fact: CCO (Chief Compliance Officer) responsible for cybersecurity risk management

fact: Adviser personnel from risk management, legal, information technology, and compliance departments

reasoning: The paragraph describes management's responsibility for cybersecurity risk management, including the CCO's role and management's qualifications, which directly answers how management is organized to handle cybersecurity. Specificity is Firm-Specific due to the named CCO role with cybersecurity responsibility and the specific organizational reliance on Adviser personnel across four named departments.


content_category: Incident Disclosure

fact: January 18, 2023 - specific date of incident announcement

fact: fewer than 300 restaurants - specific count with upper bound

fact: one day - specific duration of restaurant closures

fact: ransomware attack - domain term for specific threat type

category_confidence: high

specificity_confidence: high

reasoning: This paragraph describes an actual cybersecurity incident—a ransomware attack—with specific details about timing, scope, and impact, directly answering 'What happened in a cybersecurity incident?' The paragraph contains multiple verifiable facts including the specific announcement date (January 18, 2023), the upper bound on affected restaurants (fewer than 300), and the duration of closure (one day), plus the domain term 'ransomware attack.'

provider: z-ai

stage: benchmark


content_category: Third-Party Risk

reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from vendors and business partners, fitting Third-Party Risk. The language describes what they do (assess vendors, review policies) but lacks domain-specific terminology that would pass the ERM test—no specific security practices, tools, frameworks, or verifiable claims are mentioned.


content_category: Risk Management Process

reasoning: The paragraph describes the company's cybersecurity program activities—risk assessment follow-up, safeguard implementation, monitoring, testing, and employee training—which directly answers what the cybersecurity program does. Specificity is Level 1 because the language is entirely generic ERM terminology (risk assessments, safeguards, monitor and test, train employees) that any business professional would use; 'IT leadership' is too vague to qualify as a firm-specific role, and no domain-specific practices or verifiable claims appear.


content_category: Strategy Integration

reasoning: This paragraph states a materiality conclusion—that the company has not experienced material cybersecurity incidents and third-party incidents have not materially impacted the company—which directly answers the Strategy Integration question about business/financial impact per Rule 5's treatment of negative assertions as materiality assessments. Specificity is Generic Boilerplate because the paragraph contains only negative self-assertions about absence of incidents, which are not externally verifiable, and uses only generic business language that any ERM professional would use without demonstrating cybersecurity domain expertise.


fact: NIST CSF

type: framework

fact: Identify, Protect, Detect, Respond, and Recover

reasoning: The paragraph describes the company's cybersecurity risk management methodology and framework adoption, answering what the cybersecurity program does. Specificity is Domain-Adapted because NIST CSF is a named cybersecurity framework and the five core functions represent domain-specific terminology that demonstrates cybersecurity expertise beyond generic ERM language.


reasoning: The paragraph describes Dime's risk management activities, including maintaining an Incident Response Team and processes for determining materiality of cybersecurity events, with a concluding materiality assessment. The language uses generic business/ERM terminology without domain-specific terms, firm-specific details (the team name lacks a distinguishing identifier and composition is vague), or verifiable claims (the negative assertion about no material threats is not externally verifiable).


content_category: None/Other

reasoning: This paragraph is a cross-reference directing readers to Item 1A Risk Factors for cybersecurity risk information, with no substantive cybersecurity disclosure content. It contains no domain terminology, firm-specific facts, or verifiable claims.


reasoning: This paragraph describes the company's use of a third-party assessor to evaluate cybersecurity processes, which is a risk management activity; per Rule 3, third parties hired to serve the company (assessors) fall under RMP rather than Third-Party Risk. The paragraph contains only generic ERM language with no domain-specific terminology, named firms, or verifiable facts.


reasoning: The paragraph primarily addresses how the company manages third-party cybersecurity risks through certification requirements and breach reporting obligations imposed on vendors, making it Third-Party Risk. The language is entirely generic boilerplate with no domain-specific terminology passing the ERM test, no firm-specific facts, and no verifiable claims.


