reasoning: The paragraph describes the company's internal cybersecurity risk management processes, specifically the Information Security Department's responsibilities for day-to-day risk management and developing security controls. No specific frameworks, named certifications, cybersecurity-specific titles (CISO/CIO/CTO), dates, or other firm-specific facts are mentioned—the language is generic and could apply to any company with a security department.


content_category: Board Governance

category_confidence: high

specificity_confidence: high

reasoning: The paragraph describes Board and committee oversight structures for cybersecurity risk, with the Board, Nominating and Governance committee, and Audit Committee as grammatical subjects. The Nominating and Governance committee is a named non-generic committee that qualifies as a firm-specific fact.

provider: z-ai

stage: benchmark


content_category: Management Role

reasoning: The paragraph focuses on the qualifications, credentials, education, and career history of specific management personnel (CTO and VPCS), making it about the persons rather than processes. Contains multiple hard verifiable facts including specific years of experience (25, 20, 10 years) and named professional certifications (CISSP, CISM, CISA), meeting the Quantified-Verifiable threshold.


reasoning: The paragraph primarily focuses on the CISO role, including the individual's qualifications (25+ years experience), start date (January 2025), reporting structure to the CTO and CEO, and the history of the position including the prior CISO departure in October 2024 and interim arrangement. While Audit Committee oversight is mentioned, the main subject is the management role and personnel details.


content_category: Risk Management Process

reasoning: The paragraph describes the company's internal processes for preventing, detecting, mitigating, and remediating cybersecurity risks, including briefings, threat intelligence sources, and security tools—clearly fitting Risk Management Process.


reasoning: The paragraph describes board and Audit Committee oversight of cybersecurity risk, with the Board and Committee as the primary grammatical subjects receiving updates from management. No specific facts from the IS list are present—VP of Strategic Initiatives and CFO are generic business roles, Audit Committee is standard, and cadences are vague ('as needed', 'as appropriate').


reasoning: The paragraph describes the company's internal cybersecurity processes: tabletop exercises to test incident response, incident response procedures, and preparedness activities. The cyber insurance mention is secondary to the primary focus on incident response processes.


reasoning: The Board and Audit Committee are the grammatical subjects throughout, describing oversight structure, reporting cadence, and topics covered in cybersecurity briefings—classic board governance disclosure.


content_category: Third-Party Risk

reasoning: The paragraph's central topic is oversight of third-party service providers, describing questionnaires and annual reviews of attestation reports—requirements imposed ON vendors rather than internal processes. No specific facts are present: no named frameworks, firms, tools, dates, or cybersecurity-specific roles.


reasoning: The paragraph describes Board oversight of cybersecurity with the Board of Directors as the primary grammatical subject receiving updates and discussing risk management with senior management. It contains only generic governance language with no specific facts, named cybersecurity roles, dates, frameworks, or firm-specific details.


content_category: Strategy Integration

specificity_confidence: medium

reasoning: This is a materiality disclaimer stating no cybersecurity incidents had material impact during the specified fiscal year, which falls under Strategy Integration per the guidelines. The specific fiscal year date (December 31, 2023) provides one firm-specific fact, but not enough for Quantified-Verifiable.


reasoning: The paragraph's central topic is vendor oversight—describing security risk assessments performed ON third-party providers and security requirements imposed ON them—which fits Third-Party Risk rather than internal Risk Management Process. No named frameworks, specific roles, dates, or other firm-specific facts appear; the language is entirely generic and could apply to any company using third-party service providers.


reasoning: The paragraph describes the company's internal cybersecurity risk management program elements, including risk assessments, security team responsibilities, training, incident response planning, and third-party risk processes. No specific facts, named frameworks, dates, or verifiable details are present—only generic descriptions of common security practices that could apply to any company.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including ERM integration and framework adoption. It names NIST CSF as a recognized standard but contains no facts unique to this company beyond the framework reference.


category_confidence: medium

reasoning: The paragraph describes how management (CISO and CRO) supports the Board and risk committee's cybersecurity oversight responsibilities, including reporting cadence and escalation processes. While CISO and CRO are grammatical subjects, the focus is on board/committee oversight structure rather than management qualifications or internal risk processes.


reasoning: The Audit Committee is the grammatical subject throughout, and the paragraph describes its oversight responsibilities, meeting practices, and the quarterly briefing cadence from the chief security officer on cybersecurity risks.


reasoning: The paragraph describes the company's internal cybersecurity risk management program components including vulnerability management, third-party expert engagement, training, and vendor oversight processes.


reasoning: This paragraph addresses business/financial impact of cybersecurity risks, includes a materiality conclusion stating no incidents have materially affected the company, and discusses cyber liability insurance coverage—all hallmarks of Strategy Integration.


reasoning: The paragraph describes the company's internal cybersecurity processes including monitoring, security measures, system audits, and incident response planning. Per the Person-vs-Function Test, the content focuses on what the roles DO (processes and activities) rather than the persons' qualifications, making this Risk Management Process. CISO is a cybersecurity-specific title that qualifies as a firm-specific fact.


reasoning: The paragraph describes the company's internal processes for identifying, assessing, and managing cybersecurity risks, with the CTO mentioned in a supporting role rather than as the grammatical subject. The CTO title qualifies as a cybersecurity-specific role, and the 20 years of experience provides a specific duration, but named roles do not count toward Quantified-Verifiable threshold.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including framework integration, a security points of contact program, and a security council with specific composition and meeting cadence.


reasoning: The paragraph describes the overall risk management governance structure but focuses most specifically on the Director of Information Security's role, reporting line to the CIO, and committee memberships. Per the tiebreaker rule, management roles as the main focus with brief board oversight mention yields Management Role classification.


reasoning: The audit committee (a board committee) is the grammatical subject throughout, and the paragraph describes its oversight activities, reporting relationships, and briefing cadence regarding cybersecurity risks.


reasoning: This paragraph consists primarily of materiality disclaimers stating the company has not experienced material cybersecurity incidents and is not aware of material threats, which falls under Strategy Integration per the guidelines. The cross-reference to Risk Factors appended to the materiality assessment does not change the classification.


reasoning: The paragraph describes the Board of Directors' oversight role in receiving periodic reports on BlackRock's cybersecurity program, which constitutes board governance of cyber risk. No specific facts meet the IS list criteria—BlackRock is the sponsor/parent entity (self-reference), 'Board of Directors' and 'periodic' are generic governance terms, and 'ERM framework' is a generic program name.


reasoning: The paragraph describes the company's internal risk management processes, including the establishment of an ERM Program and incident response procedures, focusing on what the program and management do rather than on specific personnel qualifications.


reasoning: The paragraph describes the company's internal cybersecurity processes (incident response planning, testing, training, logging) through the responsibilities of the CISO and CTO roles, with no mention of individual qualifications or credentials. The CISO is a cybersecurity-specific role and Risk Committee is a named non-generic committee, both meeting the Firm-Specific threshold.


reasoning: The paragraph comprehensively describes the company's internal cybersecurity program structure and processes across multiple domains (governance, technical safeguards, incident response, third-party risk management, training, and assessment activities), which constitutes a Risk Management Process disclosure. The Vice President of Information Technology role qualifies as a firm-specific fact under cybersecurity-specific titles.


reasoning: The paragraph describes the company's framework adoption for cybersecurity risk management, which is a core risk management process activity. It names multiple recognized standards (CIS, NIST, ISO 27000 series) and a sector-specific regulatory body (FFIEC), but contains no facts unique to this specific company beyond the framework adoption statement.


reasoning: The paragraph focuses on management governance structure, identifying the CISO role, qualifications (36 years experience, 24+ years as CISO), and the cybersecurity operations risk steering group composition chaired by the Chief Insurance Officer.


reasoning: The paragraph describes the company's internal cybersecurity safeguards, audit processes, and third-party cybersecurity program—all components of the company's own risk management processes. No specific facts, named frameworks, or unique identifiers are present; the language is entirely generic and could apply to any company.


reasoning: The paragraph focuses on the qualifications, credentials, and experience of the Vice President, Head of Technology, including their 20+ years of experience and CISM certification, making it about the person rather than the function per the person-vs-function test.


reasoning: The paragraph describes the company's internal cybersecurity monitoring, detection, and escalation processes, including security devices, event correlation, and tiered incident escalation procedures—all classic risk management process disclosure. No specific facts from the IS list are present: no named frameworks, no cybersecurity-specific titles (CISO, CTO), no named products/tools, no dates, no headcounts, and no named third parties—'CSIRT' is a common industry team acronym, not a unique identifier.


reasoning: The paragraph describes the company's internal monitoring and vulnerability detection process using a specific tool, which falls under Risk Management Process. The named product 'Coalition Control' constitutes a firm-specific fact that identifies this company's unique disclosure.


reasoning: The paragraph describes AGM's internal cybersecurity risk management processes, including program implementation, multidisciplinary team deployment, monitoring activities, and reporting structures. The focus is on what the CISO and teams do (processes and activities) rather than the person's qualifications, so it passes the person-vs-function test for Risk Management Process.


