reasoning: This paragraph describes the board's oversight structure for cybersecurity, including delegation to the audit committee, which is classic Board Governance content. The paragraph contains only generic governance language (board, audit committee, risk oversight) with no domain-specific terminology, firm-specific facts, or verifiable claims.


content_category: Board Governance

fact: Chief Information Security Officer

fact: threat environment

fact: information security considerations

category_confidence: high

specificity_confidence: high

reasoning: This paragraph describes Audit Committee and Board oversight of cybersecurity, including the flow of information from management and engagement with the CISO, directly answering how the board oversees cybersecurity. The CISO role is firm-specific (Level 3), while 'threat environment' and 'information security considerations' are domain terms (Level 2).

provider: z-ai

stage: benchmark


content_category: Strategy Integration

reasoning: The paragraph primarily answers the question of whether cybersecurity has affected the business, stating a backward-looking materiality assessment that risks 'have not materially affected us, including our business strategy, results of operations or financial condition, to date.' This is a Strategy Integration conclusion per Rule 5. The specificity is Generic Boilerplate because the paragraph contains no domain terminology passing the ERM test, no firm-specific facts, and no verifiable claims—the negative assertion about material impact is not externally verifiable, and terms like 'cybersecurity risks' and 'security incidents' are generic business language.


content_category: Incident Disclosure

fact: June 2018

fact: $10 million

type: quantified

fact: ransomware

fact: malware

category_confidence: medium

reasoning: The paragraph primarily describes a real cybersecurity incident (June 2018 fraudulent payment incident) with specific details about nature, timing, and financial impact, though it also contains a materiality assessment that touches on Strategy Integration. Specificity is Quantified-Verifiable due to the specific date (June 2018) and exact dollar amount ($10 million) tied to the incident.


reasoning: This paragraph states materiality conclusions about cybersecurity risks—both backward-looking (have not materially affected) and forward-looking (reasonably likely to materially affect)—which per Rule 5 constitutes Strategy Integration. The specificity is Generic Boilerplate because the paragraph contains no domain terminology passing the ERM test, no firm-specific facts, and no verifiable claims—the negative assertions about absence of material risks are explicitly not externally verifiable per the specificity rules.


content_category: Risk Management Process

fact: penetration testing

fact: network perimeter

fact: vulnerability scanning

reasoning: This paragraph describes cybersecurity program activities—vulnerability identification, scanning, penetration testing, malware protection, log monitoring, and vendor due diligence—answering 'What does the cybersecurity program do?' The specificity is Domain-Adapted because the paragraph uses cybersecurity-specific terminology including penetration testing, malware, network perimeter, and vulnerability scanning that demonstrates domain expertise beyond generic ERM language.


content_category: None/Other

reasoning: This paragraph is a cross-reference directing readers to another section (Item 1A risk factors) for materiality disclosures, which falls under N/O per Rule 5. As a None/Other paragraph containing only a cross-reference with no substantive cybersecurity facts, it receives Generic Boilerplate specificity.


fact: October 15, 2025 — specific date of incident discovery

fact: Federal Bureau of Investigation (FBI) — named law enforcement agency notified

fact: threat actor, cyber incident response plan, encryption and monitoring software — domain terminology

reasoning: This paragraph describes an actual cybersecurity incident with specific details about timing, nature, and response, answering 'What happened in a cybersecurity incident?' The specificity reaches Level 4 due to the specific incident date (October 15, 2025) and named external party (FBI), both of which are independently verifiable facts.


reasoning: The paragraph primarily describes the oversight structure for cybersecurity, explaining how the CEO oversees day-to-day risk management, how executive management updates the Board on incidents, and how the Board receives periodic reports on cybersecurity risks. The language is entirely generic business/ERM terminology with no domain-specific cybersecurity expertise demonstrated, no firm-specific roles beyond generic titles (CEO, Board), and no verifiable claims—the materiality statement is a negative self-assertion that cannot be externally verified.


reasoning: This paragraph is a cross-reference directing readers to Item 1A (Risk Factors) for additional cybersecurity risk information, containing no substantive disclosure content itself. As a pure cross-reference with no cybersecurity measures, processes, or assessments described, it receives Generic Boilerplate specificity.


content_category: Management Role

fact: Chief Information Security Officer (CISO)

fact: over 30 years of experience in cybersecurity

fact: Security Officer in the United States Navy

fact: CISO at Amgen

fact: CISO at Warner Bros

fact: Cybersecurity roles at KPMG

fact: Cybersecurity roles at Forrester

reasoning: This paragraph describes the CISO's role responsibilities and detailed career qualifications, making it a clear Management Role classification. The specificity reaches Quantified-Verifiable due to the 'over 30 years of experience' claim and the named previous employers (Amgen, Warner Bros, KPMG, Forrester) that can be independently verified against professional records.


content_category: Third-Party Risk

fact: service provider oversight committee

reasoning: The paragraph's central topic is oversight of third-party service providers—covering selection, due diligence, contracting, monitoring, and security assessments—which directly answers how third-party cyber risks are managed. Specificity reaches Level 3 due to the named 'service provider oversight committee,' a non-generic organizational structure that distinguishes this company's governance approach.


reasoning: This paragraph is a pure cross-reference directing readers to Item 1A Risk Factors for additional cybersecurity information, containing no substantive disclosure about governance, management, processes, or incidents.


fact: Information Security Steering Committee (ISSC)

fact: executives from Legal, Accounting, Internal Audit and Risk Management, Cybersecurity, and Facilities departments

reasoning: This paragraph describes a management-level committee (ISSC), its composition by department, and its oversight responsibilities—directly answering how management is organized to handle cybersecurity. Specificity reaches Level 3 due to the named committee (ISSC) and specific departmental composition.


reasoning: The paragraph describes requirements imposed on third-party service providers (certification of security measures, breach reporting obligations), which addresses how third-party cyber risks are managed, though it also touches on using third parties for internal cybersecurity support. The language is entirely generic business terminology without domain-specific concepts, firm-specific details, or verifiable claims.


fact: triage

fact: eradicate

specificity_confidence: medium

reasoning: The paragraph primarily provides a materiality assessment stating that cybersecurity risks have not materially affected and are not reasonably likely to materially affect the company's business strategy, results of operations, or financial condition—the core SI disclosure under Item 106(b)(2). The incident response terminology 'triage' and 'eradicate' in describing control activities passes the ERM test, as non-security ERM professionals would say 'mitigate' or 'manage' risks rather than 'eradicate' attacks.


fact: more than 20 years of information security experience

fact: Chief Security Officer role at Deutsche Bank

fact: global CISO/CSO for three large European financial institutions

fact: partner position at global strategy and consulting firm

reasoning: The paragraph describes the Chief Security Officer's qualifications, career history, and supporting team structure, answering how management is organized for cybersecurity (Management Role). Specificity reaches Quantified-Verifiable due to 'more than 20 years' of experience—a verifiable lower bound that can be checked against the individual's resume.


fact: threat actors

fact: exfiltrated

reasoning: This paragraph describes an actual cybersecurity incident including unauthorized access, data exfiltration, public release of information after non-payment, and remediation steps taken, which directly answers 'What happened in a cybersecurity incident?' The paragraph uses cybersecurity domain terminology ('threat actors', 'exfiltrated') that passes the ERM test, but contains no firm-specific roles or verifiable facts such as dates, numbers, or named third parties.


reasoning: The paragraph primarily states a conclusion about whether cybersecurity has affected business outcomes—a negative assertion that no material incidents have occurred, which is a Strategy Integration assessment per Rule 5. The second sentence is generic speculation and the third is a cross-reference, but the first sentence's materiality conclusion drives the category. Specificity is Level 1 because the negative assertion about no material incidents is not a distinguishing firm-specific fact (many companies make similar claims), and the paragraph contains no domain terminology or verifiable facts.


fact: February 23, 2023 - specific date of network outage

fact: DISH Network network outage affecting internal servers and IT telephony

fact: February 28, 2023 - specific date of disclosure about data extraction

fact: data extracted from DISH Network IT systems

reasoning: This paragraph describes an actual cybersecurity incident at DISH Network with specific dates, nature of the attack (network outage, data extraction), response actions taken, and subsequent disclosures, which directly answers 'What happened in a cybersecurity incident?' Specificity is Level 4 because the paragraph contains multiple hard dates (February 23, 2023 and February 28, 2023) and specific claims about data extraction that are externally verifiable through public records and SEC filings.


fact: February 2023

fact: ransomware attack

fact: credit monitoring

reasoning: This paragraph describes an actual cybersecurity incident (February 2023 ransomware attack), including its impact on employee data and specific remediation steps taken, which directly answers 'What happened in a cybersecurity incident?' The specific date 'February 2023' tied to a real incident is externally verifiable, elevating this to Quantified-Verifiable specificity.


fact: Deutsche Bank Group as named parent entity with incident management coverage

fact: DWS as named entity with notification protocol

fact: Organizational claim that Deutsche Bank Group's incident management covers subsidiaries including the company

reasoning: This paragraph describes incident management processes and notification protocols, answering what the cybersecurity program does when incidents occur. Specificity is Level 3 due to the named entities (Deutsche Bank Group, DWS) and the specific organizational claim about how notification protocols flow between these entities and the company.


fact: March 31, 2023 restoration date

fact: DISH TV, SLING TV and Retail Wireless services

reasoning: This paragraph describes the operational impact, restoration timeline, and conclusion status of an actual cybersecurity incident, which directly answers 'What happened in a cybersecurity incident?' The specific date 'March 31, 2023' tied to systems restoration is a hard fact that could be independently verified, making this Level 4.


