reasoning: This paragraph makes explicit materiality assessments - both backward-looking ('have not materially affected') and forward-looking ('not reasonably likely to materially impact') - about cybersecurity's effect on business outcomes, which is the core of Strategy Integration per Rule 5. The specificity is Generic Boilerplate because the paragraph contains only negative assertions about incident absence (not externally verifiable) and generic business/financial language that does not demonstrate cybersecurity domain expertise or firm-specific organizational details.


content_category: Management Role

fact: Chief Security and Trust Officer

fact: reports to Executive Vice President, Operations

fact: over 25 years of experience in information technology and information security

type: quantified

category_confidence: high

specificity_confidence: high

reasoning: This paragraph describes a cybersecurity leadership role (Chief Security and Trust Officer), including reporting lines, responsibilities, and qualifications, which directly answers how management is organized to handle cybersecurity. The specificity reaches Level 4 due to the quantified claim of 'over 25 years' of experience, which is a verifiable lower bound tied to a firm-specific role that can be checked against the role holder's career history.

provider: z-ai

stage: benchmark


content_category: Third-Party Risk

reasoning: The paragraph describes contractual cybersecurity requirements imposed on the Custodian (a third party) and its vendors, making vendor oversight the central topic. Specificity is Level 1 because the language is generic contract terminology that any ERM professional would use—terms like 'cybersecurity and data protection measures,' 'data security incident,' and 'processes to assess, identify and manage risks' do not demonstrate cybersecurity domain expertise.


content_category: None/Other

reasoning: This is a cross-reference paragraph directing readers to Item 1A Risk Factors for cybersecurity risk disclosures, containing no substantive governance, management, process, or incident content. The paragraph lacks any domain terminology, firm-specific facts, or verifiable claims—it is pure cross-reference boilerplate.


fact: Cyber ERM (Enterprise Risk Management) Committee

reasoning: This paragraph describes a management-level committee's establishment, composition, and responsibilities for cybersecurity incident response, fitting Management Role under Rule 1 (structure/membership focus rather than detailed program activities). The named 'Cyber ERM Committee' is a firm-specific, non-generic committee that distinguishes this company's organizational structure, elevating specificity to Level 3.


reasoning: This paragraph is primarily forward-looking risk factor language discussing potential threats and the possibility that controls may be insufficient, ending with a cross-reference to Item 1A. The brief mention of 'regular testing of our cybersecurity incident response plan' is embedded in speculative language ('may be insufficient') rather than substantively describing what the program does. No domain-specific terminology passes the ERM test, no firm-specific facts are present, and no verifiable claims are made.


fact: CIO

fact: CISO

fact: DTI organization

fact: CDT function

reasoning: The paragraph primarily describes organizational structure and responsibilities—CIO and CISO roles, CDT team duties, and Incident Response team composition—answering how management is organized for cybersecurity. Specificity reaches Level 3 due to firm-specific leadership roles (CIO, CISO) and named internal organizational units (DTI organization, CDT function).


fact: CSO (Chief Security Officer)

fact: Chief Information Officer

reasoning: This paragraph describes the CSO's organizational role, responsibilities for cybersecurity oversight, and reporting relationship to the CIO and senior management, which directly answers how management is organized to handle cybersecurity. The specificity reaches Firm-Specific due to the named VP-level roles (CSO, CIO) that distinguish this company's management structure.


content_category: Incident Disclosure

fact: February 16, 2022 - specific date when cybersecurity intrusion was detected

reasoning: This paragraph describes an actual cybersecurity incident with specific details about timing (February 16, 2022), nature (intrusion causing network disruption), and response (engaging internal resources and third-party experts), making it Incident Disclosure per Rule 4. The specific date of the incident is a hard fact that can be independently verified through news reports or other SEC filings, elevating specificity to Level 4.


content_category: Risk Management Process

fact: firewalls

fact: intrusion prevention

fact: endpoint detection and response systems

fact: vulnerability assessments

fact: cybersecurity threat intelligence

reasoning: The paragraph describes technical safeguards and security tools deployed by the cybersecurity program, answering what the program does. Specificity is Level 2 because the paragraph uses cybersecurity domain terminology (endpoint detection and response, intrusion prevention, vulnerability assessments, threat intelligence) that demonstrates expertise beyond generic ERM language.


content_category: Board Governance

reasoning: This paragraph describes the Board's oversight structure, specifically how the Audit Committee reports to the full Board and how the Board receives management briefings on cybersecurity, which directly answers the question of how the board oversees cybersecurity. The specificity is Level 1 because the paragraph contains only generic governance language—Audit Committee and Board are standard roles at every public company, and there are no domain-specific terms, firm-specific roles, or verifiable facts.


content_category: Strategy Integration

reasoning: The paragraph opens with a materiality assessment stating that cybersecurity risks have not materially affected and are not reasonably likely to materially affect the company's business strategy, results of operations, or financial condition—this is a Strategy Integration conclusion under Rule 5. The paragraph contains no domain terminology passing the ERM test, no firm-specific facts, and no verifiable claims; the negative assertions about absence of material impact are self-reported claims that cannot be independently verified.


fact: Chief Information Security Officer

fact: Trust, Security and Reliability department

fact: Cybersecurity Risk Management Team

reasoning: The paragraph describes management's organizational structure for cybersecurity, identifying the CISO role, a named department (Trust, Security and Reliability), and a named team (Cybersecurity Risk Management Team). The person-removal test confirms MR: removing these role and team references leaves no substantive program description. Specificity reaches Firm-Specific due to three named organizational elements unique to this company.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers, covering due diligence, contractual requirements, and incident notification obligations imposed on vendors—clearly fitting Third-Party Risk. Specificity is Level 1 because the language describes vendor oversight practices at a generic level (due diligence, risk-based approach, contractual security requirements, notification obligations) without mentioning specific cybersecurity domain terms that pass the ERM test, firm-specific organizational details, or externally verifiable claims.


fact: access control

specificity_confidence: medium

reasoning: This paragraph describes the company's cybersecurity program activities—policies, standards, and IT processes for assessing, identifying, and managing risks—which directly answers 'What does the cybersecurity program do?' The specificity reaches Level 2 because 'access control' is a cybersecurity-specific practice that passes the ERM test (an ERM professional wouldn't naturally use this technical term).


fact: operational technology

category_confidence: medium

reasoning: The paragraph describes cybersecurity risk management activities at a high level (developing systems, operating programs, monitoring and updating security measures), which fits Risk Management Process despite its generic nature. The mention of 'operational technology' in the cross-reference provides domain-specific terminology that passes the ERM test, elevating specificity to Domain-Adapted.


reasoning: The paragraph contains a backward-looking materiality assessment stating the company has not experienced a material cybersecurity incident, which per Rule 5 qualifies as Strategy Integration. However, this negative assertion is not externally verifiable, and the remaining language consists of generic forward-looking risk speculation without domain-specific terminology, firm-specific details, or quantified claims.


reasoning: This paragraph primarily answers the question 'How does cybersecurity affect the business or finances?' It states a backward-looking materiality conclusion ('have materially affected us, including our results of operations and financial condition') and a forward-looking assessment ('reasonably likely to materially affect us'), which per Rule 5 constitutes a Strategy Integration assessment. It references an incident but does not describe what happened—only the business impact conclusion.


reasoning: This paragraph is a high-level values statement about data protection responsibility that does not substantively answer any of the six content questions—it describes neither board oversight, management structure, program activities, third-party risk, incident details, nor business impact. The language is entirely generic with no domain terminology passing the ERM test, no firm-specific facts, and no verifiable claims.


reasoning: The paragraph contains a backward-looking materiality assessment stating cybersecurity risks have not materially affected the business, which qualifies as Strategy Integration under Rule 5, though it is embedded within forward-looking speculation and a cross-reference to Item 1A. No domain terms pass the ERM test, no firm-specific facts are present, and the negative assertion about material impact is not externally verifiable.


reasoning: This paragraph is forward-looking disclaimer language stating that cybersecurity efforts may not prevent incidents, followed by a cross-reference to the Risk Factors section. It does not answer any of the six substantive questions—it contains no actual governance structure, management roles, program activities, third-party oversight, incident details, or materiality assessments, just speculative risk language and a pointer elsewhere.


fact: ransomware

fact: denial-of-service

fact: nation state actors

fact: defense industrial base

fact: critical infrastructure sectors

reasoning: This paragraph primarily addresses how cybersecurity integrates with business strategy, discussing its importance to the company's vision and digital transformation, the threat landscape context, and potential material adverse effects on operations. The specificity reaches Domain-Adapted due to cybersecurity domain terminology (ransomware, denial-of-service, nation state actors, defense industrial base) that demonstrates expertise beyond generic ERM language.


reasoning: The paragraph contains a negative materiality assertion ('we have not experienced any recent material cybersecurity incidents') which under Rule 5 qualifies as a Strategy Integration assessment, though the paragraph is primarily forward-looking disclaimer language with a cross-reference. No domain terminology passes the ERM test, no firm-specific facts from the approved list appear, and the negative assertion about absence of incidents is not externally verifiable.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third parties (vendors, service providers, their systems), which directly answers the Third-Party Risk question. The language is generic oversight terminology—'risk-based approach to identifying and overseeing'—that any ERM professional would use, with no domain-specific practices, tools, firm-specific details, or verifiable claims.


