reasoning: Management roles (Executive Director of IT and CFO) are the grammatical subjects, and the paragraph identifies their specific cybersecurity responsibilities rather than describing detailed processes or the qualifications of individuals. The Executive Director of IT is a specific IT leadership role with explicit cybersecurity responsibilities, distinguishing this disclosure from generic boilerplate.


content_category: None/Other

category_confidence: high

specificity_confidence: high

reasoning: This paragraph is a forward-looking disclaimer about the limitations of cybersecurity programs and a general risk statement with a cross-reference to Risk Factors, containing no substantive disclosure about actual governance, processes, or incidents.

provider: z-ai

stage: benchmark


content_category: Risk Management Process

reasoning: The paragraph describes the company's planned improvements to cybersecurity risk management practices including threat detection, tabletop exercises, and industry collaboration, which are internal processes without any specific frameworks, roles, dates, or verifiable facts.


content_category: Board Governance

reasoning: The paragraph describes the Board's oversight responsibilities for cybersecurity risk management, with the Board as the primary grammatical subject. It contains only generic governance language with no specific facts—no named roles, committees, frameworks, dates, or verifiable details.


reasoning: The paragraph describes the company's internal cybersecurity processes including governance measures, control requirements, and security monitoring activities. No specific facts are present—'outside consultants' are unnamed, 'Audit Committee' is a standard committee, and all listed practices (MFA, patching, backup, monitoring) are common security measures with no firm-specific details or named frameworks.


content_category: Incident Disclosure

reasoning: The paragraph describes response actions (cooperating with state regulators) related to a disclosed cybersecurity incident, which qualifies as incident response under Incident Disclosure. No specific facts are present - 'numerous state regulators' is vague, 'Data Incident' is a reference to an event rather than a verifiable fact, and Note 11 is a cross-reference.


content_category: Management Role

reasoning: While the paragraph begins with board governance structure, the most detailed and substantive content focuses on the CISO's qualifications (over 20 years of experience, specific certifications including CISSP, CISM, GLAW, and GSEC) and reporting relationships, making Management Role the primary category.


reasoning: The paragraph describes internal processes for threat notification, personnel education, and risk assessment oversight by consultants reporting to the CFO. No specific facts remain after filtering—CFO is a generic C-suite role, 'expert consultants' are unnamed entities, and 'periodic' is a vague cadence.


category_confidence: medium

reasoning: The paragraph describes oversight and reporting structures involving both management and the Board of Directors regarding cybersecurity risks, with the Board explicitly identified as receiving periodic updates on the cybersecurity program. However, all elements are generic governance terms (CEO, management, Board of Directors, 'at least annually') with no firm-specific details, named cybersecurity roles, or specific dates that would distinguish this disclosure.


reasoning: The paragraph describes the company's internal cybersecurity processes including monitoring tools, incident response planning, and employee training, with no mention of board oversight, management roles, or third-party risk as central topics.


reasoning: The paragraph describes the company's internal cybersecurity risk management program and its integration with the overall risk management framework, naming the NIST Cybersecurity Framework as an incorporated standard but containing no firm-specific details.


reasoning: The paragraph describes the company's internal processes for managing cybersecurity risk through regulatory compliance, including their Information Security Program and controls designed to meet GLBA, SOX, and FFIEC requirements.


reasoning: The paragraph describes the company's internal processes for monitoring cybersecurity risks and its incident response plan, including escalation procedures and post-incident activities. The Information Security Officer is mentioned in the context of what the role does (monitoring), not the person's qualifications, and the Operational Risk Committee is a named non-generic committee.


specificity_confidence: medium

reasoning: The paragraph describes an actual cybersecurity incident involving unauthorized access to an employee email account and fraudulent fund diversion, including detection and impact assessment, which qualifies as Incident Disclosure under the tiebreaker rules for incident narratives.


reasoning: This paragraph describes an actual cybersecurity incident involving employee interactions with suspicious websites, the containment response, and the confirmed scope of impact, which constitutes an incident disclosure under the category definition.


reasoning: The paragraph describes Board and Audit Committee oversight of cybersecurity risks, with both grammatical subjects being governance bodies. No specific facts remain after filtering—Audit Committee and Board of Directors are standard governance terms, and 'periodic' is a vague cadence without exact dates.


reasoning: The paragraph describes the company's internal organizational structure for cybersecurity risk management, detailing which departments comprise the management team and how they oversee security personnel and consultants. This is about the function and process structure rather than specific named individuals with credentials.


reasoning: The paragraph focuses on Board and Audit Committee oversight of cybersecurity risk, with the CISO mentioned only in the context of reporting to the Audit Committee. The presence of 'CISO' as a cybersecurity-specific title qualifies as a firm-specific fact.


reasoning: This paragraph describes an actual cybersecurity incident from November 2023, including what happened (disruption of IT systems), the response actions taken (investigation with external experts, law enforcement coordination, remediation measures, notifications), and the containment status—meeting the definition of Incident Disclosure under the tiebreaker rules.


reasoning: This paragraph is a pure cross-reference directing readers to Item 1A for cybersecurity risk disclosures, containing no substantive disclosure about governance, processes, incidents, or materiality conclusions.


reasoning: The paragraph describes the company's internal processes for assessing and managing cybersecurity risks, including how risks are prioritized and integrated into overall risk management. The VP of IT title qualifies as a firm-specific fact per the guidelines, but there are no additional hard verifiable facts to reach Quantified-Verifiable.


reasoning: The paragraph describes the company's internal cybersecurity organizational structure, team responsibilities, and risk management activities including training, testing, and audits. This is about what the cybersecurity function does rather than about a specific person's qualifications, making it Risk Management Process.


reasoning: The paragraph describes board and board committee oversight of cybersecurity risk, with the board and cybersecurity risk committee as the grammatical subjects. The named 'cybersecurity risk committee' is a specific non-generic committee that distinguishes this disclosure from standard Audit Committee oversight, making it Firm-Specific.


reasoning: The paragraph describes the company's internal cybersecurity processes including framework adoption, plan development, and regular reviews with outside experts. No specific frameworks are named, no cybersecurity-specific roles are mentioned, and 'monthly meetings' with unnamed 'outside cybersecurity experts' are generic cadences and unnamed entities that do not qualify as specific facts.


reasoning: The paragraph describes the Board's cybersecurity oversight structure, with the Audit Committee supporting the Board and management (CIO, HIS) providing regular briefings. While management roles are mentioned, they are described in the context of supporting board oversight rather than as the primary focus of the disclosure.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including framework adoption (NIST, ISA/IEC 62443), program elements, testing cadence, and ERM integration. The focus is on what the programs do rather than the CISO's personal qualifications, so it falls under Risk Management Process per the person-vs-function test.


reasoning: The paragraph describes the company's internal security assessment processes (penetration testing, vulnerability assessments, scoring findings), which fits Risk Management Process. No specific facts are present—penetration testing and vulnerability assessments are common practices, 'annual' is a generic cadence, and 'leading service providers' are unnamed entities.


reasoning: Management roles (Director of Information Technology, Chief People Officer, Chief Legal Officer, Chief Financial Officer) are the grammatical subjects, describing reporting lines and oversight responsibilities for cybersecurity. None of the titles qualify as cybersecurity-specific under the ✓ IS list (Director of IT is not equivalent to Director of IT Security), and all other roles are generic C-suite positions.


reasoning: The CTO is the grammatical subject throughout, with the paragraph describing the role's responsibilities, reporting lines, and the named individual's qualifications and career history. The CTO title is cybersecurity-specific, and the named individual with specific background details establishes firm-specificity, though the named previous employers and duration do not meet the QV threshold for hard verifiable facts.


reasoning: The paragraph describes the processes and activities used to identify, assess, and manage cybersecurity risks (monitoring, tools, scans, audits, threat assessments) rather than the qualifications or background of the individuals, so it falls under Risk Management Process per the person-vs-function test.


reasoning: The paragraph describes the company's internal incident response planning process through its Data Security Event Plan (DSEP), detailing how incidents are identified, investigated, assessed, and escalated. This is a clear Risk Management Process disclosure about incident response procedures.


reasoning: The paragraph describes board-level oversight of cybersecurity risks, with the board as the grammatical subject administering oversight directly and through the audit committee. No specific facts are present—'board of directors,' 'executive officers,' and 'audit committee' are all generic governance terms that appear in virtually every company's disclosure.


reasoning: The paragraph describes Board and Audit Committee oversight responsibilities for cybersecurity risk, with both governance bodies as the primary grammatical subjects. No specific facts, named frameworks, or unique details are present—only generic governance references (Board, Audit Committee, management) that could apply to any company.


reasoning: The paragraph describes Board and Audit Committee oversight of cybersecurity risk programs, with the Board and Audit Committee as the grammatical subjects. The specific fiscal year 2024 when the Board received a report provides one firm-specific fact, while 'Audit Committee' and 'periodic' are generic terms that do not contribute to specificity.


reasoning: The Board of Directors and Audit Committee are the primary grammatical subjects, with the paragraph focusing on their oversight roles and the reporting cadence from management to these governance bodies.


