In SUP 15.3.11 R(1)(a) or (1)(aa)18, significance should be determined having regard to potential financial losses to customers or to the firm, frequency of the breach, implications for the firm's systems and controls and if there were delays in identifying or rectifying the breach.