reasoning: The paragraph focuses on management roles (CTO, General Counsel, SVP of IT & Security), their responsibilities, and their individual qualifications and years of experience, which fits the PERSON-VS-FUNCTION test for Management Role. Three specific numbers (17, 10, and 19 years of experience) constitute hard verifiable facts, meeting the Quantified-Verifiable threshold.


content_category: Risk Management Process

category_confidence: high

specificity_confidence: high

reasoning: The paragraph describes the Sponsor's internal cybersecurity risk management approach, including identification, assessment, and mitigation processes—classic Risk Management Process content. No specific facts from the ✓ IS list are present: 'Cybersecurity Policies and Procedures Plan' is a generic program name, 'industry standards and best practices' does not name a specific framework, and 'The Sponsor' and 'the Funds' are company self-references that do not count as specific facts.

provider: z-ai

stage: benchmark


content_category: Board Governance

reasoning: The paragraph focuses on the FE Board and its committees' oversight responsibilities for cybersecurity risk, with the Board and committees as the grammatical subjects throughout. The CISO is mentioned only in the context of reporting to these governance bodies.


reasoning: The paragraph describes the company's internal cybersecurity processes including incident response procedures and governance structure, with the Senior Director role mentioned in the context of coordinating cybersecurity initiatives rather than describing the person's qualifications.


reasoning: The Board and Audit Committee are the grammatical subjects receiving reports on cybersecurity risks, which constitutes board/committee oversight of cyber risk. No specific facts remain after filtering—'Audit Committee' is standard governance, 'quarterly' is a generic cadence, and 'management' is an unnamed role.


content_category: Strategy Integration

reasoning: This paragraph contains a materiality assessment stating that the company has not experienced material losses from cybersecurity incidents, discusses potential future business/financial impacts, and includes a forward-looking disclaimer about material adverse effects—all hallmarks of Strategy Integration. The cross-reference to Risk Factors does not change the classification.


content_category: Management Role

category_confidence: medium

reasoning: The paragraph identifies specific management roles (CRO, CIO, interim CISO) and their participation in the ERC, a management-level risk oversight forum. While it describes the ERC's function, the primary focus is on identifying who participates in cybersecurity governance rather than detailing processes or frameworks.


reasoning: The paragraph describes the company's internal cybersecurity program, including framework adoption (NIST), security controls, third-party oversight processes, and employee training—all core risk management activities.


reasoning: The paragraph focuses on the CIO/CISO as the grammatical subject, describing their qualifications (25+ years of experience) and responsibilities, which fits the Management Role category per the person-vs-function test.


reasoning: The paragraph describes the company's internal cybersecurity processes—ongoing knowledge acquisition, monitoring of information systems, and incident response procedures—rather than focusing on the CISO's personal qualifications. CISO is a cybersecurity-specific title that qualifies as a firm-specific fact.


reasoning: The paragraph describes management's activities and responsibilities for cybersecurity risk management—assessing risks, managing the program, and supervising consultants—which fits the Risk Management Process category under the person-vs-function test. No specific facts qualify for Firm-Specific: COO is generic C-suite (explicitly excluded), and 'external cybersecurity consultants' are unnamed entities.


reasoning: The paragraph briefly mentions the CFO's oversight responsibility but primarily describes the company's internal cybersecurity processes including protocols, policies, third-party assessments, incident response planning, and training programs. ISO 27001 is named as a framework the company aligns with, but no firm-specific facts like named CISO, specific dates, named third parties, or certification claims are present.


reasoning: The paragraph describes the company's internal cybersecurity risk management program—how the team prevents, detects, mitigates, and remediates risks through briefings, threat intelligence analysis, and security tool monitoring. While the SVP of IT is identified with qualifications, the PERSON-VS-FUNCTION test indicates the paragraph is primarily about what the program/team does rather than the person's credentials, as removing the title and experience would still leave a coherent description of the risk management process. The SVP of IT title qualifies as a cybersecurity-specific role under the IS list, making this Firm-Specific, but there are insufficient hard verifiable facts (no exact dates, named third-party firms, or named tools) to reach Quantified-Verifiable.


reasoning: The paragraph describes the Company's Cybersecurity Plan and its objectives for assessing, identifying, and managing cybersecurity risks, which constitutes the company's internal risk management processes.


reasoning: The Board of Directors and Audit Committee are the grammatical subjects throughout, describing their oversight role, briefing cadence, and review responsibilities for cybersecurity risk management.


reasoning: The paragraph describes the company's internal risk assessment process led by senior management, fitting Risk Management Process. It contains no specific facts, named frameworks, named roles, or unique identifiers—only generic language applicable to any company.


reasoning: The paragraph focuses on the qualifications and reporting lines of specific management personnel (VP of IT and CFO), including their years of experience and career backgrounds, which fits the Management Role category per the person-vs-function test.


content_category: Third-Party Risk

reasoning: The paragraph's central topic is vendor oversight—discussing cybersecurity partners, outsourced monitoring, and contractual requirements imposed on third parties—rather than internal processes with a brief vendor mention. No named firms, frameworks, specific dates, or verifiable facts appear; the language could apply to any company's third-party risk management.


reasoning: The paragraph describes the company's internal governance processes for cybersecurity oversight, including the establishment of an Information Security Council, Executive Information Security Committee, reporting lines between the CEO and CISO, and quarterly incident review processes. This fits Risk Management Process as it details the company's own internal processes rather than focusing on board expertise or individual management qualifications.


content_category: None/Other

reasoning: This paragraph consists of a section header followed by general background about the cybersecurity threat landscape (hackers, nation-state actors, social engineering). It does not describe the company's governance, processes, incidents, or strategy—only general threat types that apply to any company.


reasoning: The paragraph focuses on the CIO's reporting structure and professional qualifications, with governance context in the first two sentences. The CIO is a cybersecurity-specific title, and the 20+ years of experience is a specific duration, making this Firm-Specific but not Quantified-Verifiable since named roles don't count toward QV threshold.


specificity_confidence: medium

reasoning: The paragraph's central topic is oversight of third-party service providers, describing pre-engagement and periodic risk assessments specifically applied to vendors to ensure security standards are maintained.


reasoning: The paragraph focuses on management roles (CIO, CISO) with substantial detail about their qualifications, credentials, and experience, triggering the Person-vs-Function Test for Management Role.


reasoning: The paragraph's central purpose is a materiality conclusion stating the company is not aware of any material risks from cybersecurity threats that have affected or are reasonably likely to materially affect the company. Under the tiebreakers, materiality disclaimers are classified as Strategy Integration even when boilerplate.


reasoning: The paragraph focuses on the qualifications, credentials, and career backgrounds of specific cybersecurity leadership (CISO and the SVP from Inmarsat), making it about the PERSON rather than the function per the person-vs-function test. Multiple firm-specific facts include the CISO title, 31 years of experience, the SVP Global Security role, and UK Ministry of Defence background, but none meet the Quantified-Verifiable threshold (no dates, dollar amounts, headcounts, named third-party firms, or named tools).


reasoning: The paragraph describes Board and Audit Committee oversight of cybersecurity, including reporting cadences (annual to full Board, quarterly to Audit Committee) and the flow of cybersecurity information to the Board.


reasoning: The paragraph focuses on governance structure with the Board and Audit Committee as the primary subjects in three of five sentences, establishing oversight responsibility and describing the information flow from management to the Board.


reasoning: The paragraph identifies specific management roles (CIO, CTO, Information Security Officer) and describes their committee participation and reporting lines to the board. The Information Technology Steering Committee is a named non-generic committee, and the cybersecurity-specific titles qualify as firm-specific facts, but no hard verifiable facts (dates, dollar amounts, headcounts, named third-party firms, or named tools) reach the Quantified-Verifiable threshold.


reasoning: The paragraph describes the company's internal cybersecurity processes including incident response plans, business continuity management, testing exercises, and internal reporting structures. The grammatical subject is 'We' and the focus is on what the company's processes do, not on board oversight or management roles.


reasoning: The paragraph's central topic is vendor oversight - it describes the company's third-party risk management program, due diligence processes, ongoing monitoring, and incident notification requirements imposed on third-party service providers.


reasoning: The paragraph primarily describes Board and committee oversight mechanisms—the CIO's reporting to the Audit Committee, Board members' ability to raise concerns, and escalation of material incidents to the Board. While the CSIRP mention relates to incident response processes, it is framed in terms of Board reporting and oversight, making Board Governance the dominant theme.


reasoning: The Audit Committee is the grammatical subject throughout the paragraph, which describes its oversight role, briefing cadence, and engagement with the CISO on cybersecurity risk management.


reasoning: The Audit Committee is the grammatical subject throughout, and the paragraph describes its oversight activities including receiving quarterly reports, engaging with management on cybersecurity topics, and reviewing audit results.


reasoning: The paragraph describes the company's internal cybersecurity processes: employee training requirements, cyber insurance, and procedures for reviewing contracts with third-party vendors. The vendor mention is a component of internal processes rather than the central topic.


reasoning: This paragraph is a standalone materiality conclusion stating that cybersecurity threats have not materially affected the company and are not reasonably likely to do so, which fits the Strategy Integration category per the tiebreaker rules. The language is entirely boilerplate with no specific facts, dates, named entities, or unique details.