fact: CISO has 27 years of cybersecurity experience

fact: CISO has 17 years of experience in the oil and gas industry

fact: CISO graduated from the FBI's CISO Academy in Quantico, Virginia

fact: one of less than 400 CISOs globally to graduate from FBI CISO Academy

fact: Chief Information Security Officer (CISO) role

fact: Vice President and Chief Information Officer (CIO) role

fact: Cybersecurity Executive Committee (named committee)

reasoning: This paragraph describes management's organizational structure for cybersecurity—the team composition, reporting lines (Cybersecurity Team → CISO → CIO), and the CISO's qualifications and credentials. The escalation process to the Cybersecurity Executive Committee and Board is mentioned but is subordinate to the primary focus on management roles and qualifications. Specificity reaches Level 4 due to multiple verifiable claims: the CISO's 27 years of cybersecurity experience, 17 years in oil and gas, and graduation from the FBI's CISO Academy in Quantico—all specific quantities and credentials that could be independently verified.


fact: February 2022 - specific date when cyber-attack was determined

fact: CISO - firm-specific cybersecurity leadership role

reasoning: This paragraph primarily describes an actual cybersecurity incident - the February 2022 targeted cyber-attack, its operational impact (three-week shutdown of global systems), and remediation actions taken. The incident frame is dominant over the materiality assessment and governance changes mentioned. Specificity reaches Level 4 due to the specific date 'February 2022' tied to the incident discovery, which is externally verifiable through news reports and SEC filings. The CISO role is also a firm-specific fact (Level 3).


fact: more than 30 years of experience

fact: Certified Information Systems Security Professional (CISSP)

fact: Certified Information Security Manager (CISM)

fact: Security+

fact: Certified Information Systems Auditor (CISA)

reasoning: The paragraph primarily describes management's organizational role for cybersecurity—the CIO's qualifications, experience, and the cybersecurity team's credentials—making it Management Role. Specificity is Quantified-Verifiable due to the 'more than 30 years of experience' claim and multiple named certifications (CISSP, CISM, Microsoft Certified Cybersecurity Architect Expert, Security+, CISA) that are externally verifiable through their respective certification bodies.


reasoning: This paragraph describes Board-level oversight of cybersecurity risks, including that the Board retains direct responsibility (no committee delegation) and receives updates at regular meetings. The language is entirely generic governance boilerplate with no domain-specific terminology passing the ERM test, no firm-specific distinguishing facts, and no verifiable claims.


fact: February 13, 2023

fact: secure file transfer software platform

reasoning: This paragraph discloses a specific cybersecurity incident that occurred, including the date (February 13, 2023), nature (security breach via third-party vendor), and impact (patient personal information exposed), which directly answers 'What happened in a cybersecurity incident?' The specific date is an externally verifiable fact that elevates specificity to Level 4.


fact: Board's Cybersecurity Special Committee

reasoning: The paragraph primarily describes incident response methodology (four-step process, severity-based prioritization), which answers 'what does the cybersecurity program do?' The person-removal test leaves substantive process description intact, confirming RMP over MR. The named 'Board's Cyberbersecurity Special Committee' is a firm-specific governance structure that distinguishes this company.


fact: CISO

fact: Cybersecurity Executive Committee

fact: two members of the Board of Directors who are also members of the Cybersecurity Executive Committee

reasoning: This paragraph describes board-level oversight structure, specifically how the CISO briefs the Audit Committee and the composition relationship between the Audit Committee and Cybersecurity Executive Committee. The presence of a named CISO role, a named non-generic committee (Cybersecurity Executive Committee), and a specific organizational claim about two Board members serving on both committees elevates specificity to Firm-Specific.


fact: Chief Information Officer

fact: ISMS (Information Security Management System)

reasoning: This paragraph describes board and committee oversight of cybersecurity risk, including the Audit and Risk Committee's role and information flow from management to the board, which directly answers how the board oversees cybersecurity. Specificity reaches Firm-Specific due to two named cybersecurity leadership roles (CIO and Executive Director of Information Security), with ISMS providing additional domain terminology.


reasoning: This paragraph describes the company's risk assessment methodology for cybersecurity threats, answering what the cybersecurity program does. The language is entirely generic risk management terminology that any ERM professional would use—no cybersecurity domain expertise, firm-specific details, or verifiable claims are present.


fact: security questionnaires

fact: security assessments

reasoning: This paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers, including vendor assessment processes and contractual security obligations, which directly answers the Third-Party Risk question. Specificity reaches Domain-Adapted because 'security questionnaires' and 'security assessments' are cybersecurity-specific vendor due diligence practices that would not naturally be used by a non-security ERM professional.


fact: vulnerability scans

reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers, detailing vendor management processes, assessment levels based on risk factors, and specific requirements imposed on vendors (security questionnaires, vulnerability scans). Specificity reaches Level 2 due to 'vulnerability scans'—a cybersecurity-specific practice that passes the ERM test, as a non-security ERM professional would not naturally use this technical term.


fact: CSO

fact: ERM Steering Committee

fact: Global Security Organization

reasoning: The paragraph describes the board oversight structure for cybersecurity, explaining how the Risk Committee of the Board has ultimate oversight and how information flows from the Global Security Organization through the ERM Steering Committee to the Board and its committees. Specificity is Firm-Specific due to the CSO role (VP-level cybersecurity leadership), the ERM Steering Committee (named management-level committee), and the Global Security Organization (named internal team).


fact: denial of service attacks

fact: malicious software attacks

reasoning: The paragraph opens with a materiality assessment stating the company has not been materially impacted by cyber incidents, which is the primary assertion under SEC Item 106(b)(2), while the extensive third-party risk discussion provides supporting context about exposure channels. Specificity is Domain-Adapted due to cybersecurity-specific terminology including denial of service attacks and malicious software attacks, with no firm-specific roles or verifiable claims present.


fact: penetration testing

fact: security posture

reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers, covering vendor assessments, monitoring programs, and contractual requirements—three of four sentences focus on vendor oversight. Specificity reaches Level 2 due to domain terminology like 'penetration testing' and 'security posture' that demonstrate cybersecurity expertise beyond generic ERM language.


reasoning: The paragraph centrally addresses how the company manages third-party vendor cybersecurity risks through pre-engagement evaluations, ongoing reviews, and contractual confidentiality obligations. No domain-specific terminology, firm-specific facts, or verifiable claims are present—the language is generic vendor management boilerplate that any ERM professional could write.


fact: Chief Operating Officer oversees cybersecurity policies and processes

reasoning: The paragraph describes a management role (COO) with oversight responsibility for cybersecurity policies and processes, answering 'who is responsible' rather than 'what the program does.' The identification of the Chief Operating Officer as the cybersecurity oversight leader is a firm-specific fact distinguishing this company's governance structure.


fact: Chief Information Security Officer (CISO)

fact: Executive Vice President and Chief Information Officer (CIO)

reasoning: The paragraph primarily describes the enterprise information security program and its function in assessing, identifying, and managing cybersecurity risks, with management roles mentioned as supporting detail about who maintains and oversees the program. Specificity is Firm-Specific due to the named CISO and EVP/CIO leadership roles.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party vendors, including risk assessments and contractual obligations imposed on providers, which fits Third-Party Risk. The language is generic vendor management terminology that any ERM professional could write—there are no specific security practices, tools, firm-specific organizational details, or verifiable claims that would elevate specificity above Level 1.


fact: Director - Information Systems (chief information officer)

reasoning: The paragraph describes Board and Audit Committee oversight of cybersecurity risk management, including the flow of information from senior management to the Board, which directly answers how the board oversees cybersecurity. The specific identification of the Director - Information Systems role (equated to CIO) is a firm-specific fact that elevates specificity to Level 3.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers, covering pre-engagement security assessments, contractual security requirements with audit rights, and ongoing validation of vendor certifications. Specificity reaches Firm-Specific due to the named internal team 'Information Technology Automated Solutions (ITAS)' responsible for validating vendor certifications.


fact: CISO

reasoning: This paragraph describes the board and committee oversight structure for cybersecurity, including briefing frequencies and information flow from the CISO to the Audit and Risk Committee and Board, which directly answers the Board Governance question. The mention of 'CISO' is a firm-specific fact (VP-level cybersecurity leadership role), establishing Level 3 specificity.


reasoning: The paragraph describes management's role in cybersecurity incident response—specifically how the CEO and CFO oversee procedures, receive notifications, and make resource decisions. The Board notification is mentioned but as a subordinate point about management's reporting obligations. All roles mentioned (CEO, CFO, Board of Managers) are generic governance roles that exist at every company, and no domain-specific terminology passes the ERM test, resulting in Level 1 specificity.


reasoning: This paragraph describes the information flow from management to the Board and Audit Committee regarding cybersecurity risks and incidents, directly answering how the board oversees cybersecurity. The paragraph contains only generic governance language (Board, Audit Committee, management, regular reports) without domain-specific terminology, firm-specific roles, or verifiable claims.


reasoning: This paragraph describes the company's incident response capabilities and protocols, answering what the cybersecurity program does. The language is generic risk management terminology that any ERM professional would use—incident response plan, prioritization guidelines, evidence handling, law enforcement engagement—without demonstrating cybersecurity domain expertise or firm-specific details.


fact: incident in August 2023

reasoning: This paragraph describes a real cybersecurity incident (August 2023) with details about scope (affected certain information systems) and impact (temporary disruptions to operations), making it Incident Disclosure. The specific date 'August 2023' tied to a real incident is externally verifiable, elevating to Level 4.


reasoning: The paragraph describes the company's vendor management process for cybersecurity risks, including reviewing practices, contractual obligations, and assessments, which directly answers how third-party cyber risks are managed. The language uses generic vendor risk management terminology (reviewing practices, conducting assessments, periodic reassessments) that any ERM professional would naturally use, without demonstrating specific cybersecurity domain expertise or firm-specific details.