content_category: Board Governance

fact: Vice President of Information Systems

reasoning: The paragraph primarily answers how the board oversees cybersecurity, describing the oversight chain from Board to Audit Committee to the VP of Information Systems, including reporting cadence and incident notification protocols. Specificity reaches Level 3 due to the firm-specific VP-level cybersecurity leadership role.


reasoning: This paragraph states a backward-looking conclusion that cybersecurity incidents have not materially affected the business, which per Rule 5 is a Strategy Integration assessment. The specificity is Generic Boilerplate because the negative assertion about absence of incidents is not externally verifiable, and the paragraph contains no domain terminology, firm-specific facts, or quantified claims.


fact: June 2024 - specific date of cybersecurity incident

fact: CDK - named third-party provider involved in the incident

reasoning: The paragraph describes an actual cybersecurity incident that occurred in June 2024 involving CDK, a named third-party provider, including the timeline, operational disruption, and response—this is a real event disclosure, not hypothetical. The specific date (June 2024) and named entity (CDK) are externally verifiable facts that elevate specificity to Level 4.


fact: February 2024 - specific date when Board delegated cybersecurity oversight to Audit Committee

reasoning: The paragraph answers how the board oversees cybersecurity, describing the Board's delegation of oversight to the Audit Committee, the Committee's oversight role, and the reporting flow from officers to both the Committee and full Board. The specific date 'February 2024' for when the Board delegated cybersecurity oversight to the Audit Committee is a verifiable claim about a governance action.


reasoning: This paragraph is a materiality assessment stating conclusions about whether cybersecurity threats have affected (backward-looking) or are reasonably likely to affect (forward-looking) the company's business and financial condition, which directly answers the Strategy Integration question about business/financial impact. Specificity is Level 1 because the paragraph contains only generic risk management language that any ERM professional would use—no domain-specific terminology, firm-specific facts, or externally verifiable claims are present.


content_category: Management Role

fact: IT Risk and Compliance Team

fact: VP Security

reasoning: This paragraph describes management-level organizational structure, specifically the IT Risk and Compliance Team and its reporting line to the VP Security, which answers how management is organized to handle cybersecurity. Specificity reaches Firm-Specific due to the named team (IT Risk and Compliance Team) and the VP-level security role (VP Security), both of which distinguish this company's cybersecurity posture.


fact: Chief Information Officer (CIO)

reasoning: This paragraph describes the Board's oversight structure for cybersecurity, including regular reviews, management updates, and executive sessions with the CIO—answering the question of how the board oversees cybersecurity. The CIO role is a firm-specific leadership position (Level 3), while the remaining content uses generic governance and ERM terminology that does not demonstrate cybersecurity domain expertise.


fact: Deputy Chief Executive Officer and Chief Financial Officer

fact: more than seven years of operational responsibility for IT

type: quantified

reasoning: The paragraph primarily describes management's organizational role for cybersecurity—the Deputy CEO/CFO and external IT team's responsibilities and qualifications—rather than board oversight mechanics. Specificity reaches Level 4 due to the verifiable 'more than seven years' experience claim tied to a named executive role.


fact: Our Town (named hotel manager)

fact: cybersecurity insurance

reasoning: The paragraph centrally addresses how the company manages cybersecurity risk through third parties (hotel manager Our Town and franchisors), including reliance on them and expectations set, which fits Third-Party Risk. The named hotel manager 'Our Town' is a firm-specific fact distinguishing this disclosure, while 'cybersecurity insurance' demonstrates domain expertise.


fact: cybersecurity incident response team

fact: includes the Chief Financial Officer

reasoning: The paragraph primarily describes the organizational structure for incident response—specifically the composition of a designated cybersecurity incident response team and reporting lines—rather than the operational activities of the program itself. Specificity reaches Firm-Specific due to the named 'cybersecurity incident response team' and the specification that the CFO serves on this team.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers, including assessment requirements, remediation obligations, and contractual security provisions—clearly fitting Third-Party Risk under Rule 3. Specificity is Generic Boilerplate because the language describes vendor oversight in terms any ERM professional would use (risk assessments, remediation, contractual provisions, reasonable controls) without demonstrating cybersecurity domain expertise or firm-specific details.


