reasoning: The paragraph describes the objectives of the cybersecurity program (business continuity, protecting proprietary technology, safeguarding data), which answers what the program aims to accomplish. However, the language is entirely generic—terms like 'business continuity,' 'proprietary technology,' and 'safeguard data' would be used by any ERM professional and do not demonstrate cybersecurity domain expertise, firm-specific details, or verifiable claims.


content_category: Board Governance

fact: Chief Information Officer

fact: vCISO

category_confidence: high

specificity_confidence: high

reasoning: This paragraph describes the Board's oversight structure for cybersecurity, including delegation to the Audit Committee and information flow through management presentations—directly answering how the board oversees cybersecurity. The CIO and vCISO roles are firm-specific facts that distinguish this company's governance structure from generic boilerplate.

provider: z-ai

stage: benchmark


content_category: Strategy Integration

reasoning: This paragraph is a materiality assessment stating that cybersecurity threats have not materially affected and are not reasonably likely to materially affect the company—exactly the type of conclusion that defines Strategy Integration under Rule 5. Specificity is Level 1 because the paragraph contains only a negative self-assertion about absence of material impacts (not externally verifiable per the rules) and cross-references to risk factor sections—no domain terminology, firm-specific facts, or verifiable claims.


reasoning: This paragraph is a negative assertion about incident history, which Rule 5 explicitly classifies as Strategy Integration ('Have not experienced any material cybersecurity incidents' → SI). The paragraph contains no domain-specific terminology, no firm-specific facts, and no verifiable claims—the negative assertion about absence of incidents is not externally verifiable by definition.


reasoning: This paragraph describes the Audit Committee's oversight responsibilities for cybersecurity, including its role in reviewing the cybersecurity program, assessing management's risk management steps, and reporting to the Board—directly answering how the board oversees cybersecurity. The specificity is Generic Boilerplate because all content is standard governance language (Audit Committee, risk assessment, risk management) that any ERM professional would use, with no domain-specific terminology, firm-specific organizational claims, or verifiable facts.


fact: phishing

fact: 2019 we were the subject of a successful phishing attempt

specificity_confidence: medium

reasoning: The paragraph primarily provides the SEC-required forward-looking materiality assessment about cybersecurity risks' impact on the business, satisfying the Strategy Integration category. Specificity reaches Firm-Specific level due to the disclosure of a 2019 phishing incident unique to this company, with 'phishing' as domain terminology.


content_category: Risk Management Process

fact: principle of least-privilege

fact: phishing awareness exercises

fact: security-by-design principles

reasoning: This paragraph describes the company's cybersecurity program activities including framework adoption, access controls, and employee training—answering 'What does the cybersecurity program do?' Domain-specific terminology including ISO 27001, least-privilege, phishing awareness exercises, and security-by-design principles demonstrate cybersecurity expertise beyond generic ERM language, but no firm-specific or verifiable facts are present.


content_category: Incident Disclosure

fact: October 2023 — specific date of cybersecurity incident (verifiable)

fact: 23andMe.com accounts — specific platform affected (firm-specific)

fact: Security Operations — domain term

fact: two-step verification — domain term

reasoning: Category: Incident Disclosure — the paragraph primarily describes an actual cybersecurity incident (October 2023 breach of 23andMe.com accounts), including the nature of unauthorized access, timing, and remediation steps taken. Specificity: Level 4 because 'October 2023' is a specific date tied to a real cybersecurity incident that can be independently verified through public disclosures and SEC filings.


fact: forensic investigation

reasoning: The paragraph describes an actual cybersecurity incident that occurred during the reporting period, including its nature (employee interactions with suspicious websites), response (prompt containment), and investigation outcome, which fits Incident Disclosure. Specificity is Level 2 because 'forensic investigation' passes the ERM test as domain-specific terminology that a non-security ERM professional would not naturally use.


fact: Chief Information Security Officer

fact: Chief Technology and Digital Officer

reasoning: The paragraph describes board and committee oversight structure—the Audit and Finance Committee's responsibility, quarterly briefing cadence, and annual Board discussions—answering how the board oversees cybersecurity. Specificity reaches Level 3 due to two named VP-level cybersecurity leadership roles (CISO and Chief Technology and Digital Officer), but lacks verifiable facts like named individuals, certifications, or specific dates that would elevate to Level 4.


content_category: None/Other

reasoning: This paragraph describes a forward-looking disclosure policy—what the company will do if a material incident occurs—rather than answering any of the six substantive questions about governance, management, processes, third-party risk, an actual incident, or business impact assessment. The language is entirely generic procedural boilerplate with no domain terminology, firm-specific details, or verifiable claims.


content_category: Management Role

reasoning: The paragraph describes a management role's responsibilities and qualifications, fitting Management Role. No domain terms pass the ERM test (generic risk language), the Director title lacks a security qualifier so is not firm-specific per the rules, and 'approximately 20 years' is a soft hedged number, resulting in Generic Boilerplate.


reasoning: The paragraph describes Audit Committee oversight of cybersecurity risks, including briefing frequency and topics covered, which directly answers how the board oversees cybersecurity. No domain terminology passes the ERM test (incident response plan and business continuity planning are explicitly excluded; data security posture and third-party assessments are generic ERM language), no firm-specific roles beyond the generic Audit Committee, and quarterly cadence without specific dates is not verifiable.


fact: CTO

reasoning: This paragraph describes how cybersecurity information flows to the Board through quarterly reports from the CTO, addressing the Board Governance question of oversight structure and briefing frequency. The CTO is a firm-specific named role at the VP level or above, elevating specificity to Firm-Specific, while the remaining content uses generic risk management terminology that does not demonstrate domain expertise.


fact: EVP ERM (Executive Vice President of Enterprise Risk Management)

reasoning: The paragraph primarily describes the Board's oversight structure—specifically the Risk Management Committee's role in ERM oversight, quarterly reporting from management to the committee, and information flow to the full Board—making it Board Governance. The materiality assessment sentence is secondary to the governance description. Specificity is Firm-Specific due to the EVP ERM role title, a VP-level position with cybersecurity risk in its portfolio.


reasoning: This paragraph is purely a cross-reference directing readers to Item 1A for cybersecurity risk disclosures, with no substantive content about governance, management, processes, or incidents. None/Other paragraphs automatically receive Generic Boilerplate specificity as they contain no cybersecurity facts.


fact: 2025 Cybersecurity Incident

fact: threat actor

reasoning: This paragraph describes an actual cybersecurity incident with specific timeline (August 5-8, 2025), scope (unauthorized access, potential data acquisition), and investigation status, making it Incident Disclosure. The specific dates August 5-8, 2025 are externally verifiable facts that elevate this to Quantified-Verifiable specificity.


reasoning: The paragraph describes executive management's responsibility for cybersecurity risk oversight and strategy, answering how management is organized to handle cybersecurity. Specificity is Generic Boilerplate because the language is entirely generic risk oversight terminology that any ERM professional would use, with no domain-specific terms, firm-specific roles, or verifiable facts.


content_category: Third-Party Risk

fact: penetration testing

fact: SOC reports

fact: vulnerability testing

fact: encryption standards

fact: ISO (Information Security Officer)

reasoning: The paragraph primarily describes vendor oversight processes—ISO assessments of third-party service providers, SOC report reviews, vendor control evaluations, and risk ratings—making it Third-Party Risk under Rule 3. The ISO role is firm-specific (Level 3), while penetration testing, SOC reports, vulnerability testing, and encryption standards are domain terms (Level 2).


fact: not insured for damages from cybersecurity incidents

category_confidence: medium

reasoning: The paragraph primarily addresses cybersecurity insurance (a Strategy Integration topic), disclosing that the company lacks coverage for cyber incident damages. The insurance disclosure is a firm-specific organizational claim about their risk management posture, though the paragraph also contains speculative language about potential incidents.


reasoning: This paragraph provides regulatory context—describing applicable financial privacy laws, federal banking agency oversight, and SEC disclosure rules—rather than answering any of the six substantive questions about the company's actual cybersecurity governance, management, processes, or incidents. The regulatory references (financial privacy laws, SEC rules effective December 18, 2023) are general requirements applicable to all regulated financial institutions and public companies, not firm-specific facts about CWBC's cybersecurity posture, and the language does not demonstrate cybersecurity domain expertise beyond what any ERM professional would use.


fact: CISO role

fact: CIO role

fact: CISO reports directly to CIO

reasoning: This paragraph primarily answers how the board oversees cybersecurity, describing the oversight chain from Board and Audit Committee through senior management, including briefing frequency and information flow. Specificity reaches Level 3 due to firm-specific cybersecurity leadership roles (CISO and CIO) and their reporting relationship.


fact: scanning our internal network and infrastructure

reasoning: This paragraph describes the company's cybersecurity program activities—risk assessment, vulnerability monitoring, network scanning, and security tools—answering 'What does the cybersecurity program do?' which maps to Risk Management Process. The specificity reaches Level 2 because 'scanning our internal network' and 'vulnerability testing' are cybersecurity-specific practices that pass the ERM test (a non-security ERM professional would not naturally use this technical vocabulary). The cadences mentioned ('at least monthly', 'annual basis') are generic frequencies, not verifiable hard numbers, and no firm-specific roles or named products appear.


fact: Risk and Governance Committee

fact: Certified Information Systems Security Professional (CISSP) certification held by Head of Information Technology

reasoning: The paragraph describes the governance chain from Board delegation to the Risk and Governance Committee through to management updates, making Board Governance the primary category despite the management role details in the latter half. Specificity reaches Level 4 due to the verifiable CISSP certification claim, with the named Risk and Governance Committee providing Level 3 support.