reasoning: The Board is the grammatical subject throughout, describing oversight responsibilities, quarterly briefings, participation in exercises, and review of third-party assessments. No specific facts are present—'quarterly' is a generic cadence, 'Board' and 'executives' are generic roles, and 'third-party cybersecurity assessments' references unnamed entities.


reasoning: The paragraph describes the company's internal risk management strategy, including assessment tools (third-party assessor, internal audits, tabletop exercises, penetration testing) and reporting processes. This is a clear description of the company's own cybersecurity risk management processes.


reasoning: This is a SPAC (blank check company) explicitly stating it has no operations, no personnel, and no cybersecurity processes of its own - the absence of a program is not a description of a program, per the SPAC/shell company tiebreaker rule.


reasoning: The paragraph describes the company's internal process for how management monitors and stays informed about cybersecurity incidents, including through notifications from service providers and communications with ISP personnel. This is about the monitoring function rather than identifying specific management roles or qualifications.


content_category: Incident Disclosure

reasoning: This paragraph describes an actual cybersecurity incident (ransomware attack in May 2022), including what happened, when, the scope of impact, and response actions taken. The incident narrative with dates and response details clearly fits Incident Disclosure.


reasoning: The paragraph primarily describes the company's internal cybersecurity processes including the IS Program, Incident Response Team, and incident response plan, with brief mentions of Board oversight and CISO qualifications. The CISO cybersecurity-specific title makes it Firm-Specific.


reasoning: This paragraph describes an actual cybersecurity incident with specific details about what happened (ransomware), when (July 2018), scope (Dx IT systems and other operational systems), and investigation findings regarding data exfiltration.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including ERM integration and program oversight structure. The focus is on what the company does rather than on individual qualifications.


reasoning: This paragraph describes an actual cybersecurity incident at a third-party vendor (AMCA), including the notification date, nature of the incident, and affected data (personal information of patients), which constitutes incident disclosure.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, specifically the composition and responsibilities of the CSWAT team in managing cyber incidents, risks, and controls.


reasoning: The paragraph describes the company's internal incident response planning process, including protocols, team structure, and testing exercises. This is about what the company's cybersecurity program does rather than board oversight, management qualifications, or a specific incident.


reasoning: The paragraph focuses on the CIO's qualifications (25+ years experience), reporting structure (reports to Senior Vice President and General Counsel), and incident response responsibilities, making a management role the grammatical subject throughout.


reasoning: This paragraph describes an actual cybersecurity incident including the timing (fourth quarter of fiscal 2025), nature of the event (unauthorized activity on IT systems), response actions (activated incident response plan, took systems offline), and operational/business impacts (order fulfillment disruption, reduced sales, increased costs). The specific fiscal quarter reference provides one firm-specific fact, but without additional verifiable details like exact dates, dollar amounts, or named third parties, it does not reach Quantified-Verifiable.


reasoning: This paragraph describes an actual cybersecurity incident with specific details including the timing (April 2022), scope (hospital operations disruption, patient information exfiltration), and response actions (Security Operations Center enhancements, new tools and processes).


reasoning: The paragraph focuses on identifying management roles (VP/CIO, Director of Information Security), their qualifications, reporting lines, and committee leadership—classic Management Role content. It contains multiple hard verifiable facts: two specific numbers (27 years of experience for each role) and two named credentials (Doctor of Business Administration, degree in Information Technology Management), meeting the Quantified-Verifiable threshold per the calibration example for years of experience plus certifications.


reasoning: While the CIO and General Counsel are the grammatical subjects, the paragraph's substance describes the company's internal cybersecurity processes being reviewed (metrics, insurance, backup testing, incident response, training) rather than the qualifications or reporting lines of the individuals themselves. The PERSON-VS-FUNCTION test indicates this is about what the program does, not who the people are.


reasoning: The paragraph describes the company's internal incident response workflow, including how the IRT escalates threats to the CIEC for materiality assessment and potential Board notification. This is a description of the company's own internal processes for handling cybersecurity threats.


reasoning: This paragraph describes an actual cybersecurity incident with details about timing, scope (data exfiltration including employee PII), operational impact, and response actions, which clearly qualifies as Incident Disclosure.


reasoning: This paragraph contains only forward-looking risk disclaimers about potential future cybersecurity incidents and a cross-reference to Risk Factors, with no substantive disclosure about governance, processes, or actual incidents.


reasoning: The paragraph focuses on the Chief Security Officer as the grammatical subject, detailing their responsibilities, reporting lines, tenure (11+ years), prior experience (10+ years in banking), and committee membership. This is clearly about the person and their qualifications rather than internal processes.


reasoning: The paragraph describes the company's internal cybersecurity processes including monitoring tools, incident response policy, team structure, and employee training. The VP Infrastructure is mentioned in context of overseeing the process, not describing the person's qualifications.


reasoning: The paragraph describes the company's internal incident response planning processes, including CIRT strategies, forensic data preservation, and third-party monitoring procedures. The CIO is mentioned in the context of what the role does (assesses third parties), not the person's qualifications, so this is about the function rather than the person.


reasoning: The paragraph describes the company's cybersecurity risk management program and the frameworks/standards that guide it, including certification maintenance and attestation pursuits.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes including threat assessment, security tools, SOC operations, incident response protocols, vulnerability management, and framework adoption. The grammatical subject throughout is the company and its organizational units (SOC, CSIRT) describing what they DO.


reasoning: The paragraph describes Everest's internal cybersecurity processes including threat assessment, security tools, SOC operations, incident response protocols, and testing methodologies. The company's own processes are the central topic throughout.


reasoning: This paragraph is a materiality disclaimer stating that cybersecurity threats have not materially affected the company, followed by forward-looking risk language—both classic Strategy Integration content per the guidelines. The language is entirely boilerplate with no specific facts, dates, named entities, or firm-specific details.


reasoning: The paragraph describes how cybersecurity risk management is integrated into the company's overall risk management framework through regular reporting processes from the ITSC and CIO to the Board, making it about the company's internal risk management processes rather than focusing on the qualifications or identity of the CIO as a person.


reasoning: The paragraph references a real cybersecurity incident (the 2017 Equifax breach), describing when it occurred, the nature of the attack, and the scope of affected consumers across three countries. The forward-looking risk language follows the incident disclosure but does not negate the substantive incident description.


reasoning: The paragraph describes the company's enterprise risk management program and how cybersecurity risks are assessed, managed, and integrated into the broader ERM framework. The 'risk management steering committee' is a named non-generic committee that qualifies as a firm-specific fact, distinguishing this from generic boilerplate.


reasoning: This paragraph describes the scope and impact of an actual cybersecurity incident, including what systems were affected (back-office), what data was exfiltrated (PII, bank account information), and the company's response actions (regulator cooperation, notices, credit monitoring).


reasoning: This paragraph describes an actual cybersecurity incident with specific details: the MOVEit security incident at Umpqua Bank in May 2023, response actions (immediate removal and decommissioning, engagement of forensics firm), scope (no customer information or bank data obtained), and operational impact (no business interruption).


reasoning: The Audit Committee is the grammatical subject throughout most of the paragraph, with the disclosure focusing on the Committee's direction of cybersecurity activities, receipt of reports, meetings with the CIO, and reporting to the Board. While the CIO's expertise is mentioned, the primary focus is on the governance structure and oversight cadence.


reasoning: The paragraph describes the company's internal process for designing and assessing their cybersecurity program using recognized frameworks (ISO and NIST), which constitutes a risk management process disclosure. It names specific recognized standards but contains no facts unique to Ziff Davis, making it Sector-Adapted.


reasoning: The paragraph describes the company's comprehensive cybersecurity program across multiple areas (governance, technical safeguards, incident response, third-party risk management, education), which constitutes internal risk management processes. Third-party risk is one component of the broader program, not the central topic.


reasoning: This paragraph describes an actual cybersecurity incident that occurred in November 2022, including what happened (attack on network systems), scope (PII of employees, customers, and investors accessed), response actions (containment, restoration, notifications), and legal aftermath (class action lawsuits and dismissal).


reasoning: The paragraph describes the company's internal cybersecurity risk management program and its integration with enterprise risk management, which is a classic Risk Management Process disclosure. No specific facts are present—no named frameworks, roles, dates, tools, or unique identifiers—making it generic boilerplate that could apply to any company.


reasoning: The paragraph describes the company's internal cybersecurity program processes, including third-party assessments, penetration testing, and vendor oversight as components of their risk management approach. No named frameworks, specific dates, named third-party firms, or cybersecurity-specific roles appear—only generic references to 'third parties,' 'third party consultants,' and 'IT Management' that could apply to any company.


reasoning: This paragraph describes an actual cybersecurity incident that occurred in March 2021, including the incident narrative, response actions (engaging forensic firms, restoring systems), and operational/business impacts (brewery operations disruptions, production delays, $2.4 million in costs).


reasoning: The paragraph identifies specific management roles (Acting CISO and Acting CIO), their qualifications (30+ years combined experience), and reporting lines. While the ERMC is mentioned, the primary focus is on management personnel and their responsibilities rather than board governance or internal processes.