reasoning: This paragraph is a materiality assessment stating that cybersecurity risks have not materially affected and are not reasonably likely to materially affect the company, which falls under Strategy Integration per Rule 5. The paragraph contains no domain terminology passing the ERM test, no firm-specific facts, and the negative assertion about absence of material effects is not externally verifiable.


reasoning: The paragraph describes the company's cybersecurity program and assessment activities for managing cyber risks, fitting Risk Management Process. It contains only generic ERM language ('policies and controls,' 'internal and external assessments') without domain-specific terminology, firm-specific details, or verifiable claims, resulting in Level 1 specificity.


reasoning: This paragraph describes the board's oversight structure for cybersecurity risk, including direct oversight and delegation to the audit committee, which directly answers the question of how the board oversees cybersecurity. The paragraph contains only generic governance language with no domain expertise, firm-specific facts, or verifiable claims.


reasoning: Category is RMP because the paragraph describes the company's cybersecurity risk assessment methodology and process activities. Specificity is Level 1 because the language is entirely generic risk management terminology that any ERM professional would use—no cybersecurity domain expertise, firm-specific details, or verifiable claims are present.


reasoning: This paragraph provides a backward-looking negative assertion about material impact on business outcomes, which falls under Strategy Integration per Rule 5. The statement contains no domain terminology, firm-specific facts, or verifiable claims—only a generic self-reported assertion about the absence of material incidents.


fact: over 30 years of experience in various information technology roles

fact: over 20 years of experience as an IT Director

fact: over 10 years of experience in risk management

reasoning: The paragraph describes management roles and qualifications for cybersecurity oversight, fitting Management Role. Specificity is Level 4 due to three quantified experience claims (30+ years IT, 20+ years IT Director, 10+ years risk management) that are lower bounds verifiable against the individuals' resumes.


category_confidence: medium

reasoning: The paragraph describes the executive team's role in overseeing cybersecurity operations and reporting to the Board, which addresses how management is organized to handle cybersecurity rather than Board-level oversight activities. No domain terminology passes the ERM test, no firm-specific facts are present (audit committee is a generic governance body), and no verifiable claims are made.


fact: Enterprise Risk and Compliance Committee of the Company's Board of Directors (the "ERC Committee")

reasoning: The paragraph describes the flow of cybersecurity information to a board-level committee for oversight purposes, answering the governance question of how the board receives cybersecurity findings. The named committee 'Enterprise Risk and Compliance Committee (ERC Committee)' is a firm-specific governance structure that distinguishes this company from others.


fact: denial of service attacks

reasoning: The paragraph describes information security as an ongoing process to protect systems from cyber threats, which answers what the cybersecurity program does, though at a very general definitional level. Specificity is Domain-Adapted due to the mention of 'denial of service attacks,' a specific cyber attack type that requires domain knowledge and would not naturally be used by a non-security ERM professional.


reasoning: The paragraph describes engaging third-party consultants for testing and advisory services as part of the cybersecurity program, which falls under Risk Management Process per Rule 3 (third parties hired to serve the company as assessors/testers → RMP, not Third-Party Risk). The language is generic business terminology without domain-specific security practices, named firms, or verifiable facts that would elevate specificity above Level 1.


reasoning: This paragraph is a materiality assessment stating the company has not experienced material cybersecurity incidents as of a specific date, which is a backward-looking conclusion about cybersecurity's impact on the business under Rule 5. The specificity is Generic Boilerplate because the negative assertion about no material incidents is not externally verifiable, the date is reporting context rather than a verifiable cybersecurity fact, and the remaining language uses generic cybersecurity terminology that any ERM professional would use without demonstrating domain expertise.


reasoning: This paragraph describes what the cybersecurity program does—specifically asset identification, assessment, monitoring, and classification procedures—which directly answers the Risk Management Process question. The language is generic risk management terminology that fails the ERM test; an ERM professional could describe any asset management function using identical phrasing, with no cybersecurity-specific tools, frameworks, or practices mentioned.