reasoning: This paragraph describes operational cybersecurity activities—continuous monitoring, detection through security tools, and incident response coordination—which directly answers 'What does the cybersecurity program do?' The language is entirely generic (monitoring, security tools, suspicious behaviors, incident response) and fails the ERM test, as an enterprise risk management professional would use identical phrasing for any risk domain, yielding no domain-specific or firm-specific facts.


fact: Chief Information Officer

reasoning: This paragraph describes board oversight structure, including briefing frequency (annually by the CIO), briefing content, and the Audit Committee's supporting role—classic Board Governance content answering how the board oversees cybersecurity. The mention of 'Chief Information Officer' as the role briefing the board is a firm-specific fact (VP-level role with IT/cybersecurity portfolio), establishing Level 3 specificity; no externally verifiable facts are present.


reasoning: This paragraph is a materiality assessment stating a negative conclusion about cybersecurity incidents and their financial impact, which fits Strategy Integration per Rule 5's explicit inclusion of 'Have not experienced any material cybersecurity incidents' as a SI negative assertion. Specificity is Generic Boilerplate because the negative assertions about incident absence are not externally verifiable, and the paragraph contains no domain terminology, firm-specific facts, or quantified claims.


fact: defense in depth

fact: zero trust based controls

fact: phishing email simulations

reasoning: The paragraph describes what the cybersecurity program does—risk assessment methodology, security controls, monitoring activities, training programs, and tools—answering the question 'What does the cybersecurity program do?' Specificity is Level 2 because the paragraph contains domain-specific terminology including 'defense in depth,' 'zero trust based controls,' and 'phishing email simulations' that demonstrate cybersecurity expertise beyond generic ERM language.


reasoning: This is a fragmented paragraph consisting of a partial sentence and a cross-reference to Item 1A, which falls under None/Other as it primarily directs readers elsewhere rather than providing substantive cybersecurity disclosure. No specific facts are present to elevate specificity above Level 1.


fact: Chief Technology Officer (CTO)

fact: Chief Operating Officer (COO)

fact: over 10 years of experience overseeing cybersecurity functions

type: quantified

fact: over 5 years of experience overseeing cybersecurity and IT functions

reasoning: The paragraph primarily describes the Board's cybersecurity oversight structure, including delegation to the Audit Committee and reporting lines from management to the Board, though it also contains management qualification details. Specificity reaches Level 4 due to the verifiable lower-bound experience claims ('over 10 years' and 'over 5 years') for the CTO and COO roles.


reasoning: This paragraph states a materiality assessment conclusion that no cybersecurity risks have materially affected or are reasonably likely to materially affect the company, which is a classic Strategy Integration disclosure under Rule 5. The specificity is Generic Boilerplate because the negative assertion about no material risks is not externally verifiable, the date is reporting-period context rather than a verifiable cybersecurity fact, and the terminology used (cybersecurity threats, incidents, cyber-attacks) consists of generic terms that any ERM professional would use without demonstrating domain expertise.


reasoning: The paragraph centrally addresses how the company manages third-party cyber risks by reviewing IT service providers' cybersecurity measures during engagement, fitting Third-Party Risk. The language is entirely generic—'review of cybersecurity measures' fails the ERM test as any business professional could write this, and no firm-specific or verifiable details are present.


fact: more than 20 years of experience in Business Finance and Audit management industry

fact: President and CEO leads information security team

fact: reports directly to Board of Directors on cybersecurity programs

reasoning: This paragraph describes a specific leadership role (President and CEO) with cybersecurity responsibilities, their qualifications, and reporting lines—answering 'How is management organized to handle cybersecurity?' The 'more than 20 years of experience' claim is a quantified lower bound that could be verified against the individual's professional history, elevating specificity to Level 4.


reasoning: This paragraph is a materiality assessment stating that cybersecurity risks have not materially affected the company and are not reasonably likely to do so, which is the defining characteristic of Strategy Integration under Rule 5. The paragraph contains no domain terminology passing the ERM test, no firm-specific facts, and no verifiable claims—the negative assertion about absence of material impact is a self-reported conclusion that cannot be independently verified.


fact: threat intelligence

reasoning: This is a governance-chain paragraph describing oversight structure from Board to Audit Committee to management, answering how the board oversees cybersecurity. The term 'threat intelligence' passes the ERM test as cybersecurity-specific terminology that a non-security risk professional would not naturally use, elevating specificity to Domain-Adapted.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from vendors and business partners through due diligence, evidence requirements, and contractual notification obligations, fitting Third-Party Risk. The language is entirely generic—terms like 'due diligence,' 'cybersecurity and data handling requirements,' and 'contractually obligated to notify' would be used by any ERM professional managing vendor risk, with no domain-specific terminology, firm-specific details, or verifiable claims.


fact: advanced persistent threats

reasoning: The paragraph's central claim is a materiality assessment—a negative assertion that no material cybersecurity incidents occurred during the two-year period ended December 31, 2024—making it Strategy Integration per Rule 5. Specificity reaches Level 2 due to the domain term 'advanced persistent threats,' which passes the ERM test as cybersecurity-specific terminology that a non-security risk professional would not naturally use.


fact: November 2023 cybersecurity incident resulting in disruption of IT systems

reasoning: This paragraph primarily describes an actual cybersecurity incident from November 2023, including the nature (disruption of IT systems), response actions (investigation with external experts, law enforcement coordination), remediation measures, and notification to affected individuals and regulators, making it Incident Disclosure. The specific date of the incident (November 2023) tied to a real event is externally verifiable through news reports and regulatory filings, elevating specificity to Level 4.


reasoning: The paragraph primarily describes program evaluation activities and external engagement to enhance security policies, which answers 'what does the cybersecurity program do?' The reporting to governance bodies is secondary to the evaluation and enhancement activities. No domain terms pass the ERM test—'information security program' and 'policies and procedures' are generic topic language, and engagement with 'vendors, industry participants, and intelligence and law enforcement communities' is language any ERM professional would use.


reasoning: This paragraph consists entirely of materiality assessments under SEC Item 106(b)(2), stating that cybersecurity risks have not materially affected the company and are not reasonably likely to do so, plus a negative assertion about incident detection. These are classic SI content answering how cybersecurity affects business/financial outcomes. The specificity is Generic Boilerplate because the paragraph contains no domain terminology beyond generic terms any ERM professional would use, no firm-specific facts distinguishing this company's posture, and negative assertions about incident absence are not externally verifiable.


reasoning: This paragraph is a sentence fragment followed by a cross-reference to the Risk Factors section, containing no substantive cybersecurity disclosure. As a pure cross-reference pointing elsewhere, it falls under None/Other, and specificity is Generic Boilerplate by definition.


fact: threat intelligence sharing

fact: Arizona Cyber Threat Response Alliance (ACTRA)

fact: The Internet and Television Association (NCTA)

reasoning: This paragraph describes a specific cybersecurity program activity—threat intelligence sharing through industry collaboration and public-private partnerships—making it Risk Management Process. The specificity reaches Quantified-Verifiable because the company names two specific organizations (ACTRA and NCTA) with which it collaborates, which are externally verifiable entities.


reasoning: The paragraph centrally addresses how the company manages third-party cybersecurity risks through pre-contract assessments, ongoing monitoring, and contractual security requirements, which fits Third-Party Risk under Rule 3 (requirements imposed ON vendors). Specificity reaches Firm-Specific because the paragraph names the specific internal teams conducting assessments ('information security and enterprise risk management teams'), though these are common department names making this borderline; no domain terminology passes the ERM test and no verifiable facts are present.


reasoning: The paragraph describes the company's cybersecurity program activities (framework adoption, procedures for threat detection and incident response), which fits Risk Management Process. However, it contains no domain-specific terminology that passes the ERM test—'threat detection,' 'incident response,' and 'risk mitigation' are generic risk management concepts any ERM professional would use—and no firm-specific or verifiable facts.


fact: Director of IT Security and Compliance

fact: vulnerability assessments

fact: continuous monitoring

reasoning: The paragraph primarily describes cybersecurity program activities (assessments, vulnerability testing, audits, monitoring techniques) rather than management organizational structure, so it falls under Risk Management Process. Specificity reaches Firm-Specific due to the named role 'Director of IT Security and Compliance' (Director-level with security qualifier), with additional domain terminology including vulnerability assessments and continuous monitoring.


reasoning: This paragraph primarily answers how cybersecurity affects the business by stating a materiality assessment that no cybersecurity incidents have materially affected operations, reputation, or financial performance, which fits Strategy Integration under Rule 5. The paragraph contains no domain terminology passing the ERM test, no firm-specific facts, and no verifiable claims—the negative assertion about no material incidents is a self-reported claim about absence that cannot be externally verified.


fact: Chief Information Officer

fact: 25 years of experience in the information technology industry

reasoning: The paragraph primarily describes the Board and Audit Committee's oversight structure and information flow from management, with the CIO described in the context of their role in that governance chain; however, substantial content about CIO qualifications and team composition creates some overlap with Management Role. Specificity reaches Level 4 due to the verifiable claim of 25 years of IT industry experience.


fact: ORIX USA

fact: ORIX

fact: externally managed company

reasoning: The paragraph describes how the company's cybersecurity risk management is structured through reliance on ORIX USA's cybersecurity program, answering what the cybersecurity program does. Specificity reaches Quantified-Verifiable due to the named firms ORIX USA and ORIX that can be independently verified as the entities providing cybersecurity services.


reasoning: This paragraph describes the company's methodology for identifying and assessing cybersecurity risks through a multi-faceted approach, which is a classic Risk Management Process description. The specificity is Generic Boilerplate because all terms used (internal audit, IT security, governance, risk and compliance reviews, third-party assessments) are generic ERM language that any risk management professional would use—none demonstrate cybersecurity domain expertise or firm-specific details.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from vendors and contractors through annual assessments and security requirements for those with data access. The language is generic vendor risk management boilerplate without domain-specific terminology, firm-specific details, or verifiable claims.