reasoning: This paragraph is a general risk acknowledgment from a start-up with limited operations, describing only that cybersecurity risks exist and how attacks generally occur, without disclosing any governance structure, management roles, internal processes, or substantive cybersecurity program. Per the guidelines, shell companies or start-ups stating they have limited operations and merely acknowledging risks without describing an actual program fall under None/Other.


reasoning: This paragraph is a generic forward-looking risk disclaimer about regulatory compliance consequences, with no substantive disclosure about the company's actual cybersecurity governance, processes, or incidents. It contains no specific facts and could apply to any regulated company.


content_category: Strategy Integration

reasoning: This paragraph is a materiality disclaimer stating that no cybersecurity incidents have materially affected the company, which falls under Strategy Integration per the tiebreaker rules. The cross-reference to Risk Factors does not change the classification.


content_category: Third-Party Risk

reasoning: The paragraph centrally focuses on vendor oversight—conducting risk assessments during onboarding of providers, requiring security measures from providers, and mandating contractual breach notification obligations—all requirements imposed ON third parties rather than describing internal processes.


reasoning: The paragraph centers on management roles with the CISO and Enterprise Risk Committee as grammatical subjects in most sentences, featuring detailed CISO qualifications (15+ years experience, CISSP certification, previous senior leadership roles) and specific C-suite composition of the Enterprise Risk Committee. While risk management processes and board oversight are mentioned, the management role content predominates.


reasoning: The paragraph describes the company's internal risk assessment, safeguard implementation, and monitoring processes, with the role identification serving to explain process ownership rather than focusing on the person's qualifications or background.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including the Cybersecurity Program structure, oversight mechanisms, and specific activities like risk assessments, tabletop exercises, and training. While board and management roles are mentioned, the central topic is the company's own processes for identifying and managing cyber risks.


reasoning: The paragraph describes the company's internal escalation process for cybersecurity threats, including how threats are escalated to management, the decision-making process, and further escalation to the Risk Committee or Board. While it identifies management roles and mentions their qualifications, the primary focus is on the escalation process itself rather than the individuals, as confirmed by the person-vs-function test—the paragraph would still make sense if specific titles and credentials were removed.


reasoning: The paragraph focuses on the CISO's personal qualifications, certifications, and career background, which concerns the person rather than the function, making it Management Role. It contains two or more hard verifiable facts—the specific duration of experience (over 20 years) and multiple named certifications (CISSP, CISM, PCI ISA & PCIP)—meeting the Quantified-Verifiable threshold per the calibration examples.


reasoning: The paragraph's central topic is vendor oversight, describing due diligence reviews of third-party vendors' cybersecurity practices and contractual security requirements imposed on vendors.


reasoning: The paragraph describes the company's internal governance structure and processes for evaluating and addressing cybersecurity risks, which fits Risk Management Process. It contains no specific facts from the IS list—only generic C-suite roles (CEO, CFO), a standard committee (Audit Committee), and unnamed third-party consultants.


reasoning: The board of directors is the grammatical subject and the paragraph describes its oversight role for significant risks, fitting Board Governance. The language is entirely generic with no specific facts, named roles, committees, or details that would distinguish this from any other company's disclosure.


reasoning: The paragraph describes cybersecurity monitoring and incident response processes (prevention, detection, mitigation, remediation, regulatory monitoring, audits) overseen by the Director of Infrastructure. Per the PERSON-VS-FUNCTION test, this is about what the role does rather than the person's qualifications, so it classifies as Risk Management Process. No cybersecurity-specific titles, named frameworks, or verifiable facts appear—'Director of Infrastructure' is not a cybersecurity-specific title per the guidelines, and 'incident response plan' is a generic program name.


reasoning: The paragraph focuses on board and Audit Committee oversight of cybersecurity risks, with management described primarily in terms of their reporting relationship to the board. All entities mentioned (Board, Audit Committee, CEO, management) are generic governance terms that appear in virtually every company's disclosure, with no cybersecurity-specific roles, named frameworks, dates, or other firm-specific details.


reasoning: The paragraph describes the company's internal cybersecurity risk management approach, specifically how management oversees risk mitigation and integrates it with ERM, with reporting to the board as a process element.


reasoning: This is a materiality disclaimer stating that no cybersecurity threats or incidents have materially affected the company, followed by a forward-looking risk statement and cross-reference to Risk Factors. Per guidelines, materiality disclaimers are classified as Strategy Integration even when boilerplate, and the paragraph contains no specific facts identifying this company uniquely.


reasoning: The paragraph describes the company's internal cybersecurity program, including its components for identifying, assessing, and managing cybersecurity risks, and explicitly references the NIST Cybersecurity Framework as the basis for incident response and change management policies.


reasoning: The paragraph describes the company's internal cybersecurity risk assessment and mitigation processes, including how management, IT staff, and a third-party partner work together through monitoring and meetings. This is about what the processes DO rather than about specific management personnel qualifications.


reasoning: The paragraph describes the company's internal processes for identifying, assessing, and managing cybersecurity risks (monitoring, automated tools, escalation protocols), which fits Risk Management Process. The CFO is mentioned as responsible but the content focuses on what the function does, not the person's qualifications. No specific facts remain after filtering—CFO is generic C-suite, 'third-party cybersecurity vendors' are unnamed entities, and 'automated tools' is generic.


reasoning: This paragraph contains a materiality disclaimer stating no cybersecurity incidents with material impact have been identified, followed by forward-looking risk language. Materiality conclusions, even when boilerplate, fall under Strategy Integration per the category guidelines.


reasoning: The paragraph describes board oversight activities including committee reporting, management briefings to the Board, and board member education on cybersecurity topics. The Board and Board members are the grammatical subjects throughout.


reasoning: The paragraph primarily describes board and committee oversight structures with the Board and Audit Committee as grammatical subjects, while management responsibilities are mentioned secondarily as part of the oversight flow.


reasoning: The paragraph is entirely focused on the company's oversight and monitoring of cybersecurity threats from third-party vendors, service providers, and external users, making vendor oversight the central topic.


reasoning: The paragraph describes the company's internal incident response and escalation processes, including a tiered risk classification system, recovery procedures, and materiality determination protocols. CISO and CIO are cybersecurity-specific titles that qualify as firm-specific facts.


reasoning: The paragraph describes the company's overall risk management approach, including how cybersecurity is integrated into the program and the process for identifying, prioritizing, monitoring, and mitigating risks. The brief mention of board oversight does not dominate the paragraph.


reasoning: The paragraph describes the company's internal cybersecurity program, its protective objectives, and framework adoption (NIST), which constitutes a description of the company's own risk management processes.


reasoning: The paragraph describes the company's internal cybersecurity program and how it engages external service providers to enhance its own policies and procedures. Vendors are mentioned as a component of the internal process, not as the central topic of vendor oversight.


reasoning: The paragraph describes the company's internal cybersecurity assessment processes, including framework adoption (NIST), third-party maturity assessments, and how evaluation results flow to the Audit Committee.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes and oversight structure, with the primary focus being on the processes developed rather than on specific board or management roles.


reasoning: The paragraph references previously disclosed cybersecurity incidents and describes response actions (additional safeguards) implemented after incident identification, qualifying as incident disclosure. Two specific quarterly report dates provide two hard verifiable facts.


reasoning: The paragraph describes the Audit and Reserves Committee's oversight process, including the briefing cadence and topics covered in reports from management. While the VP of IT is the grammatical subject, the focus is on the board committee's oversight function and what information it receives.


reasoning: The paragraph describes the company's internal cybersecurity processes, standards, and policies including technical measures, organizational safeguards, and employee training requirements.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including framework adoption (NIST), vulnerability management, monitoring, and incident response planning. It names the NIST Cybersecurity Framework as a recognized standard but contains no firm-specific facts such as named roles, specific dates, named tools, or quantified details.


reasoning: The paragraph focuses on the Chief Digital Information Officer's qualifications, experience, and educational background, making it about the person rather than the function or process.


reasoning: The paragraph describes the company's internal cybersecurity approach and policies, which is a classic Risk Management Process disclosure about the company's own processes.


reasoning: The Board is the grammatical subject throughout, describing its oversight role, incident reporting cadence, and policy review responsibilities. The paragraph contains no specific facts—only generic governance language with no named roles, committees, dates, or frameworks.


reasoning: The paragraph describes the company's internal cybersecurity processes including employee training, phishing tests, and the IT team's role in implementing the cybersecurity program.


reasoning: This paragraph describes an actual cybersecurity incident with specific details about what happened (attack on systems), when (January 31, 2022), scope (limited to Aurora acquisition systems), and response actions (isolation, forensic investigation).


reasoning: The paragraph describes the company's internal cybersecurity risk assessment processes, including vulnerability scanning, internal audits, and ISO 27001 certification maintenance. This is a clear description of the company's own risk management processes.


reasoning: The paragraph centers on the CTO's qualifications (30 years IT experience, 20 years cybersecurity experience) and identifies the specific management roles responsible for the cybersecurity program, making it about the person and roles rather than solely about processes.


reasoning: The Audit Committee is the primary grammatical subject, and the paragraph describes its oversight responsibilities for cybersecurity risk and the quarterly reporting cadence from management to the committee.


reasoning: The paragraph describes two specific cybersecurity incidents from September 2022, including what happened (unauthorized access, data exfiltration, malicious link distribution), when (September 2022), scope (Rockstar Games systems, 2K Games vendor platform), and response actions (notified users, restricted activity, restored service).


reasoning: The paragraph describes the company's overall cybersecurity governance structure, with the Board of Directors and Audit Committee as the primary subjects establishing oversight responsibility, followed by supporting management roles and teams.


reasoning: The paragraph describes Board and Audit Committee oversight of cybersecurity risks with briefing cadences, making it Board Governance. No specific facts from the IS list are present—only generic governance terms (Board, Audit Committee, management) and generic cadences (quarterly, periodically).