fact: ERMC (Enterprise Risk Management Committee) - named non-generic committee

fact: TISC - firm-specific committee acronym

fact: Chief Risk Officer - C-level role with cybersecurity oversight

reasoning: This paragraph describes the ERMC, a management-level committee responsible for enterprise risk governance including cybersecurity, its composition, leadership structure, and reporting to the board's Audit and Risk Committee. It contains firm-specific facts including the named non-generic committee (ERMC), the TISC acronym, and the Chief Risk Officer role.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers, including contract review and security amendments—this is vendor oversight as the primary topic, fitting Third-Party Risk. Specificity is Level 1 because the language is generic vendor management terminology that any business professional could write; it lacks domain-specific security practices, firm-specific organizational details, or verifiable claims.


fact: Technology Committee

reasoning: This paragraph describes the Board's oversight structure for cybersecurity risk, including delegation to the Technology Committee and reporting flows, directly answering how the board oversees cybersecurity. The Technology Committee is a named board committee that distinguishes this company's governance structure, establishing Level 3 specificity.


fact: vulnerability scanning

fact: penetration testing

reasoning: The paragraph describes the activities of the cybersecurity program (risk assessments, vulnerability scanning, penetration testing, third-party assessments), which directly answers what the program does. Specificity is Domain-Adapted because vulnerability scanning and penetration testing are specific cybersecurity practices that demonstrate domain expertise beyond generic ERM language.


reasoning: The paragraph's central topic is third-party cyber risk—describing BHE's dependence on service providers, the exposure this creates, and how BHE monitors those risks. The vocabulary is generic business language ("third-party service providers," "information systems," "monitors the risks") that any ERM professional would use—no cybersecurity domain expertise, firm-specific details, or verifiable claims are present.


reasoning: This paragraph contains a backward-looking materiality assessment stating that cybersecurity risks have not materially affected the company's business strategy, results of operations, or financial condition, which fits the Strategy Integration category per Rule 5. The paragraph lacks domain terminology, firm-specific facts, or verifiable claims—the negative assertion about no material impact is a self-reported claim that cannot be independently verified.


reasoning: The paragraph primarily states a materiality assessment—that no cybersecurity threats have materially affected or are reasonably likely to materially affect the company's business—which directly answers the Strategy Integration question about business/financial impact. The specificity is Generic Boilerplate because the paragraph contains only a negative self-assertion about materiality (not externally verifiable), generic risk management language that fails the ERM test, and a cross-reference to risk factors.


fact: Mr. Lee

specificity_confidence: medium

reasoning: This paragraph describes the flow of cybersecurity information to the Board and Audit Committee for oversight purposes, which is Board Governance. The named individual 'Mr. Lee' providing cybersecurity updates is a firm-specific fact, though without his title the specificity confidence is medium.


fact: CISSP certification held by management team

fact: CISM certification held by management team

fact: CISA certification held by management team

reasoning: The paragraph describes management's responsibilities for cybersecurity oversight and their qualifications, directly answering how management is organized to handle cybersecurity. The named certifications (CISSP, CISM, CISA) are externally verifiable through credentialing bodies, elevating specificity to Level 4.


fact: CISO role

reasoning: The paragraph describes the CISO's leadership responsibilities and professional qualifications, which directly answers how management is organized to handle cybersecurity. Specificity reaches Level 3 due to the firm-specific CISO role, but lacks verifiable credentials like named certifications or quantified experience years.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks associated with third-party service providers, detailing vendor oversight activities like security assessments, contractual obligations, and on-site inspections—clearly fitting Third-Party Risk. While the paragraph describes multiple vendor management activities, all are described in generic business terms (security assessments, written questionnaires, on-site inspections) that any ERM professional could write; no specific cybersecurity domain terminology, firm-specific details, or verifiable facts are present.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers, including risk assessments at onboarding and renewal, risk-based assessment levels, and contractual cybersecurity obligations imposed on providers. No domain-specific terminology passes the ERM test (terms like 'cybersecurity risk assessments' and 'vendor management process' are generic risk management language any ERM professional would use), and there are no firm-specific roles, named programs, or verifiable claims.