fact: Information Security Steering Committee (ISSC)

fact: executives from Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments

reasoning: This paragraph describes a management-level committee structure (ISSC), its specific departmental composition, and its oversight responsibilities—answering how management is organized for cybersecurity. The named committee (ISSC) and specific department composition (Legal, Accounting, Internal Audit and Risk Management, Cybersecurity, Facilities) are firm-specific facts that distinguish this company's governance structure.


reasoning: This paragraph is purely a cross-reference directing readers to Item 1.A for additional information, with no substantive cybersecurity disclosure content. It contains no domain terminology, firm-specific facts, or verifiable claims—only a navigational pointer to another section.


reasoning: This paragraph describes what the cybersecurity program does—assessing, identifying, and managing risks through controls and third-party reviews—which answers the RMP question. The language is entirely generic risk management terminology that any ERM professional would use; there are no domain-specific security practices, named tools or frameworks, firm-specific roles, or verifiable claims.


fact: IT Committee

reasoning: The paragraph describes ongoing cybersecurity program activities—identifying improvements, assessing security layers, evaluating technologies, and engaging experts for analysis—which fits Risk Management Process. Under Rule 1, a management-level committee described in terms of its activities (not structure/membership) maps to RMP. Specificity reaches Firm-Specific due to the named 'IT Committee,' a non-universal committee structure, though no domain-specific terminology or verifiable claims are present.


fact: Chief Information Security Officer

fact: 25 years of prior experience

fact: CISSP certification

fact: CISA certification

fact: CRISC certification

fact: CICA certification

fact: PCIP certification

fact: master's and bachelor's degrees in Computer Information Systems and Business Administration

reasoning: This paragraph describes the CISO's responsibilities, qualifications, and credentials, which directly answers the Management Role question about how management is organized to handle cybersecurity. Specificity is Quantified-Verifiable due to the 25 years of experience (specific number) and multiple named certifications (CISSP, CISA, CRISC, CICA, PCIP) that can be independently verified through certification registries.


fact: threat intelligence

fact: penetration testing

fact: managed cybersecurity service providers

reasoning: This paragraph describes the types of external service providers the company uses as part of its cybersecurity risk management activities, which fits RMP (Rule 3: third parties hired to serve the company are RMP, not TP). The specificity is Domain-Adapted because terms like 'threat intelligence,' 'penetration testing,' and 'managed cybersecurity service providers' demonstrate cybersecurity domain expertise that an ERM professional would not naturally use.


fact: Information Security Officer

fact: Chief Risk Officer

reasoning: The paragraph primarily describes the organizational structure for cybersecurity oversight, specifically the Information Security Officer's role, responsibilities, and reporting lines to the Chief Risk Officer and various committees. Specificity reaches Level 3 due to firm-specific roles (Information Security Officer, Chief Risk Officer) and a named committee (Information Technology Steering Committee) that distinguish this company's governance structure.


reasoning: This paragraph is a materiality assessment stating that management has not identified cybersecurity risks that have materially affected or are reasonably likely to materially affect the company, which directly answers the Strategy Integration question about business/financial impact. The specificity is Generic Boilerplate because the paragraph contains only negative assertions and generic risk language—no domain-specific terminology passing the ERM test, no firm-specific facts, and no externally verifiable claims.


reasoning: This paragraph is a materiality assessment stating that cybersecurity threats and incidents have not materially affected the company and are not reasonably likely to materially affect it, which per Rule 5 makes it Strategy Integration. The paragraph contains only generic language with no domain-specific terminology passing the ERM test, no firm-specific facts, and no verifiable claims—negative assertions about absence of incidents are not externally verifiable.


fact: June of 2023 - timing of cybersecurity event

fact: two of our employees - scope of email account access

fact: early September 2023 - customer notification timing

fact: approximately $25,000 in expenses incurred

reasoning: The paragraph describes an actual cybersecurity incident with specific details about timing (June 2023), nature (unauthorized access to employee email accounts), scope (two employees), notification (September 2023), and quantified financial impact ($25,000), making it clearly Incident Disclosure. Multiple verifiable facts including specific dates and dollar amounts elevate specificity to Quantified-Verifiable.


fact: Clarium Managed Services, LLC conducted a Cybersecurity Assessment

fact: score of 4.8 on a scale of 0 to 5

reasoning: The paragraph primarily states materiality conclusions about cybersecurity's lack of impact on the business, with the Clarium assessment serving as supporting evidence. Contains multiple verifiable facts: named assessor (Clarium Managed Services, LLC), specific year (2022), and quantified score (4.8 out of 5).


reasoning: This paragraph describes general IT procurement activities (using third parties for hardware, software, telecommunications) and mentions exploring cybersecurity vendors, but does not substantively address any of the six core cybersecurity disclosure questions - it neither describes oversight structure, management roles, risk management processes, vendor risk management, an incident, nor business impact. The paragraph contains no domain-specific cybersecurity terminology, firm-specific facts, or verifiable claims - only generic statements about IT outsourcing and vendor exploration.


fact: CSO (Chief Security Officer)

reasoning: This paragraph describes the CSO's role and management's organizational structure for cybersecurity—specifically how the CSO coordinates with executive leadership and deploys multidisciplinary teams—answering 'How is management organized to handle cybersecurity?' The CSO (Chief Security Officer) is a firm-specific cybersecurity leadership role that distinguishes this company's organizational structure from companies without such a position.


reasoning: This paragraph describes Board and Audit Committee oversight of cybersecurity, including delegation of responsibility and briefing frequency, which directly answers the Board Governance question. The specificity is Generic Boilerplate because Audit Committee is a generic governance role that exists at every company, and 'at least once each year' is a generic cadence without specific dates—no domain terminology, firm-specific facts, or verifiable claims are present.


fact: June 2019

fact: over 20 years of experience

fact: system alerts of potential malicious cyber activity

fact: real-time dashboards

fact: attack vectors

reasoning: The paragraph blends management role qualifications with cybersecurity process descriptions; applying the person-removal test leaves substantive RMP content including system alerts, dashboards, and vulnerability monitoring, which constitutes the majority of the text. Specificity reaches Level 4 due to the verifiable specific date (June 2019) and quantified experience claim (over 20 years), with domain terms like attack vectors and real-time dashboards providing additional technical depth.


fact: over twenty years of experience

fact: Project Management Professional certification

fact: Certified Scrum Master certification

fact: IT Infrastructure Library certification

reasoning: The paragraph primarily answers 'How is management organized to handle cybersecurity?' by describing the Head of IT role, reporting line to the CFO, qualifications, certifications, and responsibilities. Specificity reaches Level 4 due to multiple verifiable facts: 'over twenty years of experience' is a checkable lower bound, and named certifications (Project Management Professional, Certified Scrum Master, IT Infrastructure Library) can be verified through their respective credential registries.


fact: vulnerability scans

fact: penetration tests

reasoning: The paragraph describes the company's cybersecurity risk management activities including risk assessment methodology, monitoring, and testing, which directly answers 'what does the cybersecurity program do?' The domain terms 'vulnerability scans' and 'penetration tests' demonstrate cybersecurity expertise beyond generic ERM language, elevating specificity to Domain-Adapted.


fact: February 23, 2023 network outage affecting internal servers and IT telephony

fact: February 28, 2023 disclosure that data was extracted from IT systems

reasoning: This paragraph describes an actual cybersecurity incident with specific timeline (February 23, 2023 outage, February 28, 2023 data extraction disclosure), scope (internal servers, IT telephony, data extraction), and response actions, clearly answering 'What happened in a cybersecurity incident?' The specific dates tied to real, publicly-reported events are externally verifiable facts.


reasoning: This paragraph provides regulatory context and a cross-reference to another section without disclosing any substantive cybersecurity measures, processes, or governance structures. It contains no domain-specific terminology beyond generic regulatory language and no firm-specific or verifiable facts.


reasoning: The paragraph's primary substantive content is a materiality assessment stating the company has not been materially affected by cybersecurity incidents and does not expect past incidents to materially affect it, which directly answers the Strategy Integration question about business/financial impact. No domain-specific terminology passes the ERM test, no firm-specific facts are present, and the negative materiality assertion is not externally verifiable.


reasoning: This paragraph describes the governance chain for cybersecurity oversight, showing how information flows from an IT employee through the CEO to the Board, which is classic Board Governance content. The paragraph contains no domain-specific terminology (prevention/detection/mitigation are generic ERM terms), no firm-specific facts (CEO and Board are generic roles), and no verifiable claims.


fact: National Institute of Standards and Technology (NIST) frameworks

fact: Center for Internet Security Controls

reasoning: This paragraph describes the company's cybersecurity risk management program and the frameworks it adopts, directly answering what the program does. Specificity is Level 2 because the paragraph references named cybersecurity frameworks (NIST, CIS Controls) that demonstrate domain expertise beyond what a general ERM professional would naturally use.


fact: managed security service monitoring

fact: penetration testing

fact: vulnerability assessment

fact: Management Enterprise Risk Committee

fact: Vendor Management Committee

reasoning: The paragraph centrally addresses how third-party cyber risks are managed through vendor oversight mechanisms—risk management guidelines, due diligence reviews, ongoing oversight procedures, and contractual cybersecurity requirements—making it Third-Party Risk. Specificity reaches Firm-Specific due to two named management-level committees (Management Enterprise Risk Committee, Vendor Management Committee) that distinguish this company's governance structure, plus domain terminology including penetration testing, vulnerability assessment, and managed security service monitoring.