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including ERM integration, risk assessment cadence, and reporting structures. The grammatical subject is the company's cybersecurity risk management program and its processes.


reasoning: This paragraph discusses cyber insurance as a financial protection mechanism against cybersecurity incidents, which falls under Strategy Integration as it addresses business/financial impact and risk transfer strategy.


reasoning: The paragraph's central and exclusive topic is vendor oversight—describing the vendor management program, risk evaluation processes, and contractual security requirements imposed on vendors. The specific team composition of 'corporate security, product security, and legal teams' is a firm-specific fact that distinguishes this disclosure from generic boilerplate.


reasoning: This paragraph describes the scope and impact of a cybersecurity incident (what data was and was not accessed/extracted) and the company's response actions, which is the core definition of Incident Disclosure.


reasoning: The paragraph focuses on the CISO as a person—their title, reporting structure, educational credentials, professional certifications, and career experience—which fits the person-focused criteria for Management Role rather than process-focused Risk Management Process.


reasoning: This paragraph describes an actual cybersecurity incident including what happened (fraudulent email leading to erroneous wire transfer), when (year ended December 31, 2023), the financial impact ($0.7 million loss), and response actions (strengthened wire transfer procedures with outside consultant assistance).


reasoning: The paragraph describes the company's cybersecurity program structure, ERM integration, and framework adoption, with management roles mentioned as part of describing the program's organizational structure rather than focusing on individual qualifications.


reasoning: The paragraph describes the company's internal cybersecurity risk management approach, including policies, standards, processes, and practices for assessing and managing risks. It contains no named frameworks, specific roles, dates, or other firm-specific facts—only generic statements that could apply to any company.


reasoning: The paragraph describes the company's internal risk management processes, specifically how cybersecurity is integrated into the ERM program and the organizational structure for managing cyber risk. While management roles are mentioned, they serve to explain the process rather than being the primary focus on the person's qualifications. The CISO and Chief Digital and Information Officer are cybersecurity-specific titles that qualify as firm-specific facts.


reasoning: The paragraph describes the company's cybersecurity program governance structure, including the GIS team's responsibilities, the Enterprise Security Council's composition and function, escalation processes to the Enterprise Risk Council, and controls implementation. While CISO and CEO qualifications are mentioned, they support the broader discussion of risk management processes rather than being the primary focus.


reasoning: The paragraph focuses on Board of Directors' oversight responsibilities for cybersecurity risks, including receiving annual updates from management and engaging in periodic conversations about cybersecurity matters. The Board is the primary grammatical subject throughout, making this a clear Board Governance disclosure.


reasoning: This is a materiality disclaimer stating that cybersecurity threats and prior incidents have not materially affected the company's operations, business strategy, results of operations, or financial condition, followed by a cross-reference to Risk Factors. Per the guidelines, materiality disclaimers are classified as Strategy Integration even when boilerplate, and a cross-reference appended to a materiality assessment does not change the classification.


reasoning: This paragraph is a materiality disclaimer stating that no cybersecurity risks or incidents have materially affected the company's business strategy, results of operations, or financial condition, which falls under Strategy Integration per the guidelines. It contains only boilerplate language with no specific facts—no named roles, dates, frameworks, or verifiable details.


reasoning: The paragraph identifies specific management roles (CIO, VP Information Technology, Manager of Security) responsible for leading cybersecurity processes and describes their collective qualifications and experience, which focuses on the persons rather than the processes they oversee.


reasoning: The paragraph describes the company's internal processes for monitoring IT systems, detecting security incidents, and collecting evidence—core risk management activities.


reasoning: The paragraph describes the company's internal incident management and escalation processes, including tracking, logging, reviewing, and escalating incidents across the organization and third parties. No specific facts from the IS list are present—only generic terms like 'incident management teams,' 'cross-functional working group,' 'senior management,' and 'outside counsel' without any named frameworks, specific roles, dates, or verifiable details.


reasoning: The paragraph describes the company's internal cybersecurity processes (risk assessment, security controls, incident response) managed by a security team, fitting Risk Management Process. No specific facts are present—'information technology manager' is not a cybersecurity-specific title like CISO/CIO, and no frameworks, dates, or verifiable details are mentioned.


reasoning: The paragraph describes the company's internal processes for managing cybersecurity risk, including who is responsible (Co-President), what they do (develop mitigation strategies, implement controls), and reporting to the Audit Committee. By the Person-vs-Function test, since the paragraph focuses on what the role does rather than the person's qualifications or credentials, it qualifies as Risk Management Process. No specific facts from the IS list are present—Co-President is generic C-suite, Audit Committee is standard governance, and 'enterprise risk management program' is a generic program name.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including ERM integration and the Information Security Team's structure and reporting. CIO and Director of Information Security are cybersecurity-specific titles on the ✓ IS list, qualifying as firm-specific facts.


reasoning: The paragraph centers on a materiality conclusion (no material incident in fiscal 2023) with brief reference to two past breaches without describing what happened, plus discussion of potential costs and forward-looking risk factors—this fits Strategy Integration under the tiebreaker for materiality conclusions without incident narrative.


reasoning: The paragraph describes the company's comprehensive cybersecurity risk management structure, including monitoring processes, incident response planning, and governance oversight. While Board oversight is mentioned, the primary focus is on the company's internal processes for managing cybersecurity risk, with CISO and CIO being cybersecurity-specific roles that qualify as firm-specific facts.


reasoning: The paragraph describes the company's internal cybersecurity training and awareness program, including employee training requirements and phishing simulations, which constitutes a risk management process. No specific facts, named frameworks, or verifiable details are present—only generic descriptions of common security practices like 'computer-based training' and 'phishing awareness campaigns.'


reasoning: This paragraph is a general introductory statement about the importance of data security to business operations without disclosing any specific governance structures, risk management processes, incidents, or strategic considerations. It contains no substantive disclosure that fits the defined content categories.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including their cybersecurity program, regulatory compliance, and third-party risk evaluation as one component. The third-party mention is integrated into the internal evaluation process rather than being the central topic. No specific facts from the IS list are present—no cybersecurity-specific titles, named frameworks, dates, named third-party firms, or other verifiable details.


reasoning: The paragraph describes the company's internal cybersecurity risk management approach, including their Cybersecurity Risk and Compliance Program, policies and processes for incident detection/prevention/response, and framework adoption (CIS Controls).


reasoning: The paragraph describes the company's Cyber Incident Management Team (CIMT), including its composition, responsibilities, and leadership structure for incident response. This is about internal processes and what the team/function does, not about individual qualifications, so it fits Risk Management Process under the person-vs-function test.


reasoning: This paragraph describes an actual cybersecurity incident including what happened (unauthorized access, data exfiltration), scope (video meeting images, computer screens), and response actions (closing access point, bolstering defenses).


reasoning: The paragraph describes the company's internal cybersecurity risk management program, including its design objectives, management structure, mechanisms and controls, and ongoing activities such as audits, risk assessments, vendor due diligence, and employee training. The VP of IT & Facilities is a named role that qualifies as a firm-specific fact, though it is borderline whether this combined IT/Facilities role meets the cybersecurity-specific threshold.


reasoning: The paragraph's central topic is vendor oversight - describing how the company assesses third-party vendors and subservice organizations for cybersecurity risks and imposes information security requirements on them. This fits Third-Party Risk as the requirements are imposed ON vendors, not merely mentioning vendors as a component of internal processes.


reasoning: The paragraph begins with and dedicates substantial content to Board and Audit Committee oversight of cybersecurity risks, including meeting cadence and reporting structures. While the CTO's role and qualifications are detailed, the Board/Audit Committee governance content appears first and frames the overall oversight structure.


reasoning: This paragraph contains a materiality conclusion about past cybersecurity incidents without describing any specific incident, followed by forward-looking risk disclaimers and a cross-reference to Risk Factors. Materiality assessments are classified as Strategy Integration even when boilerplate.


reasoning: The paragraph focuses on identifying specific management roles (VP of Information Technology, COO), their qualifications, and reporting lines. The grammatical subjects are management positions describing who leads cybersecurity efforts and their responsibilities, fitting the Management Role category.