reasoning: The paragraph makes materiality assessments about cybersecurity impact, stating no material impacts for over 5 years and potential future risks, which is Strategy Integration under Rule 5. The claims are negative assertions about absence (not externally verifiable) and forward-looking speculation, with no domain terminology passing the ERM test and no firm-specific organizational facts.


fact: CISO

fact: threat landscape

fact: client security audits

reasoning: This paragraph describes the Board's oversight structure for cybersecurity, including delegation to the Audit Committee and the flow of information from the CISO to both the Audit Committee and the Board—classic Board Governance content. Specificity reaches Firm-Specific (Level 3) due to the CISO role, with supporting domain terminology ('threat landscape,' 'client security audits') that demonstrates cybersecurity expertise.


reasoning: This paragraph is a negative assertion stating that no material cybersecurity incidents occurred during the reporting period, which constitutes a materiality assessment under Rule 5 and falls under Strategy Integration. The paragraph contains no domain terminology, firm-specific facts, or verifiable claims—only a self-reported negative assertion about the absence of incidents, which is not externally verifiable.


fact: NEE Management

fact: NEER

reasoning: The paragraph describes board oversight of cybersecurity services provided through affiliate arrangements, answering how the board oversees cybersecurity. Named entities (NEE Management, NEER) are verifiable firms, making this Quantified-Verifiable.


reasoning: This paragraph is a cross-reference directing readers to Item 1A for cybersecurity risk disclosure, with no substantive content about governance, management, processes, or actual incidents. It contains only generic forward-looking risk language and no domain terminology, firm-specific facts, or verifiable claims.


reasoning: This paragraph contains backward-looking and forward-looking materiality assessments about cybersecurity's impact on the business ('did not experience a material cybersecurity incident,' 'not aware of any cybersecurity risks that are reasonably likely to materially affect,' 'have not materially adversely affected'), which fall squarely under Rule 5's SI materiality rule. Specificity is Level 1 because the paragraph contains only negative self-assertions that cannot be externally verified, no domain-specific terminology that passes the ERM test, and no firm-specific facts.


fact: Chief Operating Officer as the primary role briefing the Audit Committee on cybersecurity risks

reasoning: The paragraph describes the governance chain—how the COO informs the Audit Committee on cybersecurity matters, the briefing topics and frequency, and the Audit Committee's oversight activities including strategic decision participation and annual program review. This is primarily about board oversight structure rather than management's organizational role. The COO being designated as the primary cybersecurity liaison to the Audit Committee is a firm-specific organizational choice, as many companies use CISO, CIO, or CTO for this function instead.


reasoning: The paragraph primarily addresses third-party cybersecurity risk oversight, describing pre-engagement security assessments and ongoing compliance reviews for third-party providers; the final sentence on materiality is subordinate. The language is entirely generic ('stringent processes,' 'thorough security assessments,' 'cybersecurity standards') without domain-specific terminology that passes the ERM test, firm-specific details, or verifiable claims—the negative assertion about not encountering material challenges is a self-reported claim about absence, not externally verifiable.


fact: Change Healthcare - named third-party firm that experienced the incident

fact: UnitedHealth Group - parent company of Change Healthcare

fact: EXOGEN device - named product affected by claims processing disruption

reasoning: This paragraph describes an actual cybersecurity incident at Change Healthcare that affected the company's billing operations, including what happened (threat actor gained access), the business impact (delayed claims submissions and cash remittances), and the company's response (alternative intermediary). The incident frame is dominant over the materiality assessment frame, making this Incident Disclosure per Rule 4. Specificity is Quantified-Verifiable due to the named firms (Change Healthcare, UnitedHealth Group) and named product (EXOGEN device) that can be independently verified.


fact: COO leads cybersecurity strategy and reports to CEO

fact: over 15 years of cybersecurity experience

reasoning: The paragraph describes the COO's cybersecurity leadership role, reporting line, responsibilities, and qualifications, which directly answers how management is organized to handle cybersecurity (MR). The 'over 15 years of experience' is a lower-bound quantified claim verifiable against the COO's resume, elevating specificity to Level 4.


reasoning: This paragraph is a materiality assessment stating a conclusion about whether cybersecurity incidents have affected business outcomes, which falls under Strategy Integration per Rule 5. The paragraph contains no domain terminology, firm-specific facts, or verifiable claims—only a negative self-assertion about the absence of material incidents, which is not externally verifiable.


reasoning: This paragraph is a definition of 'systems'—it does not answer any of the six substantive questions about cybersecurity governance, management, processes, third-party risk, incidents, or strategy integration. It contains no domain-specific cybersecurity terminology (only general IT concepts), no firm-specific facts, and no verifiable claims.


reasoning: This paragraph is a pure cross-reference directing readers to the risk factors section (Item 1A) with no substantive disclosure about cybersecurity governance, processes, or incidents. The quoted risk factor language is generic speculation about potential harms, not an actual description of cybersecurity measures or a materiality assessment. No domain-specific terminology, firm-specific facts, or verifiable claims are present.


reasoning: The paragraph's primary substantive content is a materiality assessment stating the company has not experienced a cybersecurity incident with material adverse impact, which is a Strategy Integration disclosure per Rule 5. The policy review mention is minimal and the remainder is forward-looking disclaimer and cross-reference to risk factors. No domain terms pass the ERM test, no firm-specific facts are present, and the negative assertion about incidents is not externally verifiable.


reasoning: The paragraph describes the company's cybersecurity program at a high level—implementing policies, procedures, and security measures to mitigate risks—which fits Risk Management Process, though the disclosure is entirely generic. No domain-specific terminology passes the ERM test (terms like 'policies, procedures, and security measures' and 'mitigate risks' are generic ERM language any business professional would use), and there are no firm-specific or verifiable facts.


reasoning: This paragraph is a cross-reference directing readers to Item 1A for materiality assessments related to cybersecurity threats, containing no substantive cybersecurity disclosure content itself.


reasoning: The paragraph primarily answers 'How does cybersecurity affect the business or finances?' by stating a backward-looking materiality assessment that cybersecurity risks have not materially affected the company's business strategy, results of operations, or financial condition—explicitly matching the SI category under Rule 5. Specificity is Generic Boilerplate because the paragraph contains no domain-specific terminology passing the ERM test, no firm-specific facts, and no verifiable claims; the negative materiality assertion is not externally verifiable, and 'from time to time' references to threats and breaches are vague and non-specific.


reasoning: The paragraph's central topic is vendor cybersecurity oversight—conducting due diligence and periodic reviews of third-party providers—which directly answers the Third-Party Risk question. The language is generic vendor management terminology that any ERM professional would use; it mentions 'cybersecurity standards' without naming specific standards or describing what evidence the company reviews, failing the ERM test for domain expertise.


fact: security incidents

reasoning: The paragraph primarily describes what the cybersecurity program does (monitoring systems, testing, security tools, third-party collaboration for assessments), making it Risk Management Process; the board governance, third-party due diligence, and materiality assessment sentences are secondary. The domain term 'security incidents' passes the ERM test and elevates specificity to Domain-Adapted, though the overall language remains largely generic.


reasoning: This paragraph describes the Board's oversight of cybersecurity risk and its delegation to the Audit Committee, which directly answers how the board oversees cybersecurity. The language is entirely generic governance boilerplate with no domain-specific terminology, firm-specific facts, or verifiable claims.


reasoning: The paragraph describes how the cybersecurity program integrates with enterprise risk management, answering what the program does (RMP). The language is entirely generic ERM terminology—'common methodologies, reporting channels and governance processes'—that any business professional could write; it fails the ERM test for domain expertise and contains no firm-specific or verifiable facts.


fact: phishing attempts

fact: routine scanning

fact: technical vulnerabilities

reasoning: The paragraph primarily provides a materiality assessment stating no cybersecurity incidents had material impact on operations, liquidity, or financial condition, which is a backward-looking Strategy Integration conclusion under Rule 5. The domain terminology (phishing attempts, scanning, technical vulnerabilities) demonstrates cybersecurity expertise and passes the ERM test, but no firm-specific or verifiable facts are present.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers, specifically describing ongoing monitoring through weekly calls and immediate issue remediation. Specificity is Level 1 because the language is generic vendor management terminology that any ERM professional would use—'weekly calls' is a generic cadence, 'compliance monitoring' and 'mitigating measures' are standard risk language, and no cybersecurity domain expertise or firm-specific details are demonstrated.


reasoning: This paragraph describes the board-level oversight structure for cybersecurity, specifically how management reports to the Audit Committee and how the committee evaluates cybersecurity strategy, which directly answers the board governance question. The specificity reaches Level 3 due to the firm-specific role title 'Senior Director, Global Information Security' — a Director-level position with an explicit security qualifier that distinguishes this company's organizational structure.


reasoning: This paragraph describes the company's lack of cybersecurity resources and provides speculative risk language without describing any actual cybersecurity measures, processes, or governance structure, fitting the None/Other category for companies without substantive programs. The paragraph contains no domain terminology passing the ERM test, no firm-specific facts, and no verifiable claims.


reasoning: This paragraph is forward-looking risk disclosure language describing hypothetical threats and potential consequences, not answering any of the six substantive questions about cybersecurity governance or operations. It concludes with a cross-reference to the Risk Factors section, which is explicitly classified as None/Other under Rule 5. The specificity is Generic Boilerplate because the paragraph lists common threat types (ransomware, nation-state actors) without demonstrating domain expertise in HOW cybersecurity works, and contains no firm-specific facts or verifiable claims.