fact: Technology Steering Committee

reasoning: This paragraph describes the oversight structure for cybersecurity, identifying the Board, Audit Committee, and Technology Steering Committee as responsible bodies—answering the question of how the board oversees cybersecurity. The Technology Steering Committee is a named management-level committee that distinguishes this company's governance structure from generic oversight arrangements.


reasoning: This is a standard forward-looking statements legal disclaimer that appears in SEC filings generally, with no substantive cybersecurity content or disclosure. It does not answer any of the six substantive cybersecurity questions and contains no cybersecurity-specific facts.


reasoning: The paragraph primarily provides a materiality assessment stating that cybersecurity incidents during 2024 did not materially affect business operations, strategy, or financial results, which directly answers the Strategy Integration question about business/financial impact. Specificity is Level 1 because the paragraph contains only generic cybersecurity language, a negative assertion about absence of material incidents (not externally verifiable per Rule 5), and forward-looking speculation—none of which demonstrate domain expertise or firm-specific facts.


reasoning: This paragraph is a materiality assessment stating the company's conclusion that cybersecurity risks have not and are not reasonably likely to materially affect the business—exactly the type of backward-looking and forward-looking assessment described in Rule 5 for Strategy Integration. The specificity is Level 1 because the materiality conclusion is a negative self-assertion that cannot be externally verified, and the cross-reference to Risk Factors is not a substantive cybersecurity fact.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from its vendors through due diligence, periodic reviews, and contractual requirements, which directly answers the third-party risk question. The language is generic vendor management terminology that any ERM professional would use—terms like 'vendor due diligence evaluation,' 'periodically review,' and 'industry and regulatory standard clauses' do not demonstrate cybersecurity domain expertise, and no firm-specific or verifiable facts are present.


reasoning: The paragraph directly answers how third-party cyber risks are managed by describing vendor oversight activities (risk assessments, control requirements, compliance monitoring), placing it firmly in Third-Party Risk. Specificity is Generic Boilerplate because the language uses ERM-level terms any business professional would use—'risk assessments of vendors,' 'appropriate cybersecurity controls,' 'monitoring vendor compliance'—without demonstrating cybersecurity domain expertise or providing any firm-specific or verifiable facts.


reasoning: This paragraph describes regulatory requirements and provides a cross-reference to another section of the 10-K. It does not substantively address board governance, management organization, risk management processes, third-party risk, incident disclosure, or strategy integration—it merely states that the company is subject to certain regulations and SEC disclosure rules. The paragraph contains no domain-specific cybersecurity terminology demonstrating expertise (fails ERM test), no firm-specific facts about the company's cybersecurity posture, and no verifiable claims about the company's cybersecurity practices.


reasoning: This paragraph is a forward-looking disclaimer stating that future incidents cannot be predicted, followed by a cross-reference to the Risk Factors section—it contains no substantive cybersecurity disclosure. No domain terminology, firm-specific facts, or verifiable claims are present.


reasoning: The paragraph describes elements of the cybersecurity program—incident response planning and employee training—which answers the question 'What does the cybersecurity program do?' The language is entirely generic (incident response plan, annual training) with no domain-specific terminology that passes the ERM test, no firm-specific facts, and no verifiable claims.


fact: August 2020

fact: ransomware

reasoning: This paragraph describes an actual cybersecurity incident (ransomware attack discovered in August 2020), including the nature of the threat, response actions, and outcome, which directly answers 'What happened in a cybersecurity incident?' The specific date 'August 2020' tied to a real event is externally verifiable, elevating specificity to Quantified-Verifiable.


reasoning: This paragraph describes oversight responsibilities (items b and c from a larger list), which directly answers the question of how the board/committee oversees cybersecurity. The language is entirely generic governance boilerplate with no domain-specific terminology, firm-specific details, or verifiable claims.


