important to keep this ESG-focused meaning of materiality distinct from other uses of the term. The concept of 'materiality' also appears in cybersecurity, financial disclosure, and incident-reporting contexts, where it carries a different meaning and different inputs. An ESG materiality assessment addresses sustainability topic prioritization; it does not draw on cybersecurity frameworks or incident-reporting criteria, and conflating the two leads to inaccurate expectations about what the exercise produces.

Who it's relevant to

Sustainability and ESG teams
Teams responsible for a company's sustainability strategy use materiality assessments to identify and prioritize the ESG topics most significant to the business and its stakeholders, which then shapes strategy and reporting priorities.
Companies preparing sustainability reports
Organizations producing sustainability disclosures rely on materiality assessments to determine which ESG topics to report on, helping ensure that reporting focuses on genuinely significant issues and, in many cases, supports legal or disclosure requirements.
External stakeholders
Stakeholders outside the organization are often engaged in the assessment to express how important they consider various environmental, social, and governance topics, giving their perspective a role in shaping what the company treats as material.
Business leaders and decision-makers
Executives and decision-makers use the prioritized results of a materiality assessment to focus resources and attention on the ESG issues most critical to the organization rather than attempting to address every possible topic at once.

Inside Materiality Assessment

Cybersecurity Materiality Determination
In the context of security leadership and vCISO work, a materiality assessment typically refers to evaluating whether a cybersecurity incident, risk, or exposure is significant enough to warrant escalation, formal reporting, or disclosure. This is distinct from ESG or financial-reporting materiality and centers on the potential impact of a security event on the organization.
Impact and Severity Analysis
A structured evaluation of the potential or actual consequences of an incident or risk, often considering factors such as operational disruption, data sensitivity, affected systems, financial exposure, and reputational harm. The output helps the organization decide whether a matter rises to a level requiring board, executive, or regulatory attention.
Disclosure and Reporting Thresholds
Criteria used to determine when an incident must be reported internally or externally under applicable obligations. A virtual CISO typically advises on how to define and apply these thresholds, but the accountability for disclosure decisions generally remains with the client organization and its officers, not the vCISO.
Stakeholder and Governance Inputs
Materiality decisions often draw on input from legal counsel, executive leadership, risk owners, and where relevant the board. A vCISO commonly facilitates or informs this process by translating technical risk into business-relevant terms, but the process depends on client cooperation and access to decision-makers.
Documentation and Rationale
A record of how a materiality conclusion was reached, including the factors weighed and who was consulted. This supports consistency and defensibility, though the specific format and rigor may vary by provider and by the organization's maturity and regulatory environment.

Common questions

Answers to the questions practitioners most commonly ask about Materiality Assessment.

Is a cybersecurity materiality assessment the same as an ESG materiality assessment?
No, and conflating the two is a common error. In a securities and disclosure context, a materiality assessment for a cybersecurity incident evaluates whether an event is significant enough to a reasonable investor to warrant disclosure. In a sustainability context, an ESG materiality assessment prioritizes environmental, social, and governance topics based on their significance to the business and its stakeholders. These are distinct exercises with different criteria, participants, and outputs. When discussing materiality in the context of a virtual CISO engagement, the relevant meaning is typically the cybersecurity-incident sense, so it is important to confirm which definition is in use before proceeding.
Does a virtual CISO make the final call on whether a cybersecurity incident is material?
Generally no. A virtual CISO may advise on the technical severity, scope, and potential business impact of an incident and may help gather the information a materiality determination requires. However, the determination of materiality for disclosure purposes is typically a business, legal, and financial judgment made by the client organization, often involving executive officers, legal counsel, and where relevant the disclosure or audit committee. Accountability for the decision usually remains with the client's officers rather than the advising vCISO, unless a contract specifies otherwise.
Who should be involved in a cybersecurity materiality assessment?
In many organizations the assessment draws on multiple functions rather than a single role. Security leadership, including a virtual or fractional CISO, often provides input on the technical facts and potential impact. Legal counsel, finance, and senior executives typically weigh the disclosure implications and apply the applicable legal standard for materiality. The specific participants and decision path vary by organization and by regulatory context, so defining these roles in advance, ideally before an incident occurs, tends to improve the quality and speed of the assessment.
When during an incident should a materiality assessment take place?
Materiality assessment is often not a single point-in-time event. Early in an incident the facts may be incomplete, so an initial assessment may be preliminary and subject to revision as investigation continues. Many organizations establish a process to reassess materiality as new information emerges, since an incident initially judged immaterial may later prove significant, or vice versa. A virtual CISO can help support this ongoing evaluation by ensuring incident findings are communicated to the decision-makers in a timely and usable form, though the timing of any resulting decision remains the client's responsibility.
What information does a materiality assessment typically require?
Assessments generally rely on a combination of technical and business information. Technical inputs may include the nature and scope of the affected systems and data, the extent of any compromise, and containment status. Business inputs may include potential financial exposure, operational disruption, reputational effect, and legal or contractual implications. Because materiality involves both quantitative and qualitative factors, the assessment usually depends on cooperation across functions and on the client organization providing access to relevant stakeholders and information.
How can an organization prepare to conduct a materiality assessment before an incident happens?
Preparation often includes documenting a defined process that identifies who participates, what criteria are applied, and how decisions are escalated and recorded. Many organizations integrate this process with their broader incident response planning so that materiality evaluation is not improvised under pressure. A virtual CISO may support this preparation by helping establish the process, clarify roles, and ensure security reporting produces the information decision-makers need. The effectiveness of such preparation typically depends on organizational maturity, clearly defined scope, and engagement from legal, finance, and executive stakeholders.

Common misconceptions

A cybersecurity materiality assessment is the same as an ESG or sustainability materiality assessment.
The term materiality is used differently across disciplines. In security leadership contexts it typically concerns whether a cybersecurity incident or risk is significant enough to escalate, report, or disclose. This is not the same exercise as ESG topic prioritization or financial-statement materiality, and the terms should not be treated as interchangeable.
A virtual CISO who supports a materiality assessment thereby assumes accountability for disclosure or regulatory decisions.
A vCISO typically advises on how to define thresholds and evaluate impact, but legal and organizational accountability for materiality and disclosure decisions generally remains with the client organization and its officers unless a contract explicitly states otherwise.
A materiality assessment produces a fixed, objective answer that guarantees compliant reporting.
Materiality involves judgment and depends on context, applicable obligations, and the facts available at the time. Supporting an assessment helps an organization make and document a defensible decision, but it does not guarantee a particular regulatory outcome, and conclusions may need revision as new information emerges.

Best practices

Clarify at the outset which definition of materiality applies to the engagement, since the term differs across cybersecurity, financial, and ESG contexts, and align scope accordingly.
Define impact and severity criteria in advance rather than deciding case by case, so that materiality determinations are consistent and defensible.
Involve legal counsel and executive stakeholders early, recognizing that a vCISO informs the process while accountability for disclosure decisions typically rests with the client's officers.
Document the rationale, factors weighed, and parties consulted for each materiality conclusion to support consistency and later review.
Treat materiality determinations as time-sensitive and revisit them as new facts about an incident or risk become available.
Set clear expectations that supporting a materiality assessment does not guarantee a specific regulatory or reporting outcome, and that value depends on client cooperation and access to decision-makers.