fact: threat actor

reasoning: This paragraph describes an actual cybersecurity incident—unauthorized access to an employee email account resulting in fraudulent fund diversion—answering 'What happened in a cybersecurity incident?' The specificity reaches Level 2 due to 'threat actor,' cybersecurity domain terminology that an ERM professional would not naturally use; the incident description lacks firm-specific organizational facts or quantified-verifiable claims (no specific dates, dollar amounts, named parties, or certifications).


fact: ransomware

reasoning: This paragraph describes an actual cybersecurity incident (ransomware attack), including the nature of the threat, scope (several machines on corporate network), impact assessment, and remediation approach—clearly answering 'What happened in a cybersecurity incident?' Specificity reaches Firm-Specific due to the claim of exactly one cybersecurity incident in the last decade, plus domain terminology (ransomware, encryption of machines). No externally verifiable facts are present.


reasoning: This paragraph describes the Board's oversight structure for cybersecurity risks, including delegation to the Audit Committee, which directly answers the governance question of how the board oversees cybersecurity. The language is generic governance boilerplate with no domain-specific terminology, firm-specific facts, or verifiable claims.


reasoning: The paragraph contains a backward-looking materiality assessment ('prior incidents have not had a material impact on us') which qualifies as Strategy Integration under Rule 5, though it is mixed with forward-looking speculation and a cross-reference to Item 1A. The language is entirely generic risk management terminology with no domain-specific terms passing the ERM test, no firm-specific facts, and no verifiable claims.


fact: Namecheap, GoDaddy, and Cloudflare as hosting providers

reasoning: The paragraph describes the company's approach to managing cybersecurity risks related to their websites by using third-party hosting services, which fits Risk Management Process. Specificity is Quantified-Verifiable because the paragraph names specific third-party firms (Namecheap, GoDaddy, Cloudflare) engaged for hosting services, which are externally verifiable through domain registration and DNS records.


fact: Chief Technology Officer

fact: over 26 years of extensive information technology experience

reasoning: The paragraph primarily answers how management is organized to handle cybersecurity, detailing the leadership structure (CFO and CTO oversight), the CTO's qualifications (26 years of experience, specific prior roles), and team composition. Specificity reaches Level 4 due to the verifiable claim of 'over 26 years' of experience, which establishes a checkable lower bound.


fact: Form 8-K filed on July 14, 2023

fact: MOVEit

fact: zero-day vulnerability

fact: managed file transfer software

fact: First National 1870 division

fact: Guardian Mortgage division

reasoning: This paragraph describes an actual cybersecurity incident (the MOVEit zero-day vulnerability affecting a third-party vendor), including the nature of the incident, specific dates, and the company's use of the affected software. The specific filing date (July 14, 2023), incident notification date (May 31, 2023), and named software product (MOVEit) are externally verifiable facts that elevate specificity to Level 4.


reasoning: The paragraph contains a materiality assessment stating the company is not aware of any cybersecurity incidents that have materially affected it to date, which per Rule 5 constitutes a Strategy Integration disclosure. However, the specificity is Generic Boilerplate because the paragraph lacks domain-specific terminology passing the ERM test, contains no firm-specific facts (no named roles, committees, or programs), and the negative assertion about incidents is not externally verifiable.


reasoning: This paragraph describes a Director's cybersecurity responsibilities, qualifications, and review process with the CFO, answering how management is organized to handle cybersecurity. No domain-specific terminology passes the ERM test (generic terms like 'information security program' and 'controls' are standard business language), the Director title lacks a security qualifier making it non-firm-specific, and there are no quantified or verifiable claims.


reasoning: This paragraph describes Board-level oversight of cybersecurity, including which Board members are responsible, the quarterly review cadence, and incident escalation procedures—directly answering how the Board oversees cybersecurity. No domain terminology, firm-specific facts, or verifiable claims are present; 'quarterly' is a generic cadence, 'independent board members' is not a named committee, and all other language is standard governance boilerplate.


fact: connected vehicles

reasoning: The paragraph primarily describes what the cybersecurity program does—processes, technologies, and capabilities for risk avoidance, identification, assessment, mitigation, and remediation—with governance oversight mentioned only in a subordinate clause at the end. The term 'connected vehicles' demonstrates domain expertise specific to automotive cybersecurity, passing the ERM test for Level 2 specificity.


fact: Chief Information Officer (CIO)

fact: Chief Information Security Officer (CISO)

fact: Cyber Incident Response Teams

fact: partnership with Risk and Legal

reasoning: This paragraph describes management-level roles and reporting relationships (CIO oversees CISO, CISO leads Information Security team, Cyber Incident Response Teams under CISO), answering how management is organized to handle cybersecurity. Specificity reaches Level 3 due to firm-specific roles (CIO, CISO) and named internal teams (Cyber Incident Response Teams) that distinguish this company's organizational structure.


fact: SOC2 report evaluations

fact: Trust Service Criteria (security, availability, processing integrity, confidentiality, privacy controls)

reasoning: The paragraph's central topic is managing cybersecurity risks from third parties—covering due diligence on operators/managers, vendor selection processes, a centralized registry, SOC2 report reviews, and incident oversight at vendors—which directly answers 'How are third-party cyber risks managed?' The SOC2 terminology and the five Trust Service Criteria demonstrate domain expertise that passes the ERM test, elevating specificity to Level 2, but no firm-specific organizational claims or verifiable facts are present to reach higher levels.


fact: February 26, 2024 - date SEC document request received

fact: Progress software - named software involved in the breach

fact: SEC investigation into data breaches

reasoning: This paragraph describes the aftermath of an actual cybersecurity incident, including public disclosure, customer notifications, and a subsequent SEC investigation with a specific request date. The specificity reaches Level 4 due to the specific date (February 26, 2024) and named software (Progress software), both of which are externally verifiable facts tied to a real event.


reasoning: The paragraph primarily answers 'How does cybersecurity affect the business or finances?' by making a materiality assessment—stating the company has not identified risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect its operations, business strategy, results of operations, or financial condition. This is a negative assertion under Rule 5's SI materiality rule. Specificity is Generic Boilerplate because the negative assertion about absence of material incidents is not externally verifiable, and the quoted SEC definition does not demonstrate company domain expertise.


fact: CISO

fact: Security Governance Committee

fact: over 20 years of cybersecurity and technology management experience

reasoning: This paragraph describes management organization by identifying the CISO role and Security Governance Committee composition, along with the CISO's qualifications. The specificity reaches Level 4 because 'over 20 years of experience' is a verifiable lower-bound claim that could be checked against the CISO's resume.


reasoning: The paragraph is split between third parties serving the company (auditors, experts helping with policies—RMP content) and requirements imposed on vendors (certification and breach reporting—TP content), with the longer third sentence focusing on vendor oversight requirements. No domain-specific terminology passes the ERM test, and there are no firm-specific facts or verifiable claims—only generic business language applicable to any vendor risk management context.


fact: Incident Response Plan (IRP)

fact: DPT

fact: Incident Response Team (IRT)

fact: Chief Information Officer

reasoning: This paragraph primarily describes the incident response process—what the IRP does (containment, review, escalation, recovery, remediation) and how incidents flow through the organization. While organizational elements (IRT, DPT) are mentioned, they serve to explain the process workflow rather than being the primary focus about management structure. Specificity reaches Level 3 due to firm-specific facts: named internal programs (Incident Response Plan/IRP), named committees (DPT, Incident Response Team/IRT), and a VP-level role (Chief Information Officer).


reasoning: The paragraph is entirely focused on how the company manages cybersecurity risks from third parties (vendors, service providers, external users), which directly answers the Third-Party Risk question. The language is generic risk management terminology that any ERM professional would use—terms like 'risk-based approach,' 'assessing and overseeing risks,' and 'vendors, service providers' do not demonstrate cybersecurity domain expertise or contain any firm-specific or verifiable facts.


reasoning: This paragraph describes board-level oversight structure, specifically how the Board has delegated cybersecurity oversight to the Audit Committee and the frequency of updates, which directly answers the governance question. No domain-specific terminology, firm-specific facts, or verifiable claims are present—Audit Committee and Board of Directors are generic governance roles that exist at every public company, and the language is standard oversight boilerplate any ERM professional would use.


reasoning: The paragraph primarily addresses cybersecurity insurance as a financial risk management tool, answering how cybersecurity affects the company's financial risk posture. No domain terminology passes the ERM test (cybersecurity insurance and cyber-attacks are common business terms), no firm-specific cybersecurity facts are present, and no verifiable claims appear in the text.


reasoning: This paragraph is a high-level commitment statement that does not answer any of the six substantive questions—it describes neither oversight structure, management organization, program activities, third-party risk management, incident details, nor business/financial impact. The language is entirely generic ("protecting our IT assets and data") with no domain-specific terminology, firm-specific details, or verifiable claims.


fact: more than 20 years' experience in financial services

fact: degree from the University of California, Santa Barbara

fact: Certified Information Systems Security Professional (CISSP) certification from ISC2

reasoning: The paragraph describes a leadership role (Director of Information Technology), their qualifications, credentials, and responsibilities for managing cybersecurity programs, which directly answers how management is organized to handle cybersecurity. Specificity is Level 4 due to multiple verifiable facts: the 'more than 20 years' experience' is a checkable lower bound, the degree from UC Santa Barbara is a specific educational credential, and the CISSP certification can be independently verified via the ISC2 registry.


reasoning: This paragraph states backward-looking and forward-looking materiality assessments about cybersecurity's impact on the business, which per Rule 5 places it in Strategy Integration. The language is generic ERM-style risk disclosure with no domain-specific terminology passing the ERM test, no firm-specific organizational details, and no externally verifiable claims—the negative assertions about absence of material incidents are self-reported claims that cannot be independently verified.