reasoning: The paragraph describes the company's internal cybersecurity risk management approach, including cross-departmental coordination, software tools, and policy governance—classic Risk Management Process content. No cybersecurity-specific titles (CISO, CTO, etc.), named frameworks, specific dates, named products, or other firm-specific facts appear; the senior vice president of operations and engineering is not a cybersecurity-specific role, and all mentioned tools and practices are generic.


reasoning: The paragraph focuses on the Vice President, IT Security's qualifications, credentials, and responsibilities, making Management Role the primary category. The disclosure contains multiple hard verifiable facts: 26 years of experience (specific number) and three named certifications (CISSP, CRISC, CISM), meeting the Quantified-Verifiable threshold.


content_category: Incident Disclosure

reasoning: The paragraph describes incident response actions taken following a cybersecurity incident, including forensic investigation, implementation of monitoring systems, and training. The materiality conclusion at the end is appended to the incident response narrative, making this incident disclosure rather than standalone strategy integration.


reasoning: The paragraph centrally focuses on cybersecurity risks arising from third-party service providers and the company's monitoring of those vendor-related risks, fitting the Third-Party Risk category. It contains no specific facts—no named providers, frameworks, dates, cybersecurity-specific roles, or verifiable details—making it generic boilerplate that could apply to any company.


reasoning: The Audit Committee is the grammatical subject in two of three sentences and the overall focus is board-level oversight; the CISO is mentioned only to describe reporting lines to the Audit Committee, not as the primary topic.


reasoning: The paragraph describes the VP of IT's professional qualifications, career history, education, and certifications, which is a classic Management Role disclosure focused on the person rather than processes.


reasoning: This paragraph contains a materiality disclaimer stating that cybersecurity risks have not materially impacted operations, business strategy, or financial results, which per the guidelines classifies as Strategy Integration even when boilerplate. The paragraph lacks any specific facts such as named roles, frameworks, dates, or verifiable details—only generic program references and standard forward-looking language.


reasoning: This paragraph describes the company's internal process for assessing, identifying, and managing cybersecurity risks, which fits the Risk Management Process category. It contains only generic risk categories (operational risks, intellectual property theft, fraud, extortion, etc.) that could apply to any company, with no named frameworks, specific roles, dates, or firm-specific details.


reasoning: The paragraph describes the Board's oversight role for cybersecurity risks and the expected quarterly reporting cadence from management to the Board. It contains no specific facts—only generic governance language (Board of Directors, senior management, quarterly updates, periodic conversations) that could apply to any company.


reasoning: The paragraph describes the company's internal risk management structure—a management-led Risk Committee that reviews cybersecurity risks as part of enterprise risk management and reports to the board committee. This is about the company's risk assessment and ERM integration processes, not individual management qualifications or board oversight.


reasoning: The paragraph focuses on board and committee oversight structures, with the Audit Committee as a grammatical subject and reporting cadences to the Board and Audit Committee as the main topic. Management roles (CISO, CTO) are mentioned only in the context of their reporting relationships to the board/committee, not their qualifications.


reasoning: The paragraph identifies the management structure for cybersecurity, naming the VP of IT Services as the leader who reports to the CSO, and describes the security team's composition and reporting responsibilities. The VP of IT Services title qualifies as a cybersecurity-specific role under the IS list, establishing Firm-Specific disclosure.


reasoning: The paragraph describes the company's internal processes for monitoring cybersecurity threats and incident response, with the InfoSec Director as the responsible party. While the InfoSec Director is the grammatical subject, the content focuses on what the role does (monitoring processes, incident response planning) rather than the person's qualifications, making it Risk Management Process per the person-vs-function test.


reasoning: The paragraph describes the company's cybersecurity monitoring and vulnerability management activities performed by an IT Service Provider, which constitutes internal risk management processes rather than vendor oversight. No specific facts are present—no named frameworks, tools, dates, or specific details that would distinguish this from any other company's disclosure.


reasoning: The paragraph describes CTBI's incident response planning and escalation procedures, which are internal risk management processes. The specific composition of officers in the critical incident escalation group constitutes a firm-specific organizational detail.


content_category: None/Other

reasoning: This paragraph is a pure cross-reference directing readers to Risk Factors sections, containing no substantive cybersecurity disclosure content.


reasoning: The paragraph describes an incident response assessment phase as part of the company's internal processes, not a narrative of a specific incident with dates or details. No specific facts remain after filtering—company name is excluded, and 'incident response team' and 'patient data' are generic terms without verifiable specifics.


reasoning: The paragraph describes the company's internal cybersecurity tools, systems, and monitoring capabilities, which constitutes disclosure of risk management processes and defensive measures.


reasoning: The paragraph describes the company's internal incident response planning framework, including the cyber emergency response team structure and escalation processes. This is a clear example of risk management process disclosure focused on IR planning.


reasoning: The paragraph describes the Audit Committee's oversight role in receiving cybersecurity incident reports and holding quarterly discussions with the CSO, making it Board Governance. The CSO title is a cybersecurity-specific role that qualifies as a firm-specific fact.


reasoning: The paragraph describes the company's internal incident response planning processes, including established plans, testing procedures, and the incident response playbook workflow from detection to recovery.


reasoning: The paragraph describes the company's internal process for auditing its Information Security program to ensure regulatory alignment, which is a risk assessment and monitoring activity.


reasoning: The paragraph describes an actual cybersecurity incident from June 2018 involving unauthorized email system access that resulted in $10 million in fraudulent payment disbursements, which qualifies as Incident Disclosure under the tiebreaker for paragraphs that describe what happened in an incident with dates and scope. The specificity is Quantified-Verifiable because it contains two hard verifiable facts: a specific date (June 2018) and a specific dollar amount ($10 million).


reasoning: This paragraph discusses cybersecurity insurance coverage, which falls under Strategy Integration as it addresses financial risk transfer mechanisms for cyber incidents.


reasoning: The paragraph contains a materiality conclusion stating that no cybersecurity threats have materially affected the company's business strategy, results of operations, or financial condition, which falls under Strategy Integration per the guidelines.


reasoning: The paragraph primarily describes internal risk management processes including vulnerability assessments, penetration testing, enterprise risk assessments, and ERM integration. While the CISO's qualifications are mentioned at the end, the bulk of the content focuses on what the program does rather than the person, making Risk Management Process the primary category under the person-vs-function test.


reasoning: The paragraph describes the company's internal cybersecurity training and awareness programs for both personnel and customers, which constitutes risk management process disclosure.


reasoning: The paragraph concludes with a standalone materiality statement that the Bank has not experienced any material incidents, which fits the Strategy Integration category for materiality assessments. The regulatory context is background.


reasoning: The paragraph describes reporting lines for cybersecurity information with COO and CFO as the grammatical subjects who receive updates from IT providers and relay them to the Board. COO and CFO are generic C-suite roles on the exclusion list, and no cybersecurity-specific titles, named entities, dates, or other verifiable facts appear.


reasoning: The paragraph describes internal training and awareness programs as part of the company's cybersecurity risk management activities, with a brief mention of insurance purchase. No specific facts are present—training programs, cadences (annual, periodic, regular), and insurance policy references are all generic language that could appear in any company's disclosure.


reasoning: The CFO is the grammatical subject throughout, describing their cybersecurity oversight responsibilities, tools used, and reporting relationship to the Board. Coalition management platform is a named product that identifies this specific company's disclosure.


reasoning: The paragraph describes the company's internal cybersecurity risk management program, including risk assessments and security controls employed to protect information systems.


reasoning: The paragraph describes the company's internal Enterprise Risk program framework, risk assessment processes, and coordination between risk management functions. The focus is on what the risk management function does rather than on individual qualifications.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, specifically how they use both internal specialized teams and third-party experts for security assessments, penetration testing, and technology consulting to validate controls and identify focus areas.


reasoning: The paragraph describes the board of directors' oversight process for cybersecurity risks, with the board as the grammatical subject receiving regular presentations from management. No specific facts qualify under the IS list - 'board of directors' and 'senior management team' are generic governance terms, 'regular basis' is a vague cadence, and the topics listed are standard security practices.


reasoning: The paragraph describes the company's internal cybersecurity program processes for identifying threats and interfacing with other departments, fitting Risk Management Process. The listed departments (IT, legal, risk, HR, internal audit) are standard organizational functions found at most companies, and the 'including but not limited to' qualifier makes this non-specific, resulting in Generic Boilerplate.


reasoning: The paragraph describes the company's internal cybersecurity processes including engagement with third-party specialists for program assessment, a 5-year compliance plan, defense mechanisms, and vendor assessment as one component of the overall risk management program.


reasoning: The paragraph describes the Company's internal process for assessing and managing cybersecurity threats through a designated Materiality Assessment Team (MAT), including its convening triggers, responsibilities for materiality determination, and reporting lines. It contains firm-specific facts including the named MAT team, CIO and CISO cybersecurity-specific roles, and the Risk Committee as a named non-generic committee.


reasoning: The paragraph focuses on the CIO's qualifications (over 15 years of experience) and reporting structure, which are person-specific details rather than process descriptions. The PERSON-VS-FUNCTION test indicates that qualifications and credentials point to Management Role.