reasoning: The paragraph describes an actual cybersecurity incident (the Change Healthcare breach), including what happened (threat actor gained access to IT systems), the scope of impact on the company (disruption to patient billing and collections, delayed claims submissions), and response actions (identified alternative claim processing intermediary, resumed claims submissions). This constitutes an incident disclosure even though the incident occurred at a third-party vendor. The specificity is Quantified-Verifiable because the paragraph names two third-party firms (Change Healthcare and UnitedHealth Group), which are hard verifiable facts.


reasoning: The paragraph focuses on the CISO's role, qualifications, and reporting line to the GCSO, which fits the Management Role category. The CISO title is a cybersecurity-specific role that qualifies as Firm-Specific, and GCSO is a non-standard organizational title indicating a specific reporting structure.


reasoning: The paragraph describes the company's internal processes for supervising cybersecurity threat prevention, detection, mitigation, and remediation, including briefings, threat intelligence gathering, and security tool monitoring.


reasoning: The paragraph describes the company's internal cybersecurity processes including engaging external resources for assessments, monitoring threat intelligence, and informing cybersecurity investments and strategies. The CDO and CISO titles appear in context of their functional roles in the process, not as biographical descriptions.


reasoning: The paragraph describes the company's internal incident response and vulnerability management policies, including escalation procedures and team involvement. The focus is on the process and function rather than on individual qualifications or board oversight as the primary topic.


reasoning: The paragraph describes ADT's Enterprise Risk Management program and cybersecurity risk assessment processes, including specific tools and frameworks used. The CISO is mentioned as leading the process, but the focus is on the activities and tools rather than the person's qualifications. Two hard verifiable facts (SecurityScorecard as a named tool and CISSP as a named certification) meet the Quantified-Verifiable threshold.


reasoning: The paragraph describes the company's internal cybersecurity program structure, incident classification system, and response procedures. The grammatical subjects are the Program and Corporate Security Group, not the board or individual managers.


reasoning: The paragraph describes the company's internal process for managing cybersecurity risks, which involves engaging various types of third-party service providers as tools to support their risk management activities.


reasoning: The paragraph describes the Audit Committee's oversight of cybersecurity matters, including briefing cadence, strategic decision participation, and annual program review. While the COO is mentioned as providing information to the Audit Committee, the COO is not a cybersecurity-specific role (CISO/CTO/CIO), and the primary focus is on board committee oversight activities rather than management qualifications or role details.


reasoning: The paragraph describes the company's internal risk assessment processes, including how they leverage third-party consultants for audits and oversee service providers as part of their cybersecurity risk management program. The third-party oversight is a component of their internal processes rather than the central topic.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including the composition and function of the Cyber Incident Response Team (IRT), the Cybersecurity Plan, and monitoring/reporting procedures. This is a classic Risk Management Process disclosure about the company's own internal processes for incident response and risk management.


reasoning: The paragraph describes the company's implementation of additional safeguards to detect and prevent cybersecurity events, which constitutes a risk management process. While past incidents are referenced, they are not described—only cross-referenced to prior disclosures. The two specific quarter-end dates (June 30, 2023 and September 30, 2023) are verifiable facts that meet the Quantified-Verifiable threshold.


reasoning: The ISO is the grammatical subject and the paragraph describes the ISO's reporting lines to management, the BRCC, and the Board, which falls under Management Role's explicit coverage of reporting structures.


reasoning: The paragraph primarily describes the Audit Committee's oversight of cybersecurity risks and the CTO's reporting relationship to the Audit Committee, which constitutes board governance of cyber risk. The CTO is mentioned in service of explaining the oversight structure rather than as the main focus about the person's qualifications.


reasoning: The paragraph describes the company's internal cybersecurity team structure and operational processes (detection, assessment, classification, escalation, reporting), which fits Risk Management Process. The Person-vs-Function test confirms this is about what the CIRT does rather than individual qualifications as the primary focus.


reasoning: The Nominating and Governance Committee (a board committee) is the grammatical subject, receiving periodic reports from the CISO on cybersecurity threats and risk mitigation processes, which constitutes board oversight of cyber risk.


reasoning: The paragraph describes the company's internal processes for assessing, identifying, and managing cybersecurity risks, including framework adoption (NIST) and an incident response plan (CIRP).


reasoning: The paragraph describes the company's internal IT governance and risk management processes, including committee structures, meeting cadences, and review activities. It contains firm-specific facts including named cybersecurity-specific roles (Director of Information Technology, CISO) and named internal committees (IT Operating Committee, IT Steering Committee), but lacks the hard verifiable facts (specific dates, dollar amounts, named third-party firms, or named tools) needed for Quantified-Verifiable.


reasoning: The paragraph describes the board's oversight role and briefing cadence for cybersecurity risks, with the board as the grammatical subject, but contains no specific facts—only generic governance language with vague cadence ('periodic updates') and no named roles, frameworks, or dates.


reasoning: The paragraph describes the Audit Committee's oversight role and reporting cadence for cybersecurity risks, with the Audit Committee and Board of Directors as key subjects receiving reports from management.


reasoning: The paragraph describes the company's internal cybersecurity processes including risk assessments, safeguards implementation, and monitoring, with the second sentence explaining the management structure responsible for these processes.


reasoning: The paragraph focuses on management executives (CEO, CFO, corporate controller) as the grammatical subjects, describing their qualifications and role in cybersecurity risk assessment and board reporting.


reasoning: This paragraph is a materiality assessment stating no material cybersecurity incidents have occurred and no material effect on business operations, which falls under Strategy Integration per the guidelines. Two specific dates (December 31, 2024 and January 2018) provide verifiable facts meeting the Quantified-Verifiable threshold.


reasoning: The paragraph describes the company's internal cybersecurity risk management function, its integration with enterprise risk management, and the processes and controls implemented to assess and manage cybersecurity risks.


reasoning: This is a standalone materiality conclusion stating no cybersecurity threats have materially affected the company, with a cross-reference to Risk Factors. Per the guidelines, materiality disclaimers are classified as Strategy Integration even when boilerplate.


reasoning: The paragraph describes the company's internal processes for monitoring cybersecurity risks through briefings, threat intelligence, and security tools. Although the CISO is the grammatical subject, the Person-vs-Function test indicates this is about what the role does (processes and activities) rather than the person's qualifications, making it Risk Management Process.


reasoning: The paragraph contains a materiality conclusion stating no cybersecurity incident has had material adverse impact to date, followed by cross-references to Risk Factors. Under the guidelines, materiality disclaimers and conclusions fall under Strategy Integration even when boilerplate in nature.


reasoning: The paragraph describes the company's internal process for reporting cybersecurity risks through established channels, referencing the 'risk management program' as the governing framework. While it touches on governance, the grammatical subject is management's reporting activities rather than board/committee oversight actions.


reasoning: The paragraph describes the IT department's functional responsibilities for managing cybersecurity processes (risk assessment, security controls, incident response), which is about what the department does rather than about a specific person's qualifications.


reasoning: The paragraph describes the company's internal information security processes for identifying, assessing, and managing cybersecurity risks to their systems and data, which is a classic Risk Management Process disclosure.


reasoning: The paragraph describes an actual cybersecurity incident with specific details about what happened (unauthorized access to employee email accounts), when (June 2023), scope (two employees), response actions (customer notification in September 2023), and financial impact ($25,000).


reasoning: The paragraph describes the company's general approach to cybersecurity risk—acknowledging threats and stating commitment to maintaining practices and evaluating threats—but contains no specific processes, governance structures, or named frameworks.


reasoning: The paragraph describes the company's internal cybersecurity monitoring processes, defense-in-depth safeguards, and incident response planning. The CISO is mentioned as the functional role overseeing these processes, not as a person with qualifications being described.


reasoning: The Audit Committee (a board committee) is the grammatical subject describing its oversight role over cybersecurity risk, including receiving reports from management and the vCIO on IT systems and cybersecurity tools.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes including vulnerability testing, employee training, incident response planning, and third-party oversight. It contains only common security practices without named frameworks, specific dates, named roles, or other firm-specific facts.


reasoning: The paragraph describes the company's internal security controls and mitigation measures for managing cybersecurity risks, which is a core risk management process disclosure.


reasoning: The audit committee is the grammatical subject receiving reports from management, making this about board/committee oversight of cybersecurity risk rather than about the management role itself.


reasoning: This paragraph describes an actual cybersecurity incident (ransomware attack) with specific timing (late May 2023), scope (certain systems on the network), and response actions (investigation, engagement of experts, law enforcement coordination), meeting the definition of Incident Disclosure.


reasoning: The paragraph describes an actual cybersecurity incident (February 2023 ransomware attack) with details on what happened (encryption of servers), when (February 2023), scope (certain network servers), and response actions (restoration by internal IT and third-party teams without paying ransom).


reasoning: The paragraph describes the company's internal processes for cybersecurity risk communication and briefings to both management and the Board, focusing on the cadence and structure of these updates rather than individual qualifications or board expertise.


reasoning: This paragraph describes an actual cybersecurity incident—the March 2020 ransomware attack—including what happened (unauthorized access to IT systems), scope (confidential information stolen, potential trade secrets and employee personal information exposure), and response actions (isolated the source, restored operations). The specific date 'March 2020' provides one firm-specific fact, but without a second hard verifiable fact (no named third-party firm, dollar amount, or named product), it does not reach Quantified-Verifiable.