fact: Brian Fellon named as VP, CIO and CISO

fact: Appointed to role in September 2024

fact: 28 years of experience in information technology

fact: Prior role: Director of Information Technology at Puget Sound Energy in Bellevue, Washington

fact: Employment at Puget Sound Energy from 2016 to September 2024

fact: Reports to Chief Financial Officer

reasoning: This paragraph describes management's organizational role for cybersecurity, including the named CISO's title, reporting line, and career history, which answers the question 'How is management organized to handle cybersecurity?' Specificity is Level 4 due to multiple verifiable facts including the specific appointment date (September 2024), 28 years of experience, named prior employer (Puget Sound Energy), and specific date range of prior employment (2016 to September 2024).


fact: third-party security scoring system

fact: security posture

reasoning: This paragraph centrally addresses how Arcosa oversees and manages cybersecurity risks from vendors, service providers, and other third parties, including evaluation of their security posture and ongoing monitoring—clearly fitting the Third-Party Risk category. Specificity is Domain-Adapted because the paragraph uses cybersecurity-specific terminology like 'third-party security scoring system' and 'security posture' that would not naturally be used by a general ERM professional, but contains no firm-specific or externally verifiable facts.


reasoning: This paragraph describes the company's cybersecurity risk management processes—specifically what assets they protect and their general approach to identifying, assessing, and managing risks—which directly answers the RMP question. The language is entirely generic ERM-style terminology (identify, assess, manage risks; critical networks, hardware, software, data) that any business professional could write without cybersecurity domain expertise, yielding no facts that elevate specificity above Level 1.


reasoning: This paragraph states a materiality assessment—specifically a negative assertion that no material cybersecurity incidents occurred and expenses were immaterial—which directly answers whether cybersecurity has affected business outcomes. Specificity is Level 1 because the negative assertions about incident absence are not externally verifiable per Rule 5, and the cross-reference to Risk Factors is non-substantive.


fact: in 2019, we were a victim of a wire fraud scheme

fact: multi-factor authentication (MFA)

reasoning: This paragraph describes an actual cybersecurity incident—a 2019 wire fraud scheme involving email compromise and unauthorized wire transfer—which directly answers 'what happened' and fits Incident Disclosure. The specificity reaches Level 4 because the 2019 incident is a specific, dated claim that can be verified through the referenced Legal Proceedings section or court records; MFA is also cited as domain terminology.


reasoning: This paragraph describes IT and OT infrastructure and business systems used in operations, which is background context about technology environment rather than answering any of the six substantive cybersecurity disclosure questions (governance, management, processes, third-party risk, incidents, or strategy integration). None/Other paragraphs are assigned Generic Boilerplate specificity per the annotation rules.


reasoning: The paragraph discusses general IT investments for business operations and strategic goals without any cybersecurity-specific content—no security measures, risks, governance, or incident information is mentioned. It contains no domain terminology, firm-specific facts, or verifiable claims, making it generic boilerplate.


fact: vulnerability scanning and misconfiguration detection

fact: cybersecurity questionnaire for vendor assessment

reasoning: The paragraph primarily describes vendor cybersecurity oversight practices (questionnaires, contractual security requirements, monitoring, and discontinuation criteria), which makes it Third-Party Risk. The mention of 'scan and analyze for vulnerable software or misconfigurations' demonstrates cybersecurity domain expertise that passes the ERM test, elevating specificity to Domain-Adapted.


fact: incident classification

reasoning: The paragraph describes the company's cybersecurity program activities including risk assessments, training, tools, incident response planning, and monitoring, which directly answers what the cybersecurity program does. Specificity is Domain-Adapted because the paragraph uses cybersecurity domain terminology (security analytical and assessment tools, incident classification criteria) that demonstrates understanding of how cybersecurity practices work, but lacks firm-specific details or verifiable claims.


fact: password spraying

fact: phishing

fact: denial-of-service attacks

fact: advanced persistent threat intrusions

fact: ransomware

fact: malware

fact: viruses

fact: worms

reasoning: This paragraph describes the general cybersecurity threat landscape without answering any of the six substantive questions—it does not address board oversight, management structure, program activities, third-party risk management, specific incidents, or business/financial impact. The specificity reaches Domain-Adapted due to multiple cybersecurity-specific terms (password spraying, APT intrusions, ransomware, denial-of-service) that demonstrate domain expertise beyond what a general ERM professional would naturally use.


fact: over 20 years of cybersecurity experience

fact: last 10 years in leadership positions

fact: CISSP certification

fact: CCSP certification

fact: GSTRT certification

fact: CISSP-ISSAP

fact: CGEIT

fact: CDPSE

fact: CEH

fact: ISSA

fact: FIRST

fact: US Cyber Army Command (ARCYBER)

reasoning: This paragraph describes management roles and qualifications for cybersecurity oversight, fitting Management Role. The specificity is Quantified-Verifiable due to specific years of experience (over 20 years, last 10 years in leadership) and named certifications (CISSP, CCSP, GSTRT) that are externally verifiable.


fact: GISO (Global Information Security Officer)

fact: Chief Information Security Officer

fact: cybersecurity maturity assessments

reasoning: The paragraph primarily describes how the cybersecurity program operates—engaging third-party vendors for protection and experts for assessments—which is RMP content; the third parties are service providers hired by the company, not vendors being overseen (Rule 3). Specificity reaches Level 3 due to firm-specific cybersecurity leadership roles (GISO, CISO), with 'cybersecurity maturity assessments' providing Level 2 domain terminology.


fact: threat actors

reasoning: The paragraph contains a materiality assessment statement ('To date we have not identified any prior cybersecurity incidents that have materially affected or are reasonably likely to materially affect us') which per Rule 5 makes it Strategy Integration. The rest is forward-looking disclaimers and cross-references. Specificity is Level 2 due to the domain term 'threat actors' which passes the ERM test—this is cybersecurity-specific vocabulary a non-security ERM professional would not naturally use.


fact: over 20 years of experience in information security, risk management, and compliance

reasoning: This paragraph primarily answers how management is organized for cybersecurity, detailing the DIT's responsibilities, qualifications, and support structure—classic Management Role content. The specificity reaches Level 4 because 'over 20 years of experience' is a hard lower bound that could be verified against the individual's employment history.


reasoning: The paragraph describes cybersecurity risk management processes and their integration with enterprise risk management, answering what the program does. The Audit Committee mention is incidental to the ERM context, not the primary focus. Specificity is Generic Boilerplate because the processes listed (maturity assessments, IT risk assessments, third-party security assessments) are general descriptions any ERM professional could write, and Audit Committee is a generic governance role that exists at every public company.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party vendors—conducting risk assessments of vendors and requiring breach notification—which directly answers the TP question about third-party cyber risk management. The language is generic vendor risk management that any ERM professional would use; terms like 'risk assessments,' 'processes to identify risks,' and 'breach notification' do not demonstrate cybersecurity domain expertise or contain firm-specific or verifiable facts.


reasoning: The paragraph states a backward-looking materiality assessment concluding that no cybersecurity threats or incidents materially affected or are reasonably likely to materially affect the business, which is Strategy Integration per Rule 5. No domain terms, firm-specific facts, or verifiable claims are present—the negative assertion about not identifying material threats is not externally verifiable per the specificity rules, and the remaining language is generic disclaimer and cross-reference.


fact: data encryption

fact: breach notification

reasoning: This paragraph describes the external regulatory environment (state cybersecurity laws and privacy regulations) rather than the company's internal cybersecurity governance, management structure, program activities, or incident history. The domain terms 'data encryption' and 'breach notification' demonstrate cybersecurity expertise beyond generic ERM language, elevating specificity to Level 2.


reasoning: This paragraph describes the Board's oversight structure and delegation of cybersecurity risk monitoring to the Audit Committee, which directly answers how the board oversees cybersecurity. The paragraph contains only generic governance language (Board, Audit Committee, ERM, internal controls) with no cybersecurity domain terminology, firm-specific facts, or verifiable claims.


fact: chief technology officer

fact: over a decade of industry experience

fact: information security team

reasoning: The paragraph primarily describes the CTO's organizational role, qualifications, team composition, and reporting responsibilities, fitting Management Role. The quantified claim of 'over a decade of industry experience' is a verifiable lower bound (more than 10 years), making this Quantified-Verifiable.


fact: ransomware

fact: malware

fact: computer viruses

fact: phishing attempts

reasoning: The paragraph opens with a materiality assessment stating no material cybersecurity incidents occurred in the last three years, which is a Strategy Integration negative assertion per Rule 5. Specificity reaches Domain-Adapted due to cybersecurity-specific threat terminology (ransomware, malware, phishing) that passes the ERM test, while the negative incident assertion is not externally verifiable.


fact: Chief Information Officer

reasoning: This paragraph describes the Board and Audit Committee's oversight structure for cybersecurity, including reporting flows, briefing cadences, and information channels—answering 'How does the board oversee cybersecurity?' The CIO is a VP-level IT leadership role explicitly listed as firm-specific, elevating specificity to Level 3; no domain-specific terminology or verifiable claims are present.


fact: March 2020

fact: ransomware attack

reasoning: Category: This paragraph describes an actual cybersecurity incident (March 2020 ransomware attack) including nature, scope, remediation actions, and potential impacts—the incident frame dominates over the opening materiality assessment. Specificity: The specific date 'March 2020' tied to a real ransomware attack is externally verifiable through news reports or public records, elevating to Level 4; 'ransomware attack' is a domain term at Level 2.