reasoning: This paragraph is a pure cross-reference to the Risk Factors section with no substantive cybersecurity disclosure content.


reasoning: The paragraph describes BNY Mellon's internal cybersecurity risk management processes, including the ISD structure, threat monitoring, incident classification, and third-party arrangements. This is about what the program does rather than about a specific person's qualifications.


reasoning: The paragraph describes the company's general cybersecurity risk management measures (security technologies, internal controls, disaster recovery processes) and potential consequences of failures, but is framed as risk factor language with no specific frameworks, named roles, dates, or verifiable details.


reasoning: The paragraph's central topic is the company's consideration of cybersecurity risks from third-party vendors and service providers, making vendor oversight the primary focus rather than a component of broader internal processes.


reasoning: The paragraph is primarily a materiality assessment stating that no cybersecurity threats have materially affected the company in the last fiscal year, which falls under Strategy Integration per the category guidelines for materiality conclusions.


reasoning: The paragraph describes the company's internal cybersecurity management program, including its design, quarterly review process, and benchmarking to industry frameworks, which fits the Risk Management Process category. The Audit Committee mention is a minor component showing ERM integration rather than the primary focus.


reasoning: This paragraph describes an actual cybersecurity incident with specific details about what happened (ransomware attack, file encryption, malware deployment), when (June 28, 2023), scope (limited downtime, certain systems), and response actions (implementing manual processes).


reasoning: The paragraph describes the company's internal cybersecurity processes including detection and investigation efforts, prevention through internal process changes, and implementation of a cybersecurity risk assessment process and incident response plan. The materiality statement about prior incidents is secondary to the process description.


reasoning: The paragraph describes potential business and financial consequences of cybersecurity incidents (fines, litigation, financial losses, reputational damage), which aligns with Strategy Integration's coverage of business/financial impact. However, it uses entirely hypothetical, forward-looking language with no specific facts, dates, or unique details.


reasoning: The Audit Committee's oversight role is the primary focus, with management mentioned only in the context of reporting to the board committee.


reasoning: The paragraph describes the company's internal cybersecurity processes including risk management integration, threat mitigation approach, and incident response planning, with no board, management personnel, or specific incident discussed.


reasoning: The paragraph's central topic is vendor oversight—obtaining SOC-1 reports from service providers, reviewing them, and limiting third-party access to data. The entire disclosure focuses on requirements imposed on vendors rather than internal processes that merely mention vendors as a component.


reasoning: The paragraph describes the company's internal cybersecurity processes including monitoring systems, incident response practices, and employee training, which fits Risk Management Process. It contains no specific facts, named frameworks, or unique identifiers—only generic security practices that could apply to any company.


reasoning: The Board of Directors and Audit Committee are the grammatical subjects, and the paragraph describes their oversight responsibilities for cybersecurity risk assessment and management processes.


reasoning: The paragraph focuses on board committee oversight of cybersecurity risk management, with the Audit and Examination Committee as the primary grammatical subject establishing oversight responsibilities, and the Information Security Officer mentioned in the context of reporting to that committee.


reasoning: The paragraph describes the company's internal cybersecurity risk assessment activities including vulnerability scanning, threat intelligence feeds, and use of third-party assistance, which are standard risk management process elements. No specific facts, named frameworks, roles, dates, or unique details are present - the language is entirely generic and could apply to any company.


reasoning: The paragraph describes what the CISO and CIO do (provide briefings, inform the Board) rather than their personal qualifications or credentials. Under the person-vs-function test, this is about the function/process, not the persons, so it classifies as Risk Management Process.


reasoning: This paragraph is forward-looking risk disclaimer language describing hypothetical cybersecurity threats and potential consequences without disclosing actual governance structures, management roles, internal processes, or real incidents. It contains no specific facts—only generic references to 'the Company,' 'third parties,' 'vendors,' and standard risk language that could apply to any company.


reasoning: The paragraph describes the company's internal organizational structure for cybersecurity risk management, including specific team responsibilities, oversight relationships, and named professional certifications held by team members. This is about the company's own internal processes rather than board governance or management roles specifically.


reasoning: The paragraph describes the company's internal cybersecurity program, including risk assessments, controls, threat intelligence sources, and the operational responsibilities of security leadership. The named roles (CISO, CTO, CIO) are mentioned in the context of what they do (oversee, implement, enforce) rather than their qualifications, so this is about the function, not the person.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including the structure and composition of a named cybersecurity committee and how multidisciplinary teams are deployed to address threats.


reasoning: The CTO is the grammatical subject throughout, with the paragraph focusing on their qualifications (25+ years of experience), role (overseeing the cybersecurity program), and reporting lines (reports to CEO, briefs the Board).


reasoning: The paragraph focuses on the IT Lead's qualifications (11 years of experience) and the external agency's expertise (8 years), making it about the person and their credentials rather than the processes themselves.


reasoning: This paragraph is primarily threat landscape and risk context—describing why cybersecurity matters to the company—rather than substantive disclosure about governance, management roles, processes, or incidents. The final sentence fragment about an Information Security Program is incomplete and does not constitute a meaningful process description.


reasoning: This paragraph is a cross-reference to the Risk Factors section in Item 1A, directing readers to where cybersecurity risks are discussed. It contains no substantive disclosure about the company's cybersecurity program, governance, or incidents—only a pointer to another section.


reasoning: The paragraph identifies a management role (Director of Compliance) and describes their reporting lines to the Board, which fits the Management Role category. However, 'Director of Compliance' is not a cybersecurity-specific title per the IS list, and all other elements (Board of Directors, regular reports, third-party service providers) are generic boilerplate language.


reasoning: The paragraph centers on the VP of IT as the management role responsible for cybersecurity oversight, with substantial detail about the person's qualifications (20+ years experience, degrees) and supporting team structure, making it primarily about the management role rather than just processes.


reasoning: The paragraph describes Exelon's internal cybersecurity processes including threat intelligence gathering, security tools and monitoring, regulatory compliance frameworks, information sharing programs, employee training, and cyber insurance review. The company's own processes and activities are the central topic throughout.


reasoning: This paragraph is purely educational/definitional content explaining what a DoS attack is, with no substantive disclosure about the company's cybersecurity governance, processes, incidents, or strategy.


reasoning: The paragraph's central topic is oversight of third-party service providers, including assessment of their compliance, review of SOC 2 reports, and contractual requirements via business associate agreements—this is vendor oversight, not internal processes.


reasoning: The paragraph describes board oversight structure, specifically the delegation of cybersecurity oversight to a subsidiary's Information Security Committee and the reporting cadence back to the board.


reasoning: The paragraph focuses on identifying the individuals responsible for cybersecurity (CFO, General Counsel, Head of IT) and detailing their qualifications and years of experience, with management roles as the grammatical subjects throughout most of the paragraph.


reasoning: The paragraph describes the company's internal cybersecurity policies and incident response planning processes, including employee policies and incident response activities, which clearly falls under Risk Management Process. No specific facts remain after filtering—employee handbook, Code of Conduct, Acceptable Use policy, and incident response plan are all generic program names explicitly excluded from the IS list, and no frameworks, roles, dates, or verifiable details are present.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including the incident response team structure, how risks are managed, the GRC platform, and third-party support for the program. While management roles are mentioned, the focus is on what the program does rather than on the individuals' qualifications.


reasoning: This paragraph contains only generic risk acknowledgment language about cybersecurity threats and potential adverse effects, with no substantive disclosure about governance structures, management roles, internal processes, or actual incidents.


reasoning: The paragraph describes the scope and operational impact of a cybersecurity incident (disruptions to business applications, systems taken offline) and the response actions (containing unauthorized activity, restoring systems), which clearly fits Incident Disclosure. No specific facts from the ✓ IS list are present—no dates, named products, named firms, cybersecurity-specific roles, or other identifiers—so it remains Generic Boilerplate.


reasoning: The paragraph focuses on a specific individual (the IT consultant) and their qualifications, including their experience level, which aligns with the Management Role category per the person-vs-function test. The specific role title and years of experience constitute firm-specific facts.


reasoning: This paragraph describes an actual cybersecurity incident (MOVEit) with specific details about what happened, when it was disclosed, the scope of affected individuals (2.5-2.7 million), types of data exposed (SSNs), response actions (investigation with PBI), and operational impact assessment.


reasoning: The Board is the grammatical subject and the paragraph describes its oversight role over cybersecurity risks and management's implementation of the cybersecurity program, which fits Board Governance.


reasoning: The paragraph discusses potential business and financial impacts of cybersecurity threats (financial losses, remediation expenses, reputational damage, regulatory fines, insurance coverage) and includes a standalone materiality conclusion that no material incident has occurred to date. No specific facts identify this disclosure as unique to the company.


reasoning: The paragraph is entirely focused on vendor oversight, describing the company's approach to assessing and mitigating cybersecurity risks from third-party service providers through due diligence and contractual safeguards.


reasoning: This paragraph contains a materiality disclaimer stating that no cybersecurity threats or incidents have materially affected the company's business strategy, results of operations, or financial condition, which falls under Strategy Integration per the tiebreaker rules.