reasoning: This paragraph describes Board oversight mechanisms—how committee results flow to the Board, what cybersecurity topics are presented at meetings, and how significant threats are communicated between meetings—which directly answers the Board Governance question. The paragraph contains no domain terminology passing the ERM test (all language is generic governance/risk vocabulary), no named roles or committees (the Committee is referenced but not named), and no verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes how third-party consultants support the company's cybersecurity program (risk assessment, policy design, monitoring, testing) and the requirements placed on these service providers, which falls under RMP as these are third parties hired to serve the company's internal program rather than supply chain vendor oversight. The language is entirely generic business terminology without domain-specific cybersecurity concepts, firm-specific details, or verifiable claims.


fact: backdoor into ISG systems or network

reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party suppliers, including risk assessment processes, contractual security requirements, and supplier engagement on deficiencies. The term 'backdoor' is a cybersecurity-specific concept that passes the ERM test, establishing Domain-Adapted specificity, while no firm-specific roles, named programs, or verifiable claims are present.


reasoning: This paragraph contains two materiality assessments: a forward-looking statement that no known cybersecurity risks are reasonably likely to materially affect the company, and a backward-looking negative assertion that no material incidents occurred during the reporting period. Both are conclusions about whether cybersecurity affects business outcomes, which per Rule 5 defines Strategy Integration. Specificity is Level 1 because negative assertions about absence of risks or incidents are not externally verifiable, and the language contains no domain-specific terminology or firm-specific facts.


fact: vulnerability assessments

fact: threat environment

reasoning: The paragraph describes the Board and Audit Committee's oversight structure for cybersecurity, including information flow and reporting relationships, which is classic Board Governance content. Specificity reaches Level 2 due to domain terminology ('vulnerability assessments', 'threat environment') that demonstrates cybersecurity expertise beyond generic ERM language; 'Executive Director of IT' lacks a security qualifier and thus does not qualify as firm-specific.


fact: Chief Information Security Officer (CISO)

fact: Chief Risk Officer (CRO)

fact: information security team

fact: over 18 years of experience in information technology leadership

fact: eight years of experience in leading information security oversight

reasoning: This paragraph describes management organization for cybersecurity, including the CISO role, reporting lines to the CRO, and qualifications of the CISO and team. Specificity reaches Level 4 due to two quantified claims about years of experience (18 years IT leadership, 8 years security oversight) that are externally verifiable against the CISO's professional history.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from vendors and third parties, including a Vendor Management Policy and risk-based oversight requirements—clearly fitting Third-Party Risk. The language is generic business/ERM terminology (risk assessments, ongoing monitoring, contractual controls) without domain-specific cybersecurity expertise, firm-specific identifiers, or verifiable claims, resulting in Level 1 specificity.


reasoning: This paragraph is introductory boilerplate that does not substantively answer any of the six category questions—it merely states that the company handles sensitive information and has a cybersecurity program without describing governance, management structure, processes, third-party management, incidents, or business impact. No domain-specific terminology, firm-specific facts, or verifiable claims are present, resulting in Generic Boilerplate specificity.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers, including assessment timing, organizational collaboration, and evaluation criteria. No domain terminology passes the ERM test (the language is general business/risk management terminology any ERM professional could write), no firm-specific facts distinguish this company, and no verifiable claims appear.


reasoning: This paragraph describes the Company's incident response plan and its components, which is a core element of cybersecurity risk management processes. The language is entirely generic—'incident response plan,' 'breaches,' 'roles, responsibilities, and steps to recover'—with no domain-specific terminology that passes the ERM test, no firm-specific details, and no verifiable claims.


reasoning: The paragraph describes the company's cybersecurity risk assessment and management processes, answering what the cybersecurity program does. Specificity is Level 1 because all language is generic ERM terminology that any business professional could write—no domain-specific terms, firm-specific details, or verifiable claims are present.


reasoning: This paragraph is a negative materiality assessment stating that no cybersecurity incidents have materially affected or are reasonably likely to materially affect the company, which falls under Strategy Integration per Rule 5. The specificity is Generic Boilerplate because the negative assertion about absence of incidents is not externally verifiable, and the paragraph contains no domain terminology, firm-specific facts, or quantified claims.


fact: Security & Technology Committee

reasoning: This paragraph describes how information flows to the Board and a named committee regarding cybersecurity incidents, directly answering how board oversight of cybersecurity works. The specificity reaches Level 3 due to the named 'Security & Technology Committee,' which is a firm-specific governance body not generic across all companies.


reasoning: The paragraph describes what the cybersecurity program includes (mechanisms, controls, technologies, policies) and how it operates with outside advisors, which answers 'What does the cybersecurity program do?' The language is entirely generic boilerplate with no domain-specific terminology passing the ERM test, no firm-specific roles or programs named, and no verifiable claims.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers, including diligence, monitoring, contractual requirements, and audits—clearly answering the third-party risk question. No domain terminology passes the ERM test (terms like 'diligence,' 'monitor,' and 'cybersecurity audits' are generic risk management language any ERM professional would use), and there are no firm-specific roles, named programs, or verifiable claims.


reasoning: This paragraph is a cross-reference to risk factors in Item 1A, containing only generic statements about facing cybersecurity risks without describing any substantive governance, management structure, processes, or specific incidents. No domain terminology, firm-specific facts, or verifiable claims are present.


reasoning: The paragraph describes management's organizational role in cybersecurity information flow—how the CFO coordinates with the cybersecurity team and the escalation pathway to CEO, senior management, and the Board. This answers 'How is management organized to handle cybersecurity?' All roles mentioned (CFO, CEO, senior management, Audit Committee, Board) are generic governance roles that exist at every public company, and the terminology (prevention, detection, mitigation, remediation, escalation process) is standard ERM vocabulary that fails the domain expertise test.


fact: Chief Financial Officer and Chief Executive Officer are responsible for managing and assessing cybersecurity practices

reasoning: The paragraph describes the governance chain with Board oversight delegated to CFO and CEO for day-to-day cybersecurity management, which is Board Governance per Rule 1. The assignment of cybersecurity responsibility to CFO and CEO rather than a dedicated CISO is a firm-specific organizational structure distinguishing this company's cybersecurity governance.


fact: March 31, 2023 restoration date

fact: DISH TV and SLING TV services

reasoning: This paragraph describes the operational status and restoration timeline of an actual cybersecurity incident, answering what happened during and after the event. The specific date 'March 31, 2023' tied to restoration completion is a hard fact that could be verified through service status records or customer reports, elevating to Level 4.


reasoning: The paragraph makes a materiality assessment about cybersecurity risks' effect on business outcomes ("we do not believe any risks...have materially affected or are reasonably likely to materially affect"), which is Strategy Integration under Rule 5. The specificity is Generic Boilerplate because the paragraph contains no domain-specific terminology, no firm-specific facts about organizational structure, and no verifiable claims—the materiality conclusion is a self-reported belief statement, and the cross-reference to Item 1A is not a cybersecurity fact.


fact: $2.7 million of loss - specific dollar amount verifiable via financial statements

fact: March 2023 - specific date of incident

reasoning: This paragraph describes an actual cybersecurity incident (fraudulently-induced wire transfers), including timeline, nature, response actions, and financial impact, making it Incident Disclosure. The specificity reaches Level 4 due to the quantified $2.7 million loss figure and the specific March 2023 date—both hard facts that can be independently verified through financial statements and SEC filings.


fact: Maritime Transportation System Information Sharing and Analysis Center (MTS-ISAC)

fact: FBI InfraGard

fact: NSA Cybersecurity Collaboration Center

fact: U.S. Coast Guard Area Maritime Security Committees and Cybersecurity Subcommittees

fact: Cyber-Hawaii

fact: U.S. Cybersecurity and Infrastructure Security Agency's Critical Partnership

reasoning: This paragraph lists specific external cybersecurity information-sharing and collaboration organizations the company participates with, which is part of their risk management process for threat intelligence and coordination. The named organizations (MTS-ISAC, FBI InfraGard, NSA Cybersecurity Collaboration Center, etc.) are specific, verifiable claims about the company's external partnerships that could be independently confirmed.


reasoning: This paragraph addresses cybersecurity insurance coverage, which falls under Strategy Integration as it concerns financial protection against cyber risks. The paragraph contains no domain-specific terminology that passes the ERM test (incident response is generic ERM language), no firm-specific facts, and no verifiable claims such as coverage amounts or named insurers.


reasoning: The paragraph is primarily a materiality assessment stating that cybersecurity risks have not materially affected and are not reasonably likely to materially affect the company, which falls under Strategy Integration per Rule 5; the brief Board governance mention at the end is secondary. Specificity is Generic Boilerplate because the materiality statement is a negative assertion (not externally verifiable), "Board" is a generic governance role, and no domain-specific terminology or firm-specific facts are present.


fact: SOC2 T2

fact: penetration testing

fact: ISO 27001 certification

reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from vendors and third parties, covering pre-engagement due diligence, contractual security requirements, and ongoing monitoring—clearly fitting Third-Party Risk. Specificity reaches Level 2 due to domain terminology (SOC2 T2, penetration testing, ISO 27001) that demonstrates cybersecurity expertise beyond generic ERM language, but no firm-specific or externally verifiable claims are present.


fact: CISO

fact: CIO

reasoning: This paragraph describes Board and Audit Committee oversight of cybersecurity, including the Audit Committee's semi-annual review of ERM and the information flow from cybersecurity leaders to the Board. Specificity is driven by firm-specific leadership roles: CISO, CIO, and Security & Resiliency global practice leader are named positions that distinguish this company's governance structure.