reasoning: This paragraph is general context-setting language about the threat landscape facing the financial services industry, not a substantive disclosure answering any of the six key questions about governance, management, processes, third-party risk, incidents, or strategy integration. It contains no domain-specific terminology, firm-specific facts, or verifiable claims—only generic risk environment language any business professional could write.


fact: Information Security Program (ISP) - named internal program with distinguishing identifier

fact: Information Technology Board Committee (ITBC) - named non-generic board committee

fact: IT Steering Committee (ITSC) - named non-generic committee

reasoning: The paragraph describes oversight structure for the cybersecurity program, featuring a board-level committee (ITBC) and another committee (ITSC), which per Rule 1 defaults to Board Governance when describing oversight structure. Specificity reaches Level 3 due to three named internal programs/committees with distinguishing acronyms (ISP, ITBC, ITSC) that distinguish this company's governance structure from others.


reasoning: The paragraph describes what the Incident Response Plan does—its framework, notification/escalation processes, coordination structure, and annual evaluation—answering 'What does the cybersecurity program do?' No domain terms pass the ERM test ('incident response plan' is explicitly listed as failing), the COO is a generic C-level role not specifically a cybersecurity leadership position, and 'evaluated at least annually' is a generic cadence without specific dates.


reasoning: The paragraph centrally addresses how the company manages third-party cyber risks through pre-engagement vendor assessments focused on data security, availability, and confidentiality. The language is generic vendor risk management that any ERM professional could write without cybersecurity domain expertise, containing no firm-specific details or verifiable claims.


reasoning: The paragraph primarily answers 'How does cybersecurity affect the business?' by stating a materiality assessment conclusion that no cybersecurity incidents have materially impacted the company. Under Rule 5, negative assertions about material impact ('have not materially affected') constitute Strategy Integration assessments. Specificity is Generic Boilerplate because the negative assertion about absence of incidents is not externally verifiable, and the remaining language consists of generic risk disclaimers and a cross-reference without domain-specific terminology or firm-specific facts.


reasoning: This paragraph is a forward-looking disclaimer stating that there can be no assurance about program effectiveness, followed by a cross-reference to the Risk Factors section. It does not answer any of the six substantive questions about cybersecurity governance, management, processes, third-party risk, incidents, or strategy integration.


fact: Vice President of IT

fact: denial-of-service attacks

fact: phishing

fact: social engineering

fact: vendor software supply chain compromises

reasoning: This governance-chain paragraph describes oversight structure with the VP of IT responsible for the information security program and the Board overseeing risks directly and through the Audit Committee, defaulting to Board Governance under Rule 1. Specificity reaches Firm-Specific due to the named VP of IT role, with multiple domain terms (ransomware, phishing, social engineering, etc.) providing Level 2 foundation.


fact: security questionnaires

fact: security capabilities and maturity assessments

fact: controls evidence reviews

fact: application vulnerability assessments

fact: public internet presence monitoring

fact: NIST

type: framework

fact: ISO

fact: HIPAA

fact: Payment Card Industry standards

reasoning: The paragraph centrally addresses how the company manages supplier cybersecurity risks through contractual requirements, audits, and assessments, which is Third-Party Risk. Specificity is Domain-Adapted due to multiple cybersecurity domain terms (vulnerability assessments, security questionnaires, NIST, ISO, HIPAA, PCI) that demonstrate expertise beyond generic ERM language.


fact: Chief Technology Officer

fact: in 2023, management hosted an expert during the annual board retreat

reasoning: The paragraph describes the board's cybersecurity oversight structure, including the audit committee's role, reporting lines, and information flow to the board. Specificity is driven by the named CTO role (Level 3) and the verifiable claim about a 2023 expert presentation at the board retreat (Level 4).


reasoning: The paragraph contains a backward-looking materiality assessment stating the company has not experienced significant impacts from cybersecurity threats, which constitutes a Strategy Integration conclusion under Rule 5. The surrounding text is forward-looking speculation and a cross-reference, but the negative assertion is the sole substantive disclosure. Specificity is Generic Boilerplate because the negative assertion about absence of incidents is not externally verifiable, and no domain terminology, firm-specific facts, or quantified claims are present.


reasoning: This paragraph describes Board oversight structure, member expertise, and information flow mechanisms for cybersecurity, which directly answers the Board Governance question. No specific facts elevate specificity beyond Level 1: 'incident response' fails the ERM test as ERM professionals use this term broadly, 'cybersecurity posture' is used generically without specific practices, and no named individuals, certifications, frameworks, tools, or verifiable claims appear.


fact: Security Incident Response Plan ("SIRP")

fact: encryption protocols

fact: multi-factor authentication

fact: data loss prevention controls

reasoning: The paragraph describes the company's cybersecurity program activities including incident response planning, data protection controls, and business continuity measures, answering 'what does the cybersecurity program do?' The named Security Incident Response Plan (SIRP) is a firm-specific identifier that distinguishes this company's program, while encryption, MFA, and data loss prevention are domain-specific security controls.


reasoning: The paragraph is primarily forward-looking disclaimers and speculative risk language ('may be unable,' 'could have a material adverse impact'), which are explicitly categorized as None/Other. The brief negative assertion at the end ('we are not aware of any cybersecurity threats, nor have we had any cybersecurity incidents') is minimal compared to the preceding speculative content. Rule 6's threshold for N/O refers to 'measure/process/assessment described'—a negative assertion about absence of incidents is not describing a measure, process, or assessment, so Rule 6 does not override the 'most text wins' principle. No domain-specific terminology, firm-specific facts, or verifiable claims are present.


fact: CISO

reasoning: The paragraph describes the governance chain for cybersecurity information flow from management (CISO) to board-level oversight bodies (Audit Committee, Board), which answers how the board oversees cybersecurity. The CISO role is a firm-specific fact that distinguishes this company's cybersecurity leadership structure.


fact: Incident Response Team

reasoning: The paragraph describes the incident response process and notification chain during cybersecurity events, which answers what the cybersecurity program does during incidents. The capitalized 'Incident Response Team' is a named team specific to this company, elevating specificity to Firm-Specific, though the vocabulary otherwise remains at a general business level without domain-specific terminology.


reasoning: This paragraph is Strategy Integration because it states a materiality conclusion—a negative assertion that no cybersecurity threats or incidents have materially affected or are reasonably likely to materially affect the company's business outcomes (Rule 5). Specificity is Generic Boilerplate because the paragraph contains no domain-specific terminology beyond generic ERM language, no firm-specific organizational details, and no externally verifiable claims—negative assertions about the absence of incidents cannot be independently verified by external parties.


fact: October 2023 incident date

fact: 23andMe.com accounts

fact: two-factor verification

fact: Security Operations

reasoning: This paragraph describes an actual cybersecurity incident that occurred in October 2023, including what happened (unauthorized access to 23andMe.com accounts), the scope (user information accessed/downloaded), and remediation steps taken (password resets, two-factor verification, detection tools). The specific October 2023 date tied to a real event is externally verifiable through news reports and regulatory filings, elevating specificity to Level 4.


fact: Senior Vice President of Engineering

fact: Chief Information Security Officer (CISO)

fact: CISO reports to Chief Executive Officer

fact: General Counsel and Head of Global Affairs

fact: Chief Privacy Officer

fact: Chief Privacy Officer reports to General Counsel

fact: Privacy and Security Council

reasoning: This paragraph describes the management organizational structure for cybersecurity—specific roles (SVP Engineering, CISO, Chief Privacy Officer), their reporting lines, and a named management committee (Privacy and Security Council). The person-removal test confirms MR: stripping titles and reporting lines leaves only generic purpose statements, indicating the paragraph's core content is about WHO manages cybersecurity rather than WHAT the program does operationally.


reasoning: This paragraph describes board-level oversight through the Audit Committee receiving reports and updates on cybersecurity risks and incidents, which directly answers how the board oversees cybersecurity. The paragraph contains only generic governance language (Audit Committee, regular reports, management updates) without any domain-specific terminology, firm-specific facts, or verifiable claims.


reasoning: This paragraph is primarily a concluding disclaimer with forward-looking risk warnings and a cross-reference to Risk Factors; the brief mention of cybersecurity insurance is incidental and does not constitute a substantive disclosure answering any of the six primary questions. No domain terms passing the ERM test, firm-specific facts, or verifiable claims are present.


reasoning: This paragraph is a negative materiality assessment stating the company has not experienced any material cybersecurity incidents, which Rule 5 explicitly categorizes as Strategy Integration. The specificity is Generic Boilerplate because the negative assertion about absence of incidents is not externally verifiable, and the cross-reference to Item 1A is not a substantive cybersecurity disclosure.


fact: technology committee

reasoning: This paragraph describes the board and committee oversight structure for cybersecurity, including the Audit Committee and a technology committee, which is a classic governance-chain disclosure answering how the board oversees cybersecurity. The specificity reaches Firm-Specific because 'technology committee' is a named non-generic committee that distinguishes this company's governance structure from companies that only have standard Audit Committee oversight.


fact: confidentiality, integrity, and availability (CIA triad)

reasoning: The paragraph describes the company's efforts to integrate a cybersecurity risk management program, answering what the program does (RMP). The CIA triad terminology (confidentiality, integrity, and availability) passes the ERM test as domain-specific cybersecurity vocabulary that a non-security ERM professional would not naturally use, elevating specificity to Level 2.


reasoning: The paragraph describes the company's cybersecurity risk management activities including assessment processes, incident response planning, and use of third-party assessors, which answers 'What does the cybersecurity program do?' The language is entirely generic risk management terminology that any ERM professional would use—no domain-specific security practices, tools, frameworks, or verifiable facts are present.