reasoning: The paragraph describes an internal cybersecurity control (access control) as part of the company's risk management practices, focusing on how access to systems and data is managed and reviewed.


reasoning: The paragraph describes the company's internal processes for monitoring cybersecurity risk, including the use of an IT consultant, and concludes with a materiality assessment. The primary focus is on the company's risk monitoring approach rather than a specific incident or governance structure.


reasoning: The paragraph describes internal governance structures and oversight processes for cybersecurity risk through named management-level committees (OROC and IT Steering Committee), which constitutes the company's risk management process. The focus is on what these committees do rather than on individual management qualifications.


reasoning: This paragraph describes an actual cybersecurity incident (MOVEit breach via third-party vendor PBI) with specific details including the event timeline, scope of data exposed (2.5-2.7 million policyholders), response actions taken, and impact assessment. The incident narrative is the primary focus, with the materiality conclusion secondary.


reasoning: The paragraph focuses on identifying the CIO and Senior Director, Information Security as the individuals responsible for cybersecurity oversight, with substantial detail on their qualifications, years of experience, and certifications. The PERSON-VS-FUNCTION test indicates this is about the persons (credentials, career history) rather than solely about processes.


reasoning: The paragraph describes the company's internal security safeguards and assessment procedures (firewalls, intrusion detection, anti-malware, external provider assistance), which constitutes risk management process disclosure. No specific facts are present—only generic security tools and unnamed external providers that could apply to any company.


reasoning: The paragraph describes the company's internal risk management process and how third-party providers assist with identifying, assessing, and managing cybersecurity risks—vendors are mentioned as tools/components of the company's own process, not as entities whose risk is being overseen.


reasoning: The paragraph describes management's internal processes for overseeing cybersecurity threat assessment and incident response procedures, rather than identifying specific management roles or qualifications.


reasoning: The paragraph describes an ongoing incident investigation, the unknown scope of the incident, and the status of data compromise analysis, which constitutes incident disclosure content. No specific facts are present—there are no dates, named systems, named third parties, or other verifiable details; all language is standard incident response boilerplate.


reasoning: The paragraph focuses on the CISO's qualifications, credentials, and experience (28 years, master's degree), which makes it about the PERSON rather than the function. The specificity is Quantified-Verifiable because it contains two hard verifiable facts: a specific number (28 years of experience) and multiple named certifications (CISA, CISM, HITRUST, QSA, CSP).


reasoning: This paragraph describes the scope and aftermath of a cybersecurity incident (data exfiltration from accessed IT systems), which qualifies as Incident Disclosure. It contains no specific facts—only vague references to 'certain information,' 'sensitive information,' and 'accessed IT systems' without dates, named systems, or other verifiable details.


reasoning: The paragraph describes the company's internal access management processes including provisioning, de-provisioning, access reviews, and authentication controls for third-party hosted environments. This is a description of internal risk management processes with no named frameworks, specific roles, dates, or other identifying facts—only common security practices like least privilege, need-to-know access, and single sign-on that could apply to any company.


reasoning: The paragraph describes the company's internal cybersecurity processes including patch management, employee security training, and review of third-party security procedures. The third-party mention is a component of internal risk management processes rather than the central topic.


reasoning: This paragraph provides general business context about IT systems importance and data types handled, without describing board oversight, management roles, risk management processes, third-party oversight, incidents, or materiality assessments. It is background information rather than substantive cybersecurity disclosure.


reasoning: The paragraph primarily describes the company's internal cybersecurity processes including risk assessments, audits, vulnerability identification, and the delineation of roles, with Board oversight and management reporting serving as components of the overall risk management framework.


reasoning: The paragraph describes the company's internal cybersecurity risk management framework, including the three lines of defense model, testing and assessment activities, third-party due diligence processes, and monitoring activities. The VP, ISS is mentioned as leading the function, but the focus is on what the function does rather than the person's qualifications.


reasoning: The paragraph describes the governance structure for cybersecurity oversight, beginning with the board's overall responsibility and ending with incident reporting to the audit committee and board. While management and the VP of Operations are mentioned, they are described in the context of the oversight and reporting structure rather than focusing on the person's qualifications or detailed internal processes.


reasoning: The paragraph begins with board oversight but the majority and more detailed portion focuses on management's role, including a named executive (R. LaDuane Clifton) with specific titles and the IT staff's combined 40 years of experience in cybersecurity functions.


reasoning: This paragraph contains only forward-looking risk disclaimers and hypothetical breach scenarios without any substantive disclosure about governance, processes, actual incidents, or specific organizational details.


reasoning: The paragraph describes the company's ongoing monitoring and safeguarding activities related to cybersecurity risk, which constitutes a risk management process, though stated at an extremely high level. No specific facts, dates, named roles, frameworks, or verifiable details are present—only generic statements that could apply to any company.


reasoning: The paragraph describes the company's internal cybersecurity organizational structure, security controls, and processes for managing cyber risks, including third-party risk management as one component of the overall program.


reasoning: The paragraph describes the company's internal cybersecurity measures and their ongoing review process, which fits Risk Management Process. It contains no named frameworks, specific roles, dates, or any other identifying facts—only generic language applicable to any company.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including framework adoption (NIST), ERM integration, policy structure, and governance oversight. Risk Committee is a named non-generic committee that qualifies as a firm-specific fact.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes including ongoing assessments, audits, penetration testing, and training programs. It contains no named frameworks, specific dates, named third-party firms, or other verifiable facts that would distinguish it from generic disclosure.


reasoning: This paragraph is a materiality disclaimer stating that no cybersecurity risks materially affected the company in 2024, followed by forward-looking risk language and a cross-reference to Risk Factors. Materiality conclusions without incident narrative fall under Strategy Integration per the guidelines.


reasoning: While the paragraph begins with Board oversight, the majority of the content focuses on the CIO and CISO roles, their reporting relationships, and extensive qualifications including specific degrees, certifications, and professional affiliations. The management qualifications section dominates the paragraph's substance.


reasoning: This paragraph contains a standalone materiality conclusion stating that no cybersecurity risks have materially affected or are reasonably likely to materially affect the company's business strategy, results of operations, or financial condition. The first sentence is a forward-looking disclaimer, and the second is a standard materiality assessment with no incident narrative or firm-specific details.


reasoning: The paragraph describes the company's internal processes for managing cybersecurity incidents, including the structure and responsibilities of the crisis management team and disclosure committee. The focus is on what these teams do rather than individual qualifications, so it fits Risk Management Process per the Person-vs-Function test.


reasoning: The paragraph describes the Bank's internal cybersecurity risk management activities including monitoring, training, penetration testing, and incident response planning, but contains no named frameworks, specific tools, dates, personnel titles, or other identifying details.


reasoning: This paragraph describes the company's internal incident response planning and testing processes, which falls squarely under Risk Management Process. It contains no specific facts—'incident response and recovery plans' is a generic program name and 'regular basis' is vague cadence—making it Generic Boilerplate that could appear in any company's filing.


reasoning: This paragraph contains only a forward-looking disclaimer stating no material incident occurred, a statement that future incidents cannot be predicted, and a cross-reference to Risk Factors. There is no substantive disclosure about governance, processes, roles, or an actual incident.


reasoning: The Board of Directors is the grammatical subject, described as discussing risks and inquiring of management about controls—classic board oversight activities. The absence of a CIO is a firm-specific organizational fact, as CIO is a cybersecurity-specific title on the approved list.


reasoning: The paragraph describes the board-established management committee structure for cybersecurity oversight, including named committees (IT Steering, Operational Risk Management) and their composition, meeting cadences, and the CISO's reporting line to the board's Innovation and Technology Committee.


reasoning: The paragraph describes the company's internal incident response planning and recovery procedures, which falls under risk management processes. It contains no specific facts—no named frameworks, dates, tools, third parties, or cybersecurity-specific roles—and could apply to any company.


reasoning: This paragraph describes the company's cybersecurity risk management approach, including policies, procedures, controls, and framework adoption (NIST CSF), all delivered through CIM Group as their IT provider. The named third-party firm CIM Group identifies this disclosure as firm-specific, distinguishing it from generic boilerplate.


reasoning: This paragraph contains a standalone materiality conclusion stating no cybersecurity incidents or threats have materially affected the company, which falls under Strategy Integration per the guidelines for materiality disclaimers.


reasoning: The paragraph describes the company's internal cybersecurity controls and defense posture across multiple security domains, which is a classic Risk Management Process disclosure. No specific facts are present—ISP is a generic acronym for Information Security Program, the control domains listed are standard security categories, and no named frameworks, roles, dates, tools, or verifiable details appear.


reasoning: The paragraph describes the company's internal incident response structure and processes, including the crisis management team composition, Board communication protocols, and materiality evaluation procedures.


reasoning: The paragraph describes the company's internal cybersecurity risk assessment processes and safeguards, with the company ('We') as the grammatical subject conducting assessments and implementing controls. No named frameworks, specific roles, dates, products, or other firm-specific facts are present—only common security practices that could apply to any digital asset company.