fact: National Institute of Standards and Technology (NIST) framework

fact: International Organization for Standardization (ISO) standards

reasoning: The paragraph primarily describes the cybersecurity program's integration with ERM, framework adoption (NIST, ISO), and general risk management approach, with brief Board oversight framing in the opening sentences. Named frameworks (NIST, ISO) demonstrate domain expertise passing the ERM test, elevating specificity to Level 2.


reasoning: This paragraph is a pure cross-reference directing readers to Item 1A Risk Factors for additional cybersecurity risk information, with no substantive disclosure about the company's cybersecurity program, governance, or incidents. It contains no domain terminology passing the ERM test, no firm-specific facts, and no verifiable claims—only generic risk category labels that any business professional would use.


fact: IS Steering Committee

fact: Chief Information Officer

reasoning: The paragraph primarily addresses how third-party cyber risks are managed through a vendor management program, with governance elements (Board, IS Steering Committee, CIO) explaining the oversight structure for vendor oversight. Specificity reaches Level 3 due to firm-specific facts: the named 'IS Steering Committee' and the 'Chief Information Officer' role chairing that committee.


reasoning: The paragraph is entirely focused on how the company oversees and manages cybersecurity risks from third-party service providers—security assessments before engagement, monitoring compliance, and periodic reviews by the CISO—making Third-Party Risk the central topic. Specificity reaches Level 3 due to the mention of the Chief Information Security Officer (CISO) role, which is a firm-specific cybersecurity leadership position; no verifiable facts (certifications, specific headcounts, named vendors, or dates) are present to reach Level 4.


reasoning: This paragraph is a pure cross-reference directing readers to Item 1A for cybersecurity risk discussion, which does not substantively answer any of the six key questions about cybersecurity governance, management, processes, third-party risk, incidents, or strategy integration. The paragraph contains no domain-specific terminology, firm-specific cybersecurity facts, or verifiable claims—it is purely navigational text pointing to another section.


reasoning: The paragraph describes the Board's risk oversight structure and delegation to committees, answering how the board oversees risk (Board Governance). It contains only generic governance language without cybersecurity-specific domain terms, firm-specific roles, or verifiable facts.


fact: ransomware actors

fact: exfiltrated

fact: provided notifications to individuals and regulators

reasoning: This paragraph describes an actual cybersecurity incident (ransomware attack with data exfiltration and regulatory notifications), answering 'what happened' → Incident Disclosure. The domain terms 'ransomware' and 'exfiltrated' demonstrate cybersecurity expertise (Level 2), and the specific notification actions taken by this company in response to this incident are firm-specific (Level 3).


fact: early April 2023 - timeframe when cybersecurity incident was detected

reasoning: This paragraph describes an actual cybersecurity incident—its detection timing, investigation, and response actions—directly answering 'What happened in a cybersecurity incident?' The specificity reaches Level 3 due to the firm-specific incident timing (early April 2023), which distinguishes this company's experience, though the vague 'early' qualifier prevents it from being an externally verifiable precise date.


fact: Vice President of IT & Digitization

reasoning: This paragraph describes management-level organizational structure for cybersecurity—a VP role and IT team with their responsibilities and qualifications—answering 'How is management organized to handle cybersecurity?' The VP title is firm-specific (Level 3) as it identifies a unique leadership role, but no verifiable credentials, years of experience, or domain-specific terminology are present to reach Level 4.


reasoning: This paragraph describes the board's oversight of cybersecurity risk and its delegation to the audit committee, which directly answers the Board Governance question of how the board oversees cybersecurity. The paragraph contains only generic governance language (board, audit committee, risk oversight) without any domain-specific terminology, firm-specific roles, or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: This paragraph is a general introductory statement about technology reliance and associated security risks, not answering any of the six substantive questions about governance, management, processes, third parties, incidents, or strategy integration. It contains no domain-specific terminology, firm-specific facts, or verifiable claims - just generic risk acknowledgment language.


fact: Service Organization Controls (SOC) reports

reasoning: This paragraph centrally addresses how the company manages third-party cyber risks through due diligence, contractual requirements, and ongoing monitoring of vendors with access to sensitive data or systems. The specificity reaches Level 2 due to the reference to SOC reports, which demonstrates cybersecurity domain knowledge about what specific evidence to evaluate when assessing vendor security.


reasoning: This is an introductory transition paragraph that states a general commitment to cybersecurity and signals that principles will follow, but does not substantively describe any governance structure, management role, risk management process, or other category content. The language is entirely generic—'confidentiality, integrity, and availability' is the basic CIA triad known to ERM professionals, and no firm-specific or verifiable facts are present.


fact: CompTIA

fact: PCI, SOC1 and SOC2

type: framework

reasoning: The paragraph describes management organization for cybersecurity, including the Head of Global IT role, the IT Security Team, their responsibilities, and team qualifications, which directly answers how management is organized to handle cybersecurity. Specificity reaches Quantified-Verifiable due to the 'over 20 years of combined infrastructure architecture experience' claim, which is a verifiable lower-bound quantity explicitly recognized in the classification rules.


reasoning: The paragraph describes board oversight of cybersecurity—quarterly reports, management updates, and incident escalation thresholds—which directly answers how the board oversees cybersecurity risk. Specificity is Level 1 because the language is generic governance boilerplate: 'quarterly' is a generic cadence, 'Board' is a universal governance role, 'pre-determined minimum threshold' is vague rather than quantified, and 'security posture' and 'cybersecurity events' do not demonstrate domain expertise beyond what any ERM professional would use.


reasoning: The paragraph describes the characteristics of the company's information security program (comprehensive, integrated into operations, cross-functional approach), which answers what the cybersecurity program does. The language is entirely generic—terms like 'information security program,' 'cross-functional approach,' and 'integrated into operations' would be used by any ERM professional and do not demonstrate cybersecurity domain expertise or provide firm-specific or verifiable facts.


reasoning: This paragraph is primarily speculative risk disclosure describing what could happen rather than what the company does about cybersecurity. The materiality negative assertion ('we do not believe we have experienced a cybersecurity incident that materially affected our business') is one sentence embedded in a paragraph dominated by generic risk language and cross-references. Under Rule 6, pure speculation without measures → N/O. Specificity is Level 1 because the paragraph contains no domain terminology passing the ERM test, no firm-specific facts, and negative assertions about incident absence are not externally verifiable.


reasoning: This paragraph contains only speculative risk acknowledgment language ('may be a potential target', 'may be exposed') without describing any actual cybersecurity measures, governance structures, or processes, making it None/Other. The language is generic risk disclosure that any business professional could write, with no domain terminology, firm-specific facts, or verifiable claims present.


reasoning: The paragraph is entirely focused on how the Adviser manages cybersecurity risks from third parties (vendors, service providers, external users), making Third-Party Risk the clear category. The language is generic risk management terminology—'comprehensive, risk-based approach,' 'identifying and overseeing cybersecurity risks'—that any ERM professional could write without cybersecurity domain expertise; no specific security practices, tools, frameworks, or verifiable claims are present.


reasoning: This paragraph is a pure cross-reference directing readers to Item 1A for cybersecurity risk information, with no substantive disclosure about governance, management, processes, or incidents. It contains no domain terminology, firm-specific facts, or verifiable claims—only a pointer to another section.


reasoning: This paragraph is purely a cross-reference directing readers to risk factors elsewhere in the 10-K, with no substantive cybersecurity disclosure content. As a None/Other paragraph, it receives Generic Boilerplate specificity with no facts that would elevate it.


reasoning: This paragraph is a pure cross-reference directing readers to Item 1A Risk Factors for cybersecurity risk discussion, with no substantive disclosure about governance, management, processes, or incidents. It contains no domain terminology, firm-specific facts, or verifiable claims—only a section reference and generic risk factor language.


reasoning: The paragraph describes vendor oversight practices (assessing third-party security measures and breach reporting requirements), which directly answers how third-party cyber risks are managed. The language is entirely generic vendor oversight terminology that any ERM professional would use—no specific security practices, tools, standards, or firm-specific details are mentioned.


reasoning: The paragraph opens with a backward-looking materiality assessment stating that cybersecurity incidents have not materially affected business strategy, operations, or financial condition, which directly answers the Strategy Integration question about business/financial impact. Specificity is Level 1 because the paragraph contains only generic statements—the negative materiality assertion is not externally verifiable, and terms like 'information security,' 'cybersecurity risk,' and 'service providers' fail the ERM test as they are language any business professional would use.


reasoning: This paragraph is a cross-reference directing readers to risk factors in Item 1A, not substantive cybersecurity disclosure content. As a None/Other paragraph containing only a forward-looking disclaimer and cross-reference, it receives Generic Boilerplate specificity.


reasoning: The paragraph describes the Board's ultimate responsibility for risk oversight and the Audit Committee's delegated oversight of cybersecurity strategies, risks, and data protection—answering how the board oversees cybersecurity. The language is entirely generic governance boilerplate with no domain-specific terminology passing the ERM test, no firm-specific facts, and no verifiable claims.


reasoning: This paragraph describes the Board's oversight of cybersecurity risk and its delegation to the Audit Committee, directly answering how the board oversees cybersecurity. No domain-specific terminology, firm-specific facts, or verifiable claims are present—only generic governance language that any public company would use.