reasoning: The paragraph contains a negative assertion about material cybersecurity incidents ('has not experienced a cybersecurity threat that has materially affected the company'), which falls under Strategy Integration per Rule 5's materiality assessment rule. The cross-reference to risk factors is N/O content but the materiality statement is the substantive disclosure. Specificity is Generic Boilerplate because the negative assertion is not externally verifiable (cannot prove absence), and no domain terminology passing the ERM test or firm-specific structural facts are present.


reasoning: The paragraph primarily provides a materiality assessment stating that cybersecurity risks have not materially affected and are not reasonably likely to materially affect the company's business strategy, results of operations, or financial condition, which fits Rule 5 for Strategy Integration. The specificity is Generic Boilerplate because the paragraph contains no domain terminology passing the ERM test (only generic terms like 'cybersecurity threats' and 'security incidents'), no firm-specific facts about cybersecurity posture (the negative materiality assertion is a standard disclosure many companies would make), and no verifiable claims (negative assertions about absence of incidents cannot be independently confirmed).


fact: zero-day vulnerability (domain term)

fact: material cybersecurity incident involving unauthorized access to personal information via third-party file transfer application (firm-specific)

fact: third quarter of fiscal year 2023 (verifiable timeframe for disclosed incident)

reasoning: This paragraph describes actual cybersecurity incidents, including a material incident in Q3 FY2023 with specific details about the attack vector (zero-day vulnerability in a file transfer application), scope (personal information accessed), and financial impact (expenses recorded for investigation and remediation). The specificity reaches Level 4 due to the verifiable timeframe 'third quarter of fiscal year 2023' for a previously disclosed incident, plus the domain term 'zero-day vulnerability' demonstrates cybersecurity expertise.


fact: third-party risk monitoring security rating services

reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third parties through diligence, contractual protections, and monitoring services, making it Third-Party Risk. The mention of 'security rating services' demonstrates domain expertise beyond generic ERM language, elevating specificity to Domain-Adapted.


reasoning: This paragraph describes the general threat landscape and why cybersecurity matters (reliance on systems, types of threats, evolution of threats) without answering any of the six substantive questions—it contains no governance structure, management roles, program activities, vendor oversight, actual incidents, or materiality assessments. None/Other paragraphs automatically receive Generic Boilerplate specificity regardless of domain terminology present.


reasoning: This paragraph describes the Board's oversight responsibilities for cybersecurity risk management, directly answering how the board governs cybersecurity. The language is entirely generic governance boilerplate with no domain-specific terminology, firm-specific facts, or verifiable claims.


reasoning: This paragraph is a cross-reference to Item 1A Risk Factors with speculative language about potential cybersecurity impacts ('may be materially affected'), which fits None/Other rather than Strategy Integration per Rule 5 since it lacks an actual materiality assessment or conclusion. The paragraph contains no domain terminology passing the ERM test, no firm-specific facts, and no verifiable claims—only generic risk language that appears in virtually every 10-K.


reasoning: The paragraph describes the company's cybersecurity program purpose (identifying and mitigating threats) and what it protects, which answers 'What does the cybersecurity program do?' but at an extremely generic level. No domain-specific terminology, firm-specific facts, or verifiable claims are present—only boilerplate language any company could use.


fact: Director of Information Security and Privacy

fact: CISSP (Certified Information Systems Security Professional) certification

fact: CCSP (Certified Cloud Security Professional) certification

fact: email phishing test campaigns

fact: intrusion detection

fact: information security management system

reasoning: The paragraph is split between management role description (first half) and program activities (second half), but RMP content has more text devoted to specific cybersecurity activities like penetration testing and vulnerability scanning. Specificity reaches Quantified-Verifiable due to the named CISSP and CCSP certifications, which are externally verifiable via the (ISC)² registry.


fact: CSIRPs (Cybersecurity Incident Response Plans) - named internal program with distinguishing acronym

fact: incident response phases: detection, analysis, containment, eradication, recovery, post-incident review

reasoning: The paragraph describes what the cybersecurity incident response program does, covering the specific phases of incident response, which directly answers the Risk Management Process question. Specificity reaches Firm-Specific due to the named program identifier 'CSIRPs' with its distinguishing acronym, while the incident response phases demonstrate domain expertise.