reasoning: The paragraph describes an actual cybersecurity incident from June 2018 involving unauthorized access to the company's email system that resulted in $10 million in fraudulent payment disbursements, providing both a specific date and dollar amount that constitute two hard verifiable facts.


reasoning: This paragraph describes an actual cybersecurity incident (email spoofing) with specific details about what happened, when it occurred (April 2024), the scope ($30,825 wire transfer), and the company's response actions including new security measures adopted.


reasoning: The paragraph's central topic is oversight and management of third-party service provider risks, describing security assessments before engagement and ongoing monitoring for compliance—vendor oversight is the focus, not merely a component of internal processes.


reasoning: This paragraph is a forward-looking disclaimer stating the company has not experienced material cyber-attacks, followed by generic risk language and a cross-reference to Item 1A risk factors. It contains no substantive disclosure about governance, management, processes, or actual incidents—only a negative statement and a cross-reference.


reasoning: The paragraph describes the company's internal approach to cybersecurity risk management—assessing risk as minimal, assigning oversight responsibility, and using basic commercial software—but contains no specific facts, named frameworks, or unique identifiers that would distinguish it from any other small company's disclosure.


reasoning: The paragraph describes the company's internal approach and process for identifying and overseeing cybersecurity risks from third parties, which fits Risk Management Process as it concerns the company's own internal processes rather than specific vendor requirements or contractual standards imposed on vendors.


reasoning: The paragraph describes the company's internal risk management and cybersecurity processes, including ERM integration, framework adoption, and the information security program. The CISO is mentioned in the context of what the role does within the process rather than the person's qualifications, so this fits Risk Management Process.


reasoning: The paragraph describes the company's own internal cybersecurity measures, processes, and policies for managing and mitigating cybersecurity risks, which is the core definition of Risk Management Process. The mention of a dedicated CISO provides one firm-specific fact.


reasoning: The Board is the grammatical subject throughout, overseeing the cybersecurity program and receiving reports from named technology/security executives, which constitutes board governance of cyber risk.


reasoning: The paragraph's central topic is vendor oversight—describing the company's vendor management program, security questionnaires, audits, and contractual obligations imposed on third-party providers, which fits Third-Party Risk. No specific facts appear: no named frameworks, cybersecurity-specific roles, dates, named third parties, or quantified details—only generic program descriptions and common practices.


reasoning: This paragraph describes an actual cybersecurity incident with specific details about what happened (unauthorized access, encryption and monitoring software deployment), when (October 15, 2025), the scope (portions of IT environment), and response actions (activated incident response plan, notified FBI, retained external experts).


reasoning: This paragraph describes an actual cybersecurity incident with specific details about what occurred (unauthorized access, malware deployment, data exfiltration), when it happened (specific dates in November and December 2023), and the scope of impact.


reasoning: The paragraph describes oversight activities, reporting cadences, and incident response protocols—what the management function does rather than person-specific qualifications. Under the Person-vs-Function test, this is about processes and activities, not credentials or career history. All elements (CFO, VP of Internal Audit, quarterly updates, third-party IT service provider, cyber incident response plan) fall on the ✗ NOT list, yielding Generic Boilerplate specificity.


reasoning: The paragraph describes management reporting lines for cybersecurity oversight, with the IT Team Director meeting with the CFO and CEO, and an incident reporting structure involving the CFO, CEO, and General Counsel. The roles mentioned (IT Team Director, CFO, CEO, General Counsel) are either generic C-suite positions or not cybersecurity-specific titles, and no frameworks, dates, named third parties, or other specific facts from the IS list are present.


reasoning: The paragraph describes the Director of IT's role in assessing and managing cybersecurity risks and the team's monitoring and response activities. Applying the person-vs-function test, the paragraph primarily describes what the role and team DO (monitoring, investigating, acting on security events) rather than the person's specific qualifications or credentials, making it about the function rather than the person.


reasoning: The paragraph describes internal processes for cybersecurity risk reporting and ERM integration through internal audit functions, focusing on what the security function does rather than the person's qualifications. The Chief Security and Trust Officer is a cybersecurity-specific role, providing one firm-specific fact, but no dates, amounts, or named third parties to reach Quantified-Verifiable.


reasoning: The paragraph describes the company's internal cybersecurity risk management program for identifying, assessing, and mitigating risks to data and systems, which fits the Risk Management Process category. No specific facts qualify—the phrase 'recognized industry standards and frameworks' does not name a specific standard, and all other elements are generic boilerplate applicable to any company.


reasoning: This paragraph is a materiality disclaimer stating that no cybersecurity threats have materially affected or are reasonably likely to materially affect the company, followed by a cross-reference to Risk Factors and forward-looking risk language. Per the guidelines, materiality disclaimers are classified as Strategy Integration even when boilerplate. The paragraph contains no specific facts—no named roles, dates, frameworks, tools, or verifiable details—only generic references to 'the Company' and standard risk factor cross-references.


reasoning: The paragraph identifies the executive officer's responsibility for cybersecurity risk management and notes their lack of cybersecurity expertise, which constitutes a management role disclosure about qualifications and responsibilities.


reasoning: The paragraph describes the company's cybersecurity risk management approach, including detection, analysis, response capabilities, technical controls, and monitoring systems, even though implemented through their property manager IHM. The focus is on the processes and controls rather than vendor oversight requirements.


reasoning: The paragraph's central topic is vendor oversight, describing due diligence, monitoring, and contractual requirements imposed on third parties, which fits Third-Party Risk. It contains no specific facts, named frameworks, or unique identifiers, making it generic boilerplate.


reasoning: The paragraph describes board-level oversight of cybersecurity risks, with the Board of Directors and its Risk and Information Security Committee as the grammatical subjects responsible for risk management oversight.


reasoning: The paragraph's central topic is vendor oversight - discussing onboarding and monitoring processes for third-party vendors, limitations in monitoring their cybersecurity practices, and risks from potential compromises of their systems.


reasoning: The paragraph describes the company's internal processes for managing third-party cybersecurity risk, including due diligence procedures and contractual requirements, which constitutes the company's own risk management activities rather than standalone vendor oversight. No specific facts, named frameworks, or verifiable details appear—only generic practices applicable to any company.


reasoning: This is a forward-looking risk disclaimer stating that cybersecurity threats could materially affect the company, without describing any actual governance, processes, incidents, or strategies. It contains no substantive disclosure and could appear in any company's filing unchanged.


reasoning: The paragraph describes an actual cybersecurity incident with specific details including the date (February 14, 2025), nature of unauthorized access to information systems and email systems, and the resulting impact (misdirected vendor payments), which qualifies as Incident Disclosure under the tiebreaker rules.


reasoning: The paragraph describes the company's internal cybersecurity processes including scans, penetration tests, vulnerability assessments, and tabletop exercises. All elements are generic security practices with no named frameworks, specific roles, dates, named vendors, or other firm-specific details.


reasoning: The paragraph describes an internal process for keeping management informed about cybersecurity posture and risks, which fits the Risk Management Process category focused on monitoring and communication of cyber risks.


reasoning: This is a forward-looking disclaimer stating the company is not aware of any system weaknesses or malware that would materially affect operations. It contains no substantive disclosure about governance, processes, incidents, or strategy—just a negative assertion about current state.


reasoning: The paragraph describes the company's internal technical security controls and infrastructure protection measures, including authentication requirements, encryption protocols, and DDoS defense, which constitutes the company's own risk management processes. AWS Shield is a named security product that qualifies as a firm-specific fact.


reasoning: The paragraph describes actual cybersecurity events—phishing attacks targeting the company's online banking platform—including the timing, scope, response actions, and outcome, which fits Incident Disclosure. However, it lacks any specific verifiable facts: 'beginning of the year' is vague, 'online banking platform' is a generic system description, and no named products, firms, dates, or headcounts are provided.


reasoning: The paragraph describes the company's internal cybersecurity operations and incident response capabilities, which are core risk management process activities.


reasoning: This paragraph describes the company's internal cybersecurity infrastructure and technical controls for protecting data storage, which falls under risk management processes. The disclosure details specific architectural decisions (private network, port restrictions, firewall configuration) that constitute the company's security measures.


reasoning: The paragraph describes the Audit Committee's oversight of cybersecurity risks through briefings from the CEO, focusing on the governance structure and briefing cadence rather than the CEO's personal qualifications.


reasoning: The Audit Committee is the grammatical subject in most sentences and the paragraph focuses on board-level oversight structure, with management roles mentioned to explain how they support that oversight.


reasoning: The paragraph describes an actual cybersecurity incident at ETI with specific details including the date (June 2022), nature (network security incident), operational impact (limited access to applications and services for employees and customers), and response actions (costs to restore security, adopted enhancements). This meets the Incident Disclosure criteria for describing what happened, when, scope, and response actions.


reasoning: The paragraph focuses on materiality assessment with the key conclusion that cybersecurity risks have not materially affected the company since 2017, with only a brief reference to past incidents in 2016 and 2017. Per the tiebreaker, 'brief mention of a past incident + materiality conclusion as the main point' falls under Strategy Integration. The specific years of past cyber attacks constitute a firm-specific fact.