reasoning: The paragraph focuses on the qualifications and credentials of specific individuals (Mr. Madigan and Mr. James) and the collective experience of the InfoSec Leadership Team, which is about the persons rather than the processes they oversee.


reasoning: The paragraph identifies specific management roles serving on the ISO Committee and describes the Chief Risk Officer's qualifications (25 years of experience), making it about management roles and credentials rather than processes or board oversight.


reasoning: The paragraph describes Board and Audit Committee oversight responsibilities for cybersecurity risk management, with both the Board and Audit Committee as grammatical subjects responsible for oversight and ensuring management processes are in place.


reasoning: The paragraph describes the company's internal processes for assessing and managing cybersecurity risks, including a cross-functional committee structure, meeting cadence, escalation processes, and monitoring protocols. The CIO is mentioned as a committee member, but the focus is on what the committee and processes do, not on the person's qualifications.


reasoning: The paragraph describes the company's internal cybersecurity program including department structure, controls, monitoring tools, training, and framework adoption. The grammatical subject is the IT department and the company's processes, not individual management qualifications or board oversight.


reasoning: Management roles (Executive Officer and Vice President of Technology) are the grammatical subject, describing their reporting function to the Board regarding cybersecurity matters. The Vice President of Technology is a cybersecurity/IT-specific title that qualifies as a firm-specific fact.


reasoning: This paragraph is a materiality disclaimer stating that no cybersecurity incident has materially affected the company, which the guidelines explicitly classify as Strategy Integration even when boilerplate. The cross-reference to Risk Factors does not change the classification.


reasoning: The paragraph's primary focus is on management roles—the CISO and CRO—detailing their reporting lines, qualifications, certifications, and responsibilities. While board governance and risk management processes are mentioned, they serve to describe the management structure rather than being the central topic.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including formation of a Risk Management Committee, vulnerability and penetration testing, and use of third-party security vendors as part of their security program.


reasoning: The paragraph describes the company's risk evaluation process and reporting structure for cybersecurity risks. While the CTO is mentioned as reporting to the board, the PERSON-VS-FUNCTION TEST indicates this is about what the role does (processes, reporting activities) rather than the person's qualifications, making it Risk Management Process. The CTO title is explicitly listed as a cybersecurity-specific role on the ✓ IS list, and BDT & MSD is a named entity distinct from the company, yielding Firm-Specific.


reasoning: The paragraph describes the company's internal cybersecurity risk management program and its key elements, including risk assessments, departmental responsibilities, specific toolkits, training, and incident response planning. The grammatical subject is the company's information security program and its components.


reasoning: The paragraph describes the qualifications, credentials, and career history of management personnel (CISO, CIO, CRO, CEO, General Counsel), focusing on the PERSON rather than what the role/program does, which classifies as Management Role per the person-vs-function test.


reasoning: The CISO is the grammatical subject and the paragraph describes the CISO's reporting lines to various committees and management, which falls under Management Role. The CISO title and the named Technology Risk Management Committee are firm-specific facts, but neither constitutes a hard verifiable fact (date, dollar amount, headcount, named third-party firm, or named product) required for Quantified-Verifiable.


reasoning: The paragraph describes the company's internal cybersecurity program (WISP) and its processes including assessments, framework adoption, and security activities, which clearly fits Risk Management Process. It names the NIST Cyber Security Framework as a recognized standard, but contains no firm-specific facts beyond generic program elements.


reasoning: The paragraph's central topic is vendor and service provider oversight, including selection criteria and contractual security requirements imposed on third parties.


reasoning: This is a fragment of an enumerated list (items g and h) describing topics for consideration rather than providing substantive disclosure about actual governance, processes, or strategy. It contains no factual information about the company's cybersecurity program.


reasoning: The paragraph describes the company's internal processes for assessing, identifying, and managing cybersecurity risks, including various controls and mechanisms. The third-party security program is mentioned as one component of the overall risk management approach, not as the central topic.


reasoning: Management roles (Chief Business Officer, Chief Accounting Officer, Head of Legal) are the grammatical subjects, describing their cybersecurity responsibilities and oversight structure. The named 'Cybersecurity Risk Management Committee' is a specific non-generic committee that distinguishes this disclosure from boilerplate.


reasoning: The paragraph describes AFG's general approach to assessing, identifying, and managing cybersecurity risks, which constitutes a risk management process disclosure. It contains no named frameworks, specific roles, dates, or any other firm-unique facts - only generic statements about cyber threats that could apply to any company.


reasoning: The paragraph focuses entirely on vendor assessment, selection criteria, and controls imposed on third parties (access limitations, data usage restrictions, deletion requirements), making Third-Party Risk the appropriate category. It contains no named frameworks, specific roles, dates, named vendors, or verifiable facts—only general descriptions that could apply to any company.


reasoning: The paragraph focuses on identifying specific individuals (Katherine Dowling and Hong Kim), their titles, qualifications, and career backgrounds responsible for cybersecurity oversight, which is the hallmark of Management Role disclosure. The paragraph is about the persons and their credentials rather than describing processes or activities.


reasoning: This paragraph describes SEC regulatory requirements and the purpose behind new disclosure rules, not the company's actual cybersecurity practices, governance, or incidents. It is explanatory context about what the rules require rather than substantive disclosure about EAWD's cybersecurity program.


reasoning: The paragraph identifies the VP of Informatics as the leader of cybersecurity efforts, describes their qualifications (20+ years of IT experience), and details their oversight of the Informatics department including the cybersecurity team, which fits the Management Role category focused on role identification and qualifications.


reasoning: The paragraph discusses the company's security procedures and controls and acknowledges the cybersecurity threat landscape they are managing, which fits Risk Management Process. However, it contains no specific facts—no named frameworks, roles, dates, tools, or verifiable details—making it generic boilerplate that could appear in any bank's disclosure.


reasoning: The paragraph describes the company's internal risk management processes, specifically how it uses third-party consultants to support security testing and assessments. This fits Risk Management Process because the third parties are engaged to assist with the company's own systems, not to oversee vendor security.


reasoning: The paragraph describes an actual incident involving erroneous payments made in October 2023, including the scope (three invoices, two recovered, one unrecoverable) and response actions (management investigation, material weakness conclusion). The specific date (October 2023) combined with specific numbers (three invoices, two payments) provides two or more hard verifiable facts.


reasoning: This paragraph contains a materiality disclaimer stating no cybersecurity incidents materially affected the Company during the specified period, which falls under Strategy Integration per the guidelines. The cross-reference to Risk Factors does not change the classification since the paragraph includes a materiality conclusion.


reasoning: This paragraph is a general company business description with no cybersecurity-related content; it describes the company's stage and therapeutic focus areas.


reasoning: This is a SPAC (blank check company) explicitly stating it has no operations and no cybersecurity program, personnel, or processes of its own. Per the category tiebreaker, SPACs stating they have no operations or formal processes are classified as None/Other regardless of incidental mentions of board oversight or risk acknowledgment.


reasoning: The paragraph's central topic is vendor oversight—describing a dedicated Third-Party Risk Management Program and the five stages of evaluating third-party service providers. The program name is descriptive rather than a unique identifier, and no named frameworks, specific dates, roles, or verifiable facts appear.


reasoning: The paragraph describes the company's cybersecurity organizational structure, governance committees, framework alignment with NIST, training program, and security tools. Using the person-vs-function test, this is about what the cybersecurity function does rather than about the persons themselves (no qualifications or credentials mentioned), fitting Risk Management Process.


reasoning: The paragraph describes the company's internal cybersecurity training program for personnel, which is a risk management process. It contains no specific facts—no named frameworks, dates, roles, tools, or named third parties—and could apply to any company.


reasoning: The Audit Committee is the primary grammatical subject throughout the paragraph, describing its oversight role over cybersecurity risks and the CISO's reporting to it, which constitutes board governance content.


reasoning: The paragraph primarily describes Board and audit committee oversight of cybersecurity risk management, with the Board as the grammatical subject of the opening sentence and reporting flows to the audit committee and Board emphasized throughout. The Principal Accounting Officer directing cybersecurity programs is unusual but presented within the governance structure rather than focusing on qualifications.


reasoning: The paragraph centers on the Vice President of Information Technology as the key individual responsible for cybersecurity monitoring and incident reporting, describing their role and organizational position rather than detailed processes or personal qualifications.


reasoning: The paragraph describes the company's internal cybersecurity risk management framework, including how business units organize their cybersecurity programs and reporting structures. It contains no specific facts from the IS list—no named cybersecurity-specific roles, frameworks, dates, products, or verifiable details—making it generic boilerplate that could apply to any company.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes including training, assessments, incident response planning, vulnerability management, and access controls. The detailed team composition for the incident response team (IT, information security, finance, risk management, investor relations, and legal) constitutes a firm-specific fact.


reasoning: This paragraph describes the company's internal cybersecurity risk management measures and mitigation activities, which is the core definition of Risk Management Process. The paragraph contains no named frameworks, specific roles, dates, products, third parties, or other firm-specific facts—it lists only generic security practices that could appear in any company's disclosure.