reasoning: This paragraph describes management's organizational role in cybersecurity—specifically, business unit senior management's responsibilities for day-to-day operations, reporting requirements for material cybersecurity events, and authority to determine SEC filing decisions. The CGNC reference provides oversight context, but management's role is the primary content. The language is entirely generic governance terminology that any ERM professional could write; 'CGNC' is a common acronym for a standard board committee, and the organizational structure described (business units responsible for cybersecurity, reporting upward, SEC filing decisions) contains no domain-specific expertise or firm-specific distinguishing facts.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party vendors, including contractual requirements, monitoring based on criticality and risk profiles, and a cyber review process during vendor onboarding. Specificity is Level 1 because the language is generic vendor management terminology that any ERM professional would use—no specific security practices (like SOC 2 review or encryption requirements), named standards, firm-specific organizational details, or verifiable claims appear.


fact: ISO (Information Security Officer)

fact: Interagency Guidelines for Safeguarding Customer Information

type: framework

reasoning: This paragraph describes the ISO's annual reporting to the board on Information Security Program status and compliance, which directly answers how the board oversees cybersecurity. Specificity reaches Firm-Specific due to the ISO role (a named cybersecurity leadership position) and includes the Interagency Guidelines as a domain framework reference.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from suppliers, describing the procurement process for assessing key suppliers' security posture. The language is generic risk management terminology that does not demonstrate cybersecurity domain expertise—phrases like 'cybersecurity certifications' and 'technical and organizational controls' lack the specificity of named standards or practices that would pass the ERM test.


reasoning: This paragraph is a pure cross-reference directing readers to another section of the filing, which falls under None/Other per Rule 5. It contains no substantive cybersecurity disclosure and no facts that would elevate specificity above Level 1.


reasoning: This paragraph describes board-level oversight through the Audit Committee, including reporting frequency and escalation procedures for material incidents, which directly answers how the board oversees cybersecurity. No domain terminology, firm-specific facts, or verifiable claims are present—the Audit Committee is a generic governance body that exists at every public company, and terms like 'cybersecurity threats and risks' and 'cybersecurity incidents' are generic language any business professional would use.


fact: Software Approval Board (named internal committee)

fact: cross-functional membership from Quality, Internal Audit, Information Security, Business Systems, and R&D

reasoning: The paragraph primarily answers how third-party cyber risks are managed, covering due diligence on high-risk vendors, a software approval process for third-party software, and contractual security requirements imposed on vendors. Specificity reaches Firm-Specific level due to the named 'Software Approval Board' committee and its specified cross-functional composition from five departments.


fact: Chief Information Officer

reasoning: The paragraph describes Board oversight of cybersecurity, including what information the Board receives and from whom, which directly answers the Board Governance question. Specificity reaches Firm-Specific due to the CIO role, a named VP-level leadership position that distinguishes this company's governance structure.


reasoning: This paragraph consists entirely of forward-looking disclaimers and a cross-reference to another section—it states that cybersecurity investment is driven by general risk rather than a specific incident, includes standard no-assurance language, and points readers to Item 1A for risk factor discussion. The materiality language ('reasonably likely to materially affect') is speculative forward-looking disclosure, not an actual assessment under Rule 5. The paragraph contains no domain-specific terminology, firm-specific facts, or verifiable claims.


reasoning: This paragraph is a materiality assessment stating that cybersecurity risks have not materially affected and are not reasonably likely to materially affect the company's business strategy, results of operations, or financial condition, which fits the Strategy Integration category under Rule 5. The paragraph contains no domain terminology passing the ERM test, no firm-specific facts, and no verifiable claims—the date is reporting context, and the negative assertion about absence of material impacts is not externally verifiable.


fact: patches (vendor-provided software fixes)

fact: vulnerability scanning

fact: intrusion detection tools

fact: security configurations

reasoning: This paragraph describes specific activities the cybersecurity program performs to address identified risks (patching, configuration management, vulnerability scanning, intrusion detection), which directly answers what the program does. The specificity reaches Domain-Adapted because terms like 'vulnerability scanning,' 'intrusion detection tools,' and 'patches' demonstrate cybersecurity domain expertise that an ERM professional would not naturally use.


reasoning: The paragraph describes how third-party consultants and service providers support the company's cybersecurity program through risk assessment, policy design, and testing—this is about third parties serving the company's internal program (RMP under Rule 3), not managing supply chain vendor risk. The language is entirely generic ERM-style terminology (risk assessment processes, policies and procedures, monitor and test safeguards, security measures, breach) with no domain-specific terms passing the ERM test, no firm-specific facts, and no verifiable claims.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from vendors, suppliers, and business partners through due diligence and contractual requirements, directly answering the third-party risk question. Specificity is Generic Boilerplate because the language—due diligence on practices and controls, contractual provisions, identifying and mitigating risks—uses generic ERM terminology that any business professional could write without demonstrating cybersecurity domain expertise.


reasoning: This paragraph states a management conclusion about whether cybersecurity risks are reasonably likely to materially affect the business, which is a forward-looking materiality assessment under Rule 5. The language is entirely generic—no domain-specific cybersecurity terminology beyond the topic itself, no firm-specific roles or structures, and the negative assertion about absence of material risks is not externally verifiable.


reasoning: This paragraph describes board-level oversight structure, specifically how the Audit Committee oversees cybersecurity risk and receives updates from management, which is classic Board Governance content. The paragraph contains no domain-specific terminology beyond generic references to cybersecurity risk and threats, no firm-specific cybersecurity roles (Chief Business Officer is a general business role, not a cybersecurity-specific position), and no verifiable claims—all elements are generic governance language applicable to any public company.


reasoning: The paragraph primarily describes Audit Committee oversight of cybersecurity (Board Governance), though it also contains a materiality assessment that would otherwise be Strategy Integration. No domain-specific terminology, firm-specific facts, or verifiable claims are present—only generic governance language and a standard negative materiality assertion that is not externally verifiable.


fact: September 14, 2023 - specific announcement date (verifiable)

fact: social engineering attack - domain terminology

fact: IRP (Incident Response Plan) - domain acronym

fact: loyalty program database - firm-specific data asset compromised

fact: state gaming regulators - firm-specific notification target

reasoning: This paragraph describes an actual cybersecurity incident (the September 2023 Caesars data breach), including the attack vector, data compromised, and response actions—directly answering 'What happened in a cybersecurity incident?' The specific date September 14, 2023 is a hard fact that could be independently verified against public announcements, elevating specificity to Level 4.


reasoning: This paragraph describes board-level oversight through the audit committee receiving reports from the CISO, which is classic Board Governance content about information flow to the board. Specificity reaches Firm-Specific due to the CISO role, a named cybersecurity leadership position that distinguishes this company's governance structure.


fact: Chief Technology Officer (CTO)

fact: Chief Information Security Officer (CISO)

reasoning: This paragraph describes board oversight of cybersecurity, including reporting lines from specific officers to the board and incident notification protocols, which directly answers the Board Governance question. Specificity reaches Firm-Specific (Level 3) due to the identification of two VP-level leadership roles—CTO and CISO—that distinguish this company's cybersecurity governance structure.


fact: over 20 years of experience

fact: Ecole Supérieure de Commerce de Chambéry, Rhône-Alpes, France

fact: Miami University

fact: bachelor's degree in management information systems and marketing

fact: CDO role

fact: interim CISO role

reasoning: This paragraph describes the roles, reporting lines, qualifications, and career history of Kroger's cybersecurity leadership (CDO and interim CISO), directly answering how management is organized to handle cybersecurity. Specificity reaches Level 4 due to verifiable facts including 'over 20 years' of experience (a checkable lower bound) and specific educational credentials from named institutions (Ecole Supérieure de Commerce de Chambéry and Miami University).


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party vendors, including compliance requirements and due diligence activities like questionnaires. The language is generic business risk management terminology (confidentiality, security, privacy requirements, questionnaires, inquiries) that does not demonstrate cybersecurity domain expertise or contain any firm-specific or verifiable facts.


reasoning: The paragraph primarily delivers a backward-looking materiality assessment ('risks from cybersecurity threats have not materially affected our Company'), which fits Strategy Integration under Rule 5. The paragraph contains only generic risk language and a cross-reference—no domain terminology passing the ERM test, no firm-specific structural facts, and no verifiable claims (negative assertions about absence cannot be independently verified).


reasoning: This paragraph describes the Audit Committee's oversight of cybersecurity risks and its information flow from management, which directly answers the Board Governance question of how the board oversees cybersecurity. The specificity is Generic Boilerplate because the paragraph contains only generic governance language—'Audit Committee' exists at every public company, 'periodic reports' is an unspecified cadence, 'third-party consultants' are unnamed, and no domain-specific terminology, firm-specific facts, or verifiable claims are present.


fact: Chief Information Officer (CIO)

fact: Information Security team

fact: led the Century Communities IT efforts since 2016

fact: more than 20 years of experience as an IT leader in the homebuilding industry

fact: CIO reports to our Corporate General Counsel

reasoning: This paragraph answers how management is organized for cybersecurity by describing the CIO's leadership of the Information Security team, qualifications, experience, and reporting line. Specificity reaches Level 4 due to verifiable claims: the CIO's tenure 'since 2016' and 'more than 20 years of experience' are specific quantities that could be independently verified against employment records.