reasoning: The paragraph describes the company's internal cybersecurity program structure and framework adoption, which is a core risk management process disclosure. It achieves Firm-Specific specificity because the company names its own internal program with a unique identifier (EISF), beyond merely listing recognized external standards.


reasoning: The paragraph describes an actual cybersecurity incident (2021 malware attack), including what happened, response actions (quarantine, server rebuild), and operational/financial impact. This meets Incident Disclosure criteria as it narrates a real event with dates, scope, and response actions. Contains multiple hard verifiable facts: specific year, dollar amount, flight cancellation count, and recovery date.


reasoning: The paragraph focuses on the IT Director's role, responsibilities, and professional qualifications (25 years IT management, 15 years cybersecurity experience), with the IT Steering Committee mentioned as a supporting governance structure.


reasoning: This paragraph contains forward-looking risk disclaimer language with only a vague, non-specific reference to past cyber-attacks (no dates, scope, or incident details). It does not describe any specific incident, governance structure, management role, or internal process—it is standard risk factor language that could appear in any company's filing.


reasoning: The paragraph describes the company's internal cybersecurity processes including program review, audits, and risk assessment methodology. The Board is mentioned as receiving reports but is not the primary grammatical subject; the focus is on the Information Security Program and team activities.


reasoning: This paragraph describes an actual cybersecurity incident (fraudulent email leading to erroneous wire transfer), including when it occurred, the financial impact ($0.7 million), and the company's response actions (engaging outside consultant, strengthening procedures).


reasoning: The paragraph describes the company's comprehensive cybersecurity risk management approach, covering multiple internal processes including monitoring, insider threat programs, information sharing, third-party assessments, training, and supplier engagement. The grammatical subject throughout is 'We' (the company), describing what the company does to manage cyber risk.


reasoning: The paragraph identifies management roles (Chief Risk Officer and CISO) and describes their responsibilities for enterprise and cybersecurity risk management, which fits the Management Role category. CISO is a cybersecurity-specific title on the ✓ IS list, establishing Firm-Specific disclosure.


reasoning: This paragraph is a materiality disclaimer stating that cybersecurity threats have not materially affected the company, which falls under Strategy Integration per the category guidelines. The cross-reference to Risk Factors does not change the classification.


reasoning: The paragraph discusses insurance reimbursements and materiality conclusions related to a cybersecurity incident without describing the incident itself, which fits Strategy Integration per the tiebreaker rules for paragraphs that only discuss financial impact or materiality without incident narrative.


reasoning: This is a general risk acknowledgment statement about potential cybersecurity threats without any substantive disclosure about governance, processes, or actual incidents - essentially forward-looking disclaimer language.


reasoning: The paragraph describes the company's internal cybersecurity program components including risk assessments, penetration testing, incident response planning, security operations, and third-party risk management—all classic Risk Management Process topics. No specific facts are present: no named frameworks (only 'prevailing cybersecurity standards'), no cybersecurity-specific titles, no specific dates beyond generic 'annual' cadences, and no named tools or third-party firms.


reasoning: The paragraph describes the company's internal risk assessment process, specifically the types of cybersecurity risks they continually evaluate and monitor.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including safeguards implementation, monitoring, and day-to-day risk assessment activities. The IT consultant reference describes the function rather than the person's qualifications.


reasoning: The paragraph describes an actual cybersecurity incident (June 2022 network outage), including when it occurred, the operational impact (limited access to applications and services for employees and customers), and response actions taken (costs to restore security, enhancements adopted). This meets the criteria for Incident Disclosure as it references a real event with incident narrative and response actions.


reasoning: This paragraph describes response actions to an actual cybersecurity incident, including notification to 1.3 million consumers, provision of credit monitoring services, coordination with law enforcement, and litigation resulting from the incident. The materiality conclusion is embedded within the incident narrative rather than standing alone.


reasoning: The paragraph describes the company's internal incident response process, including severity assessment, escalation to senior executive leadership, and Board notification procedures, which constitutes risk management process disclosure.


reasoning: This paragraph describes the integration of cybersecurity risk management into the enterprise risk management program, which is a clear example of ERM integration under Risk Management Process. The language is entirely generic with no named frameworks, specific roles, dates, or unique identifiers that would distinguish it from any other company's disclosure.


reasoning: The paragraph describes the integration of cybersecurity risk management with the company's overall enterprise risk management program, which constitutes a description of internal risk management processes. It contains no named frameworks, specific roles, dates, or other identifying facts that would distinguish it from generic disclosure.


reasoning: The board of directors is the grammatical subject throughout, describing its oversight responsibilities for cybersecurity risk management and the reporting cadence it receives from management.


reasoning: The paragraph describes an actual cybersecurity incident detected in 2022, including what happened (impacted the Company's network) and response actions taken (activated incident response protocols, completed investigation), which constitutes an incident disclosure. The year 2022 provides one specific fact identifying when the incident occurred.


reasoning: The Audit Committee (a board committee) is the grammatical subject throughout, describing its oversight responsibilities for cybersecurity risk, the reporting it receives from management, and how it informs the full Board. The CIO is a cybersecurity-specific role that qualifies as a firm-specific fact.


reasoning: The paragraph describes the company's internal processes for assessing and managing cybersecurity risks and their integration into the broader risk management framework, which is the core definition of Risk Management Process. No specific facts, named frameworks, or unique identifiers appear—'IT Security Incident Response Plan' is a generic program name without a unique identifier, and the language could apply to any company.


reasoning: The paragraph focuses on the vCISO role—their responsibilities, reporting structure, and professional qualifications—which fits the Management Role category per the person-vs-function test. The vCISO title and CISSP certification are specific facts, but only the named certification counts as a hard verifiable fact, falling short of the two required for Quantified-Verifiable.


reasoning: The paragraph describes the company's internal threat intelligence monitoring process, which is a core risk management activity. It contains no specific facts, named frameworks, or unique identifiers that would distinguish it from generic disclosure.


reasoning: The paragraph describes the qualifications, credentials, tenure, and career history of multiple executives (CISO, CDIO, CEO, CFO, GC), which is squarely about the persons in management roles rather than processes or functions.


reasoning: The paragraph describes the company's internal processes for assessing and monitoring third-party providers, which constitutes Risk Management Process rather than Third-Party Risk because the focus is on the company's own activities (conducting assessments, maintaining monitoring) rather than requirements imposed on vendors.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including framework integration, vulnerability detection, and incident notification procedures. The Head of Information Security is mentioned in the context of what the role does (collaborate on risk evaluation), not the person's qualifications, so this is about the function rather than the person.


reasoning: The audit committee is the grammatical subject throughout, receiving quarterly updates, materials, and incident reports from management on cybersecurity matters.


reasoning: The paragraph describes the company's cybersecurity risk assessment processes and the activities/responsibilities of management roles (hiring, integrating risk considerations, reviewing assessments), not the qualifications or credentials of specific individuals. Under the person-vs-function test, this is about what the roles DO rather than the persons themselves, so it classifies as Risk Management Process. No cybersecurity-specific titles, named frameworks, dates, or verifiable facts appear—COO and SVP for Operations are generic C-suite/operations roles.


reasoning: The paragraph describes the company's internal incident response and escalation process, including the composition of a cross-functional steering committee and escalation procedures to the Audit Committee and Board.


reasoning: This paragraph describes the company's internal controls and procedures for managing cybersecurity risks, including monitoring, training, and reviewing third-party SOC reports, which fits the Risk Management Process category.


reasoning: The Board of Directors is the grammatical subject throughout the paragraph, which describes Board oversight of cybersecurity risk, the briefing cadence (annual and periodic updates), and the topics covered in Board discussions.


reasoning: This paragraph describes an actual cybersecurity incident with specific details about what happened (unauthorized third party access), when it was detected (June 30, 2024), and response actions taken (retained external cybersecurity experts), which fits the Incident Disclosure category. The specific date provides one firm-specific fact, but without a named third-party firm or quantified amounts, it does not reach Quantified-Verifiable.


reasoning: The paragraph describes the company's internal risk management framework and governance structure, including the establishment of a senior leadership committee for risk oversight. While an IT leadership role is mentioned, it describes the committee structure rather than the person's qualifications.


reasoning: The paragraph describes the company's cybersecurity governance structure, with the board having oversight responsibility for cybersecurity risk and management (CEO, Interim CFO) responsible for incident response and reporting to the board. The board is the primary oversight body mentioned, with no delegation to committees.


reasoning: The paragraph focuses on identifying specific management roles (CIO and VP, Information Security) and describing the qualifications and experience of the personnel leading the cybersecurity program, which fits the Management Role category under the person-vs-function test.


reasoning: The paragraph describes the company's internal cybersecurity incident detection and response processes, including the incident response plan and tabletop exercises. It contains no named frameworks, specific roles, dates, or other firm-specific details that would distinguish it from generic disclosure language.


reasoning: The paragraph describes the company's commitment to developing and amending processes to meet evolving cybersecurity regulations and best practices, which constitutes a description of internal risk management processes, though stated at a high level. The statement about no incidents occurring is a negative statement, not an incident disclosure.