reasoning: The paragraph describes the company's internal cybersecurity processes including training, layered defenses, monitoring, and testing—all classic risk management activities with no board, management role, or incident as the focus.


reasoning: The paragraph focuses on management oversight with the VP, Global Cybersecurity as the grammatical subject, describing their qualifications (CISSP certification, 20+ years experience), reporting lines to CIO and CEO, and their role chairing the Cybersecurity Management Committee.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including the information security team's day-to-day responsibilities, escalation procedures, and use of third-party tools. No specific facts qualify under the IS list—CEO, CFO, and COO are generic C-suite roles, 'nationally recognized third parties' are unnamed, and no named frameworks, specific dates, or quantified details appear.


reasoning: This paragraph describes the company's internal cybersecurity risk management processes, listing various technical, physical, and organizational measures they implement. All items mentioned are generic security practices with no named frameworks, specific roles, dates, or unique identifiers.


reasoning: The paragraph describes the company's internal cybersecurity program activities—threat assessment, monitoring, protective measures, incident response planning, and employee training—which are classic risk management process elements. No specific facts remain after filtering: the company name doesn't count, 'third-party cybersecurity experts' are unnamed, and all mentioned practices (penetration testing, firewalls, virus scanning, incident response plan) are generic common practices without named frameworks, tools, dates, or quantified details.


reasoning: The paragraph describes the company's internal cybersecurity monitoring processes, including security metrics, control assessments, and detection activities, which are core risk management functions.


reasoning: The paragraph contains a materiality conclusion stating the company has not encountered cybersecurity threats that materially impaired operations, with a cross-reference to Risk Factors. Per the tiebreaker rules, materiality disclaimers with appended cross-references classify as Strategy Integration, not None/Other.


reasoning: The paragraph describes the company's internal cybersecurity incident response procedures, cross-functional coordination approach, and organizational structure for managing cyber threats, which constitutes risk management process disclosure. It achieves Firm-Specific specificity through the named 'Incident Response Committee' (a non-generic committee) and the specific departmental composition of the cross-functional team.


reasoning: The paragraph describes the company's internal incident reporting protocols and communication processes, which falls under risk management processes. While the Board is mentioned as a recipient of updates, the focus is on the reporting protocols themselves rather than Board oversight activities.


reasoning: The paragraph describes board committee (CyTOC) oversight activities including briefing cadence, topics covered, and information flows to the full Board, with CyTOC as the primary grammatical subject throughout.


reasoning: This paragraph contains a materiality conclusion stating no material cybersecurity incidents have occurred, followed by forward-looking risk disclaimer language about potential material effects on business strategy, results of operations, and financial condition—both of which fall under Strategy Integration per the guidelines.


reasoning: This is a forward-looking risk disclaimer stating the company has not experienced material incidents and cannot guarantee future immunity—standard boilerplate language with no substantive disclosure about governance, processes, or actual events.


reasoning: The paragraph describes the company's internal cybersecurity governance processes—document review cycles, strategic planning, and reporting workflows—making it Risk Management Process. The CISO title, Audit & Risk Committee (a named non-generic committee), and named internal governance documents (Charter, Policy, Program Plan) establish Firm-Specific disclosure, but there are no two hard verifiable facts like specific dates, dollar amounts, or named third-party firms to reach Quantified-Verifiable.


reasoning: The paragraph describes the governance and reporting structure for cybersecurity risk management, culminating in the Board Risk Committee which is explicitly identified as 'primarily responsible for overseeing risk management, including risks associated with cybersecurity.' While management roles and internal reporting processes are detailed, the ultimate focus is on board-level oversight. The specificity is Firm-Specific due to the CISO title (cybersecurity-specific role) and named committees (Risk Management Council, Board Risk Committee) that go beyond generic governance structures.


reasoning: The paragraph is primarily a materiality disclaimer stating that cybersecurity risks have not materially affected the company's business strategy, results of operations, or financial condition, with a brief general acknowledgment of past incidents and a cross-reference to Risk Factors.


reasoning: The Audit Committee is the primary grammatical subject throughout, describing its oversight responsibilities for cybersecurity risks and the briefing cadence with the CISO. The paragraph contains firm-specific facts including the CISO role, specific year 2023, and four meetings, but only one QV-qualifying fact (the date).


reasoning: The paragraph primarily describes oversight structure and reporting lines: the CFO directs cybersecurity programs, incidents are reported to the board, and the Audit Committee receives periodic updates. The Board of Directors and Audit Committee serve as grammatical subjects in key sentences, making Board Governance the primary category. The specific year '2024' in the incident statement provides one firm-specific fact, but no named frameworks, cybersecurity-specific roles, or other verifiable details are present to reach Quantified-Verifiable.


reasoning: The paragraph primarily identifies and describes the qualifications of specific management roles (CISO and UScellular SVP of IT) responsible for cybersecurity, including their experience (over twenty years) and incident response accountability. While it includes incident response process elements and a materiality disclaimer, the grammatical subject and main focus remains on the management personnel and their qualifications.


reasoning: The board of directors is the grammatical subject and the paragraph describes board oversight of cybersecurity risk mitigation efforts, fitting Board Governance. The language is entirely generic with no named roles, committees, frameworks, dates, or other specifics that would distinguish this disclosure.


reasoning: The paragraph describes the company's internal escalation and incident response processes, with management as the grammatical subject reporting to the Audit Committee and Board. All elements are generic boilerplate—Audit Committee is a standard committee, 'incident response plan' is a generic program name, and there are no named frameworks, cybersecurity-specific roles, dates, or other firm-specific facts.


reasoning: The paragraph describes the company's internal processes for evaluating and implementing safeguards following risk assessments, which is characteristic of Risk Management Process. The brief mention of IT leadership reporting to the CEO does not shift the category since 'IT leadership' is not a specific cybersecurity role and CEO is a generic C-suite title.


reasoning: The paragraph describes the company's internal risk assessment processes as part of its cybersecurity program, which is a core risk management activity. It contains no specific facts—no named frameworks, cybersecurity-specific roles, dates, tools, or verifiable details—just generic descriptions of common security practices.


reasoning: The paragraph describes Audit Committee oversight activities related to IT systems and information security, which constitutes board governance. Audit Committee is explicitly a standard/generic committee on the NOT list, and all other elements (management, IT systems, information security program, compliance, controls) are generic boilerplate terms with no firm-specific details.


reasoning: This is a pure cross-reference directing readers to the Risk Factors section with no substantive cybersecurity disclosure content.


reasoning: The paragraph describes the company's internal cybersecurity risk management structure, including how risks are identified, assessed, monitored, and mitigated. While it references the Board and Principal Accounting Officer, the focus is on the processes and governance structure rather than board oversight as the primary topic or individual qualifications.


reasoning: The paragraph describes the company's internal incident response procedures, including escalation paths to management and committees, which constitutes a Risk Management Process disclosure about how the company handles cybersecurity incidents.


reasoning: The paragraph describes the company's overall cybersecurity risk management approach, including threat landscape awareness, resource commitment, regulatory compliance, and framework adoption, without focusing on a specific governance body or management role as the primary subject.


reasoning: This paragraph describes an actual cybersecurity incident—an email spoofing attempt in May 2014—including what happened, when, and the response outcome, which fits the Incident Disclosure category. The specific date 'May 2014' provides one firm-specific fact, but with only one hard verifiable fact, it does not reach the Quantified-Verifiable threshold.


reasoning: This paragraph is purely a cross-reference directing readers to Risk Factors sections in Item 1A, with no substantive disclosure about cybersecurity governance, processes, or incidents.


reasoning: The paragraph describes the company's internal processes for providing cybersecurity support and conducting assessments for its Affiliates, including pre-investment diligence reviews. The Affiliates are mentioned as a component of the company's risk management activities rather than as the central topic of vendor oversight requirements.


reasoning: The paragraph contains a materiality conclusion stating the company is not aware of cybersecurity incidents that have materially affected or are reasonably likely to materially affect them, plus mentions cyber insurance, which falls under Strategy Integration per the category guidelines for materiality assessments and insurance.


reasoning: This paragraph describes an actual cybersecurity incident at a third-party vendor (Fortra) that affected the company, including details about the attack method (zero-day vulnerability), scope of data accessed (PHI and PII), and response actions taken (engaged outside experts, provided notifications). The presence of a specific date (fiscal 2023), named third-party firm (Fortra, LLC), and named product (GoAnywhere) provides three hard verifiable facts.


reasoning: The paragraph focuses on board-level cybersecurity oversight, discussing the Technology & Cybersecurity Committee composition and director training to enhance cybersecurity understanding.


reasoning: The Board is the grammatical subject, describing its risk oversight function and delegation of cybersecurity oversight to executive officers. No cybersecurity-specific roles (CISO, CTO, CIO), named frameworks, or other firm-specific facts appear—only generic governance roles and program names.


reasoning: The paragraph describes the company's internal cybersecurity risk management framework, including threat assessment processes, mitigation strategies, employee training, vulnerability assessments, and monitoring mechanisms—classic Risk Management Process content. All elements are generic: no named frameworks (NIST, ISO, etc.), no specific roles (CISO), no named third parties, no dates, and common practices like 'security awareness training' and 'vulnerability assessments' that could apply to any company.