reasoning: The paragraph centrally addresses how the company manages third-party cyber risks through vendor review processes, due diligence, and contractual controls, fitting Third-Party Risk. The language is generic business/risk management terminology that any ERM professional would use—no cybersecurity domain expertise, firm-specific details, or verifiable claims are present.


reasoning: The paragraph contains both a materiality assessment (SI) and vendor security requirements (TP), with the TP content being longer and more detailed. The vendor requirements are described using generic business language ('reasonable and appropriate security measures,' 'consistent with all applicable laws') that fails the ERM test for domain expertise, with no firm-specific roles, programs, or organizational claims, and no verifiable facts like certifications or hard numbers.


reasoning: The paragraph primarily describes the board and audit committee's cybersecurity oversight structure, including information flow, reporting responsibilities, and committee-level delegation. Specificity reaches Firm-Specific due to the mention of an enhanced Employee Self Service portal developed in 2022, though this system is only tangentially related to the governance topic and lacks a distinguishing identifier like an acronym.


reasoning: This paragraph is a forward-looking disclaimer stating the company cannot guarantee prevention of all cybersecurity risks, followed by a cross-reference to the Risk Factors section. It contains no substantive cybersecurity disclosure and no specific facts that would elevate specificity above Level 1.


fact: Security Committee

fact: Chief Security Officer (CSO)

fact: Cyber Risk Advisory Committee

reasoning: This paragraph describes the governance chain for cybersecurity oversight from the board through the Security Committee and Cyber Risk Advisory Committee to the CSO, answering how the board oversees cybersecurity. Specificity is Firm-Specific due to three named, non-generic organizational elements: Security Committee, Chief Security Officer, and Cyber Risk Advisory Committee.


fact: extended detection and response

fact: vulnerability scanning

fact: phishing simulations

fact: penetration tests

reasoning: The paragraph describes the components and activities of the company's cybersecurity program, answering what the program does, which is Risk Management Process. The specificity is Domain-Adapted because the paragraph uses multiple cybersecurity-specific terms (extended detection and response, vulnerability scanning, phishing simulations, penetration tests) that demonstrate domain expertise beyond what a general ERM professional would naturally use.


fact: ransomware

reasoning: The paragraph primarily states a materiality assessment concluding that cybersecurity risks and incidents have not materially affected business strategy, results of operations, or financial condition, which per Rule 5 is Strategy Integration. The mention of 'ransomware' (explicitly listed as domain terminology) elevates specificity to Level 2.


fact: ransomware attack

fact: late May 2023

reasoning: This paragraph describes an actual cybersecurity incident (ransomware attack) with specific timing (late May 2023) and response actions, clearly answering 'what happened' for Incident Disclosure. The specific date tied to a real event is externally verifiable, elevating specificity to Quantified-Verifiable, with 'ransomware attack' as supporting domain terminology.


reasoning: The paragraph describes the company's cybersecurity program activities—risk identification, prioritization, mitigation, policy development, escalation procedures, and training—which directly answers 'What does the cybersecurity program do?' The third parties mentioned are consultants engaged to assist with assessments, which per Rule 3 falls under RMP rather than Third-Party Risk. For specificity, the paragraph uses only generic ERM language (risk assessment, policies and procedures, training, escalation) that any business professional could write—no domain-specific security practices, named standards, firm-specific roles, or verifiable facts are present.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers, including supply chain vendors and those with system/data access, which directly answers the Third-Party Risk question. Specificity is Level 1 because the language is entirely generic ERM-style vendor oversight terminology without any domain-specific terms, firm-specific facts, or verifiable claims.


reasoning: This paragraph provides a materiality assessment stating that cybersecurity risks have not materially affected and are not reasonably likely to materially affect the company's business strategy, results of operations, or financial condition, which is a clear Strategy Integration disclosure under Rule 5. The paragraph contains no domain terminology that passes the ERM test (cyber-attack and cybersecurity threats are general terms that have entered common business vocabulary), no firm-specific facts such as named roles or committees, and no verifiable claims (negative assertions about absence of material impact are self-reported and cannot be externally verified).


reasoning: The paragraph describes Board oversight structure—audit committee responsibility for cybersecurity risk oversight, quarterly coordination meetings, and annual program reviews—which directly answers how the board oversees cybersecurity. The Vice President of Information Technology is a firm-specific VP-level role that distinguishes this company's governance structure.


reasoning: This paragraph is a generic risk acknowledgment with no substantive disclosure about any specific aspect of cybersecurity governance, management, processes, or incidents. It contains no domain-specific terminology, firm-specific facts, or verifiable claims—only boilerplate language about being exposed to threats and committed to strengthening posture.


fact: targeted attack simulations

reasoning: This paragraph describes the activities and methodologies of the cybersecurity program—vulnerability testing, phishing simulations, training, internal and external reviews, and attack simulations—which directly answers what the cybersecurity program does. Specificity is Domain-Adapted because the paragraph uses cybersecurity-specific terminology like 'phishing simulations' and 'targeted attack simulations' that demonstrate domain expertise beyond what a general ERM professional would naturally use.


reasoning: This paragraph describes the Board's oversight structure for cybersecurity, specifically how the Audit Committee supports oversight by interacting with management—classic governance-chain content that answers 'How does the board oversee cybersecurity?' No domain terminology passes the ERM test (generic governance language), 'Director of Information Technology' lacks a security qualifier so is not firm-specific per the rules, and 'our Manager' is an unnamed entity reference, yielding no facts above Level 1.


fact: $1.0 million in Cybersecurity Incident related costs net of expected insurance receivable in 2023

fact: December 30, 2023 - system remediation efforts concluded

fact: $0.6 million - insurance proceeds exceeded recorded receivable amount

fact: fourth quarter of 2024 - received insurance proceeds

reasoning: This paragraph describes an actual cybersecurity incident including the nature (affected IT systems), response actions (system suspension and restoration), timeline (remediation concluded December 30, 2023), and quantified financial impacts ($1.0M costs, $0.6M insurance proceeds excess), making it Incident Disclosure with multiple verifiable dollar amounts and specific dates.


fact: vulnerability management

fact: encryption of data

reasoning: The paragraph describes the company's cybersecurity program activities and measures, answering what the program does, which fits Risk Management Process. Specificity is Domain-Adapted because 'vulnerability management' and 'encryption of data' are cybersecurity-specific terms that pass the ERM test—an ERM professional wouldn't naturally use this vocabulary for non-cyber risks.


fact: security threat intelligence system

fact: vulnerability management tools

fact: patch management

fact: Security Operations Center

fact: event correlation

reasoning: The paragraph describes operational elements of the cybersecurity program—threat intelligence system, patch management, and Security Operations Center—answering what the program does. Specificity is Level 2 because the paragraph uses cybersecurity domain terminology (threat intelligence, vulnerability management, patch management, SOC, event correlation) that demonstrates expertise beyond generic ERM language.


reasoning: The paragraph describes the company's cybersecurity program activities—policies, risk assessment, protective measures, monitoring, and incident response—which directly answers what the cybersecurity program does. The language is entirely generic boilerplate with no domain-specific terminology passing the ERM test, no firm-specific facts, and no verifiable claims.


reasoning: This paragraph describes how the company uses an IT consultant to assist with cybersecurity risk assessment, policy design, and safeguard testing, which answers 'What does the cybersecurity program do?' Per Rule 3, third parties hired to serve the company (consultants, assessors) fall under RMP rather than Third-Party Risk. The language is entirely generic—terms like 'risk assessment processes,' 'cybersecurity policies and procedures,' 'safeguards,' and 'security measures' would all be natural vocabulary for a non-security ERM professional and do not demonstrate cybersecurity domain expertise.


fact: CISO (Chief Information Security Officer)

fact: CRO (Chief Risk Officer)

fact: CTO (Chief Technology Officer)

fact: CLO (Chief Legal Officer)

fact: Information Security Program

reasoning: This paragraph describes management's organizational structure for cybersecurity—the CISO's role, reporting line to the CRO, and coordination with the executive team—making it Management Role. Specificity is Firm-Specific due to the named C-level cybersecurity leadership roles (CISO, CRO, CTO, CLO) and the capitalized Information Security Program.


fact: Enterprise Risk Committee (ERC) - named management-level committee

fact: Operational Risk Committee (ORC) - named management-level committee

fact: ERC is led by the CEO

fact: CISO role with operational responsibility for risk management, control and governance processes

fact: CISO reports to the ERC at least annually

fact: Cybersecurity team coordinates with Compliance, Human Resources, Internal Audit, and Legal

reasoning: The paragraph describes management-level committee structure (ERC led by CEO, ORC), the CISO's operational responsibilities and reporting lines, and cross-functional team coordination—answering how management is organized to handle cybersecurity. Contains multiple firm-specific facts including named committees, the CISO role, and specific departmental coordination, but no externally verifiable claims.


reasoning: The paragraph describes collaboration with third-party vendors on cybersecurity matters, making vendor relationship the central topic. However, it contains no domain-specific terminology, firm-specific facts, or verifiable claims—only generic language about collaboration and meeting frequency that any ERM professional could write.


fact: CISO

fact: steering committee on information security

fact: over 20 years of experience

reasoning: This paragraph answers how management is organized for cybersecurity by describing the CISO and steering committee roles, responsibilities, and the CISO's qualifications. Specificity reaches Level 4 due to verifiable claims: 'over 20 years of experience' sets a checkable lower bound, and the 'CIO Executive Education Certificate from Stanford University' is a named credential from a named institution that can be independently verified.


reasoning: This paragraph describes the oversight chain from Board to Audit Committee to management (CFO), answering how the board oversees cybersecurity—classic governance structure content. The specificity is Level 1 because all roles mentioned (Board, Audit Committee, CFO) are generic governance roles that exist at every company, and no domain-specific terminology, firm-specific facts, or verifiable claims are present.