reasoning: The paragraph describes the company's internal cybersecurity risk assessment processes, including the structure and activities of the Cybersecurity Council and executive management's role in assessing material risks. This is about what the governance structures DO (processes and activities) rather than the qualifications of specific individuals, fitting Risk Management Process.


reasoning: The paragraph describes the governance structure for cybersecurity oversight, including a management committee (Information Security Governance Committee) that reports to the Board and provides regular updates on cybersecurity risks, incidents, and program activities. While the committee is a management body rather than a board committee, the paragraph's focus is on how cybersecurity oversight flows to the Board through reporting cadences and educational sessions.


reasoning: The paragraph describes the company's internal cybersecurity risk management program components, including policies, risk assessments, security team responsibilities, and third-party vetting processes. No specific facts remain after filtering—generic program names (incident response plan, business continuity policy), unnamed external consultants, and standard practices like employee training do not meet the Firm-Specific threshold.


reasoning: The Audit and Finance Committee is the grammatical subject in two of three sentences, describing its oversight responsibilities and the updates it receives from management. The management roles are mentioned primarily in the context of their reporting relationship to the board committee.


reasoning: The paragraph describes Deutsche Bank Group's internal cybersecurity controls, prevention methods, detection capabilities, incident response processes, and information-sharing practices, which are the company's own risk management processes.


reasoning: The paragraph identifies specific management roles (CTO and VPCS) with their reporting lines and responsibilities for cybersecurity oversight and day-to-day management, fitting the Management Role category. Both CTO and VP of Cyber Security are cybersecurity-specific titles per the guidance, making this Firm-Specific.


reasoning: This paragraph is primarily forward-looking risk acknowledgment language, generic statements about cybersecurity commitment, and a cross-reference to Risk Factors. The statement about not experiencing a material incident in 2023 is a negative disclosure (absence of an event), not a substantive description of governance, management roles, risk management processes, or third-party oversight.


reasoning: The paragraph describes the company's internal processes for identifying and assessing cybersecurity risks through retained consultants and vendors, which fits Risk Management Process. No named frameworks, specific dates, named third-party firms, or cybersecurity-specific titles (CISO, CTO, CIO) appear—only generic references to unnamed partners and common security practices.


reasoning: The paragraph describes the company's Cybersecurity Committee governance structure, including its composition and role in prioritizing cybersecurity programs and providing oversight. This is an internal process for managing cyber risk, not individual management role qualifications or board-level oversight.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including framework adoption (NIST), control testing by internal and third parties, and industry benchmarking—clearly fitting Risk Management Process. It names the NIST framework but contains no facts unique to Freshpet, making it Sector-Adapted.


reasoning: The paragraph is primarily a materiality assessment stating that no material cyber breaches have occurred as of the filing date, which constitutes a materiality conclusion under Strategy Integration. The secondary mention of reviewing policies and procedures is generic and does not describe specific risk management processes.


reasoning: The paragraph describes the company's internal cybersecurity risk management approach, including ERM integration and adoption of recognized frameworks (NIST, ISO). The brief Board oversight mention is incidental to the main focus on the company's processes and policies.


reasoning: The paragraph concludes with a materiality disclaimer stating the company is not aware of any cybersecurity risks that have materially affected or are reasonably likely to materially affect its business strategy, results of operations, or financial condition. Per the category tiebreakers, materiality disclaimers should be classified as Strategy Integration even if boilerplate.


reasoning: The paragraph focuses on Board and Audit Committee oversight of cybersecurity risks, including director expertise identification and management reporting lines to the Board/Committee. CISO and CDIO are cybersecurity-specific titles that distinguish this disclosure from generic boilerplate.


reasoning: The paragraph focuses on the CIO's qualifications, credentials, and tenure, which fits the Management Role category per the Person-vs-Function Test. The specificity is Quantified-Verifiable because it contains multiple hard facts: specific years of experience (19 total, 11 with company) and named certifications (SANS Global Information Security Leader, Certified Information Systems Auditor), matching the calibration example for CISO credentials.


reasoning: This paragraph is a forward-looking disclaimer about hypothetical future cybersecurity incidents with a cross-reference to the Risk Factors section. It contains no substantive disclosure about actual governance, processes, incidents, or materiality assessments—only generic risk acknowledgment language that could appear in any company's filing.


reasoning: The paragraph identifies specific management roles involved in cybersecurity risk management and describes their responsibilities, with management as the grammatical subject throughout. The identification of the Head of Security and Head of Global Privacy constitutes firm-specific disclosure of cybersecurity-related roles.


reasoning: The paragraph describes board committee oversight—specifically the Committee receiving reports from management on cybersecurity posture and incidents—which fits the Board Governance category. No specific facts are present: 'The Committee' is generic governance language, 'management' is generic, and 'annual' is a vague cadence without exact dates.


reasoning: The paragraph focuses on the ISO's personal qualifications, credentials, and career experience, which fits the Management Role category under the person-vs-function test. The specificity is Quantified-Verifiable due to the specific number of years (25) combined with multiple named certifications that can be independently verified.


reasoning: The paragraph describes the company's internal cybersecurity risk assessment, monitoring, and security tool deployment processes. It contains no named frameworks, specific dates, named products, or other firm-specific facts—only generic descriptions of security practices and tool categories that could apply to any company.


reasoning: The paragraph describes an actual cybersecurity incident—a 2021 ransomware attack with details about unauthorized access and data acquisition—making it Incident Disclosure. However, the year '2021' alone lacks month specificity and does not meet the threshold for a 'specific date' under the IS list examples (which require month+year or exact date), and no other facts from the IS list are present, resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes the company's internal cybersecurity program elements including risk assessments, security team responsibilities, training, incident response planning, and third-party risk management as components of their overall process.


reasoning: The paragraph describes reporting lines from the Chief Security Officer to board-level governance bodies, including the Supervisory Board's Committee responsible for technology, data and innovation, which constitutes board oversight of cyber risk. The Chief Security Officer is a cybersecurity-specific role and the Supervisory Board's Committee is a named non-generic committee, meeting the Firm-Specific threshold.


reasoning: The paragraph describes the company's internal cybersecurity risk assessment processes, committee structure, and technical safeguards, which clearly fits Risk Management Process. It contains firm-specific facts including a named non-generic committee (Information Security Steering Committee) and a cybersecurity-specific role (CISO), but lacks the two hard verifiable facts needed for Quantified-Verifiable.


reasoning: The paragraph describes the company's internal cybersecurity risk management program and the industry frameworks it adopts (NIST CSF and CIS), which is a classic Risk Management Process disclosure. It names recognized standards but contains no facts unique to this company.


reasoning: This paragraph describes an actual cybersecurity incident (the Change Healthcare breach), including what happened, when, the operational impact on the company's billing processes, and response actions, which fits the Incident Disclosure category. It contains multiple hard verifiable facts including two specific dates (March 7, 2024; March 18, 2024) and named third-party entities (Change Healthcare, UnitedHealth Group, Exogen device), meeting the Quantified-Verifiable threshold.


reasoning: The paragraph describes the company's internal cybersecurity risk management activities including threat hunting, monitoring, threat intelligence sharing, third-party evaluations, and vendor oversight. The mention of third-party service provider review is a component of internal processes rather than the central topic, and no specific frameworks, roles, dates, or verifiable facts are named.


reasoning: The paragraph discusses potential business and financial impacts of cybersecurity risks on the company's operations, reputation, and financial condition, which aligns with Strategy Integration's coverage of business/financial impact. It contains no specific facts, named frameworks, dates, or verifiable details—only generic risk factor language that could apply to any company.


reasoning: The paragraph identifies multiple management roles (CISO, CFO, COO, General Counsel, CTO) comprising a cybersecurity oversight committee and describes the CISO's supervisory role over the InfoSec team. The focus is on who oversees cybersecurity rather than the technical details of risk management processes. Specificity is Firm-Specific due to the cybersecurity-specific titles (CISO, CTO) and named internal programs (InfoSec Roadmap, InfoSec team).


reasoning: The paragraph describes the company's internal cybersecurity training and awareness processes, which falls under Risk Management Process. No specific facts from the IS list are present—'monthly' and 'regular' are generic cadences without exact dates, and the training practices described are common security measures that could apply to any company.


reasoning: The paragraph describes the company's internal cybersecurity risk management program components, including risk assessments, security team responsibilities, training, incident response planning, and third-party risk management as one element of the broader program.


reasoning: The paragraph describes the company's internal cybersecurity program structure and the activities of its information security and data privacy teams, which constitutes risk management process disclosure. It contains no specific facts such as named frameworks, specific roles like CISO, dates, or verifiable details that would distinguish it from generic security program language.


reasoning: The paragraph describes Tripadvisor's internal processes for managing cybersecurity risk, including committee structures, oversight mechanisms, and monitoring activities integrated with enterprise risk management. It contains firm-specific facts including a named committee (Information Governance and Privacy Committee) and specific team composition details.