reasoning: The paragraph focuses centrally on vendor oversight as its main topic, describing processes for managing third-party risks including risk ratings, data classification mapping, and ensuring vendor adherence to cybersecurity standards. No specific facts, named frameworks, or verifiable details appear—only generic practices that could apply to any company.


reasoning: The paragraph describes the company's internal cybersecurity risk assessment and management processes, including how management and the IT team implement these processes and the executive team's responsibilities. Using the person-vs-function test, this is about what the roles DO (hiring, budgeting, approving processes) rather than about the persons themselves, so it is Risk Management Process not Management Role. No specific facts remain after filtering—CEO and CFO are generic C-suite roles, Board of Directors is generic governance, and no named frameworks, dates, cybersecurity-specific titles, or verifiable numbers appear.


reasoning: The paragraph describes the company's internal training program infrastructure and process for integrating acquired companies, which falls under risk management processes. However, it contains no specific facts from the IS list - LMS is a generic software category, not a named product, and the training program description is boilerplate that could apply to any acquiring company.


reasoning: The paragraph focuses primarily on the CIO's role, reporting lines, qualifications, and support structure, with Board oversight mentioned only briefly as the recipient of quarterly reports. Three cybersecurity-specific roles (CIO, Director of IT Security, vCISO) and a quantified experience claim provide firm-specific detail.


reasoning: The paragraph describes the company's internal cybersecurity risk management program and its components (risk assessments, security team, external providers, security tools, training, incident response plan, third-party risk management), which is a textbook Risk Management Process disclosure. No named frameworks, specific dates, named roles, named products, named third-party firms, or other firm-specific facts appear—only generic program elements that could apply to any company.


reasoning: This is a SPAC (special purpose acquisition company) explicitly stating it has no business operations and no cybersecurity risk management program. Per the guidelines, SPACs and shell companies stating they have no operations or no formal processes are classified as None/Other, as the absence of a program is not a description of a program.


reasoning: The paragraph focuses on management roles—the CISO's reporting line and the VP of Platform and Technology Services' qualifications, credentials, and career history—making it about the PERSON rather than processes or functions.


reasoning: The Chief Technology Officer is the grammatical subject throughout, with disclosure of reporting lines (to CEO), qualifications (25+ years experience), and role responsibilities. The paragraph focuses on the person and their position rather than describing internal processes independent of the role holder.


reasoning: The paragraph describes the company's internal risk management processes—enterprise security assessments and regular reporting mechanisms—rather than board governance activities or management qualifications. The CISO title qualifies as firm-specific, while 'Audit Committee' and 'regular' cadence are generic.


reasoning: The paragraph's second sentence has management roles (Manager of Information Technology, Chief Operating Officer) as grammatical subjects and emphasizes their qualifications (years of experience), which triggers the Person-vs-Function test for Management Role.


reasoning: The paragraph identifies management roles responsible for cybersecurity (executive officers, third-party consultant) and describes the qualifications and background of the Security Operations Center Manager, focusing on the people and their credentials rather than specific processes or frameworks.


reasoning: The CISO is the grammatical subject throughout, and the paragraph focuses on the person's qualifications (20+ years experience, multiple named certifications) and reporting lines, which fits the Management Role category per the person-vs-function test.


reasoning: The CISO is the grammatical subject and the paragraph describes the role's reporting relationships to management and escalation paths to the Board, making this about the management role's structure rather than board governance processes. The CISO title is a cybersecurity-specific role and the Compliance Committee is a named non-generic committee, both qualifying as firm-specific facts.


reasoning: The paragraph describes the company's risk management program structure and processes, including how senior management assesses risks and how the CISO identifies cybersecurity risks and collaborates with risk owners. While management roles are identified, the focus is on what these roles DO within the risk management process rather than on individual qualifications or credentials, making Risk Management Process the appropriate category under the Person-vs-Function Test.


reasoning: The paragraph focuses on identifying management roles (ISO, Chief Risk Officer, Chief Information Officer) and detailing the qualifications and credentials of cybersecurity team members, which fits the Management Role category per the person-vs-function test.


reasoning: This paragraph is a cross-reference to Risk Factors that discusses materiality assessments of cybersecurity threats and their potential impact on business strategy, results of operations, and financial condition. Under the guidelines, materiality conclusions and disclaimers fall under Strategy Integration, and a cross-reference appended to materiality language does not change the classification to None/Other.


reasoning: This is a SPAC explicitly stating it has no business operations and has not adopted any cybersecurity risk management program or formal processes. Per the guidelines, SPACs stating they have no operations or formal processes should be classified as None/Other regardless of incidental mentions of board oversight.


reasoning: The paragraph is entirely focused on vendor oversight processes including vendor code of conduct, questionnaires, due diligence, and contractual security terms, making third-party risk the central topic rather than a component of internal processes.


reasoning: The paragraph's central topic is the company's reliance on third-party SaaS providers and the security standards (SSAE audits) those vendors maintain, which constitutes vendor oversight rather than internal processes.


reasoning: The paragraph describes the company's internal process of briefing management to prepare them for cybersecurity risk assessment, which falls under risk management activities. The mention of third-party providers having experience is incidental and does not constitute vendor oversight as the central topic.


reasoning: The grammatical subject is 'These members of management' and the paragraph describes their reporting lines to the Information Technology Steering Committee and Board, which fits the Management Role category. However, there is some ambiguity because the paragraph also describes management's monitoring activities within the risk management process, which could suggest Risk Management Process under the person-vs-function test.


reasoning: The paragraph focuses on the CISO's qualifications, experience, responsibilities, and reporting structure, with the CISO as the primary grammatical subject throughout most of the paragraph. The PERSON-VS-FUNCTION test indicates Management Role when qualifications and credentials are the focus.


reasoning: The paragraph describes the company's internal cybersecurity training and testing processes, including a named internal program (TT&E) and a specific NIST publication standard, which constitutes risk management process disclosure with firm-specific details.


reasoning: The paragraph describes board and Audit Committee oversight of cybersecurity matters, with the board and Audit Committee as the grammatical subjects throughout. The disclosure includes cybersecurity-specific titles (SRC Director and CIO) that identify unique aspects of this company's governance structure.


reasoning: The paragraph describes Board and Audit Committee oversight of cybersecurity risk, with the Board and Audit Committee as the primary grammatical subjects. No firm-specific facts are present—CFO is a generic C-suite role, Audit Committee is a standard committee, and 'quarterly' is a generic cadence without exact dates.


reasoning: This is a SPAC explicitly stating it has no business operations, no cybersecurity risk management program, and no formal processes for assessing cybersecurity risk, which falls under the None/Other category per the explicit instruction for SPACs and shell companies.


reasoning: This paragraph describes the company's internal incident response processes, including triage, escalation, containment, investigation, and remediation activities, which fits the Risk Management Process category. The language is entirely generic—no named frameworks, specific roles, dates, or unique identifiers—and could apply to any company's incident response plan.


reasoning: The paragraph describes the Bank's internal cybersecurity risk management framework, including defense-in-depth controls, ERM integration, and various mitigation activities—all of which constitute the company's own internal processes for managing cyber risk. No named frameworks, specific dates, roles, or verifiable facts appear; all program names (Information Security program, Cybersecurity Incident Response Plan, business continuity management program) are generic terms that could apply to any company.


reasoning: This paragraph contains only a forward-looking disclaimer about potential future cybersecurity threats and a cross-reference to Risk Factors, with no substantive disclosure about the company's cybersecurity governance, processes, or actual incidents.


reasoning: This paragraph describes an actual cybersecurity incident—a business email compromise resulting in theft of cryptocurrency—with specific details about what happened, the scope (26 BTC, $560,000), and response actions (engaging law enforcement). The disclosure contains two hard verifiable facts: the specific amount stolen (26 BTC) and the dollar value ($560,000), meeting the Quantified-Verifiable threshold.


reasoning: The paragraph describes the Company's cybersecurity program structure and its key areas (governance and collaborative approach), which constitutes the company's own internal risk management processes. The CIO is a cybersecurity-specific title that qualifies as a firm-specific fact.


reasoning: The paragraph describes the company's internal security governance structure for evaluating and addressing cyber risk, which fits Risk Management Process. The CFO and Board are mentioned only in relation to oversight of this structure, not as the primary subject. No specific facts remain after filtering—CFO is a generic C-suite role, Board is generic governance, and 'security governance structure' is a generic program name.


reasoning: This paragraph describes an actual cybersecurity incident involving stolen Bitcoin, the forensic investigation by a third-party firm, and response actions including a specific payment, making it an Incident Disclosure with two verifiable facts (specific date and dollar amount).