fact: June 30, 2024 - specific date when cybersecurity incident was detected

fact: unauthorized third party gained access to certain information systems

fact: retained external cybersecurity experts to assist with investigation

reasoning: This paragraph describes an actual cybersecurity incident with specific details about timing (June 30, 2024), nature (unauthorized third party access to information systems), and response (retaining external experts), which directly answers 'What happened in a cybersecurity incident?' The specific date tied to a real event is externally verifiable, elevating specificity to Level 4.


reasoning: The paragraph's central topic is managing cybersecurity risks from third-party technology service providers, specifically describing outreach to providers to ascertain downstream implications of known breaches. Specificity is Generic Boilerplate because the language fails the ERM test—terms like 'cyberattack,' 'breaches,' and 'confidential information' are general business vocabulary any ERM professional would use, not cybersecurity domain expertise.


reasoning: This paragraph is a materiality assessment stating that no cybersecurity threats or incidents materially affected or are reasonably likely to materially affect business outcomes, which fits Rule 5's SI category for negative assertions about material impact. The specificity is Level 1 because the negative assertion about absence of incidents is not externally verifiable, and the hedging language and cross-reference contain no domain terminology, firm-specific facts, or quantified claims.


reasoning: This paragraph describes the reporting flow from management to the Audit Committee for cybersecurity oversight, which is a governance-chain disclosure about how information reaches the board. The paragraph contains no domain terminology passing the ERM test, no firm-specific facts (Audit Committee is a generic governance body present at virtually every public company), and no verifiable claims.


fact: CTO (external manager/advisor)

fact: Senior Vice President, Chief Financial Officer and Treasurer

fact: Senior Vice President, General Counsel and Corporate Secretary

fact: Senior Vice President, Chief Accounting Officer

fact: approximately 20 years or more of experience

reasoning: This paragraph describes the qualifications and experience of specific management executives, directly answering how management is organized to handle cybersecurity risks. The specificity reaches Level 4 due to the named external manager (CTO), multiple VP-level executive titles, and the quantified experience threshold of 20+ years which establishes a verifiable lower bound.


reasoning: The paragraph primarily describes management's role in cybersecurity oversight and their qualifications, making it Management Role. The claims are about generic roles (CEO, CFO) and common situations (management lacking cybersecurity certifications, consulting with unnamed third party), which don't distinguish this company from others.


reasoning: This paragraph is a backward-looking materiality assessment stating that cybersecurity risks and incidents have not materially affected the company's business strategy, results of operations, or financial condition, which fits the Strategy Integration category under Rule 5. The paragraph contains no domain terminology passing the ERM test, no firm-specific facts, and no verifiable claims—the negative assertion about absence of material impact is a self-reported claim that cannot be independently verified.


fact: Marco Technologies as Managed IT provider

fact: Red Canary for 24/7 endpoint monitoring

fact: High Point Networks for backup solutions

fact: monthly cybersecurity training requirement

fact: Return to Operations objectives of less than 24 hours

fact: CFO coordinates third-party providers and implements incident response plan

reasoning: This paragraph describes the company's cybersecurity program activities (monitoring, training, backups) using named third-party service providers, which per Rule 3 classifies as RMP rather than TP since these vendors are hired to perform cybersecurity functions for the company. Specificity reaches Level 4 due to multiple named vendors (Marco Technologies, Red Canary, High Point Networks) and a quantified RTO metric ('less than 24 hours') that are externally verifiable claims.


fact: CISO

fact: Global Information Security Policy

fact: NIST CSF

fact: endpoint detection

fact: security incident response and event management

fact: privileged access management

reasoning: The paragraph describes the cybersecurity program's activities including policy creation, framework adoption (NIST CSF), and layered security measures, which answers 'What does the cybersecurity program do?' The CISO mention describes their role in implementing program activities rather than organizational structure or qualifications. Specificity reaches Firm-Specific (Level 3) due to the CISO role and named Global Information Security Policy, with additional domain terms (NIST CSF, endpoint detection, privileged access management) at Level 2.


fact: $2.7 million of loss recognized

reasoning: This paragraph describes an actual cybersecurity incident (criminal wire fraud scheme) with specific details about timing (early Fiscal 2024), nature (fraudulently-induced wire transfers), response actions, and quantified financial impact ($2.7 million loss), making it a clear Incident Disclosure. The $2.7 million loss figure is a hard number that appears in the company's financial statements (referenced as Note 18), making it externally verifiable and elevating specificity to Quantified-Verifiable.


fact: CDIO chairs a security council

fact: security council comprised of senior leaders from Legal and Regulatory, Corporate Security, Network Engineering, Internal Audit, Finance & Accounting and Risk and IT Infrastructure

fact: April 2024 cyber-attack

reasoning: The paragraph primarily describes management-level organizational structure for cybersecurity: a security council chaired by the CDIO, its specific departmental composition, response teams and their expertise, and escalation procedures to the Audit Committee. Specificity reaches Level 4 due to the reference to the 'April 2024 cyber-attack,' a specific dated incident that can be independently verified through news reports or other SEC filings.


fact: The Business Continuity Institute (BCI)

fact: Disaster Recovery Institute International (DRII)

reasoning: The paragraph describes the company's business resilience planning methodology, including framework adoption (BCI, DRII, ISO 22301), assessment activities (business impact analyses, risk assessments), and testing exercises (tabletop exercises), which answers what the cybersecurity program does. The named business continuity standards demonstrate domain expertise but are referenced as guidance sources rather than verifiable certifications, placing specificity at Level 2.


reasoning: This paragraph is a cross-reference directing readers to Item 1A for risk factor information, which falls under None/Other per Rule 5. As a pure cross-reference with no substantive cybersecurity disclosure content, it contains no domain terminology, firm-specific facts, or verifiable claims.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party vendors, service providers, and external users of company systems, which directly answers the Third-Party Risk question. The language is entirely generic risk management terminology without domain-specific practices, firm-specific details, or verifiable claims.


reasoning: This is a governance-chain paragraph describing how cybersecurity oversight flows from management (IT Committee, SVP IT, CAO, COO) to the Board through briefings, ongoing dialogue, and strategic participation—by Rule 1, governance-chain paragraphs default to Board Governance when describing oversight structure. The Senior Vice President of Information Technology is a VP-level IT role qualifying as firm-specific; no domain terms pass the ERM test (briefing topics are generic), and no verifiable facts appear (no certifications, specific dates, or quantified claims).


fact: B.S. in Network Security

fact: Information Security Steering Committee (ISSC)

reasoning: This paragraph primarily answers how management is organized to handle cybersecurity, focusing on the CISO's role, qualifications, reporting line, and the management-level Information Security Steering Committee they lead. Specificity reaches Level 4 due to multiple verifiable facts about the CISO's qualifications: 'over 20 years of information security experience,' 'over four years as a director in the information security management practice of a big four accounting firm,' and 'B.S. in Network Security' — all externally verifiable claims.


reasoning: This paragraph centrally addresses how the company manages cybersecurity risks from vendors and subcontractors, including contractual security requirements and incident reporting obligations imposed on third parties. The language is generic business/contract management terminology that any ERM professional could write without cybersecurity domain expertise—no specific security practices, tools, or standards are mentioned.


fact: containment and remediation

reasoning: This paragraph describes third-party service providers hired to assist the company's cybersecurity program with containment and remediation activities, which falls under RMP per Rule 3 (third parties serving the company, not vendor oversight). The terms 'containment and remediation' are cybersecurity-specific incident response practices that pass the ERM test, elevating specificity to Domain-Adapted.


reasoning: This paragraph is a cross-reference directing readers to Item 1A Risk Factors for information about material cybersecurity effects, with no substantive cybersecurity disclosure content. Per Rule 5, cross-references pointing elsewhere are classified as None/Other, and the paragraph contains no domain terminology, firm-specific facts, or verifiable claims.


fact: Kroll (named third-party firm)

fact: November 2022 (specific date of security maturity assessment)

fact: September 2023 (specific date of tabletop exercises)

fact: Information Security Incident Response Policy (named internal program)

fact: Information Security Team (named team)

fact: penetration tests (domain term)

fact: network architecture (domain term)

fact: tabletop exercises (domain term)

reasoning: This paragraph describes the company's cybersecurity assessment and improvement activities with Kroll, including maturity assessments, gap remediation, policy development, and tabletop exercises—answering 'What does the cybersecurity program do?' Specificity reaches Level 4 due to the named third-party firm (Kroll) and specific dates (November 2022, September 2023) that are externally verifiable.


fact: CIO/CDO

fact: information security vulnerabilities

reasoning: The paragraph describes Board and Audit Committee oversight of cybersecurity, including reporting cadences, topics covered, and information flow from management to the Board. The CIO/CDO is a named VP-level role that qualifies as firm-specific, elevating specificity to Level 3.


reasoning: This paragraph describes board-level oversight structure and delegation to the Audit Committee, which directly answers how the board oversees cybersecurity risk. It contains only generic governance language with no domain-specific terminology, firm-specific facts, or verifiable claims.


fact: security questionnaires

fact: information security addenda

fact: network infrastructure

reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers, describing a vendor oversight program with specific assessment activities—this is the defining question for Third-Party Risk. Specificity reaches Level 2 because the paragraph uses cybersecurity domain terminology including 'security questionnaires,' 'information security addenda,' and 'network infrastructure' that would not naturally be used by a general ERM professional.


fact: chief information officer (CIO)

fact: cyber threat detection and response

fact: security engineering

reasoning: The paragraph primarily describes management-level cybersecurity leadership roles, responsibilities, and reporting lines (CIO and Director of IT positions, their reporting structures, and qualifications), with some RMP content at the end about assessments and audits. Specificity reaches Firm-Specific due to the CIO role, which is a VP-level cybersecurity leadership position; domain terms like 'cyber threat detection and response' and 'security engineering' provide additional Level 2 support.