reasoning: The paragraph primarily describes the Audit Committee's oversight structure and reporting cadence for cybersecurity risk management, with the CIO described in relation to their reporting duties to the Committee. The CIO qualifications and team details support the governance framework but constitute substantial Management Role content, creating borderline classification.


reasoning: The paragraph covers both Board oversight and management roles, but the management section is more detailed and substantive, identifying specific positions (Senior Director of Information Technology, Senior Vice President Quality Assurance) and describing their responsibilities and qualifications. The specific team composition 'internal technology and quality assurance compliance personnel' provides a firm-specific detail.


reasoning: This paragraph describes the company's internal cybersecurity processes and controls (training, monitoring, vulnerability management, threat intelligence) without any named frameworks, specific roles, dates, or unique identifiers that would distinguish it from any other company's disclosure.


reasoning: This paragraph is a forward-looking risk disclaimer describing potential consequences of cyber-attacks in general terms, without any substantive disclosure about the company's actual governance, processes, roles, or incidents.


reasoning: This paragraph describes an actual cybersecurity incident with incident narrative (November 2023 timing), scope (exfiltration of employee and patient information), operational impact (temporary disruption), and response actions (enhanced security measures, new tools, expanded vulnerability management). The specific date of November 2023 provides one firm-specific fact, but named internal programs do not count toward the Quantified-Verifiable threshold.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including ongoing threat identification, assessment, and mitigation activities. It contains no named frameworks, specific roles, dates, or other firm-unique details that would distinguish it from generic disclosure.


reasoning: This paragraph describes an actual cybersecurity incident (ransomware attack) with specific details about when it occurred, what systems were affected, and the business impact (service delays, costs), which fits the Incident Disclosure category per the tiebreaker rules.


reasoning: The paragraph describes the company's internal incident response policy, including escalation procedures and reporting lines, which constitutes a risk management process. CFO is a generic C-suite role and Audit Committee is a standard governance body, neither qualifying as firm-specific facts under the specificity criteria.


reasoning: The paragraph focuses on management oversight structure (DPIRC, a management committee co-chaired by CCO and CIO) and the Vista CIO's qualifications and tenure, making Management Role the primary category. The DPIRC is a named non-generic committee and the CIO is a cybersecurity-specific role, meeting the Firm-Specific threshold, but the date (year only) and duration do not qualify as hard verifiable facts for Quantified-Verifiable.


reasoning: This paragraph contains a materiality conclusion stating that cybersecurity threats have not materially affected the company's business strategy, results of operations, or financial condition, which falls under Strategy Integration per the guidelines. The cross-reference to Risk Factors appended to the materiality assessment does not change the classification.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including risk assessment, incident response procedures, training, and ongoing monitoring. It contains no named frameworks, specific roles, dates, or any facts from the IS list—only generic descriptions that could apply to any company.


reasoning: The paragraph describes a management-level committee (ISSC) with oversight responsibility for cybersecurity risks, including its specific composition across multiple departments. This fits Management Role as it addresses management oversight structure rather than board governance or specific risk management processes.


reasoning: The paragraph describes an actual cybersecurity incident (phishing scam in 2024 that resulted in a loss) and the company's response actions (additional cybersecurity procedures, new checking accounts), which qualifies as Incident Disclosure under the tiebreaker for paragraphs that describe what happened in an incident.


reasoning: This is a forward-looking risk disclaimer about potential cybersecurity threats to the company and its customers/suppliers, with no substantive disclosure about governance, processes, incidents, or actual strategies.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes including policies, vulnerability scanning, disaster recovery testing, and annual program evaluation. It contains no named frameworks, specific dates, named roles, named tools, or other firm-specific facts that would elevate it above generic boilerplate.


reasoning: This paragraph describes an actual cybersecurity incident with specific details about what happened (unauthorized access via social engineering attack), when (September 14, 2023), scope (loyalty program database with driver's license and SSN data), and response actions (IRP activation, law enforcement notification, engagement of third-party professionals). The specific date qualifies as a Firm-Specific fact, but without a second hard verifiable fact (no named third-party firms, dollar amounts, or headcounts), it does not reach Quantified-Verifiable.


reasoning: The paragraph describes the company's internal risk assessment process and framework adoption for cybersecurity, which is a Risk Management Process topic. It names the CIS Critical Security Controls framework (a recognized standard) but contains no facts unique to this specific company.


reasoning: The paragraph describes board and Audit Committee oversight activities with the board and its committee as the grammatical subjects receiving updates and discussing cybersecurity threats with management. No specific facts qualify under the IS list—Board of Directors, Audit Committee, and CEO are all generic governance terms, and cadences like 'periodic' and 'annual basis' lack specific dates.


reasoning: The paragraph is entirely focused on vendor oversight—due diligence, contractual requirements, and ongoing monitoring of third-party service providers—making Third-Party Risk the appropriate category. The mention of SOC reports, a recognized standard, elevates this to Sector-Adapted, but there are no firm-specific facts such as named vendors, specific dates, or unique internal programs.


reasoning: The paragraph describes management's oversight activities for cybersecurity risk management, including charter adoption, periodic reviews, and reporting to the Board, which constitutes internal process description. No specific facts are present—'Management' and 'Board' are generic governance terms, 'periodically' is a vague cadence, and no named frameworks, roles, dates, or verifiable details appear.


reasoning: This paragraph describes an actual cybersecurity incident with specific dates (August 5-8, 2025), what happened (threat actor gained unauthorized access), and scope (may have acquired certain data), which clearly falls under Incident Disclosure. The specific date range provides one hard verifiable fact, making it Firm-Specific, but without a second hard fact (named third-party firm, dollar amount, etc.), it does not reach Quantified-Verifiable.


reasoning: This paragraph describes the company's internal security policy framework and its objectives (protecting data confidentiality, integrity, availability; security controls; company-wide risk management), which constitutes a description of internal risk management processes. The policy name 'Enterprise Information Systems Security Policy' is a generic descriptive title without a unique identifier, and the paragraph contains no named frameworks, specific dates, roles, or other firm-specific facts.


reasoning: The paragraph is entirely focused on vendor oversight processes—including questionnaires, due diligence, audit reports, and contractual security terms—making Third-Party Risk the appropriate category. No specific frameworks, dates, named entities, or unique details are mentioned, resulting in Generic Boilerplate specificity.


reasoning: This paragraph is primarily a materiality disclaimer stating that cybersecurity threats have not materially affected the company's business strategy, results of operations, or financial condition, combined with a statement about the absence of cyber insurance coverage—both elements that fall under Strategy Integration per the guidelines.


reasoning: This paragraph presents a materiality assessment conclusion stating that monitoring has not identified cybersecurity risks expected to significantly affect the company, which falls under Strategy Integration per the guidelines for standalone materiality conclusions. The language is entirely generic boilerplate with no specific facts, dates, named roles, or verifiable details.


reasoning: The paragraph identifies a specific management body (cybersecurity sub-committee), describes their qualifications (combined 45 years of experience), and outlines their responsibilities—fitting Management Role as it focuses on the role and expertise of this governance body rather than describing internal processes in the abstract.


reasoning: The paragraph focuses on Board oversight responsibilities (reviewing ICSPP and ICSIRP, monitoring risks) and specifically highlights a board member's cybersecurity expertise, with the Board of Directors as the grammatical subject in multiple sentences.


reasoning: The paragraph describes the company's risk management structures, policies, procedures, and cybersecurity organization within the operations department, which constitutes disclosure about internal processes for managing cyber risk. While it opens with a materiality disclaimer about no incidents, the substantive content focuses on risk management processes rather than strategy or incident disclosure.


reasoning: The paragraph describes the company's internal risk assessment and mitigation processes, including evaluating safeguards, addressing gaps, and monitoring effectiveness. The CIO mention is incidental to describing the process rather than focusing on the person's qualifications, so this falls under Risk Management Process per the person-vs-function test.


reasoning: The CISO is the grammatical subject throughout, with the paragraph focusing on role identification, responsibilities, and reporting lines to the Chief Risk Officer. While it describes some departmental activities, the primary focus is on the management role structure rather than detailed risk management processes.


reasoning: The paragraph primarily describes the Company's cybersecurity policies, standards, processes, and practices, including framework adoption (ISO, NIST) and the comprehensive approach to addressing cybersecurity risks. While the first two sentences mention Board oversight, this serves as introductory framing for the substantive Risk Management Process content that follows.


reasoning: The paragraph describes the company's internal information security processes for identifying, assessing, and managing cybersecurity risks to their systems and data, which is a classic Risk Management Process disclosure with no board, management roles, or incident details.


reasoning: This paragraph is a materiality disclaimer stating that cybersecurity threats have not materially affected the company's business strategy, results of operations, or financial condition, with a cross-reference to risk factors. Per the guidelines, materiality disclaimers are classified as Strategy Integration even when boilerplate, and cross-references appended to materiality assessments do not change the classification.


reasoning: The paragraph primarily describes the company's cybersecurity risk management process, including a named cybersecurity committee with specific role compositions and ongoing process improvements. The brief incident mention and materiality conclusion are secondary to the process description.