fact: we maintain cyber risk insurance

reasoning: The paragraph primarily provides a backward-looking materiality assessment (no incidents have had material adverse effect) and discusses cyber risk insurance and potential financial exposure, which directly answers how cybersecurity affects business and financial outcomes. Specificity reaches Firm-Specific due to the claim about maintaining cyber risk insurance, but no verifiable details (coverage amounts, insurers) are provided, and the negative assertion about incidents is not externally verifiable.


reasoning: The paragraph describes board and Audit Committee oversight of cybersecurity, including information flows from management and external advisors to the board, making it Board Governance. It contains no domain-specific terminology passing the ERM test, no firm-specific facts (Director of Global Information Systems lacks a security qualifier), and no verifiable claims, resulting in Generic Boilerplate specificity.


fact: over 10 years of networking and information technology management or executive experience

fact: over 25 years of networking and information technology management or executive experience

fact: Chief Technology and Digital Officer

fact: Senior Vice President, Technology

fact: Cybersecurity Committee

fact: accounting, finance, legal, internal audit, and information technology

reasoning: The paragraph primarily describes management organization for cybersecurity—leadership roles, qualifications, and committee structure—making it Management Role. Specificity reaches Level 4 due to verifiable lower bounds on executive experience ('over 10 years' and 'over 25 years') that could be checked against resumes.


fact: Paresh Patel, one member of the Board of Directors, has information technology expertise

reasoning: The paragraph answers how the Board oversees cybersecurity by describing the reporting flow to the Board and identifying a specific board member with relevant IT expertise, which is classic Board Governance content. The naming of Paresh Patel as a director with IT expertise is a firm-specific fact that distinguishes this company's disclosure from generic boilerplate.


reasoning: The paragraph's primary content is the materiality assessment stating the company is not aware of cybersecurity risks that have materially affected or are reasonably likely to materially affect its business, which answers the Strategy Integration question. The first two sentences about third-party involvement are thin setup context rather than a substantive risk management process description. No domain terms pass the ERM test (all are generic ERM vocabulary), no firm-specific facts are present, and the negative assertion about material risks is not externally verifiable.


reasoning: The paragraph primarily describes Board oversight of cybersecurity within the enterprise risk management framework, answering how the Board governs cybersecurity risk. No domain terminology passes the ERM test (terms like 'risk management program,' 'policies, standards, processes and practices,' and 'identifying, preventing and mitigating' are generic business language any ERM professional would use), and there are no firm-specific or verifiable facts.


fact: attack vectors

reasoning: The paragraph primarily states a materiality assessment (negative assertion that no material cybersecurity events have occurred), which is a Strategy Integration statement per Rule 5, though it also contains speculative language and a cross-reference. Specificity reaches Domain-Adapted due to the term 'attack vectors,' which is cybersecurity-specific terminology that would not naturally be used by a non-security ERM professional.


fact: penetration testing

reasoning: The paragraph describes the company's cybersecurity program activities—risk assessment, policy development, framework adoption, and third-party security evaluations—answering 'What does the cybersecurity program do?' The mention of 'penetration testing' passes the ERM test as a domain-specific practice, establishing Level 2 specificity; no firm-specific roles or verifiable claims are present.


reasoning: This paragraph is a materiality assessment stating that cybersecurity risks have not had and are not reasonably likely to have a material effect on the company, which falls under Strategy Integration per Rule 5. The paragraph contains no domain terminology, firm-specific facts, or verifiable claims—it is a generic negative assertion about absence of material impact.


reasoning: This paragraph describes the Board and Audit Committee's oversight mechanisms for cybersecurity, including ad hoc conversations, Board meeting discussions, and annual comprehensive updates, which clearly answers the question of how the board oversees cybersecurity. The paragraph contains only generic governance language (Audit Committee, Board, Management) and generic business terms (risk management, business continuity planning) that any ERM professional would use, with no domain-specific cybersecurity terminology, firm-specific facts, or verifiable claims.


reasoning: The paragraph centrally addresses how third-party cybersecurity risks are managed through vendor oversight and periodic reviews of cybersecurity controls, fitting the Third-Party Risk category. The language is generic ERM-style terminology (vendor management program, periodic reviews, risk-based frequency) that any business professional could write—no specific cybersecurity practices, tools, standards, or firm-unique details are included.


fact: Director of Information Security

fact: over 30 years of experience in information technology and information security

fact: Certified Information Systems Security Professional (CISSP)

fact: OD Technology Department

fact: Risk Committee

fact: incident response and recovery plans

reasoning: The paragraph primarily describes the Director of Information Security's qualifications, role responsibilities, and coordination with teams, answering how management is organized to handle cybersecurity. Specificity reaches Quantified-Verifiable due to the verifiable 'over 30 years' experience claim and CISSP certification, supported by firm-specific facts including the named Director role, OD Technology Department, and Risk Committee.


reasoning: This paragraph is a cross-reference directing readers to Item 1A for cybersecurity risk factors, containing no substantive disclosure about the company's cybersecurity governance, program, or incidents. The language is generic risk factor boilerplate without domain-specific terminology, firm-specific facts, or verifiable claims.


fact: CISO

fact: CPO

fact: CIO

fact: VP of Global IT Security

fact: Certified Information Systems Auditor

fact: Certified Information Systems Security Professional

fact: Fellow of Information Privacy

fact: Certified Information Privacy Professional

reasoning: This paragraph primarily describes management organization for cybersecurity—identifying specific leadership roles (CISO, CPO, CIO, VP of Global IT Security), their qualifications and certifications, and team composition for incident response. The person-removal test confirms MR: removing role titles and qualifications leaves only generic process statements, indicating the paragraph is about WHO is responsible rather than WHAT the program does.


reasoning: This paragraph contains only generic boilerplate language about cybersecurity investment and internal controls without describing any specific measures, processes, or organizational structure, followed by a cross-reference to Item 1A. No domain terminology, firm-specific facts, or verifiable claims are present.


reasoning: This paragraph describes the governance chain for cybersecurity oversight, from the CFO managing risk to the Audit Committee's oversight role to potential Board reporting, making it Board Governance. The paragraph contains only generic roles (CFO, Audit Committee) and standard ERM terminology without any domain-specific cybersecurity terms, firm-specific facts, or verifiable claims.


reasoning: This paragraph is a cross-reference directing readers to Item 1A (Risk Factors) for additional cybersecurity information, which falls under None/Other per Rule 5's guidance that cross-references pointing elsewhere are not substantive disclosure. No specific facts are present—only generic forward-looking language about potential material effects.


reasoning: The paragraph's primary content is a backward-looking materiality assessment stating that cybersecurity risks and threats have not materially affected business strategy, results of operations, or financial condition, which fits Strategy Integration under Rule 5. The terms 'malware' and 'computer virus attacks' are generic vocabulary that any business professional would use and do not pass the ERM test for domain expertise, and the materiality statement is a negative self-assertion that is not externally verifiable.


fact: over thirty years of experience

fact: threat intelligence

reasoning: This paragraph primarily answers 'How is management organized to handle cybersecurity?' by describing the Head of IT role, responsibilities, and qualifications. The specificity reaches Level 4 due to the quantified claim of 'over thirty years of experience,' which is a verifiable lower bound that could be checked against the individual's professional history.


fact: security engineering

fact: cyber threat detection and response

fact: certificate in Cybersecurity Oversight from Carnegie Mellon University Software Engineering Institute

reasoning: The paragraph primarily answers how management is organized for cybersecurity, focusing on the CISO role, responsibilities, and qualifications. Specificity reaches Quantified-Verifiable due to the named certification from Carnegie Mellon SEI, which is an externally verifiable credential.


reasoning: This paragraph describes the board-level oversight structure for cybersecurity, with the Board delegating to the Audit Committee and the General Counsel serving as the responsible management officer, which is a classic governance-chain disclosure. No domain terminology, firm-specific facts, or verifiable claims are present—only generic governance roles (Audit Committee, General Counsel) that exist at most public companies.


fact: Breach Response Team

reasoning: The paragraph describes the activities of the Breach Response Team—conducting tabletop exercises, analyzing risks, and developing detection/mitigation/remediation strategies—which are program operations rather than organizational structure or qualifications, making it RMP under Rule 2. The named 'Breach Response Team' is a firm-specific organizational unit that distinguishes this company's cybersecurity posture, elevating specificity to Level 3.


reasoning: The paragraph primarily describes the organizational structure for cybersecurity management, specifically that the Investment Adviser manages day-to-day operations and has implemented a cybersecurity program applicable to the Company. This answers 'How is management organized to handle cybersecurity?' The specificity is Level 1 because the paragraph contains only generic ERM language ('processes to assess, identify, and manage risks') that would be natural for any risk professional, with no domain-specific terminology, firm-specific facts, or verifiable claims.


fact: Chief Information Security Officer (CISO)

fact: threat landscape

reasoning: The paragraph primarily describes the CISO's role and activities (leading information security, meeting with governance bodies, facilitating oversight, performing tabletop exercises), answering how management is organized to handle cybersecurity. The CISO role is a firm-specific cybersecurity leadership position, elevating specificity to Level 3. 'Threat landscape' is a domain term demonstrating cybersecurity expertise.


fact: Vice President, Information Security and Privacy

fact: Senior Vice President, Chief Strategy and Digital Officer

reasoning: This paragraph describes Audit Committee oversight of cybersecurity risk on behalf of the Board, including the scope of review and who provides briefings, which directly answers the Board Governance question. Specificity reaches Firm-Specific due to two named VP/SVP-level leadership roles with cybersecurity responsibilities.