reasoning: The paragraph describes the operational status and restoration timeline of an actual cybersecurity incident, including that services remained operational and systems were restored as of a specific date.


reasoning: This is a generic introductory statement about the business importance of cybersecurity without describing any specific governance structure, processes, roles, or incidents. It contains no substantive disclosure and could appear in any company's filing.


reasoning: Paragraph describes an actual cybersecurity incident with specific details about what happened (unauthorized access via social engineering attack), when (September 14, 2023), scope (loyalty program database), and response actions (activated IRP, notified law enforcement, engaged third-party professionals).


reasoning: The paragraph focuses on the personnel structure supporting cybersecurity, identifying specific roles (CIO, Director of Cybersecurity) and emphasizing the team's collective qualifications (85 years of experience). The PERSON-VS-FUNCTION test indicates this is about the persons and their credentials rather than detailed processes or activities.


reasoning: The paragraph identifies specific management roles (CFO, COO, Controller, Director – Finance) and describes their reporting lines and communication responsibilities regarding cybersecurity, which fits the Management Role category's focus on role identification and reporting structures.


reasoning: While the paragraph begins with Board oversight, the substantive disclosure focuses on identifying a specific management role (Director of Information Technology and Data Management Systems), their reporting line to the CEO, and their qualifications (20+ years of experience). The person-qualifications focus triggers the Management Role classification.


reasoning: The paragraph describes the company's internal cybersecurity reporting processes and oversight structure—specifically how the IT function reports to the Audit Committee and leads the cybersecurity program. Under the Person-vs-Function Test, this describes what the role DOES (reporting, leading the function) rather than the person's qualifications, so it classifies as Risk Management Process.


reasoning: This paragraph describes general IT infrastructure and third-party dependencies without substantive disclosure about cybersecurity governance, risk management processes, or incidents. It provides background context about systems and vendors but does not address oversight, security controls, or risk management activities.


reasoning: The paragraph describes the company's internal Enterprise Risk Management Committee (ERMC), its meeting cadence, and how it integrates cybersecurity considerations into risk management decision-making through reports from the CISO and CDO. This is about the company's risk management processes and framework, not about individual management qualifications.


reasoning: This paragraph describes an actual cybersecurity incident with specific dates (February 23 and 28, 2023), the nature of the attack (network outage, data extraction), affected systems (internal servers, IT telephony), and response actions taken (incident response activation, engagement of experts, law enforcement notification).


reasoning: The paragraph describes the company's internal cybersecurity program and its components (monitoring, assessments, tools, training), which is a classic Risk Management Process disclosure. No specific facts from the IS list are present - only generic tool categories (firewalls, EDR, encryption), common practices (phishing awareness training), and unnamed third-party assessments.


reasoning: The paragraph describes the board's cybersecurity risk oversight function and how it is administered through the audit committee, making Board Governance the appropriate category. No specific facts remain after filtering—'board of directors' and 'executive officers' are generic governance terms, and 'audit committee' is explicitly excluded from counting as a specific fact.


reasoning: The paragraph identifies specific management roles (Senior Information Security Officer, Director of IT, Director of Information Services), their reporting lines (to CFO and Chief Risk Officer), and their respective responsibilities for the cybersecurity program. The grammatical subjects are management roles throughout.


reasoning: The paragraph describes the company's internal processes for cybersecurity risk assessment and management, including the establishment of a committee structure, meeting cadences, and reporting lines. The focus is on what the processes do rather than on individual qualifications.


reasoning: The paragraph describes a specific cybersecurity incident (2019 wire fraud scheme involving email compromise and fraudulent wire transfer), including what happened and the response actions taken (MFA implementation, enhanced controls), which clearly fits Incident Disclosure.


reasoning: The paragraph focuses on the CISO and management team's responsibilities and qualifications, with the CISO's credentials (20+ years of experience, Fortune 500 and US Government work) being a central element.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including technical safeguards (monitoring, vulnerability scans, encryption) and organizational safeguards (incident response plans, training, risk assessments). It contains no named frameworks, specific dates, named tools, named third-party firms, cybersecurity-specific titles, or other verifiable facts—only common practices and generic program names that could apply to any company.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes (policies, training, testing, incident response procedures) without any named frameworks, specific roles, dates, or unique identifiers that would distinguish it from any other company's disclosure.


reasoning: The paragraph focuses on the qualifications, credentials, and career backgrounds of specific cybersecurity management personnel (LMC's Head of Cybersecurity and QVC's VP Information Security), including their years of experience and professional certifications.


reasoning: The paragraph describes the company's internal processes for integrating cybersecurity into enterprise risk management, identifying and mitigating threats, and strengthening security posture. The materiality language is embedded within the risk assessment discussion rather than being a standalone conclusion.


reasoning: This paragraph is forward-looking risk disclaimer language describing hypothetical future impacts of cyber-attacks and potential costs, without disclosing any actual governance structures, processes, roles, or incidents. It contains no specific facts and could appear in any company's filing unchanged.


reasoning: The paragraph describes the company's internal cybersecurity program, risk assessment processes, and security monitoring activities, which are core elements of risk management processes with no named frameworks or firm-specific details.


reasoning: This paragraph contains only forward-looking risk acknowledgment language about cybersecurity threats and potential material adverse effects, without any substantive disclosure about governance structures, management roles, internal processes, third-party oversight, or specific incidents.


reasoning: The paragraph describes the company's internal cybersecurity capabilities, organizational structure (SOC, CISO), and operational processes (threat hunting, vulnerability scanning, threat detection), which constitutes Risk Management Process. The CISO is a cybersecurity-specific role that qualifies as a firm-specific fact.


reasoning: The paragraph describes actual cybersecurity incidents with specific dates, affected systems (internal servers, IT telephony), response actions (incident response plans, engaging experts, notifying law enforcement), and scope (data extraction from IT systems).


reasoning: The Board and Audit Committee are the grammatical subjects, describing how the Board's oversight is supported by the Audit Committee's interactions with management. The Director of Information Technology is a cybersecurity-specific title that qualifies as a firm-specific fact.


reasoning: This paragraph contains a materiality conclusion stating the company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the company, which is a classic Strategy Integration disclosure.


reasoning: The paragraph contains a standalone materiality conclusion stating no material cybersecurity incidents occurred in the last three years, which fits the Strategy Integration category for materiality assessments without incident narrative.


reasoning: The paragraph describes the company's internal organizational structure for cybersecurity risk assessment and management, specifically naming the Enterprise Risk Management Committee as part of that process.


reasoning: The paragraph describes a management-level committee (CSC) and its day-to-day responsibilities for monitoring, managing, and integrating cybersecurity risk management practices, which fits Risk Management Process. The focus is on the committee's function and activities rather than individual qualifications or board oversight.


reasoning: The paragraph focuses on management roles—the Director of IT and IT team personnel—with their qualifications and responsibilities as the primary subject, while Board oversight is mentioned only briefly as delegating authority.


reasoning: The paragraph describes the company's internal cybersecurity incident response plan and procedures, including detection, analysis, containment, and recovery processes. This is about what the company does (internal processes) rather than a specific person's qualifications or board oversight.


reasoning: The paragraph describes the company's incident response plan and notification/escalation procedures, which are internal risk management processes. The CISO is mentioned as part of the notification process, but the focus is on the function rather than the person's qualifications.


reasoning: The Board of Directors is the grammatical subject throughout, with the paragraph describing Board oversight responsibility for ERM, Board committee oversight of enterprise risks, and Board member expertise in cybersecurity matters.


reasoning: The paragraph describes an internal governance structure (Corporate Cybersecurity Steering Committee) and its function in managing cybersecurity challenges, which is about the company's risk management process rather than a specific management role's qualifications.


reasoning: The paragraph's central topic is vendor oversight, describing a dedicated Vendor Risk Management Program, Vendor Risk Management Policy, onboarding processes, and periodic reviews specifically for managing vendor relationships and access to sensitive data.


reasoning: The Board of Directors and Audit Committee are the primary grammatical subjects, discussing oversight responsibilities and delegation of cybersecurity risk oversight. The management role is mentioned secondarily in relation to escalation to the Board/Audit Committee. No specific facts from the ✓ IS list are present—'Audit Committee' is explicitly excluded as a standard committee, and 'an employee of the Manager' is not a cybersecurity-specific title like CISO/CIO/CTO.


reasoning: The paragraph focuses on identifying the CIO and director of IT as the individuals leading cybersecurity programs, their reporting lines to CEOs and business segment leadership, and their qualifications and team experience. The management roles are the grammatical subjects throughout most of the paragraph.


reasoning: The paragraph is entirely focused on vendor oversight—assessing cybersecurity risks from third-party service providers and using cybersecurity risk criteria for their selection and oversight—making Third-Party Risk the appropriate category. No specific facts are present; the language is entirely generic and could apply to any company.


reasoning: This paragraph describes an actual cybersecurity incident (business email compromise/wire fraud scheme) with details about what happened, when (Fiscal 2024), the scope (fraudulent wire transfers), response actions (contacting banks, law enforcement, informing audit committee), and financial impact ($2.7 million loss).