reasoning: This paragraph describes management's responsibility for cybersecurity, specifically the CEO and SVP Finance/CFO's roles, their experience, and their engagement activities—answering 'How is management organized to handle cybersecurity?' No domain terms pass the ERM test (all terms like 'cybersecurity risks,' 'IT operations,' and 'awareness training' are generic business language), the roles mentioned are not cybersecurity-specific VP titles (SVP Finance/CFO is a finance role), and there are no verifiable claims such as specific dates, named individuals, certifications, or quantified facts.


fact: NIST Cybersecurity Framework

fact: FFIEC Information Technology Examination Handbooks

fact: FFIEC Cybersecurity Assessment Tool

fact: Information Security Officer

fact: Information Technology Officer

reasoning: The paragraph primarily describes the cybersecurity program's objectives, framework alignment, and review cadence, making it Risk Management Process; the person-removal test leaves substantial program content. Specificity reaches Firm-Specific (Level 3) due to the named leadership roles (Information Security Officer, Information Technology Officer) that distinguish this company's organizational structure, with additional domain terminology (NIST CSF, FFIEC frameworks) at Level 2.


reasoning: This paragraph primarily answers 'How are third-party cyber risks managed?' by describing due diligence assessments, contractual rights, and ongoing monitoring of third-party providers' cybersecurity—vendor oversight is the central topic. Specificity is Level 1 because the language is generic vendor risk management that any ERM professional could write; terms like 'security assessments,' 'cybersecurity standards,' and 'IT Security team' fail the ERM test and no specific tools, named standards, or verifiable claims appear.


reasoning: The paragraph describes the oversight structure for cybersecurity, identifying the governance chain from Board to Audit Committee to senior leadership, which directly answers how the board oversees cybersecurity risk. The language is entirely generic governance boilerplate with no domain terminology, firm-specific roles, or verifiable facts.


fact: Third-Party Risk Management Program

fact: Vendor Management Policy

fact: Vendor Management Program

fact: Internal Audit Risk Assessment

fact: Interagency Guidance on Third-Party Relationships: Risk Management

reasoning: The paragraph centrally addresses how the company manages third-party vendor risks through its named Third-Party Risk Management Program and Vendor Management Policy, including onboarding processes and periodic reviews, making it Third-Party Risk. Specificity reaches Firm-Specific due to multiple capitalized named internal programs and policies (Third-Party Risk Management Program, Vendor Management Policy, Vendor Management Program, Internal Audit Risk Assessment) that distinguish this company's specific governance structure.


fact: Vice President and Chief Information Security Officer (CISO)

reasoning: This paragraph describes Board and Audit Committee oversight of cybersecurity, including delegation of oversight responsibilities, reporting lines from the CISO to the Committee, and briefing frequencies—directly answering how the board oversees cybersecurity. The specificity reaches Firm-Specific due to the named VP-level cybersecurity leadership role (CISO), which distinguishes this company's governance structure from generic disclosures.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers, including due diligence on vendors with access to critical systems—this is the core question for Third-Party Risk. Specificity is Level 1 because the language is generic ERM-style vendor oversight terminology that any business professional would use; no domain-specific practices (like SOC 2 reviews, encryption requirements, security questionnaires) or firm-specific details are mentioned.


reasoning: The paragraph primarily provides a materiality assessment stating that cybersecurity threats have not materially affected and are not reasonably likely to materially affect the company's business strategy, results of operations, or financial condition, which fits the Strategy Integration category per Rule 5. The specificity is Generic Boilerplate because the paragraph contains no domain-specific terminology that passes the ERM test, no firm-specific facts, and the negative materiality assertion is not externally verifiable.


reasoning: This paragraph is a cross-reference directing readers to Item 1A Risk Factors for additional cybersecurity risk information, which is explicitly classified as None/Other. No domain terminology, firm-specific facts, or verifiable claims are present.


reasoning: This paragraph is speculative risk disclaimer language about potential future incidents without describing actual cybersecurity measures, governance, or processes. It contains no domain terminology passing the ERM test, no firm-specific roles with titles, and no verifiable claims.


fact: One member of our audit committee earned the NACD's CERT Certificate in Cybersecurity Oversight in 2023

fact: CISO (Chief Information Security Officer)

fact: quarterly cybersecurity-related updates to audit committee

fact: three times per year updates to full board of directors

reasoning: The paragraph answers how the board oversees cybersecurity, describing the audit committee's oversight role, board member expertise, information flow from the CISO to the audit committee and full board, and incident escalation procedures. Specificity reaches Level 4 due to the verifiable claim that an audit committee member earned the NACD's CERT Certificate in Cybersecurity Oversight in 2023, which can be independently verified through NACD records.


fact: National Institute of Standards and Technology (NIST) governance requirements and cybersecurity framework

reasoning: The paragraph primarily describes how cybersecurity risk management is integrated into the broader framework, how IT collaborates with risk management, and alignment with NIST standards—answering what the cybersecurity program does. The NIST framework reference demonstrates domain expertise beyond generic ERM language, elevating specificity to Domain-Adapted.


reasoning: The paragraph primarily describes what the cybersecurity program does (network security, data encryption, employee training, AI data protection measures), with a secondary sentence about board oversight. RMP content has more text so it wins the split. No domain terms pass the ERM test—network security, data encryption, and employee training are generic terms any ERM professional would use; the LLM/AI reference reflects general business awareness rather than cybersecurity expertise. No firm-specific facts (Audit Committee is generic governance) and no verifiable claims.


fact: penetration testing

fact: managed cybersecurity service providers

fact: cybersecurity consultants

fact: cybersecurity software providers

reasoning: This paragraph describes how the cybersecurity program operates by engaging third parties to assist with risk identification, assessment, and management—this is about what the program does, not about overseeing vendor risks. Under Rule 3, third parties hired to serve the company (consultants, pen testers, managed service providers) are RMP, not TP. Specificity is Domain-Adapted because terms like 'penetration testing' and 'managed cybersecurity service providers' demonstrate cybersecurity domain expertise that a non-security ERM professional would not naturally use.


reasoning: The paragraph centrally addresses how the company manages third-party cybersecurity risks through vendor diligence and risk assessment criteria, fitting Third-Party Risk. The language is entirely generic—vendor diligence, access to data and systems, and supply chain risk are standard ERM terms that do not demonstrate cybersecurity domain expertise or contain any firm-specific or verifiable facts.


reasoning: The paragraph primarily addresses how third-party cyber risks are managed through vendor due diligence and ongoing monitoring of third parties, with a brief mention of internal assessments in the final sentence. No domain terminology passes the ERM test (vendor due diligence, risk-based approach, and cybersecurity assessments are all terms an ERM professional would naturally use), and there are no firm-specific roles, named programs with identifiers, or verifiable claims.


reasoning: This paragraph describes how the company uses third-party service providers (assessors, consultants) to support its cybersecurity risk management activities, which falls under RMP per Rule 3 (third parties hired to serve the company, not vendor oversight). The language is entirely generic—no domain-specific terminology, no firm-specific details, and no verifiable claims—resulting in Level 1 specificity.


fact: CISO role (firm-specific)

fact: Reports to CIO (firm-specific)

fact: Over 20 years of experience (verifiable lower bound)

fact: Undergraduate degree in Information Systems from Xavier University (verifiable)

fact: MBA from Michigan State (verifiable)

fact: Over 25 IT and Cybersecurity certifications (verifiable lower bound)

fact: CISSP certification (verifiable)

fact: CCSP certification (verifiable)

fact: CISM certification (verifiable)

reasoning: This paragraph describes the CISO's role, reporting structure, team composition, and professional qualifications, directly answering how management is organized to handle cybersecurity. Contains multiple verifiable facts including named educational institutions (Xavier University, Michigan State), named certifications (CISSP, CCSP, CISM), and quantified claims (over 20 years experience, over 25 certifications).


fact: IT Security Director (firm-specific Director-level role with security qualifier)

fact: Chief Information Officer (VP-level role)

fact: threat intelligence (domain term)

reasoning: This paragraph describes management organization for cybersecurity—the IT Security Director's reporting line to the CIO, their responsibilities, and the cybersecurity team's qualifications—answering 'How is management organized to handle cybersecurity?' Specificity reaches Firm-Specific (Level 3) due to named leadership roles (IT Security Director, Chief Information Officer), with 'threat intelligence' providing domain terminology at Level 2.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party providers, describing vendor oversight mechanisms including assessments, questionnaires, security program reviews, and contractual obligations—clearly fitting the Third-Party Risk category. Specificity is Level 1 because the vendor management practices described (assessments, questionnaires, contractual obligations) are generic ERM language that any business professional would use; no cybersecurity-specific domain terminology, firm-specific details, or verifiable facts are present.


reasoning: This paragraph describes Audit Committee member education and expertise related to cybersecurity oversight, which directly answers how the board oversees cybersecurity risks. The paragraph contains only generic governance references (Audit Committee, third-party consultants, legal counsel) and general topic mentions (information security, technology industry, corporate risk management) without any domain-specific terminology, firm-specific facts, or verifiable claims.


fact: Chief Risk Officer

reasoning: The paragraph describes how cybersecurity risk management is organized under management oversight (Chief Risk Officer) and integrated into the broader ERM structure, answering how management is organized to handle cybersecurity. The Chief Risk Officer is a C-level role with cybersecurity oversight responsibility, which is a firm-specific organizational detail.