reasoning: This paragraph describes the Audit Committee's oversight role in reviewing cybersecurity risks and how management reports to the Board, which directly answers the Board Governance question about board oversight structure. The paragraph contains only generic governance language (Audit Committee, internal controls, policies and procedures) without domain-specific terminology, firm-specific facts, or verifiable claims.


reasoning: The paragraph's central substantive content is a materiality assessment stating that cybersecurity threats have not materially affected and are not reasonably likely to materially affect the company's business strategy, results of operations, or financial condition, which directly answers the Strategy Integration question about business/financial impact. Specificity is Generic Boilerplate because the negative assertion about material impact is not externally verifiable, and the paragraph contains no domain terminology passing the ERM test, no firm-specific facts, and no quantified verifiable claims.


reasoning: The paragraph describes management's responsibilities for developing cybersecurity programs, how they acquire expertise, and how they interact with cybersecurity teams—directly answering how management is organized to handle cybersecurity. Specificity is Level 1 because the language is entirely generic: 'prevention, detection, mitigation and remediation' is standard ERM terminology that any risk professional would use, and there are no named roles, specific organizational structures, or verifiable claims.


reasoning: This paragraph is a definitional setup that references regulatory terms from Item 106 of Regulation S-K, providing no substantive cybersecurity disclosure content about the company's governance, management, processes, or incidents.


reasoning: The paragraph describes third-party service providers that assess and support the company's security program, which falls under RMP per Rule 3 (third parties hired to serve the company, not vendors being overseen). The language is generic business/ERM terminology—'assess our information security program,' 'control environment,' 'breach notification and response processes'—that any ERM professional could write without demonstrating cybersecurity domain expertise.


reasoning: The paragraph describes how the Board oversees cybersecurity risk, including the Board's oversight function, quarterly updates, presentations from IT leadership, escalation processes for incidents, and engagement of third-party experts—all answering the question 'How does the board oversee cybersecurity?' Specificity is Level 1 because 'Director of IT' is explicitly not firm-specific per the rules, 'quarterly' is a generic cadence, third-party experts are unnamed, and no domain-specific terminology passes the ERM test.


fact: ransomware attack

fact: malware

fact: persistence mechanisms

fact: early 2019

reasoning: This paragraph describes an actual cybersecurity incident—a 2019 ransomware attack—including its nature, scope, investigation, and remediation, which is the defining content of Incident Disclosure. Specificity reaches Firm-Specific due to the 'early 2019' incident timing, along with domain terms like 'ransomware attack,' 'malware,' and 'persistence mechanisms' that demonstrate cybersecurity expertise.


reasoning: This paragraph contains backward-looking and forward-looking materiality assessments per SEC Item 106(b)(2), stating that no known risks have materially affected the company but ongoing risks are reasonably likely to materially affect it—these are classic Strategy Integration conclusions. The paragraph lacks any domain terminology beyond generic 'cybersecurity' references, contains no firm-specific organizational details, and the negative assertion about material impacts is a self-reported claim that cannot be externally verified.


reasoning: The paragraph centrally addresses how third-party vendor cybersecurity risks are managed through pre-onboarding assessments, contractual protections, and ongoing monitoring, which directly answers the Third-Party Risk question. The language is entirely generic process description without cybersecurity domain terminology, firm-specific roles or committees, or verifiable claims—any ERM professional could write this about vendor risk in any domain.


fact: Chief Technology Officer role with cybersecurity risk oversight responsibilities

fact: IT Director role providing assessments to CTO for cybersecurity risks

reasoning: This paragraph describes management roles and reporting lines for cybersecurity (CTO oversees risk assessment based on IT Director's input), fitting Management Role. The CTO is a firm-specific leadership role explicitly listed in the rules, and the organizational structure (IT Director reporting assessments to CTO) distinguishes this company's cybersecurity governance from others, achieving Level 3 specificity.


fact: Vaidyanathan Raghavan named as CTO

fact: Master of Science in Electrical Engineering degree from the University of Minnesota

fact: General Manager of Technology at Wayfair

fact: Brendan Hamilton named as Vice President of Information Technology and Security

fact: Certified Information Systems Security Professional (CISSP)

reasoning: This paragraph describes management's organizational structure for cybersecurity, naming specific officers (CTO and VP of Information Technology and Security) and their qualifications. Contains multiple externally verifiable facts including named individuals with specific credentials (MS in Electrical Engineering from University of Minnesota, CISSP certification) and prior employment at Wayfair, making it Level 4.


reasoning: This paragraph is a risk acknowledgment preamble that does not substantively answer any of the six category questions—it describes no oversight structure, management roles, program activities, vendor management, actual incident, or materiality assessment. Under Rule 6, paragraphs with no substantive cybersecurity disclosure are N/O, and N/O paragraphs always receive Generic Boilerplate specificity.


fact: Chief Information Consultant

reasoning: This paragraph describes the governance chain for cybersecurity oversight, showing how cybersecurity risk information flows from the Chief Information Consultant through the CFO to the Audit Committee of the Board. The specificity reaches Level 3 due to the firm-specific role title 'Chief Information Consultant,' which is not a standard industry title and distinguishes this company's organizational structure.


reasoning: The paragraph mentions Board and Audit Committee support for the cybersecurity program, which is a minimal governance disclosure about oversight structure. However, it lacks any detail on how oversight actually operates. No domain terminology, firm-specific facts, or verifiable claims are present—the language is generic risk management boilerplate that any ERM professional could write.


fact: Chief Information Officer (CIO)

fact: CIO also serves as CISO and Chief Information Technology Architect

reasoning: This paragraph describes board/committee oversight of cybersecurity, including reporting cadence (quarterly reports, annual briefings), information flow (Committee to full Board), and who presents to the Board (CIO/CISO, internal staff, external experts). The specificity reaches Level 3 due to firm-specific organizational facts: the company has a CIO who also serves as CISO and Chief Information Technology Architect, which distinguishes this company's leadership structure.


reasoning: The paragraph primarily answers how cybersecurity affects the business by providing a materiality assessment (no material risks identified) and mentioning cyber insurance coverage—both Strategy Integration topics per Rule 5. The specificity is Level 1 because the paragraph contains no domain-specific terminology passing the ERM test, no firm-specific facts that distinguish this company, and no verifiable claims (the negative assertion about incidents is not externally verifiable, and the cyber insurance mention lacks carrier name, amount, or policy details).


reasoning: The paragraph primarily answers how the board oversees cybersecurity, describing Board and Audit Committee oversight responsibilities for the cyber risk management program. No domain terminology passes the ERM test, no firm-specific roles or committees are named beyond generic governance structures, and no verifiable claims appear—resulting in Generic Boilerplate specificity.


reasoning: This paragraph is a pure cross-reference directing readers to Item 1A for cybersecurity risk factors, with no substantive disclosure content. None/Other category applies per Rule 5 (cross-references pointing elsewhere), and Generic Boilerplate specificity applies as there are no facts, domain terms, or verifiable claims.


fact: Vice President of Information Systems and Architecture

fact: network security

reasoning: This paragraph primarily describes a management role—the VP of Information Systems and Architecture—including their responsibilities, qualifications, and reporting lines, which fits Management Role. The VP title with IT/security portfolio is a firm-specific fact distinguishing this company's cybersecurity leadership structure, while 'network security' is a domain term passing the ERM test.


fact: NIST CSF (named framework)

fact: HIPAA (named regulatory framework)

fact: SOC 2 Type II (named standard)

fact: SOX ITGC (named standard)

reasoning: The paragraph describes the company's cybersecurity risk management program, including its purpose (protecting confidentiality, integrity, and availability) and the frameworks it references for risk assessment. This directly answers 'What does the cybersecurity program do?' The specificity reaches Level 2 because the paragraph demonstrates cybersecurity domain expertise by naming specific frameworks (NIST CSF, HIPAA, SOC 2 Type II, SOX ITGC) that a non-security ERM professional would not naturally reference. The explicit disclaimer that these are used only as guides—not certifications—prevents Level 4.


reasoning: This paragraph states a materiality assessment concluding that no cybersecurity incidents have materially affected or are reasonably likely to materially affect the company, which fits Strategy Integration under Rule 5. The specificity is Generic Boilerplate because the negative assertion about absence of material incidents is not externally verifiable, and the remaining language uses only generic cybersecurity terminology without domain-specific expertise or firm-specific facts.


fact: December 2021 cyber-attack

fact: March 2024 cybersecurity breach

fact: Canadian subsidiary

fact: end point protection software

reasoning: This paragraph describes two actual cybersecurity incidents with specific dates, scope, impact, and remediation, directly answering 'What happened in a cybersecurity incident?' The specificity reaches Quantified-Verifiable due to the specific incident dates (December 2021 and March 2024) tied to real events that could be independently verified through news reports or other sources.


fact: 27 years of technology leadership experience (VP and CIO)

fact: Doctor of Business Administration credential

fact: 27 years of experience in infrastructure and security operations (Director of Information Security)

fact: Vice President and Chief Information Officer role

fact: Director of Information Security role

fact: Information Security Committee (named committee)

fact: Executive Information Security Oversight Committee (named committee)

fact: Committee membership: VP/CIO, SVP/CFO, SVP/Chief Legal Officer and Secretary, SVP/Chief Human Resources Officer

reasoning: This paragraph answers how management is organized to handle cybersecurity, detailing leadership roles (VP/CIO, Director of Information Security), their qualifications and years of experience, reporting lines, and management-level committee structure (Information Security Committee, Executive Information Security Oversight Committee) with specific membership. Specificity reaches Level 4 due to two verifiable claims: '27 years of technology leadership experience' for the VP/CIO and '27 years of experience in infrastructure and security operations' for the Director—both are hard numbers checkable against career histories.