reasoning: The paragraph describes management's responsibilities in cybersecurity processes (setting objectives, resource allocation, policy development, risk management, incident response, compliance) rather than identifying specific management roles or their qualifications, making it Risk Management Process per the person-vs-function test. No specific facts, named frameworks, or firm-specific details are present, resulting in Generic Boilerplate specificity.


reasoning: The paragraph focuses on board and audit committee oversight structures, including policy adoption, director expertise, and reporting cadences, with the CTO mentioned as part of the governance framework rather than as the primary subject.


reasoning: The paragraph describes the company's internal cybersecurity governance structure and processes, specifically the Cybersecurity Steering Committee's composition, responsibilities, and oversight functions for managing cybersecurity risk, which constitutes a risk management process rather than individual management qualifications.


reasoning: The paragraph focuses on the CIO and CISO roles, their reporting structure, and their professional qualifications and credentials, which clearly fits the Management Role category. Multiple specific numbers (years of experience) and named certifications (CISM, CDPSE, CRISC) provide two or more independently verifiable facts.


reasoning: The paragraph focuses on the qualifications, expertise, and credentials of a named security executive, which is a classic Management Role disclosure about the person rather than processes or functions.


reasoning: The paragraph describes the company's internal cybersecurity processes including ongoing education, monitoring, vulnerability identification through audits and penetration testing, and incident response planning. The CIO is mentioned as leading the team, but the focus is on what the function does (processes, activities) rather than the person's qualifications, so this is Risk Management Process per the person-vs-function test.


reasoning: This paragraph describes an actual cybersecurity incident (the '2024 Cybersecurity Incident'), including what happened (unauthorized activity on IT systems), when (fourth quarter fiscal 2024), scope (online ordering in parts of U.S.), and operational impact, which triggers the Incident Disclosure category per the tiebreaker rules. The specificity is Quantified-Verifiable because it contains multiple hard verifiable facts: a specific filing date (December 11, 2024) and three specific dollar amounts ($3 million, $11 million, $10 million).


reasoning: The Audit Committee (a board committee) is the grammatical subject and the paragraph describes its oversight role over cybersecurity policies and procedures, which fits Board Governance. No specific facts are present—Audit Committee is explicitly listed as a generic governance term, and there are no named frameworks, cybersecurity-specific roles, dates, or other verifiable details.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, specifically how third-party experts are engaged as a component of vulnerability testing and assessment. The third parties are tools for the company's own risk management, not vendors whose security is being overseen.


reasoning: The paragraph provides a historical statement that no cybersecurity incidents occurred during the specified fiscal year that resulted in operational interruptions or system breaches. This constitutes a materiality assessment (no material incidents occurred), which falls under Strategy Integration. The fiscal year end date of December 31, 2024 is a specific fact that elevates this to Firm-Specific.


reasoning: This paragraph contains a materiality conclusion stating that cybersecurity risks have not materially affected the company's business strategy, results of operations, or financial condition. Per the guidelines, materiality disclaimers are classified as Strategy Integration even when boilerplate, and the appended cross-reference to Risk Factors does not change the classification.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including ERM integration, framework adoption (NIST, COSO, ISO 27001), and testing methodology. The Cybersecurity Committee is a named non-generic committee that qualifies as a firm-specific fact.


reasoning: This is an introductory paragraph describing the general threat landscape and stating that the company expends resources on cybersecurity, without describing specific governance structures, management roles, processes, or incidents.


reasoning: The paragraph identifies a specific management role (Director of IT), their reporting line to the COO, and details their professional qualifications and years of experience in IT security.


reasoning: The paragraph describes the company's internal incident response structure, including team composition, escalation procedures, and materiality assessment processes. This is a clear Risk Management Process disclosure focused on how the company handles cybersecurity incidents.


reasoning: The paragraph's central focus is on the qualifications and credentials of the CIO and CISO, with detailed career history and certifications, while board oversight is described in more procedural terms. The tiebreaker for 'Board oversight mentioned briefly + management roles as main focus → Management Role' applies.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including governance policies, organizational structure for managing cybersecurity, and technical safeguards. It contains firm-specific facts including a named cybersecurity-specific role (CTO) and a named internal program (ISG Policy), while the NIST framework reference provides additional context but does not alone determine specificity.


reasoning: The paragraph identifies specific cybersecurity management roles (Director of Enterprise Information Security, Information Security Officer), describes their reporting lines to the Chief Risk Officer and Board, and provides quantified qualifications (30 and 22 years of experience). While it references risk management processes like the ITRGC, the focus on role identification, credentials, and reporting structure makes Management Role the primary category.


reasoning: The paragraph's central topic is the outsourced arrangement where NEE affiliates provide substantially all IT and cybersecurity functions to XPLR, with board oversight of this third-party service provision.


reasoning: The paragraph identifies specific management roles (CTO and Head of Technology Infrastructure) and provides detailed qualifications and career experience for each, which is the core focus. While it also describes program processes, the emphasis on the persons and their credentials makes Management Role the primary category.


reasoning: The paragraph describes the company's internal cybersecurity risk mitigation approach through limited system access, isolated infrastructure, and restricted connectivity - clearly fitting Risk Management Process. Multiple specific headcounts (9 employees, 6 full-time, 3 part-time, 3 with access, 1 consultant) constitute two or more hard verifiable facts.


reasoning: The paragraph primarily describes management's ongoing processes for identifying, assessing, monitoring, and mitigating cybersecurity risks, with brief mentions of board oversight and CEO oversight as governance context.


reasoning: The paragraph describes the company's internal cybersecurity tools, systems, and protective measures including multifactor authentication, firewalls, intrusion detection systems, vulnerability testing, and a 24x7 security operations center.


reasoning: The paragraph primarily describes the company's incident response plan, including its structure and components, which constitutes an internal risk management process. The physical break-in mentioned is explicitly characterized as a 'physical security incident' rather than a cybersecurity incident, so it does not qualify as Incident Disclosure. The specific fiscal year date and 24-month duration provide firm-specific facts, but only one (the exact date) counts toward the Quantified-Verifiable threshold.


reasoning: The paragraph describes the company's internal processes for assessing, managing, and identifying cybersecurity risks, including team composition for risk assessment and integration with enterprise risk management. The focus is on the company's own processes rather than board governance or management roles.


reasoning: The paragraph describes Board and Audit and Risk Committee oversight of cybersecurity risks and reporting structures, with the Board and committee as the grammatical subjects. No specific facts qualify from the IS list - 'Audit and Risk Committee' is a standard committee variant, and 'Response Team' is a generic team name without unique identifiers.


reasoning: The paragraph describes the company's internal cybersecurity risk program, including controls, monitoring, threat intelligence, third-party assessors, employee training, and vendor risk policies. This is a comprehensive description of the company's own risk management processes.


reasoning: The paragraph describes the company's internal cybersecurity program including policies, risk assessment activities aligned to NIST 800-171, monitoring, incident response, and employee training — all core risk management processes.


reasoning: This paragraph describes post-incident response actions and regulatory follow-up to an actual cybersecurity breach, including public disclosure, customer notifications, and an SEC investigation with a specific document request tied to the Progress software breach.


reasoning: The paragraph focuses on the CISO's role, qualifications (CISSP certification), and experience, with a brief secondary mention of Audit Committee oversight. The CISO is a cybersecurity-specific role and the CISSP certification is a specific credential, making this Firm-Specific.


reasoning: The paragraph identifies specific management roles and describes the composition of the Cybersecurity Team, with the CTO as a cybersecurity-specific title. While it also describes team activities, the primary focus is on organizational structure and role identification rather than detailed process descriptions.


reasoning: The paragraph primarily discusses executive officers' oversight responsibilities and the CEO's IT/cybersecurity qualifications, with board oversight mentioned only briefly at the beginning and end. No specific facts qualify for Firm-Specific—CEO is generic C-suite (on the NOT list), 'more than 15 years' is approximate rather than exact, and no named frameworks, cybersecurity-specific roles, dates, or third parties appear.


reasoning: The paragraph describes the company's internal data security and handling processes, including storage locations, data export practices, and payment information protection. It names two specific cloud platforms (Google Cloud and Amazon Web Services), which constitute two hard verifiable facts meeting the Quantified-Verifiable threshold.


reasoning: The paragraph focuses on the CISO's role, qualifications, reporting line, and the Cybersecurity Governance Council established to support the CISO. The grammatical subjects are the CISO and the CGC (an executive-level management body), making this a Management Role disclosure.


reasoning: The paragraph describes management's responsibilities and activities for the cybersecurity program (identifying risks, coordinating incident response, assessing policies, reporting progress), which constitutes internal risk management processes. The Cybersecurity Committee is a named non-generic committee that distinguishes this disclosure from generic boilerplate.


reasoning: This paragraph contains a materiality conclusion stating that cybersecurity risks have not materially affected the company, followed by forward-looking statements about potential material impact. Under the guidelines, materiality disclaimers and conclusions fall under Strategy Integration even when boilerplate in nature.


reasoning: The paragraph's central topic is managing cybersecurity risks from third-party service providers, including due diligence processes and contractual security requirements imposed on vendors with PII access. No specific facts, named frameworks, or unique identifiers appear—only generic references to 'independent cybersecurity vendor,' 'third-party service providers,' and 'security standards and protocols.'