fact: penetration testing

fact: forensic investigators

fact: security questionnaires

reasoning: The paragraph primarily answers how third-party cyber risks are managed, with the bulk of the text describing the vendor management standard, risk assessments, security reviews, questionnaires, audits, and contractual obligations imposed on vendors. Specificity is Domain-Adapted because the paragraph uses cybersecurity-specific terminology like penetration testing, forensic investigators, and security questionnaires that demonstrate domain expertise beyond generic ERM language.


fact: CIO role with primary responsibility for information security program

fact: 19 years of experience in technology risk management

fact: 11 years with the Company or its affiliates

fact: SANS Global Information Security Leader certification

fact: Certified Information Systems Auditor (CISA) certification

reasoning: This paragraph primarily answers 'How is management organized to handle cybersecurity?' by describing the CIO's role, qualifications, experience, and reporting structure, with secondary content about escalation processes. The specificity reaches Level 4 due to multiple verifiable facts: specific years of experience (19 total, 11 with the company) and named certifications (SANS Global Information Security Leader, CISA) that can be independently verified.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers, including due diligence, contractual requirements, and audits imposed on vendors, which fits the Third-Party Risk category. The language is generic ERM-style risk management terminology without domain-specific security practices, firm-specific details, or verifiable claims—an ERM professional would naturally use all of this vocabulary.


reasoning: This paragraph is a cross-reference directing readers to Item 1A Risk Factors rather than providing substantive cybersecurity disclosure content. It does not answer any of the six primary questions about governance, management, processes, third-party risk, incidents, or strategy integration. As a None/Other paragraph, it receives Generic Boilerplate specificity with no specific facts to elevate it.


fact: National Institute of Standards and Technology Cybersecurity Framework

fact: multi-layered defenses

fact: monitoring and patching of vulnerabilities

reasoning: The paragraph primarily describes what the cybersecurity program does—risk assessment methodology, framework adoption (NIST CSF), vulnerability management, safeguards, and incident response planning—with the Audit Committee oversight mentioned only in the final sentence as a subordinate detail. Specificity reaches Domain-Adapted due to the named NIST CSF framework and cybersecurity-specific terminology like multi-layered defenses and vulnerability patching that demonstrate domain expertise beyond generic ERM language.


reasoning: This paragraph is biographical information about David Shear, President International, with no mention of cybersecurity responsibilities or content. It does not answer any of the six substantive cybersecurity questions and therefore falls under None/Other, which automatically receives Generic Boilerplate specificity.


reasoning: This paragraph makes a forward-looking materiality assessment stating that cybersecurity risks, if realized, are reasonably likely to materially affect the company's operations, strategy, results, and financial condition—matching Rule 5's SI classification for 'reasonably likely to materially affect' language. However, the paragraph contains no domain-specific terminology, firm-specific facts, or verifiable claims; it is standard risk disclosure language any business professional could write, failing the ERM test for domain expertise.


reasoning: The paragraph describes the Board's oversight structure for cybersecurity, including delegation to the Audit Committee and information flow from management to the committee to the full Board, which directly answers the Board Governance question. The language is entirely generic governance boilerplate—no domain-specific terminology passes the ERM test, and there are no firm-specific roles (Audit Committee is generic) or verifiable claims.


fact: phishing sites

fact: threat actors

reasoning: This paragraph describes a real cybersecurity event—threat actors created malicious phishing sites targeting the company's online banking platform—including timing (beginning of the year), impact (no losses, no data breach), and remediation efforts. Specificity is Domain-Adapted due to cybersecurity terminology like 'phishing sites' and 'threat actors' that demonstrate domain expertise; the negative assertions about no breaches or losses are not externally verifiable, and no firm-specific roles or quantified facts are present.


reasoning: This paragraph is purely a cross-reference directing readers to Item 1A for additional risk factor information, with no substantive cybersecurity disclosure content. None/Other paragraphs automatically receive Generic Boilerplate specificity.


fact: Change Healthcare, a subsidiary of UnitedHealth Group

fact: Exogen device

fact: UnitedHealth Group

reasoning: This paragraph describes an actual cybersecurity incident at Change Healthcare that affected the company's billing processes, including the nature of the attack, timeline, business impact, and remediation efforts, making it Incident Disclosure. Specificity reaches Quantified-Verifiable due to multiple externally verifiable facts including specific dates (March 7, 2024; March 18, 2024) and named firms (Change Healthcare, UnitedHealth Group).


reasoning: The paragraph contains a backward-looking materiality assessment ('no such incident has had any such impact to date') which qualifies as Strategy Integration under Rule 5, though it is mixed with speculative language and cross-references to Item 1A. The language is entirely generic—'protocols, controls, and systems' fails the ERM test for domain expertise, the negative assertion about incidents is not externally verifiable, and cross-references to other sections do not constitute firm-specific facts about cybersecurity posture.


reasoning: This paragraph describes the cybersecurity-related responsibilities of a management role (Director, IT), including hiring, budget approval, incident preparation, and process oversight, which directly answers how management is organized to handle cybersecurity. The role title 'Director, IT' lacks a security qualifier and therefore does not qualify as firm-specific, and the activities described are generic management functions without domain-specific terminology that would pass the ERM test.


reasoning: The paragraph primarily states a materiality conclusion—that cybersecurity risks have not materially affected business strategy, results of operations, or financial condition—which directly answers the Strategy Integration question about business/financial impact. The vague reference to past threats and breaches does not constitute Incident Disclosure because it lacks specificity about any particular event. Specificity is Level 1 because 'malware' and 'computer virus' are basic terms any ERM professional would use (failing the ERM test), the negative assertion about material impact is not externally verifiable, and no firm-specific roles, programs, or quantified facts are present.


fact: CISO

fact: Audit, Risk and Finance Committee

fact: Information Security Program

reasoning: This paragraph describes the oversight structure and information flow from management (CISO, Information Security group) to the board-level Audit, Risk and Finance Committee, including briefing frequency and scope, which is classic Board Governance content. Specificity reaches Firm-Specific due to the named CISO role and the specifically named Audit, Risk and Finance Committee.


fact: SOC 1 reports

fact: SOC 2 reports

reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party vendors, including monitoring practices, audit requirements, and SOC report mandates—clearly answering the Third-Party Risk question. Specificity is Domain-Adapted because the paragraph references SOC 1 and SOC 2 audit standards, demonstrating cybersecurity domain expertise in vendor security assessment that goes beyond generic ERM language.


fact: February 2023 cyberattack

reasoning: The paragraph contains a backward-looking materiality assessment stating that the February 2023 cyberattack did not have a material adverse impact on financial position, results of operations, or liquidity, which per Rule 5 makes it Strategy Integration despite being embedded in forward-looking risk language. Specificity reaches Quantified-Verifiable due to the specific date reference to the February 2023 cyberattack, which is an externally verifiable claim about a real event.


fact: Firewalls

fact: intrusion detection/prevention systems (IDS/IPS)

fact: data loss prevention (DLP)

fact: Antivirus

fact: anti-malware

fact: Mobile Device Management

fact: principle of least privilege

fact: encryption at rest and in transit

fact: phishing

reasoning: This paragraph describes the company's cybersecurity program activities and technologies across multiple domains (network, endpoint, access, data, training), directly answering what the cybersecurity program does. Specificity is Domain-Adapted because the paragraph contains multiple cybersecurity-specific technical terms (IDS/IPS, DLP, least privilege, encryption at rest/in transit) that demonstrate domain expertise beyond what a general ERM professional would naturally use.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers, including selection assessments and ongoing monitoring—clearly fitting Third-Party Risk. The vocabulary is generic risk management language (risk assessments, questionnaires, contractual obligations) that any ERM professional would use; no cybersecurity domain expertise, firm-specific details, or verifiable claims are present.


reasoning: This paragraph describes how Marriott allocates cybersecurity responsibility to franchisees and licensees and imposes brand standards and incident reporting requirements on them, which is centrally about third-party cybersecurity risk management. Specificity is Firm-Specific because 'Marriott brand standards relating to information security' is a firm-specific claim about Marriott's unique requirements imposed on third parties.


reasoning: The paragraph is a materiality assessment stating that cybersecurity has not materially affected business outcomes, which is Strategy Integration per Rule 5. Specificity is Level 1 because the paragraph contains no domain terminology passing the ERM test, no firm-specific facts, and no verifiable claims—the negative assertion about absence of material impact is explicitly not externally verifiable per the specificity rules.


fact: CIO

fact: Technology & Operations Committee

fact: information technology, legal, and internal audit functions presenting to committees

reasoning: This paragraph primarily describes board oversight structure—specifically how information flows from management (CISO, CIO, IT, legal, internal audit) to board committees (Audit Committee, Technology & Operations Committee), including reporting frequency and content scope. Specificity reaches Firm-Specific due to named cybersecurity leadership roles (CISO, CIO), a named company-specific committee (Technology & Operations Committee), and specific functional composition (IT, legal, internal audit).


reasoning: The paragraph primarily provides a backward-looking materiality assessment stating that cybersecurity threats have not materially affected the company's business strategy, results of operations, or financial condition, which is a Strategy Integration disclosure under Rule 5. The paragraph contains no domain terminology passing the ERM test, no firm-specific facts, and no verifiable claims—the negative assertion about material impact is a self-reported claim that cannot be independently verified, and the mention of experiencing threats 'from time to time' is too vague to constitute a specific fact.