reasoning: The paragraph makes a negative assertion about material cybersecurity incidents (a backward-looking materiality assessment under Rule 5), which classifies as Strategy Integration. No domain terminology, firm-specific facts, or verifiable claims are present—the negative assertion about absence of incidents is not externally verifiable, and the forward-looking speculation is generic boilerplate language found in most 10-K filings.


reasoning: The paragraph centrally addresses how the company manages third-party cybersecurity risks through its TPRM program, fitting the Third-Party Risk category. The description is generic—stating they gather information and assess risks without mentioning specific security practices, tools, or evidence types that would demonstrate domain expertise, and TPRM is a standard industry term not unique to this company.


fact: Critical Threat Committee

reasoning: This paragraph describes the responsibilities and decision-making authority of the Critical Threat Committee, a named management-level committee, including its role in evaluating incident materiality and escalation to the Board. The named committee 'Critical Threat Committee' is a firm-specific, non-generic committee name that distinguishes this company's organizational structure.


fact: Pension Benefit Information, LLC (PBI)

fact: Progress Software Corporation

fact: MOVEit Transfer software

fact: quarter ended June 30, 2023

fact: approximately 850,000 of Jackson's customers

reasoning: This paragraph describes an actual cybersecurity incident at a third-party vendor, including the attack method (MOVEit vulnerability), scope (850,000 customers' PII), and remediation status, which directly answers 'What happened in a cybersecurity incident?' Multiple verifiable facts are present, including named firms (PBI, Progress Software), a specific software product (MOVEit Transfer), a specific date reference, and a quantified impact figure.


fact: Chief Information Officer

reasoning: This paragraph answers how the board oversees cybersecurity, describing the Board's delegation to the Audit Committee, the flow of cybersecurity updates from the CISO and CIO to both the committee and full Board, and escalation protocols for incidents. Specificity reaches Firm-Specific due to the named cybersecurity leadership roles (CISO, Chief Information Officer) that distinguish this company's governance structure.


fact: Cybersecurity Leadership Team

reasoning: This paragraph describes board and committee oversight structure for cybersecurity, including delegation to the Audit Committee and information flow from management, which is classic Board Governance content. The 'Cybersecurity Leadership Team' is a named organizational unit that distinguishes this company's governance structure, making it Firm-Specific.


fact: identity management and access control safeguards

reasoning: This paragraph lists protective cybersecurity measures the company has implemented, answering what the cybersecurity program does. The specificity reaches Level 2 because 'identity management and access control' and 'encryption of data in transit and at rest' are cybersecurity domain terms that pass the ERM test—an ERM professional wouldn't naturally use this language for non-cyber risks.


fact: CIO

reasoning: The paragraph describes the Audit & Finance Committee's oversight of cybersecurity, including briefing frequency and information flow from the CISO/CIO to the committee, answering how the board oversees cybersecurity. Specificity reaches Level 3 due to the named VP-level cybersecurity leadership roles (CISO, CIO) that distinguish this company's governance structure.


reasoning: The paragraph primarily describes management's organizational structure for cybersecurity—the ITD, Director of ITD role, their qualifications, reporting line to the CFO, and specific responsibilities—with Board oversight mentioned at the beginning and end as the reporting destination. The specificity reaches Level 4 due to the verifiable claim about the Director of ITD having 'over 7 years of experience leading cybersecurity teams and programs,' which is a specific lower bound that could be independently checked against the individual's background.


reasoning: This paragraph provides a backward-looking materiality assessment stating that cybersecurity threats have not materially affected business outcomes over the past three fiscal years, which is a quintessential Strategy Integration disclosure under Rule 5. The specificity is Generic Boilerplate because the paragraph contains no domain terminology (cybersecurity threats is a topic, not expertise), no firm-specific facts about organizational structure or programs, and the negative assertion about absence of material impact is not externally verifiable per the rules.


reasoning: This paragraph consists of forward-looking disclaimers about potential cybersecurity incidents and insurance coverage, plus a cross-reference to the Risk Factors section—none of which constitute substantive cybersecurity disclosure under the six content categories. The language is entirely generic risk boilerplate with no domain-specific terminology, firm-specific facts, or verifiable claims.


fact: Chief Information Security Officer

reasoning: This paragraph describes the board oversight structure—how the Audit Committee receives quarterly reports from management, conducts annual risk assessments, and flows information to the Board—making it Board Governance. Specificity reaches Firm-Specific (Level 3) due to the named cybersecurity leadership roles (CIO and CISO), which distinguish this company's governance structure; no verifiable claims or domain-specific terminology that passes the ERM test are present.


fact: patching and vulnerability management

fact: cybersecurity tabletop exercise

fact: security awareness training

fact: cybersecurity threat assessment

reasoning: This paragraph describes how management reports to the Board on cybersecurity matters, including briefing frequency (annual reports plus semiannual briefings) and the scope of topics covered—directly answering how the board oversees cybersecurity. Specificity is Level 2 because the paragraph contains multiple domain-specific terms that pass the ERM test, including 'patching and vulnerability management,' 'cybersecurity tabletop exercise,' 'security awareness training,' and 'cybersecurity threat assessment.'


fact: Chief Information Security Officer (CISO)

reasoning: The paragraph describes the CISO's leadership responsibilities, coordination with corporate functions, and communication duties—answering how management is organized for cybersecurity. The CISO role is a firm-specific cybersecurity leadership position explicitly listed in the guidelines, establishing Level 3 specificity.


fact: VP of IT

reasoning: This paragraph describes the board's oversight structure for cybersecurity, including delegation to the Audit Committee and the flow of information from management to the board through reports. The VP of IT title is a firm-specific fact that distinguishes this company's organizational structure.


reasoning: The first sentence contains only a generic statement that senior leadership evaluates cybersecurity risks without describing governance structure, management organization, or specific processes, and the second sentence is purely a cross-reference to Item 1A Risk Factors. No domain terminology passing the ERM test, no firm-specific facts, and no verifiable claims are present.


fact: complementary user entity controls

reasoning: The paragraph describes how the company manages third-party cybersecurity risks through attest reports, complementary user entity controls, communication protocols, and contractual safeguards, with the third-party risk management content being the most detailed and specific portion. Specificity is Domain-Adapted due to cybersecurity-specific terminology like 'attest reports covering cyber-related controls' and 'complementary user entity controls' that demonstrate domain expertise beyond generic ERM language.


reasoning: The paragraph primarily answers the Strategy Integration question by stating a backward-looking materiality assessment that cybersecurity threats have not materially affected the company's business strategy, results of operations, or financial condition. The specificity is Generic Boilerplate because the negative assertion about material impact is not externally verifiable (cannot independently confirm absence), and the remaining language uses only generic terms like 'cybersecurity threats' and 'security incidents' that any ERM professional would use.


reasoning: This paragraph describes the oversight structure and information flow from IT leadership through executive management to the Audit Committee and Board, answering how the board oversees cybersecurity. No domain terminology passes the ERM test (terms like 'cybersecurity systems testing' are generic descriptions any ERM professional would use), 'Global Director of IT' lacks a security qualifier and is not firm-specific per the rules, and no verifiable claims are present.


reasoning: The paragraph primarily describes the company's cybersecurity assessment and testing processes, which answers 'What does the cybersecurity program do?' The materiality assertion about incidents is secondary content. Specificity is Level 1 because the language uses generic ERM terminology ('periodic assessments and testing,' 'policies, standards, processes, and practices') that any business professional would use, without demonstrating cybersecurity domain expertise, and the negative assertion about material incidents is not externally verifiable.


fact: legal, finance, and internal audit team composition

fact: threat intelligence

reasoning: The paragraph primarily describes management's organizational role in cybersecurity supervision, identifying specific departments (legal, finance, internal audit) that participate—this team composition is firm-specific. The mention of 'threat intelligence' demonstrates domain expertise, but the departmental composition elevates specificity to Level 3.


fact: January 2023 incident timing

fact: reported to federal law enforcement

reasoning: This paragraph describes an actual cybersecurity incident that occurred in January 2023, including its impact on computer system operability and the company's response, which directly answers 'What happened in a cybersecurity incident?' The specific date 'January 2023' tied to a real event elevates specificity to Level 4, as this is a concrete timeframe that could be externally verified.


reasoning: The paragraph primarily answers how third-party cyber risks are managed, with vendor oversight as the central topic—contractual requirements imposed ON service providers, annual re-evaluation processes, and data deletion at termination. The language is generic risk management terminology that any ERM professional would use; it lacks domain-specific security terminology, firm-specific organizational claims, or verifiable facts.


fact: CIO has over two decades of experience in technology development, management, and security

fact: CEO, CFO, and GC each have over 15 years of experience managing enterprise risks including cybersecurity threats

fact: CIO role

reasoning: The paragraph describes the qualifications and experience of management executives (CIO, CEO, CFO, GC) related to cybersecurity and enterprise risk management, directly answering how management is organized to handle cybersecurity. Specificity is Level 4 due to verifiable lower-bound claims about years of experience ('over two decades' for CIO, 'over 15 years' for CEO/CFO/GC) that could be checked against employment history.


fact: CSO (Chief Security Officer)

fact: Executive Vice President and Chief Operations Officer

fact: over 20 years of security experience

fact: Certified Information Systems Security Professional (CISSP)

fact: Certified Information Security Manager (CISM)

reasoning: The paragraph primarily answers how management is organized for cybersecurity, covering the CSO role, reporting lines to the EVP/COO, team responsibilities, and detailed qualifications including over 20 years of experience and named certifications (CISSP, CISM) that are externally verifiable.