HALHalliburton

We note the reference to the previous Form 8-K, which disclosed under Item 8.01 that you became aware of the cybersecurity incident on August 21, 2024. Please advise us why you filed under Item 1.05 and tell us whether or not this incident is a material cybersecurity incident.

Rest of the question

The Item 1.05 Form 8-K states your belief that the incident has not had, and is not reasonably likely to have, a material impact on your financial condition or results of operations. You then state that you remain subject to various risks due to the incident, including "the adequacy of processes during the period of disruption, diversion of management’s attention, potential litigation, changes in customer behavior, and regulatory scrutiny." Please advise us to what extent you considered qualitative factors in your materiality analysis and not just potential impact on financial condition and results of operations. As the Commission noted in the adopting release, the rule’s inclusion of “financial condition and results of operations” is not exclusive; companies should consider qualitative factors alongside quantitative factors in assessing the material impact of an incident. For example, consider impacts on customer relationships, competitiveness, and potential reputational harm related to the cybersecurity incident. Please tell us what were the qualitative or quantitative 1. factors that led you to file under Item 1.05 of Form 8-K. In this regard, we note the adopting release states that “…investors are best served knowing … what led management to conclude the incident is material.”

The Company filed under Item 1.05 because it concluded that the cybersecurity incident had become material due to the discovery of additional facts after the Company initially disclosed preliminary details of the incident on Form 8-K under Item 8.01 on August 23, 2024. As the Staff is aware, significant cybersecurity incidents are dynamic, and new facts are revealed as the forensic investigation progresses.

In making its determination that a material cybersecurity incident had occurred, the Company was guided by the body of case law on the topic of materiality, as well as the Commission’s

Rest of the answer

pronouncements on the subject. The Company weighed a number of quantitative and qualitative factors, none of which was necessarily material on a stand-alone basis. Instead, the Company’s materiality determination was based on an assessment of the totality of the facts and circumstances that, in the aggregate, led the Company to conclude that the incident had become material to investors. As disclosed in the Item 1.05 Form 8-K, qualitative factors the Company deemed significant included the following:

•the outage of the Company’s critical business systems and applications, which impacted aspects of the Company’s operations and corporate functions; and

•the nature and scope of information the threat actor appeared to have exfiltrated from the Company’s information technology systems.

The Company respectfully observes that nothing in Item 1.05 or the instructions to Form 8-K requires the Company to describe in a Form 8-K filing the materiality analysis it undertook in determining to make its disclosure. Instead, we believe investors reading Form 8-K understand that when any item of Form 8-K (including Item 1.05) calls for the description of a “material” event, the registrant making responsive disclosure has necessarily concluded that the event is in fact material in compliance with Item 1.05’s materiality assessment factors.

Read in the reply ↗