fact: ransomware

fact: phishing emails

fact: targeted attacks

fact: fourth quarter of fiscal year 2019 ransomware incident

reasoning: This paragraph describes a specific ransomware incident that occurred in Q4 2019, including the nature of the attack, timing, operational and financial impacts, and remediation efforts, making it clearly Incident Disclosure. The specificity reaches Quantified-Verifiable because the specific timeframe (fourth quarter of fiscal year 2019) tied to a real ransomware incident is an externally verifiable claim that could be confirmed through news reports, SEC filings, or other public records.


reasoning: The paragraph primarily provides a materiality assessment stating that no cybersecurity threats have been identified that are reasonably anticipated to materially affect the business, which is a Strategy Integration disclosure per Rule 5. The language is entirely generic boilerplate with no domain-specific terminology passing the ERM test, no firm-specific facts, and no verifiable claims—the negative assertion about threat absence is a self-reported claim that cannot be independently verified.


reasoning: This paragraph is a materiality assessment stating that no cybersecurity risks have materially affected or are reasonably likely to materially affect the company, which per Rule 5 is Strategy Integration. The specificity is Level 1 because the negative assertion about absence of risks is not externally verifiable, and the paragraph contains no domain expertise terms, firm-specific facts, or quantified claims.


fact: Chief Technology Officer

reasoning: This paragraph describes the board's oversight structure for cybersecurity, including Audit Committee reporting, management briefings, and continuing education for board members, which directly answers how the board oversees cybersecurity. The mention of 'Chief Technology Officer' is a firm-specific fact (a VP-or-above role explicitly listed in the rules), elevating specificity to Level 3; no domain terminology passes the ERM test and no verifiable claims are present.


reasoning: This paragraph states a forward-looking materiality assessment about cybersecurity risks' potential impact on the business, which directly answers the Strategy Integration question per Rule 5. The specificity is Generic Boilerplate because the materiality conclusion is a self-reported negative assertion (not externally verifiable), and the paragraph contains no domain terminology passing the ERM test, no firm-specific facts, and no quantified verifiable claims.


fact: Security Governance Council (SGC)

fact: CISO

fact: SGC members from Operations, Information Technology, Finance, Internal Audit, Legal, Human Resources and Organizational Development, and Risk Management

reasoning: This paragraph describes a management-level cybersecurity committee (SGC), its leadership structure (chaired by CISO), and cross-functional composition, which directly answers how management is organized to handle cybersecurity. Specificity is Firm-Specific due to the named committee (Security Governance Council), the CISO role, and the specific departmental composition of the SGC.


fact: penetration testing

fact: CIS Critical Security Controls

reasoning: This paragraph primarily answers 'What does the cybersecurity program do?' by describing program activities including penetration testing, quarterly briefings, annual assessments, third-party oversight, incident response planning, and simulated incident testing. The third-party content is integrated as components of the overall program rather than being the central standalone topic. Specificity is driven by domain terminology like 'penetration testing' and 'CIS Critical Security Controls' that demonstrate cybersecurity expertise beyond generic ERM language.


reasoning: The paragraph primarily describes the company's vendor management process for third parties, including vetting, approval, and inventorying, with a brief mention of cybersecurity processes and a materiality statement. The specificity is Generic Boilerplate because the language uses generic business/risk management terminology without cybersecurity domain expertise (ERM test fails for all terms), no firm-specific structural facts about the cybersecurity program, and the materiality statement is a negative self-assertion that is not externally verifiable.


fact: Chief Information Security Officer ("CISO")

reasoning: The paragraph primarily describes what the cybersecurity program does—processes to assess, identify, manage and report risks, business continuity plans, and security infrastructure enhancements—with governance elements (CISO, Board oversight) serving as framing context rather than the main focus. Specificity reaches Firm-Specific due to the named CISO role, which is a firm-specific leadership position per the classification rules.


reasoning: This is a forward-looking aspirational statement about the goals of cybersecurity risk management rather than substantive disclosure answering any of the six key questions. The paragraph contains no domain terminology beyond generic business language, no firm-specific facts, and no verifiable claims.


reasoning: This paragraph contains only forward-looking risk speculation ('could result in,' 'could lead to,' 'could materially harm') without describing any actual cybersecurity measures, governance structure, or materiality assessments. It lacks domain terminology that passes the ERM test, firm-specific facts, or verifiable claims—only generic business continuity and cyber-attack language any ERM professional would use.


reasoning: This paragraph is a cross-reference directing readers to Item 1A Risk Factors, containing only quoted hypothetical risk factor language about potential consequences of cybersecurity failures. Per Rule 5, cross-references pointing elsewhere are classified as None/Other. The paragraph contains no domain-specific terminology, firm-specific facts, or verifiable claims—only generic risk language applicable to any company.


reasoning: The paragraph describes management roles (VP of Internal Audit, General Counsel, internal audit team) and their responsibilities in facilitating the ERM process and developing risk-based audit plans, with cybersecurity risks included as one component. No domain-specific cybersecurity terminology passes the ERM test, and VP of Internal Audit is not a cybersecurity-specific VP role, so no firm-specific or verifiable facts are present.


reasoning: This paragraph describes Board-level oversight responsibilities for cybersecurity, including the Board's expertise composition and its role in reviewing strategic direction and resource allocation—classic Board Governance content. The language is entirely generic governance boilerplate with no domain-specific cybersecurity terminology, firm-specific facts, or verifiable claims; terms like 'cybersecurity program' and 'cybersecurity threats' are generic concepts any ERM professional would use, not evidence of cybersecurity domain expertise.


reasoning: This paragraph describes Audit Committee oversight of cybersecurity risks and the information flow to the board (annual assessments, quarterly updates), which directly answers the Board Governance question of how the board oversees cybersecurity. The paragraph contains no domain-specific cybersecurity terminology that passes the ERM test, no firm-specific facts beyond the generic Audit Committee role that exists at every public company, and no verifiable claims.


fact: Ontrack software solution

reasoning: This paragraph describes the company's risk monitoring process and the specific software tool used to track risk assessments and cybersecurity incidents, answering 'What does the cybersecurity program do?' The named software 'Ontrack' is a firm-specific fact that distinguishes this company's cybersecurity toolset from others.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party vendors, fitting Third-Party Risk under Rule 3 (vendor oversight as central topic). The language is generic risk management terminology—'procedures to identify and mitigate,' 'reviewing internal controls,' 'assess their procedures'—that any ERM professional would use, with no domain-specific security practices, firm-specific details, or verifiable claims.


fact: HITRUST framework

fact: SOC2 framework

fact: threat modeling

fact: network firewalls

fact: vulnerability scanners

fact: intrusion prevention and detection systems

fact: identity and access management systems

fact: vulnerability assessments

fact: cybersecurity threat intelligence

fact: phishing email simulations

fact: tabletop exercises

fact: NIST framework

reasoning: The paragraph comprehensively describes the company's cybersecurity program activities—risk assessment, security tools, training, incident response planning—which directly answers 'What does the cybersecurity program do?' The paragraph contains numerous domain-specific terms (HITRUST, SOC2, NIST frameworks, penetration testing, vulnerability scanners, EDR, IAM systems, phishing simulations, tabletop exercises) that demonstrate cybersecurity expertise and pass the ERM test, but lacks firm-specific facts (cadences are generic 'quarterly'/'annual' without specific dates, and 'Incident Response Plan' lacks a distinguishing identifier) or externally verifiable claims (framework alignment is stated, not certification).


reasoning: The paragraph primarily answers the Strategy Integration question about cybersecurity's effect on business and finances, containing multiple materiality assessments: backward-looking ('none of the cybersecurity attacks...have resulted in a material impact') and forward-looking ('We do not believe cybersecurity threats are reasonably likely to affect us'). These SEC Item 106(b)(2) assessments are the most substantive content, outweighing generic risk management language and forward-looking disclaimers. Specificity is Level 1 because the paragraph contains no domain-specific terminology passing the ERM test, no firm-specific facts, and no verifiable claims—the materiality assertions are negative self-reports which cannot be externally verified.


reasoning: This paragraph states a materiality assessment conclusion that cybersecurity threats have not materially affected and are not reasonably likely to materially affect the business, which directly answers the Strategy Integration question about business/financial impact. The specificity is Generic Boilerplate because the negative assertion about absence of material threats is not externally verifiable per the rules, and the paragraph contains no domain terminology, firm-specific facts, or quantified claims.


fact: National Institute of Standards and Technology (NIST) framework

fact: International Organization for Standardization (ISO) standards

fact: confidentiality, security and availability (CIA triad concept)

reasoning: The paragraph primarily answers how the Board oversees cybersecurity, opening with Board recognition of cybersecurity importance and describing Board oversight of cybersecurity as a component of enterprise risk management. Specificity is driven by references to NIST and ISO frameworks, which demonstrate cybersecurity domain knowledge beyond generic ERM language.


reasoning: This paragraph describes board and Audit Committee oversight of cybersecurity risks, including information flow from the CFO to the Audit Committee and annual updates to the Board, which directly answers the Board Governance question. The specificity is Generic Boilerplate because all elements are standard governance roles (Audit Committee, CFO, independent directors) and generic cadences (annual basis) that appear in most public company disclosures, with no domain-specific terminology or firm-unique facts.


