Whereas the Security Statement made representations concerning specific practices associated with access controls and password protection, the Complaint relied upon SolarWinds' risk assessment and risk scores concerning specific controls related to the National Institute of Standards and Technology (NIST) Cybersecurity Framework and to NIST 800-53, internal communications, internal presentations and Sarbanes-Oxley Act (SOX) audits to plead sufficiently that the representations concerning these practices were false and made with scienter. The court also determined that a reasonable person would consider SolarWinds' cybersecurity practices as significant in making an investment decision.