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including team structure, incident response procedures, and internal reporting lines. It contains firm-specific facts (CISO role, named internal teams and committees) but lacks hard verifiable facts like dates, amounts, or named third-party firms.


reasoning: The paragraph describes the company's vendor management program for overseeing third-party cybersecurity risks, including assessments, questionnaires, reviews, and contractual obligations imposed on providers. Vendor oversight is the central topic throughout, rather than vendors being mentioned as one component of broader internal processes.


reasoning: The paragraph describes committee oversight responsibilities with DPIRC and Enterprise Risk Committee as grammatical subjects, covering strategic direction, policy oversight, and quarterly CISO briefings—classic board/committee governance functions.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including ERM integration, framework adoption, vulnerability management, and disaster recovery governance. It names recognized standards (ISO and NIST Cybersecurity Framework) but contains no firm-specific facts from the IS list.


reasoning: The paragraph describes the Board's cyber risk oversight responsibility and the Risk Committee's governance role in materiality determinations for cybersecurity incidents, which constitutes board/committee-level oversight structure.


reasoning: The first and more detailed sentence describes the company's evaluation of third-party service providers' security capabilities, which constitutes vendor oversight as the central topic. The second sentence briefly mentions board oversight but is less substantive, and the paragraph contains no specific facts—only generic references to 'third-party service provider,' 'Board of Directors,' and 'Audit Committee.'


reasoning: The paragraph describes the Board's oversight mechanism for receiving cybersecurity updates, with the CFO serving as the conduit for information from DIT and DIS. Although the CFO is the grammatical subject, the main focus is on Board oversight and briefing cadence for cybersecurity matters.


reasoning: The paragraph focuses on the CISO's qualifications, credentials, career history, and educational background, with the CISO as the grammatical subject throughout. The PERSON-VS-FUNCTION test confirms this is about the person, not the function.


reasoning: The paragraph describes the company's overall cybersecurity risk management approach, including governance structure, processes, controls, and potential vulnerabilities. While it mentions both the VP of IT and Board oversight, these serve to explain the risk management framework rather than being the primary focus of a Management Role or Board Governance disclosure.


reasoning: This paragraph contains a standalone materiality conclusion stating that no cybersecurity threats have materially affected or are reasonably likely to materially affect the company, which falls under Strategy Integration per the guidelines. The cross-reference to Risk Factors does not change the classification.


reasoning: The paragraph describes management's responsibilities in leading cybersecurity processes (hiring, budgets, integration, oversight) rather than focusing on individual qualifications or credentials, triggering the function-side of the person-vs-function test. No cybersecurity-specific titles (CISO, CTO, CIO), named standards, dates, or verifiable facts appear—only generic organizational roles and standard responsibilities.


reasoning: The paragraph describes the company's internal cybersecurity program, including its focus areas (defense, detection, remediation), policies, and crisis response planning, which constitutes a description of internal risk management processes.


reasoning: This paragraph describes an actual cybersecurity incident at a named subsidiary (Targus), including the discovery date, nature of unauthorized access, response actions taken, and impact assessment. The specific date (April 5, 2024) makes it Firm-Specific, but with only one hard verifiable fact counting toward the Quantified-Verifiable threshold, it does not reach that level.


reasoning: The paragraph describes internal processes for risk assessment follow-up and ongoing cybersecurity risk evaluation. While it mentions a management role (head of IT department), the focus is on what the role does rather than the person's qualifications, so Risk Management Process applies under the person-vs-function test. No specific facts are present—'head of IT department' is not a cybersecurity-specific title like CISO/CIO, and CFO is a generic C-suite role.


reasoning: The paragraph focuses on management roles (CTO, CSO, CIO) and their qualifications, experience, and responsibilities in cybersecurity governance. Applying the person-vs-function test, the content emphasizes who these individuals are and their credentials rather than describing processes or activities, making Management Role the appropriate category.


reasoning: The paragraph describes personnel transitions in cybersecurity leadership roles, including the departure of a VP, interim coverage by an IT Manager, and the search for a replacement—clearly focusing on management roles rather than processes or governance.


reasoning: The paragraph focuses on the Vice President of IT's professional qualifications, experience, and background, which is a clear Management Role disclosure about a person rather than processes.


reasoning: The paragraph focuses on the qualifications, experience, and professional certifications of the CDIO and CISO, which are management roles. The CISO is a cybersecurity-specific title and multiple named certifications are listed, making this Firm-Specific. The years of experience are approximate ('over 25 years') rather than specific numbers, so it does not reach Quantified-Verifiable.


reasoning: The Information Security Officer is the grammatical subject of the opening sentences, with emphasis on their qualifications (over a decade of experience) and team credentials. While processes are mentioned, the focus on the ISO's role and experience makes Management Role the best fit.


reasoning: The paragraph focuses on the qualifications, tenure, and career history of specific management personnel (CFO, CCO, and CIO), which fits the Management Role category under the person-vs-function test. The CIO is a cybersecurity-specific role, and multiple specific durations of experience are provided, but none of these meet the Quantified-Verifiable threshold (no specific dates, dollar amounts, headcounts, percentages, named third-party firms, or named tools/products).


reasoning: The paragraph describes the company's internal cybersecurity technologies, protective measures, assessment processes, and third-party security evaluations—clearly fitting Risk Management Process. It references PCI DSS through 'payment card industry certification' and 'Qualified Security Assessor,' naming a recognized standard, but lacks firm-specific facts such as named individuals, specific dates, or explicit certification claims that would elevate it to Firm-Specific.


reasoning: The paragraph centers on management roles with the CIO and Director of Information Security and Compliance as grammatical subjects, detailing the CIO's qualifications and responsibilities, and describing the Security Council as a management oversight body. While it includes some process descriptions, the primary focus is on who holds cybersecurity responsibility rather than detailed process mechanics.


reasoning: The paragraph describes the company's internal cybersecurity control system, including their reliance on third-party software and their process of reviewing Service Organization Controls (SOC) reports to assess third-party controls. This is about the company's own risk management process rather than vendor oversight requirements imposed on vendors.


reasoning: This paragraph is forward-looking risk acknowledgment language describing the general threat landscape and potential consequences without disclosing any specific aspect of the company's cybersecurity governance, management, processes, or strategy.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including risk assessment, monitoring via third-party providers, incident response procedures, and materiality determination. While management roles are mentioned, they are generic C-suite positions (CEO, COO, CAO) rather than cybersecurity-specific roles, and the paragraph focuses on processes rather than individual qualifications.


reasoning: The paragraph describes the company's internal cybersecurity processes for threat intelligence gathering, collaboration, and resource allocation, which clearly fits Risk Management Process. For specificity, while government agencies are named (FBI, CISA, DOE), they do not fit the IS list category of 'named third-party firms' (which refers to commercial entities), and no other specific facts from the IS list are present—no cybersecurity-specific titles, named committees, specific dates, named products/tools, specific numbers, or certification claims.


reasoning: The paragraph focuses on the qualifications and career history of specific management roles (CTO and Senior Director, Information Security), making it about the persons rather than the function per the PERSON-VS-FUNCTION test. The cybersecurity-specific titles (CTO, Senior Director, Information Security) qualify as Firm-Specific facts, and the named former employers provide additional verifiable detail.


reasoning: The paragraph focuses on Board and Audit Committee oversight of cybersecurity, including reporting structures, briefing cadences, and board member expertise in cyber risk. The grammatical subjects throughout are the Audit Committee, the full Board, and Board members.


reasoning: The EROC (Enterprise Risk Oversight Committee), a board-level committee, is the grammatical subject and the paragraph describes its oversight role in receiving presentations and reports on the Information Security Program.


reasoning: The CISO is the grammatical subject and the paragraph describes reporting lines and cadence for the CISO and senior management, which falls under Management Role's coverage of reporting structures.


reasoning: The paragraph describes the company's internal cybersecurity governance structure, including management-level committees, escalation processes to the Non-Financial Risk Committee, and reporting lines from the CIO and Head of Operational Risk to various board committees. This is about the function and process of risk management rather than individual qualifications.


reasoning: The paragraph describes the company's own internal cybersecurity measures and controls, including authentication, encryption, EDR, and SIEM implementation, which constitutes risk management process disclosure.


reasoning: The paragraph describes the company's internal process for cybersecurity risk reporting and oversight, including the structure and content of quarterly briefings to the audit committee. While management provides these briefings, the focus is on the reporting process and topics covered rather than on specific management roles or qualifications.


reasoning: The paragraph focuses on the qualifications, experience, and reporting structure of the Director of Information Technology and the third-party CISO, making it about the persons in these roles rather than the processes they execute.


reasoning: The paragraph describes the company's internal processes for monitoring, evaluating, and escalating cybersecurity incidents, with the CISO mentioned in the context of the escalation function rather than as a person with qualifications.


