How can a CISO know if a cybersecurity incident is "material," and is that even the CISO's job? Forrester principal analyst Jeff Pollard explains this and other lessons learned after one year of living with the Securities and Exchange Commission's Cybersecurity Rule.