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including assessment, detection, vulnerability management, and third-party oversight. While third parties are mentioned, they are a component of the internal process rather than the central topic, so this falls under Risk Management Process per the tiebreaker rules.


reasoning: The paragraph focuses on Board and Audit Committee oversight responsibilities, director cybersecurity expertise, and reporting structures from management to the committee. Contains two hard verifiable facts: specific headcount (Two Directors) and named certification (CERT designation from NACD/Carnegie Mellon program).


reasoning: The paragraph describes internal cybersecurity processes (risk assessment, security controls, incident response) managed by a security team, which fits Risk Management Process. It contains no named frameworks, specific roles, dates, or unique identifiers—only generic descriptions applicable to any company.


reasoning: The paragraph describes the company's internal incident response plan (IRP) and cybersecurity program design, which are risk management processes. It names the NIST Cybersecurity Framework as the basis for program design, but contains no firm-specific facts beyond the named standard.


reasoning: The paragraph describes integrating cybersecurity into enterprise risk management processes, which is a clear example of risk assessment and ERM integration under Risk Management Process. It contains no specific facts, named frameworks, or unique identifiers that would distinguish it from boilerplate language any company could use.


reasoning: The paragraph focuses on a management committee (Information Technology Steering Committee) and identifies specific management roles (CIO, CTO, Information Security Officer) who comprise it, along with the ISO's reporting line to the board. The named committee and cybersecurity-specific titles qualify as firm-specific facts, but there are no hard verifiable facts (dates, dollar amounts, headcounts, named third-party firms, or named tools) to reach Quantified-Verifiable.


reasoning: This paragraph is a pure cross-reference directing readers to Risk Factors in Item 1A for materiality discussions, with no substantive cybersecurity disclosure contained within it. It does not make any materiality conclusions itself—it merely points to where such information can be found.


reasoning: The paragraph describes the company's enterprise risk management process, framework adoption (Secure Controls Framework, NIST, ISO), and cybersecurity program objectives—core elements of internal risk management processes. While Board and management are mentioned, they serve to introduce the ERM discussion rather than being the primary focus.


reasoning: The paragraph focuses on the CIO's designation, qualifications (20+ years of experience), and detailed responsibilities for implementing and maintaining the Incident Response Plan, making the management role the grammatical subject and primary focus.


reasoning: This paragraph contains a standalone materiality conclusion stating that cybersecurity incidents have not materially affected the company's business strategy, results of operations, or financial condition, which per the guidelines falls under Strategy Integration even when boilerplate. The cross-reference to Risk Factors does not change the classification.


reasoning: This paragraph is a materiality disclaimer stating that no cybersecurity threats or incidents have materially affected the company, followed by a forward-looking risk qualifier and a cross-reference to Risk Factors. Per the guidelines, materiality disclaimers are classified as Strategy Integration even when boilerplate.


reasoning: The paragraph describes an actual cybersecurity incident—a May 2020 ransomware attack in which a cybercriminal removed data from the company's self-hosted environment—along with the resulting legal proceedings, which clearly fits Incident Disclosure.


reasoning: The paragraph describes the company's internal cybersecurity program components (authentication, training, encryption, vulnerability scanning, phishing simulations) which fits Risk Management Process. It contains no named frameworks, specific cybersecurity roles, dates, named vendors, or any firm-specific details—only generic security practices that could apply to any company.


reasoning: The paragraph describes the company's internal governance structure for cybersecurity oversight, including the IT Steering Committee's composition and functions, and the IT manager's reporting line to the Risk Management committee. This constitutes a description of internal risk management processes rather than board-level governance or individual management qualifications.


reasoning: The paragraph describes the company's internal Information Security Program, including its leadership structure (CISO) and oversight committees (TIRC, Management Risk Committee), along with the program's objectives and methods. This is a classic Risk Management Process disclosure focused on the company's own internal processes for safeguarding information assets.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes across technical safeguards, incident response planning, third-party risk oversight, and employee training. It contains no specific facts, named frameworks, or verifiable details—only generic descriptions of common security practices that could apply to any company.


reasoning: This paragraph contains a materiality disclaimer stating that cybersecurity risks have not materially affected the Bank's business strategy, financial condition, or results of operations, which is classified as Strategy Integration per the guidelines. The language is entirely boilerplate with no specific facts, named frameworks, or firm-unique details.


reasoning: The paragraph describes the organizational structure and team composition that oversees the company's cybersecurity risk management processes, which fits Risk Management Process. The grammatical subject is the processes themselves, not individual management roles or qualifications.


reasoning: The paragraph primarily describes AFG's ERM program structure and how cybersecurity risk is integrated into it, including the management committee (ERC) and Enterprise Risk Officer oversight. The director's cybersecurity credentials at the end support governance but are not the main focus; the ERM integration is the central topic.


reasoning: This is a materiality disclaimer stating that no cybersecurity incidents have materially affected the company, which falls under Strategy Integration per the guidelines. The cross-reference to Risk Factors does not change the classification.


reasoning: The paragraph focuses on the qualifications, experience, and reporting lines of specific individuals (senior vice president, finance and accounting and senior IT consultant) rather than describing cybersecurity processes or activities, making it Management Role under the person-vs-function test.


reasoning: The paragraph describes the company's internal cybersecurity processes—risk assessments and incident response planning—which are core risk management activities. It contains no specific facts, named frameworks, or unique identifiers; the language is entirely generic and could apply to any company.


reasoning: This paragraph is a general acknowledgment statement about the importance of cybersecurity without describing any specific governance structure, management role, risk management process, third-party oversight, incident, or strategy integration. It contains no substantive disclosure and could appear in any company's filing unchanged.


reasoning: This paragraph describes an actual cybersecurity incident (phishing attack) with specific details about what happened, when it occurred (April 28, 2023), the scope ($54,300), and response actions (investigation, fund recovery, implementation of new controls).


reasoning: The paragraph focuses on the CIO's qualifications, career history, and reporting relationships, which fits the PERSON-VS-FUNCTION TEST for Management Role. The ISMS Committee is described in relation to the CIO's oversight structure rather than as a standalone risk management process.


reasoning: The paragraph focuses on board and Audit Committee oversight of cybersecurity risks, including reporting cadences, update content, and incident escalation procedures. The VP of Information Technology is a cybersecurity-specific title, and the specific functional composition (legal, finance, corporate governance) provides firm-specific detail, but no hard verifiable facts like dates, amounts, or named third parties reach the Quantified-Verifiable threshold.


reasoning: The paragraph describes the company's internal governance structure and processes for managing cybersecurity risk, including reporting lines, committee oversight (ERM Committee, GLT), and review processes (ARB, PMO). Multiple named internal bodies and a cybersecurity-specific title (Chief Information Technology Officer) establish firm-specificity, but no hard verifiable facts like dates, amounts, or named external parties reach the Quantified-Verifiable threshold.


reasoning: The Audit Committee is the primary grammatical subject, and the paragraph describes the board committee's oversight responsibilities and the information flow it receives from management, making board governance the central topic.


reasoning: The paragraph describes the audit committee's oversight role in receiving cybersecurity briefings from management and updating the Board, with the audit committee as a key grammatical subject.


reasoning: This paragraph discusses cyber insurance and potential financial exposure from cybersecurity incidents, which falls under Strategy Integration as it addresses business/financial impact and insurance matters without describing any specific incident or internal processes.


reasoning: The paragraph describes the Committee's cybersecurity oversight structure, including the CTO's reporting cadence to the Committee and the Committee's reporting to the full Board. While the CTO is the grammatical subject of the first two sentences, the overall focus is on board committee oversight of cyber risk rather than management qualifications, making Board Governance the appropriate category.


reasoning: This paragraph describes hypothetical cybersecurity risk scenarios and their potential consequences (data breaches, service disruption, IP theft, costs) without discussing governance, management roles, internal processes, vendor oversight, or actual incidents. It is forward-looking risk factor language, not substantive disclosure of the company's cybersecurity program or an actual event.


reasoning: The paragraph describes the company's internal incident response process (Management Team reporting to Board) and acknowledges their current cybersecurity posture and resource limitations as an early-stage company.


reasoning: The paragraph focuses on management personnel—the chief risk officer and interim chief information officer—including their committee participation and professional qualifications. The named non-generic committees and CIO role provide firm-specific facts, but years of experience alone do not reach the Quantified-Verifiable threshold.


reasoning: The paragraph describes the company's internal post-incident review process, including reassessment of cybersecurity programs and reporting procedures, which constitutes risk management process disclosure.


reasoning: The paragraph provides a materiality conclusion about past cybersecurity threats not having significant impact, followed by forward-looking materiality language about potential future effects on business strategy, results of operations, and financial condition.


reasoning: This paragraph contains a materiality conclusion stating that no known cybersecurity risks are reasonably likely to materially affect the company, plus a statement confirming no material incidents occurred in specified fiscal years. Per the tiebreaker rules, materiality disclaimers and conclusions fall under Strategy Integration even when boilerplate in nature.


reasoning: The paragraph contains a materiality conclusion stating the company has not experienced a material cybersecurity incident, which falls under Strategy Integration per the guidelines. The cross-reference to Risk Factors appended to this materiality assessment does not change the classification.


reasoning: Management is the grammatical subject, and the paragraph describes management's responsibilities and reporting lines to the Board, which fits the Management Role category's focus on reporting structure.


reasoning: The paragraph contains a materiality disclaimer stating that cybersecurity risks have not materially affected the company's business strategy, results of operations, or financial condition, which falls under Strategy Integration per the category guidelines. The brief mention of past breaches is general and lacks incident-specific details.