reasoning: This paragraph is a cross-reference directing readers to risk factors in Item 1A, containing no substantive cybersecurity disclosure about governance, management, processes, or incidents. It contains only generic risk language and a section reference, with no domain-specific, firm-specific, or verifiable facts.


reasoning: This paragraph describes the cybersecurity responsibilities of two management-level positions (Senior Director of IT and General Counsel), answering how management is organized to handle cybersecurity. The specificity is Level 1 because 'Senior Director of IT' lacks a security qualifier (not firm-specific per the rules), 'General Counsel' is a generic governance role, and the language uses generic ERM terminology that doesn't demonstrate cybersecurity domain expertise.


reasoning: The paragraph provides a materiality assessment stating no breaches occurred and no cybersecurity risks are reasonably likely to materially affect operations—this is a backward-looking and forward-looking conclusion about cybersecurity's business impact under Rule 5. No domain terminology passes the ERM test (breaches, incidents, and threats are terms any ERM professional would use), no firm-specific cybersecurity facts are present, and negative assertions about absence of incidents are not externally verifiable.


reasoning: This paragraph describes Board and Audit Committee oversight of cybersecurity risk management, which directly answers how the board oversees cybersecurity. The paragraph contains only generic governance language (Audit Committee, Board, senior leadership) without domain-specific terminology, firm-specific facts, or verifiable claims.


reasoning: This paragraph describes the composition of incident response teams and which organizational roles may be included, answering how management is organized to handle cybersecurity incidents. The paragraph contains only generic corporate roles (CEO, CFO, department names) and an IT title below VP level without a security qualifier ('Lead IT Systems Specialist'), none of which meet the threshold for firm-specific or verifiable facts, and no domain-specific security terminology that would pass the ERM test.


reasoning: The paragraph describes the oversight chain from Board to Audit Committee to management (COO, Senior Director of IT), which is primarily about how the board oversees cybersecurity. No domain-specific terminology passes the ERM test, no firm-specific facts qualify (Audit Committee is generic, COO is not a cybersecurity-specific role, and Senior Director of Information Technology lacks a security qualifier), and no verifiable claims appear.


fact: Senior Vice President and Chief Information Officer

fact: more than 30 years of collective information and product security experience

fact: cybersecurity degrees

fact: cybersecurity-related certifications

reasoning: This paragraph primarily describes management's organizational structure for cybersecurity—the CIO role, team composition, qualifications, and reporting lines—fitting Management Role. Specificity reaches Level 4 due to the verifiable claim that the CIO has 'over 25 years of IT Risk Management experience,' which could be checked against their professional credentials.


reasoning: This paragraph describes management's organizational responsibility for cybersecurity (who develops policies, team qualifications, training) rather than board oversight or program activities, fitting Management Role. The language is entirely generic—no named roles like CISO, no specific certifications, no domain terminology beyond basic IT/cybersecurity references that any ERM professional would use, resulting in Generic Boilerplate specificity.


reasoning: This paragraph describes the board's delegation of cybersecurity oversight to the audit committee, directly answering how the board oversees cybersecurity risk. Specificity is Generic Boilerplate because it contains only standard governance language (board, audit committee, risk oversight) without domain-specific terminology, firm-specific details, or verifiable facts.


fact: information security risk committee

fact: Chief Information Security Officer (CISO)

reasoning: The paragraph primarily describes management's organizational structure for cybersecurity—the information security risk committee, the CISO's role as chair, and the committee's composition—rather than the program's operational activities. Specificity reaches Level 3 due to the CISO role and named information security risk committee, both firm-specific facts that distinguish this company's cybersecurity posture.


reasoning: The paragraph states a materiality conclusion about cybersecurity impact ("have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us"), which is a Strategy Integration disclosure under Rule 5. The paragraph contains only generic language and a negative assertion that cannot be externally verified, with no domain terminology, firm-specific facts, or verifiable claims.


fact: CTO

reasoning: The paragraph describes management's organizational responsibility for cybersecurity, specifically naming the CTO and IT Manager as responsible for risk assessment and program oversight, which answers how management is organized to handle cybersecurity. The CTO is a VP-level role explicitly listed as firm-specific, while IT Manager does not qualify as it is below VP level without a security qualifier.


fact: ransomware attacks

fact: phishing attacks

fact: insider threats

fact: third-party attacks

fact: computer viruses

fact: malicious codes

fact: unauthorized access attempts

reasoning: The paragraph primarily describes the company's cybersecurity risk landscape and defensive activities (monitoring, disaster recovery process), with the materiality assessment embedded as a subordinate clause within a broader discussion of incidents. Multiple domain-specific attack types (ransomware, phishing, insider threats) pass the ERM test and elevate specificity to Level 2, but no firm-specific roles, named programs, or verifiable claims are present.


reasoning: The paragraph primarily provides a materiality assessment—stating that prior cybersecurity incidents have not had material impact and are not reasonably likely to materially affect operations—which falls under Strategy Integration per Rule 5. The language is generic business/ERM terminology without domain-specific cybersecurity expertise, firm-specific cybersecurity posture details, or externally verifiable claims; the materiality assertions are self-reported negative claims that cannot be independently verified.


reasoning: This paragraph is a general commitment statement about taking cybersecurity seriously, without describing any governance structure, management roles, processes, third-party oversight, incidents, or business impact assessments. It contains no domain-specific terminology, firm-specific facts, or verifiable claims—just generic language any company could include.


fact: SVP of IT Security

reasoning: This paragraph describes the Audit Committee's oversight of cybersecurity, including briefing frequency and the reporting structure from management (SVP of IT Security) to the board committee, which is classic Board Governance content. The SVP of IT Security is a firm-specific cybersecurity leadership role at the VP level, establishing Level 3 specificity.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers, including due diligence and ongoing monitoring of vendor safeguards. No domain-specific terminology, firm-specific facts, or verifiable claims are present—the language consists of generic vendor risk management terms that any ERM professional would use.


reasoning: This paragraph describes the Board's oversight of cybersecurity through annual reports and incident updates, which directly answers how the board oversees cybersecurity. The language is entirely generic—'annual reports' and 'Board' are standard governance terms that any ERM professional would use, with no domain-specific terminology, firm-specific roles, or verifiable facts.


reasoning: This paragraph describes board and Audit Committee oversight of cybersecurity risk, directly answering how the board governs cybersecurity. The language is entirely generic governance boilerplate—no domain-specific cybersecurity terminology, no firm-specific roles beyond the standard Audit Committee every public company has, and no verifiable claims.


reasoning: This paragraph is introductory boilerplate that does not substantively answer any of the six category questions—it states a generic commitment to cybersecurity without describing board governance, management roles, specific risk management processes, third-party oversight, incidents, or business/financial impact. The language is entirely generic with no domain-specific terminology passing the ERM test, no firm-specific facts, and no verifiable claims.


reasoning: This paragraph is a materiality assessment stating that cybersecurity threats have not materially affected and are not reasonably likely to materially affect the company's business strategy, results of operations, or financial condition, which directly answers the Strategy Integration question about business/financial impact. The specificity is Level 1 because the paragraph contains only a negative assertion (not externally verifiable), a forward-looking belief statement, and a cross-reference to risk factors—none of which constitute domain terminology, firm-specific facts, or verifiable claims.


reasoning: This paragraph is a cross-reference directing readers to Item 1A Risk Factors for cybersecurity risk information, containing no substantive disclosure about governance, management, processes, or incidents. It quotes generic risk factor titles without providing any firm-specific or domain-specific cybersecurity content.


fact: NIST Framework

reasoning: The paragraph describes the cybersecurity program's structure, framework adoption, and security tools, answering what the program does. Specificity is Domain-Adapted due to the named NIST Framework reference, which demonstrates cybersecurity domain expertise beyond generic ERM language.


reasoning: This paragraph is an introductory commitment statement that does not answer any of the six substantive questions—it describes cybersecurity as important to the company but provides no information about governance structure, management roles, program activities, third-party oversight, incidents, or materiality assessments. The language is entirely generic business terminology with no domain-specific terms, firm-specific facts, or verifiable claims.


reasoning: This paragraph describes the board's oversight structure for cybersecurity risk through reporting from executive leadership, answering how the board oversees cybersecurity. The language is entirely generic governance boilerplate with no domain-specific terminology passing the ERM test, no firm-specific roles or committees, and no verifiable claims.


reasoning: This paragraph primarily provides a materiality assessment—stating that no cybersecurity threats or incidents have materially affected the company while acknowledging ongoing risks that are reasonably likely to materially affect it—which directly answers the Strategy Integration question per Rule 5. The specificity is Generic Boilerplate because the paragraph contains no domain terminology passing the ERM test (terms like 'internal controls,' 'systems and infrastructure,' and 'invest in cybersecurity' are generic business language any ERM professional would use), no firm-specific facts (no named roles, committees, or programs), and no verifiable claims (the negative assertion about no material incidents cannot be independently confirmed).


reasoning: The paragraph describes Board and Audit Committee oversight of cybersecurity risk assessment and mitigation, which directly answers the Board Governance question about how the board oversees cybersecurity. Specificity is Generic Boilerplate because it contains only generic governance language (Board, Audit Committee, processes for assessing and managing risk) that any public company could use, with no domain-specific terminology, firm-specific facts, or verifiable claims.


reasoning: This paragraph makes a materiality assessment about whether cybersecurity incidents have affected the business, stating that no material incidents have occurred in the last three fiscal years. Per Rule 5, negative assertions about material impact ('have not experienced any cybersecurity incidents which have materially affected') are Strategy Integration. The paragraph contains only a cross-reference and a negative assertion about absence of incidents, which is not externally verifiable per the rules, and uses generic cybersecurity language that fails the ERM test for domain expertise.