reasoning: The paragraph describes the company's internal cybersecurity processes including risk assessments, monitoring mechanisms, third-party engagement for security testing, and threat intelligence participation. The grammatical subject is 'We' (the company) throughout, describing its own risk management activities.


reasoning: The paragraph focuses on the management team's responsibilities for cybersecurity risk management, their qualifications (prior work experience in highly-regulated industries), and the expertise of personnel they supervise. The grammatical subject throughout is the management team and personnel, making this about roles rather than processes.


reasoning: The paragraph describes an actual cybersecurity incident (ransomware attack) with specific timing (late May 2023), scope (certain systems on the network), and response actions (engaging experts, law enforcement, containment and remediation).


reasoning: The paragraph describes the board's oversight role in cybersecurity risk management, including receiving annual reports from a cybersecurity committee on risks, threats, and program status.


reasoning: The paragraph focuses on the Chief Technology Officer's qualifications, career history, and credentials, which is about the person rather than the function. CTO and CIO are both cybersecurity-specific titles on the ✓ IS list, making this Firm-Specific.


reasoning: The paragraph focuses on the qualifications, experience, tenure, and responsibilities of specific management roles (CTO, DPI Head, SSA). The PERSON-VS-FUNCTION TEST indicates this is about the persons rather than just the function, as it details career history, specific accomplishments during tenure, and prior employment background.


reasoning: The Audit Committee is the grammatical subject of the first sentence and the primary focus is on board-level oversight through briefings and reports received from management. The CISO is mentioned in the context of their reporting function to the Audit Committee, not their personal qualifications.


reasoning: The paragraph describes the company's internal ISMS governance committee structure, its responsibilities for oversight and risk remediation, and reporting processes. While management roles (CSO, DPO) are mentioned, the focus is on what the committee and roles DO rather than on individual qualifications, meeting the function-over-person test for Risk Management Process.


reasoning: This paragraph describes the sources and nature of cybersecurity risk exposure (geographic scope, system complexity, threat actor interest, third-party dependencies) rather than disclosing governance structures, management roles, internal processes, or actual incidents. It functions as risk factor language explaining why the company faces cyber risks, not as substantive disclosure about cybersecurity program elements.


reasoning: The paragraph describes the company's internal risk management framework and its processes for identifying and estimating protective measures, which is a core risk management process disclosure.


reasoning: The paragraph describes an actual cybersecurity incident—a ransomware attack in October 2021—including the type of attack, timing, and material impact on the business, which constitutes incident disclosure.


reasoning: The paragraph describes the board-level Audit Committee's oversight authority over cybersecurity risks and the CISO's reporting relationship to that committee, making board governance the primary focus even though management roles are also mentioned.


reasoning: The paragraph describes the company's internal cybersecurity policies, processes, and risk management activities, including information security governance, IT asset management, and engagement with third-party cybersecurity providers as part of their overall strategy.


reasoning: The paragraph describes the company's internal cybersecurity program design and employee training initiatives, including security awareness training, quarterly exercises, and simulations. This is a description of the company's own internal processes for managing cyber risk.


reasoning: The paragraph describes the company's internal processes for integrating cybersecurity into risk management, including reporting cadences, report contents, and program evaluation procedures. The focus is on the processes and activities rather than on specific individuals or board oversight as the primary subject.


reasoning: The paragraph focuses on the CISO Drew Robertson as the grammatical subject, detailing his qualifications, career history, prior roles (Deputy CISO, NSA, US Army), and educational credentials—this is clearly about the person rather than the function.


reasoning: The paragraph focuses on the CIO as the primary grammatical subject, covering their role leading cybersecurity processes, reporting lines to the President and CFO, engagement with the Audit Committee, and prior work experience in information security and risk management.


reasoning: The paragraph focuses on identifying specific management roles (CIO, Senior Director of IT Governance, Senior Director of Global Infrastructure, Senior Information Security Architect) and their qualifications, credentials, and experience—this is about the persons and their backgrounds, not about processes or activities.


reasoning: The paragraph describes the company's internal cybersecurity processes including monitoring procedures, incident response protocols, team composition, and escalation procedures. The grammatical subject is 'We' (the company) describing its own risk management activities.


reasoning: The paragraph describes the company's internal monitoring and reporting processes for cybersecurity threats, including how the Risk Management Steering Committee, CFO, and GC oversee prevention, detection, and remediation. While it mentions individuals' experience, the focus is on what the committee does (monitoring, reporting) rather than specific person qualifications.


reasoning: The paragraph primarily describes the company's internal information security program, including organizational structure, security tools and technologies deployed, and reporting channels. While management roles are mentioned, they serve to explain how the risk management process functions rather than focusing on individual qualifications.


reasoning: The paragraph describes board and committee oversight of cybersecurity risks, with the Board of Directors, Audit Committee, Technology and Innovation Committee, and Governance Committee as the grammatical subjects throughout.


reasoning: The paragraph describes the company's internal incident response and vulnerability management processes, including escalation procedures and reporting lines. The grammatical subject is the company's processes, not the board or a specific management person.


reasoning: The paragraph identifies a specific management role (Vice President of Corporate Development & Administration) and describes their reporting responsibilities to the board on cybersecurity matters, making management the grammatical subject and primary focus.


reasoning: The paragraph describes the company's internal cybersecurity operations, team structure, and incident response processes. The focus is on what the team does (monitoring, prevention, detection, mitigation, remediation, reporting) rather than on individual qualifications, making this Risk Management Process under the person-vs-function test.


reasoning: The paragraph focuses on the qualifications and credentials of individuals responsible for cybersecurity - the CIO (management) and Strategy Committee Chair (board member with cyber expertise). While both management and board subjects appear, the CIO is identified as having primary responsibility for cyber risk management and is discussed first, making Management Role the primary classification. The Strategy Committee Chair's cyber expertise is highlighted but without describing board oversight activities.


reasoning: The paragraph describes Board and Audit Committee oversight of cybersecurity risks, including reporting cadences and briefing structures. The CIO and CISO are mentioned only in the context of their reporting duties to the Audit Committee, making this a governance-focused disclosure.


reasoning: This paragraph describes an actual cybersecurity incident that occurred in October 2023, including what happened (unauthorized access and download of user information from 23andMe.com accounts), when it occurred, and the specific response actions taken (password resets, two-factor verification implementation, new detection tools). This fits the Incident Disclosure category as it provides incident narrative and response actions for a real event.


reasoning: The paragraph describes an actual cybersecurity incident including what happened (systems affected, suspended), response actions (containment, restoration, remediation), and specific dates and costs. This fits Incident Disclosure as it describes the incident itself rather than just financial impact.


reasoning: The CISO is the grammatical subject describing reporting lines to the Risk Committee, which fits the Management Role category focused on reporting relationships. The Risk Committee is a named non-generic committee, and CISO is a cybersecurity-specific role, both qualifying as firm-specific facts.


reasoning: The paragraph describes the company's internal cybersecurity program, including its processes, departmental responsibilities, annual assessments, and engagement of third-party firms for benchmarking and testing. The focus is on the company's own risk management processes rather than board oversight, management qualifications, or incident disclosure.


reasoning: The paragraph opens with the CIO as the grammatical subject, detailing their qualifications (CISSP certification, senior technical leadership experience) and reporting line to the CEO. While subsequent sentences describe IT department processes under the CIO's direction, the primary focus is on introducing the management role and credentials.


reasoning: The paragraph describes the qualifications, credentials, and career history of multiple executives (CIO, Director of Cyber Security, Director of Technology Compliance), which is about the PERSON rather than what the role/program does, fitting the Management Role category per the person-vs-function test.


reasoning: This paragraph is purely biographical information about a Chief Corporate Officer whose role is not cybersecurity-specific, and the paragraph contains no cybersecurity content.


reasoning: The paragraph describes the company's Enterprise Risk Council and its risk management activities, including how cybersecurity risk is integrated into the council's identification, assessment, management, and monitoring processes. While the CISO is mentioned, the focus is on the council's function and processes rather than the CISO's qualifications or credentials.


reasoning: The paragraph describes the assessment, oversight, and review processes for the Cybersecurity Program, including internal audit activities, third-party reviews, and regulatory examinations, which constitutes risk management process disclosure.


reasoning: The paragraph describes management roles (CIO, Senior Director of Information Security) with specific qualifications including the CIO's 15 years of cybersecurity experience. While board governance elements (Audit and Risk Committee, Cybersecurity Infrastructure Committee) and risk management processes are also present, the management roles and detailed CIO qualifications are prominent, making Management Role the primary category.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including risk identification, monitoring, ERM integration, technical controls, and threat intelligence services. The focus is on the company's own processes and controls.


reasoning: The paragraph focuses on board oversight of cybersecurity risks and identifies specific board members by name with their cybersecurity expertise, making Board Governance the clear category with the board as the grammatical subject.


reasoning: The paragraph describes the company's internal cybersecurity assessment processes, including external audits, ISO 27001 certification activities, and penetration testing. This is about the company's own risk management processes rather than board governance, management roles, or third-party risk management.