reasoning: This paragraph describes an actual cybersecurity incident with specific details about what happened (data extraction from IT systems), when (December 2022), scope (employee personal data), and response actions (investigation, containment protocols, third-party experts).


reasoning: The paragraph describes the company's internal cybersecurity processes including firewall solutions, patch management, internal cloud infrastructure, and backup procedures. No named frameworks, specific dates, named products/tools, named third-party firms, cybersecurity-specific roles, or other firm-specific facts appear—only generic technology descriptions and standard practices.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including technical controls, monitoring systems, training, and framework adoption, with the company's own processes as the grammatical subject.


reasoning: The paragraph describes the company's use of third-party partners as a component of its internal cybersecurity risk management strategy, detailing the monitoring and security services they provide. This fits Risk Management Process because the partners are integrated into the company's own processes rather than being the subject of vendor oversight requirements.


reasoning: The paragraph describes the company's internal processes for identifying, assessing, and managing cybersecurity threats, listing various methods and tools used in their risk management program.


reasoning: This paragraph contains a materiality disclaimer stating that cyber risks have not materially affected business strategy, operations, or financial condition, which falls under Strategy Integration per the tiebreaker rules. The cross-reference to Risk Factors does not change the classification.


reasoning: The Board of Directors is the grammatical subject throughout, and the paragraph describes how the Board administers cybersecurity risk oversight both directly and through the Audit Committee.


reasoning: The paragraph describes the company's internal incident response structure, team composition, and testing processes - focusing on what the program does rather than a specific person's qualifications.


reasoning: The paragraph describes the company's internal processes for cybersecurity training, professional development, and knowledge maintenance, which fits Risk Management Process. It contains multiple named certifications (GIAC, CompTIA, ISC2, CERT) that constitute hard verifiable facts per the calibration examples, plus named industry groups (FS-ISAC, American Bankers Association, Mid-Sized Banking Coalition of America).


reasoning: This is a SPAC (Constellation Acquisition Corp I) explicitly stating it has not adopted any cybersecurity risk management program or formal processes. Per the guidelines, SPACs and shell companies stating they have no operations or no formal processes are classified as None/Other regardless of incidental mentions of board oversight or risk acknowledgment.


reasoning: The paragraph describes an internal risk governance structure (Engineering Risk Steering Group) and its oversight activities, which constitutes a risk management process. The CISO is mentioned in a functional capacity as chair, not in terms of personal qualifications.


reasoning: The paragraph describes the company's internal processes for integrating cybersecurity into its enterprise risk management program, including annual reviews and reporting to the Board.


reasoning: The paragraph describes the technology team's activities—defining work plans, setting improvement objectives, implementing investments, and maintaining security maturity—rather than focusing on the Director's personal qualifications. The brief mention of the Director's experience is secondary to describing the team's ongoing processes.


reasoning: The CISO (a management role) and Cybersecurity Committee are the grammatical subjects, and the paragraph describes their oversight responsibilities and information flows rather than detailing the internal processes themselves. CISO is a cybersecurity-specific title and Cybersecurity Committee is a named non-generic committee, both qualifying as firm-specific facts.


reasoning: The paragraph describes the company's internal structure for cybersecurity risk management, including delegation of responsibilities to the General Partner and Investment Manager, and reliance on the parent company Blackstone for assessing, identifying, and managing cybersecurity risks.


reasoning: The paragraph describes the company's internal incident management processes, including response policies, materiality determination procedures, and disclosure timelines. This is about the company's own internal processes for handling cybersecurity incidents, not an actual incident disclosure.


reasoning: This paragraph contains a materiality disclaimer stating that no cybersecurity threats or prior incidents have materially affected or are reasonably likely to materially affect the company, which the guidelines explicitly classify as Strategy Integration even when boilerplate. The cross-references to Risk Factors do not change the classification.


reasoning: The paragraph describes the company's internal cybersecurity program, including its design approach, framework adoption (NIST), and risk management activities such as training, monitoring, and assessments.


reasoning: The paragraph focuses on the CIO's reporting responsibilities and professional qualifications (20+ years of experience), with board oversight mentioned as the audience for the CIO's reports rather than as the primary subject.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including team composition, oversight structure, and monitoring activities. While it mentions qualifications of the leaders, the primary focus is on the process and activities rather than specific individuals.


reasoning: The paragraph focuses on the VP of Information Technology as the grammatical subject, describing their reporting responsibilities, incident response coordination role, and professional qualifications (25+ years of experience). Board oversight is mentioned but is secondary to the management role description.


reasoning: The paragraph identifies a specific management role (Senior Principal Security and Infrastructure Architect) and describes the individual's qualifications and experience, making this about the person rather than the processes themselves.


reasoning: This is a materiality disclaimer stating no cybersecurity threats materially affected the company, which falls under Strategy Integration per the guidelines. The language is standard boilerplate that could appear in any company's filing, with no unique facts about LendingClub.


reasoning: The paragraph describes Board and Audit Committee oversight of cybersecurity, including reporting structures and continuing education, with the Board and its committee as the grammatical subjects.


reasoning: The paragraph describes the company's internal processes for identifying and assessing cybersecurity risks, including monitoring methods, threat assessments, and vulnerability assessments. While management roles are mentioned briefly, the focus is on what the roles do (the function) rather than the persons themselves.


reasoning: The paragraph profiles three IT/security executives with their qualifications, certifications, and years of experience—clearly fitting Management Role as it describes the persons rather than processes. Multiple hard verifiable facts (specific years of experience: 24, 28, 20; named certifications: CISA, CRISC, Series 99) exceed the two-fact threshold for Quantified-Verifiable.


reasoning: This is a standalone materiality disclaimer stating that no cybersecurity risks have materially affected the company, which falls under Strategy Integration per the category guidelines for materiality conclusions without incident narrative.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes and ERM integration without any specific frameworks, named roles, dates, or unique details. All references (Board of Directors, Audit Committee, enterprise risk management program) are generic and could apply to any company.


reasoning: The paragraph describes the company's internal processes for monitoring and managing cybersecurity incidents, which fits Risk Management Process. Third-party service providers are mentioned only as a component of internal monitoring, not as the central topic.


reasoning: The paragraph describes the company's comprehensive approach to managing cybersecurity risks, including policies, standards, processes, and the establishment of a Security Steering Group as part of the risk management program. While Board and Audit Committee oversight is mentioned, the primary focus is on the internal risk management processes rather than governance structure alone.


reasoning: The paragraph focuses on the CISO as the grammatical subject, describing their responsibilities, team composition, and personal qualifications including tenure (13 years with the company) and experience (over 20 years in cybersecurity).


reasoning: This paragraph describes an actual cybersecurity incident—a business email compromise attack—detailing what happened (threat actor impersonated CFO in email thread), the scope (26 BTC worth approximately $560,000), and response actions (engaged US Federal law enforcement).


reasoning: The paragraph describes the company's internal IT risk identification process and risk register, which is a classic Risk Management Process disclosure. No specific facts are present—no named frameworks, specific roles, dates, tools, or unique identifiers—making it generic boilerplate that could apply to any company.


reasoning: This paragraph contains a materiality disclaimer stating that cybersecurity risks have not materially impacted the company's operations, business strategy, or financial results, which is classified as Strategy Integration per the guidelines. The language is entirely boilerplate with no specific facts, named frameworks, or unique details.


reasoning: The paragraph focuses on management roles—the CIO and CISO—with detailed qualifications, credentials, and tenure for the CIO, while board oversight is presented as context for how management reports to the Board and Audit Committee.


reasoning: The paragraph describes the board's oversight mechanism for cybersecurity, including how the board and Audit Committee receive updates on cybersecurity programs, risks, and mitigation strategies. Although management (COO) is the grammatical subject providing updates, the main focus is on the board's oversight process and briefing cadence, with the specific detail that Audit Committee updates will begin in 2024.


reasoning: This paragraph describes response actions to an actual cybersecurity incident involving stolen BTC, including forensic investigation, findings that the threat actor did not enter via Gryphon's systems, control system modifications, and specific financial remediation. The presence of a specific date (June 30, 2023) and a specific dollar amount ($560,000) provides two hard verifiable facts.


reasoning: This paragraph is a materiality disclaimer stating that cybersecurity risks have not materially affected the company's operations, business strategies, or financial results, which falls under Strategy Integration per the guidelines. It contains no specific facts—only generic references to 'the Company,' 'cybersecurity program,' and a cross-reference to Risk Factors.


reasoning: The paragraph describes the responsibilities and activities of an internal management-level committee that oversees the company's cybersecurity program, which constitutes the company's own internal risk management processes rather than board governance or individual management roles.


reasoning: The paragraph covers both board governance (ERM Committee, director expertise) and management roles (CSO, team qualifications), but the management portion is more extensive with detailed qualifications and certifications, making Management Role the appropriate category under the tiebreaker rules. The ERM Committee and Chief Security Officer are firm-specific facts, while the named certifications alone constitute only one type of hard verifiable fact, falling short of the two distinct types needed for Quantified-Verifiable.