fact: ERMC

fact: Vice President of Information Technology

fact: over 20 years of experience in information technology and cybersecurity

reasoning: The paragraph describes management's organizational structure for cybersecurity, including roles, committees, and qualifications—answering 'How is management organized to handle cybersecurity?' The 'over 20 years of experience' claim is a verifiable lower bound (checkable against the key employee's resume), elevating specificity to Level 4. The VP of Information Technology title and ERMC committee name provide additional firm-specific facts.


reasoning: This paragraph describes the board oversight mechanism—specifically how information flows from the security team to the Audit Committee and Board through quarterly updates. The category is Board Governance because it answers how the board oversees cybersecurity. Specificity is Level 1 because the paragraph contains only generic governance language ('quarterly updates', 'Audit Committee', 'Board of Directors', 'security team') without domain-specific terminology that passes the ERM test or any firm-specific or verifiable facts.


reasoning: This paragraph describes the flow of cybersecurity information from a Task Force to the Audit Committee, including briefing frequency and incident notification responsibilities—classic board oversight structure. The language is entirely generic: 'Audit Committee' exists at every public company, 'Task Force' is a generic organizational term without a distinguishing modifier, 'at least annually' is a standard cadence, and no domain-specific terminology, firm-specific roles, or verifiable claims appear.


reasoning: This paragraph describes the company's methodology for determining materiality of cybersecurity incidents—explicitly listed under Strategy Integration in the category definition. It outlines the financial and operational factors considered when assessing whether an incident is material. Specificity is Level 1 because the language consists of generic business and risk terminology (legal penalties, remediation costs, reputational harm, etc.) that any ERM professional would use; even 'data exfiltration' has become common business vocabulary and doesn't demonstrate specialized cybersecurity domain expertise.


reasoning: The paragraph centrally addresses vendor cybersecurity oversight—security assessments before engagement and ongoing monitoring of third-party providers—making Third-Party Risk the appropriate category. Specificity is Generic Boilerplate because the language fails the ERM test: 'security assessments' and 'ongoing monitoring for compliance with cybersecurity standards' are practices an ERM professional would describe for any vendor risk domain, without demonstrating cybersecurity domain expertise through specific tools, standards, or technical practices.


fact: September 2022 incident dates

fact: Rockstar Games

fact: 2K Games

fact: Grand Theft Auto

reasoning: This paragraph primarily describes actual cybersecurity incidents that occurred in September 2022, including the nature of the attacks (network intrusion, unauthorized access), scope (Rockstar Games systems, 2K Games vendor platform), and response actions taken—classic Incident Disclosure content. Specificity is Level 4 because the paragraph contains specific dates (September 2022) and named entities (Rockstar Games, 2K Games, Grand Theft Auto) tied to real incidents that are externally verifiable.


fact: VP of Information Technology

reasoning: The paragraph describes the management team responsible for cybersecurity leadership, listing specific roles and their collective qualifications, which directly answers how management is organized to handle cybersecurity. The VP of Information Technology is a firm-specific fact (VP-level IT leadership role), while other titles (CEO, CFO, General Counsel) are generic governance roles; no domain terminology or verifiable claims are present.


reasoning: This paragraph describes board and committee oversight structure, including who receives updates and at what cadence, which directly answers the question of how the board oversees cybersecurity. The specificity is Level 1 because all terms (Board, Audit Committee, quarterly updates, cybersecurity assessments, third party risk management) are generic governance or ERM language that any business professional would use, with no domain-specific terminology, firm-specific facts, or verifiable claims.


fact: vulnerability scanning

fact: penetration testing

fact: threat intelligence feeds

reasoning: This paragraph describes the company's cybersecurity risk management program activities including vulnerability scanning, penetration testing, and threat intelligence monitoring, answering 'What does the cybersecurity program do?' The third-party vendor risk assessment component is part of the broader internal program rather than the central topic, so RMP applies over TP. Specificity reaches Domain-Adapted due to cybersecurity-specific terminology (vulnerability scanning, penetration testing, threat intelligence feeds) that demonstrates domain expertise beyond generic ERM language.


fact: Risk Committee

fact: at least once each calendar year

reasoning: The paragraph describes the Audit Committee's oversight of cybersecurity risks, including briefing frequency and review of the enterprise risk management matrix, which answers the Board Governance question of how the board oversees cybersecurity. Specificity reaches Firm-Specific due to the named Risk Committee and the quantified briefing cadence of at least once per calendar year.


fact: vulnerability assessments

reasoning: This paragraph describes board and audit committee oversight of cybersecurity, including delegation structure, information flow to the committee, and board-level engagement—answering 'How does the board oversee cybersecurity?' For specificity, 'vulnerability assessments' is a domain term (Level 2), and 'January 2024 board cybersecurity training session' is a firm-specific event with a specific date that distinguishes this company's governance activities (Level 3).


reasoning: This paragraph is a cross-reference pointing readers to Item 1A Risk Factors for substantive cybersecurity risk discussion, with no actual disclosure of governance, processes, or assessments. It contains no domain terminology, firm-specific facts, or verifiable claims—only generic risk language.


fact: advanced and persistent threat actors

reasoning: This paragraph is introductory threat landscape language that does not substantively answer any of the six category questions—it describes threats in general terms without detailing governance, processes, roles, or assessments. The phrase 'advanced and persistent threat actors' is cybersecurity-specific terminology for APTs, which passes the ERM test and elevates specificity to Domain-Adapted.


reasoning: The paragraph primarily provides a materiality assessment stating that cybersecurity risks have not materially affected and are not reasonably likely to materially affect the company's business strategy, results of operations, or financial condition, which is a classic Strategy Integration disclosure under Rule 5. The paragraph contains no domain terminology passing the ERM test, no firm-specific facts, and no verifiable claims—the mention of past breaches is vague and non-specific, the materiality conclusion is a self-reported negative assertion, and the date is merely reporting period context.


reasoning: This paragraph describes the Audit Committee's oversight role in receiving cybersecurity reports from management, which directly answers how the board oversees cybersecurity risks. The specificity is Level 1 because the paragraph contains only generic governance language—Audit Committee and standard officer titles (General Counsel, CFO, VP Finance) are not firm-specific cybersecurity roles, and the terminology (periodic reports, threats, risk, mitigation) fails the ERM test as language any business professional would use.


reasoning: This paragraph provides a backward-looking materiality assessment stating that cybersecurity threats and incidents have not materially affected the company during the reporting period, which fits the Strategy Integration category under Rule 5. The language is entirely generic—no domain-specific terminology, firm-specific facts, or verifiable claims are present, resulting in Generic Boilerplate specificity.


fact: ransomware

fact: December 15, 2020

reasoning: This paragraph describes a specific cybersecurity incident (ransomware attack on December 15, 2020), including its nature, timing, and business impact, which directly answers 'What happened in a cybersecurity incident?' The specific date of the incident is an externally verifiable fact that elevates specificity to Level 4.


reasoning: The paragraph describes third parties engaged to support the company's internal risk assessment processes (designing policies, monitoring safeguards), which falls under RMP per Rule 3's guidance that third parties serving the company are RMP rather than TP. The vendor certification requirements in the final sentence are secondary to the primary focus on how third parties support the cybersecurity program. Specificity is Level 1 because all terminology (risk assessment, policies and procedures, safeguards, security measures, breach) is generic ERM/business language that any professional could write—none passes the ERM test for domain expertise, and there are no firm-specific or verifiable facts.


fact: threat monitoring

reasoning: The paragraph addresses how third-party cyber risks are managed, covering both engagement of external security firms and security requirements imposed on vendors—central TP topics under Rule 3. Domain terms 'penetration testing' and 'threat monitoring' pass the ERM test, elevating specificity to Level 2.


reasoning: This paragraph describes board oversight structure for cybersecurity, including the full Board's primary responsibility, reporting lines from management to the Board and Audit Committee, and reporting cadence. The language is generic governance boilerplate without cybersecurity domain expertise, firm-specific facts, or verifiable claims.


reasoning: The paragraph describes the cybersecurity program's use of external service providers to evaluate and enhance security policies, which is a risk management process activity. Under Rule 3, third parties hired to serve the company (assessors, consultants) fall under RMP rather than Third-Party Risk. The paragraph contains no domain terminology passing the ERM test (generic 'policies and procedures' and 'regulatory requirements' are standard ERM language), no firm-specific facts, and no verifiable claims.


reasoning: This paragraph is a cross-reference directing readers to Item 1A for additional cybersecurity risk information, containing no substantive disclosure about governance, management, processes, or incidents. It contains no domain terminology, firm-specific facts, or verifiable claims—only standard cross-reference language.


fact: Vice President, IT Security and Compliance

fact: Chief Information Officer

fact: IT Security Director

fact: threat intelligence

reasoning: The paragraph describes management structure for cybersecurity, including reporting lines (VP IT Security and Compliance reports to CIO), role responsibilities (IT Security Director's duties), and team qualifications. Specificity reaches Firm-Specific due to named VP-level and Director-level security roles that distinguish this company's organizational structure.


reasoning: This paragraph is meta-commentary describing the section itself rather than answering any substantive cybersecurity question—it summarizes what follows rather than disclosing actual governance, processes, or incidents. The language is entirely generic business prose with no domain terminology, firm-specific details, or verifiable claims.


reasoning: This paragraph is a materiality assessment stating that cybersecurity risks have not materially affected and are not reasonably likely to materially affect the company's business strategy, results of operations, or financial condition, which is a classic Strategy Integration disclosure under Rule 5. The paragraph contains no domain terminology that passes the ERM test, no firm-specific facts, and no verifiable claims—the negative assertion about absence of material incidents is a self-reported claim that cannot be independently verified.