fact: Senior Vice President – Technology Solutions role

fact: Reports directly to President

fact: Over four years in current role

fact: More than 25 years of aggregate experience

fact: More than ten years with the Company

fact: At least semi-annual reporting to Audit Committee

reasoning: The paragraph primarily describes board oversight structure, opening and closing with Audit Committee responsibilities for cybersecurity oversight, with management details embedded to explain the governance chain and information flow. Multiple verifiable claims about tenure and experience establish Level 4 specificity.


fact: ISO 27001 certification

fact: second ISO 27001 certification

reasoning: This paragraph describes the company's cybersecurity program activities—controls review, external testing, employee training, and third-party assessments—answering 'What does the cybersecurity program do?' The ISO 27001 certification claim is externally verifiable through certification bodies, and 'second' is a specific quantity, elevating this to Level 4.


reasoning: This paragraph provides backward-looking and forward-looking materiality assessments regarding cybersecurity threats and incidents, which directly answers the Strategy Integration question about how cybersecurity affects the business. The paragraph contains no domain-specific terminology, firm-specific facts, or verifiable claims—only negative assertions about absence of material impact, which are self-reported claims that cannot be independently verified.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers, including assessment processes and contractual requirements imposed on vendors. The language uses generic vendor risk management terminology that any ERM professional could write—terms like 'security questionnaires' and 'contractual obligations related to cybersecurity' do not demonstrate cybersecurity domain expertise beyond general business practice.


fact: ISO (Information Security Officer) role

fact: CISO role

reasoning: The paragraph describes board and audit committee oversight of cybersecurity, including reporting lines and information flow to the board level, which directly answers how the board oversees cybersecurity. Specificity is Firm-Specific due to the ISO and CISO roles, which are cybersecurity leadership positions that distinguish this company's governance structure.


reasoning: This paragraph provides the SEC-required materiality assessment under Item 106(b)(2), stating conclusions about whether cybersecurity risks have materially affected or are reasonably likely to materially affect the company's business strategy, operations, and financial condition. The specificity is Level 1 because the language is generic risk management terminology that any ERM professional would use—no domain-specific terms, firm-specific facts, or verifiable claims are present.


fact: penetration tests

reasoning: The paragraph describes management's involvement in cybersecurity activities (policies, testing, incident response), but applying the person-removal test, the substantive content describes what the cybersecurity program does rather than management's organizational structure or qualifications. The term 'penetration tests' is a domain-specific cybersecurity practice that passes the ERM test, elevating specificity to Level 2.


reasoning: This paragraph is purely a cross-reference directing readers to Item 1A for cybersecurity risk information, with no substantive disclosure about governance, management, processes, or incidents. It contains no domain terminology, firm-specific facts, or verifiable claims—only navigational text pointing elsewhere in the filing.


fact: phishing attacks

fact: malware infections

fact: state-sponsored actors

reasoning: The paragraph primarily provides a materiality assessment stating that attempted cyber incidents would not have resulted in material adverse effects, which fits Strategy Integration under Rule 5. Specificity reaches Domain-Adapted due to cybersecurity-specific terminology (phishing, malware, state-sponsored actors) that passes the ERM test.


reasoning: This paragraph contains pure biographical information about Mr. Tao's general business experience (consultation, operations, management, marketing) with no cybersecurity content whatsoever - no cybersecurity role, qualifications, or responsibilities mentioned. None/Other paragraphs always receive Generic Boilerplate specificity.


reasoning: The paragraph is primarily a materiality assessment stating that no cybersecurity threats have materially affected or are reasonably likely to materially affect the company, which per Rule 5 is classified as Strategy Integration. The specificity is Generic Boilerplate because the paragraph contains only negative assertions (not externally verifiable), generic risk language, and a vague insurance reference without any domain-specific terminology, firm-specific facts, or verifiable claims.


fact: incident response

fact: vulnerability management

reasoning: This paragraph primarily describes the Principal Accounting Officer's role in cybersecurity oversight and incident response, including receiving reports, working with the incident response team, and assessing materiality. While it mentions processes, the focus is on management's organizational responsibilities rather than program activities. Specificity is Level 2 due to domain terminology (incident response, vulnerability management) that passes the ERM test.


fact: Progress Software Corporation

fact: MOVEit Transfer

fact: patches

fact: cyber insurance

fact: cyberattack

reasoning: This paragraph describes an actual cybersecurity incident (MOVEit Transfer) affecting the company's customer data, including nature, scope, remediation, and business impact, which directly answers 'What happened in a cybersecurity incident?' The paragraph contains verifiable facts including the named firm Progress Software Corporation and the named product MOVEit Transfer, elevating specificity to Quantified-Verifiable.


reasoning: The paragraph describes IT supplier risk assessments and due diligence procedures imposed on vendors that handle customer data, directly answering how third-party cyber risks are managed. The language is generic business/ERM terminology ('periodic assessments,' 'due diligence procedures,' 'access, handle, transmit, process or store') without cybersecurity domain expertise, firm-specific details, or verifiable claims.


reasoning: This paragraph is a materiality assessment stating that no known cybersecurity incidents have or are likely to materially affect the company's business strategy, results of operations, or financial condition, which falls under Strategy Integration per Rule 5. The paragraph contains only generic language and a non-verifiable negative assertion, with no domain-specific terminology, firm-specific facts, or verifiable claims.


fact: GDPR

reasoning: This paragraph describes the company's cybersecurity program methodology, including framework adoption and operational processes for threat identification and response, which directly answers 'What does the cybersecurity program do?' The specificity reaches Domain-Adapted due to the named frameworks (ISO 27001, NIST 800-53, GDPR) that demonstrate cybersecurity domain expertise, but no firm-specific roles or verifiable claims are present.


fact: Chief Information Officer

fact: cybersecurity governance committee

fact: Chief Financial Officer

fact: Chief Legal Officer

fact: Head of Internal Audit

reasoning: This paragraph describes management's organizational structure for cybersecurity, including leadership (CIO), team responsibilities, and a management-level cybersecurity governance committee with its specific composition and duties. The specificity reaches Level 3 due to firm-specific facts: the CIO role, the named 'cybersecurity governance committee' (a non-generic committee), and the specific committee composition (CFO, CLO, CIO, Head of Internal Audit).


fact: Senior Director - Information Security

fact: over 15 years' experience in information technology and cybersecurity

fact: over 15 years' experience in auditing information security

fact: BA in math and computer science from Ohio Wesleyan University

reasoning: This paragraph describes the qualifications, experience, and credentials of a cybersecurity leadership role, directly answering how management is organized to handle cybersecurity. Specificity reaches Quantified-Verifiable due to multiple externally verifiable claims: the lower-bound experience claims ('over 15 years'), the specific educational credential from a named university, and the Information Systems Auditor certification which can be verified through ISACA's registry.


reasoning: This paragraph makes a materiality assessment (negative assertion that cybersecurity threats have not materially affected and are not likely to affect the company), which falls under Strategy Integration per Rule 5. The paragraph contains no domain terminology that passes the ERM test, no firm-specific facts, and no verifiable claims—the negative assertion about absence of material impact is a self-reported claim that cannot be externally verified.


fact: Enterprise Risk Management Committee

fact: Information Security Policy and Program

fact: penetration test

fact: internal and external penetration test

fact: Information Systems Audit

reasoning: The paragraph primarily describes testing activities (Information Systems Audit, penetration testing) and risk assessment activities, which are RMP content. RMP content comprises approximately 72% of the paragraph. The person-removal test leaves substantial cybersecurity program description. The specificity is Level 3 due to the named management-level committee (Enterprise Risk Management Committee) and named internal program (Information Security Policy and Program).


reasoning: The paragraph contains a negative assertion about not experiencing cybersecurity incidents since the IPO, which per Rule 5 constitutes a materiality assessment about whether cybersecurity has affected business outcomes. The remainder is speculative forward-looking language about potential risks and resource limitations typical of a SPAC with minimal operations. Specificity is Level 1 because the paragraph lacks domain-specific terminology (fails ERM test), firm-specific cybersecurity facts, and verifiable claims—the negative assertion about absence of incidents is explicitly not externally verifiable per the rules.


reasoning: The paragraph describes Board oversight structure for cybersecurity, answering how the Board oversees cybersecurity risk management, which is classic Board Governance content. The language is generic governance boilerplate without domain-specific terminology that passes the ERM test, no named committees or roles, and no verifiable claims.


fact: over twenty years of experience

fact: Senior Vice President, Finance

fact: General Counsel

fact: Incident Response Team composition including SVP Finance and General Counsel

reasoning: The paragraph describes management-level roles and responsibilities for cybersecurity risk management, including specific positions (Senior Director IT, SVP Finance, General Counsel), team composition, and qualifications—answering how management is organized to handle cybersecurity. Specificity reaches Level 4 due to the verifiable claim of 'over twenty years of experience' for the Senior Director, IT position.


reasoning: This is a fragment of a risk factor heading describing hypothetical negative outcomes ('Could... Disrupt Our Operations') rather than substantive cybersecurity disclosure about governance, processes, or actual incidents. It contains no domain-specific terminology, firm-specific facts, or verifiable claims—just speculative forward-looking language.


fact: over 25 years of work experience

reasoning: The paragraph describes which management roles are responsible for cybersecurity implementation and their qualifications, answering how management is organized to handle cybersecurity. The 'over 25 years of work experience' is a quantified lower bound that could be verified against the Senior Director of IT's employment history.