reasoning: The paragraph describes a management-level Information Security committee, its composition of named C-suite roles, and its oversight activities, which fits the Management Role category focused on identification of management roles and their cybersecurity responsibilities.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including how senior executives and an IT Managed Service Provider work together to protect systems and respond to incidents. The MSP is mentioned as a component of the internal process rather than the central topic of vendor oversight.


reasoning: The paragraph describes the company's internal cybersecurity processes for risk identification, assessment, mitigation, and employee training, but contains no named frameworks, specific dates, named tools/products, headcounts, or other verifiable facts that would distinguish it from any other company's disclosure.


reasoning: The paragraph describes the company's internal cybersecurity programs and their alignment with the NIST Cybersecurity Framework, which constitutes risk management process disclosure. It names a recognized framework (NIST CSF) but contains no facts unique to this company beyond the company's own brand name, placing it at Sector-Adapted.


reasoning: This paragraph describes an actual cybersecurity incident with specific dates (October 28, 2023 announcement, mid-December 2023 recovery), operational impact (shipping disruptions), and financial costs ($1.5 million), meeting the Incident Disclosure criteria for describing what happened, when, scope, and response actions.


reasoning: The paragraph describes the composition of a management-level committee responsible for technology and operations oversight, which is part of the company's internal risk management organizational structure. The named committee (Technology and Operations Committee), cybersecurity-specific roles (CIO, CISO), and specific departmental composition make this Firm-Specific.


reasoning: The paragraph describes a management role (SVP of IT) and their reporting function to senior management on cybersecurity matters, fitting the Management Role category for reporting lines. The Person-vs-Function test creates some ambiguity since it describes an activity (briefings), but the focus is on the reporting relationship rather than the underlying risk management processes.


reasoning: The paragraph focuses on the CSO's responsibilities and qualifications, with the CSO as the grammatical subject in two of three sentences. The Executive Committee's evaluation of the CSO's expertise is mentioned briefly in support of establishing the CSO's qualifications, making this a Management Role disclosure.


reasoning: The paragraph describes the company's internal cybersecurity processes—engaging external firms for security engineering, assessments, and audits—which fits Risk Management Process. No named firms, frameworks, dates, or specific details appear; 'leading cybersecurity firms' is an unnamed entity reference that does not qualify as a specific fact.


reasoning: The paragraph emphasizes the management team's qualifications and credentials (combined years of experience, track record, adeptness) rather than describing specific risk management processes, making it about the person rather than the function under the person-vs-function test.


reasoning: The paragraph contains a materiality conclusion stating that cybersecurity risks have not materially affected the company's business strategy, results of operations, or financial condition, which falls under Strategy Integration per the tiebreaker rules. The cross-reference to Risk Factors appended to the materiality assessment does not change the classification.


reasoning: The paragraph focuses on the CISO's qualifications, reporting structure, and team composition, which is about the person rather than the function, making it Management Role under the person-vs-function test.


reasoning: The CIO is the grammatical subject throughout, and the paragraph focuses on the person's role, reporting lines, and extensive qualifications/experience (over two decades in cybersecurity functions), which fits the Management Role category per the person-vs-function test.


reasoning: The paragraph describes the company's internal cybersecurity processes including IT operations, security monitoring enhancements, risk assessments, and controls development. The mention of third-party risk identification is a component of internal processes rather than the central topic.


reasoning: The paragraph describes the company's internal information security processes for identifying, assessing, and managing cybersecurity risks to their systems and data, which is a classic Risk Management Process disclosure.


reasoning: The paragraph describes the company's internal processes for vulnerability management, security testing, and remediation tracking—core risk management activities. It contains no named frameworks, specific dates, named roles, or other firm-specific details; the practices described could apply to any technology company.


reasoning: The paragraph focuses on the qualifications and professional certifications held by the Vice President of Risk Management and other security personnel, which is about the person's credentials rather than the function or process.


reasoning: This is a standalone materiality disclaimer stating that no cybersecurity threats have materially affected or are reasonably likely to materially affect the company's business strategy, results of operations, or financial condition. Per the guidelines, materiality disclaimers of this type are classified as Strategy Integration even when boilerplate, and the appended cross-reference to Risk Factors does not change the classification.


reasoning: This paragraph contains a standalone materiality conclusion stating the company has not been materially impacted by cybersecurity threats or incidents, followed by forward-looking disclaimer language. Under the tiebreaker rules, materiality disclaimers about business strategy, results of operations, or financial condition fall under Strategy Integration even when boilerplate.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes including incident response planning, governance structure, framework adoption, and supply chain risk oversight. No specific facts qualify under the IS list—FDA and SEC are regulatory bodies applicable to many companies, not unique firm facts, and no named frameworks, roles, dates, or third-party firms are disclosed.


reasoning: The paragraph describes the Audit Committee's oversight responsibilities for cybersecurity, its quarterly briefing cadence with management, and member expertise, with the Board and Audit Committee as grammatical subjects. The CIO is a cybersecurity-specific title that qualifies as a firm-specific fact per the IS list.


reasoning: This is a materiality disclaimer stating that cybersecurity threats have not materially affected the Company, which falls under Strategy Integration per the guidelines. The paragraph contains no specific facts—only boilerplate materiality language and a cross-reference to Risk Factors.


reasoning: This paragraph describes response actions to a disclosed cybersecurity incident, including notification to affected parties, remediation services, and legal consequences. The 1.3 million consumer count is a specific verifiable fact, but only one hard fact is present, falling short of the Quantified-Verifiable threshold.


reasoning: This paragraph describes an actual cybersecurity incident with a specific date, detection details, and response actions taken, which clearly fits the Incident Disclosure category.


reasoning: The paragraph describes the company's internal cybersecurity training and awareness programs, including onboarding requirements and phishing testing, which are core risk management processes.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including risk assessments, monitoring, third-party input, and escalation procedures. The specific team composition of personnel involved in oversight makes this firm-specific.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes including risk identification, assessment approaches, and defensive activities, with no named frameworks, specific roles, dates, or other firm-specific details.


reasoning: The paragraph describes the Fund's internal process for identifying and overseeing cybersecurity risks, including the roles involved (CCO, Investment Adviser personnel). While third parties are mentioned, the focus is on the Fund's internal oversight mechanism rather than vendor requirements or contractual standards.


reasoning: This paragraph is primarily a materiality assessment stating that cybersecurity threats have not materially affected the company's business strategy, results of operations, or financial condition. Per the guidelines, materiality disclaimers are classified as Strategy Integration even when boilerplate, and the appended cross-reference to Risk Factors does not change this classification.


reasoning: This paragraph describes an actual cybersecurity incident (the CDK attack) with specific dates, the named third-party provider affected, scope of systems impacted, response actions taken, and operational consequences—meeting all criteria for Incident Disclosure.


reasoning: The paragraph describes the company's internal management committee structure for cybersecurity risk management, including the IT Steering Committee and IT Subcommittee—their composition, meeting cadence, and responsibilities. This is about internal governance processes rather than board oversight, individual qualifications, or incident disclosure.


reasoning: The paragraph describes the company's internal incident identification, assessment, and response processes, with the VP of IT and IT security team as the actors. No named frameworks, specific dates, named products/tools, or cybersecurity-specific titles from the IS list appear—'VP of IT' is a general IT role, 'SIEM partner' is an unnamed vendor category, and 'incident response plan' and 'Audit Committee' are generic terms.


reasoning: The paragraph describes the board committee's oversight responsibilities for cybersecurity, with the Risk and Compliance Oversight Committee as the grammatical subject, which clearly fits the Board Governance category.


reasoning: The paragraph describes the company's enterprise-wide information security program and the processes, technologies, and controls used to identify, assess, and manage cybersecurity risks. The CISO is mentioned in the context of managing the program, not about their qualifications, so this is about the function rather than the person.


reasoning: This paragraph is a materiality disclaimer stating that no cybersecurity incidents have materially affected the company, followed by a cross-reference to Risk Factors. Under the guidelines, materiality disclaimers are classified as Strategy Integration even when boilerplate.


reasoning: The paragraph's central topic is the company's third-party service provider management program, including contract reviews and due diligence processes for vendors, which fits the Third-Party Risk category as vendor oversight is the primary focus rather than a component of broader internal processes.


reasoning: The paragraph describes the structure, composition, and oversight activities of a cybersecurity sub-committee established by the audit committee with board representation, making it a board governance disclosure focused on committee-level cyber oversight.


reasoning: The paragraph describes the company's internal information security processes for identifying, assessing, and managing cybersecurity risks to their systems and data, which is a classic Risk Management Process disclosure. It contains no named frameworks, specific roles, dates, numbers, named tools, or other firm-specific facts—only generic descriptions of what they protect and that they maintain security processes.


reasoning: The paragraph describes the company's internal risk management structure, including an ERM committee and a dedicated cybersecurity committee that oversees the cybersecurity program, with the CTO serving as a member and providing quarterly updates—this is about organizational processes rather than individual qualifications or board-level oversight.


reasoning: The paragraph identifies specific cybersecurity and privacy leadership roles (CSO and CPO) and describes their collective qualifications and experience, which is characteristic of Management Role disclosure focused on the persons and their credentials rather than processes.