reasoning: This paragraph is a negative materiality assertion stating no cybersecurity incidents occurred that materially affected or were reasonably likely to affect the company, which falls under Strategy Integration per Rule 5's explicit inclusion of 'have not experienced any material cybersecurity incidents' statements. Specificity is Generic Boilerplate because negative assertions about absence of incidents are not externally verifiable, and the paragraph contains no domain terminology, firm-specific facts, or quantified claims.


fact: threat assessments

fact: proactive detection tools

reasoning: The paragraph describes the company's cybersecurity program activities including engaging external experts for assessments and using detection tools, which answers 'What does the cybersecurity program do?' The domain terms 'threat assessments' and 'proactive detection tools' demonstrate cybersecurity expertise beyond generic ERM language, elevating specificity to Level 2.


fact: Chief Information Officer

fact: Information Security Officer

reasoning: This paragraph describes specific management roles (Information Security Officer and Chief Information Officer) and their training responsibilities, directly answering how management is organized for cybersecurity. Specificity reaches Level 3 due to the firm-specific CIO role (C-level leadership position) and Information Security Officer role (security-qualified title).


reasoning: This paragraph is a cross-reference directing readers to Item 1A (Risk Factors) for cybersecurity risk discussion, containing no substantive disclosure about governance, management, processes, or incidents. As a pure cross-reference with no actual cybersecurity content, it receives None/Other at Generic Boilerplate specificity.


fact: IT Security Steering Committee

fact: VP of Software Engineering

fact: Director of Information Systems and Security

fact: IT Security Team

fact: collectively have over 40 years of experience

fact: test and monitor for vulnerabilities and threats

reasoning: The paragraph primarily describes management organizational structure for cybersecurity, including the IT Security Steering Committee composition and leadership, the IT Security Team membership, and their collective qualifications, answering how management is organized to handle cybersecurity. Specificity reaches Quantified-Verifiable due to the 'over 40 years of experience' claim, which is a verifiable lower bound, plus multiple firm-specific facts including named committee, team, and VP/Director-level roles with security responsibilities.


reasoning: This paragraph is a materiality assessment stating that cybersecurity risks have not materially affected the company's business strategy, results of operations, or financial condition, which falls under Strategy Integration per Rule 5. The paragraph contains only generic language and negative self-assertions (which are not externally verifiable), with no domain terminology passing the ERM test, no firm-specific facts, and no verifiable claims.


reasoning: The paragraph opens with a materiality assessment stating no cybersecurity incidents have materially affected or are reasonably likely to materially affect the company, which is a Strategy Integration conclusion under Rule 5. The remaining sentences about lacking specific policies and general awareness activities are secondary. No domain-specific terminology passes the ERM test (terms like 'cybersecurity threats' and 'information systems' are generic), no firm-specific facts distinguish this company, and the negative assertions about incident absence are not externally verifiable.


reasoning: This is a SPAC (blank check company) explicitly stating it has no operations and no cybersecurity personnel or processes of its own, which falls under Rule 6 for SPACs with no program. None/Other paragraphs always receive Generic Boilerplate specificity.


reasoning: This paragraph is forward-looking risk factor language describing potential threats and hypothetical business impacts without any substantive cybersecurity disclosure such as governance, processes, or actual incidents; it contains no domain terminology passing the ERM test, no firm-specific facts, and no verifiable claims.


reasoning: This paragraph is a backward-looking materiality assessment stating that cybersecurity threats have not materially affected the company's business strategy, results of operations, or financial condition, which is Strategy Integration per Rule 5. The specificity is Generic Boilerplate because the paragraph contains only a negative assertion (not externally verifiable), no cybersecurity domain expertise passing the ERM test, and no firm-specific facts.


fact: CISO

fact: Security Steering Committee

fact: CSIRT

fact: PSIRT

fact: incident handling lifecycle

reasoning: The paragraph primarily describes management-level cybersecurity roles and organizational structure, including the CISO, Security Steering Committee, involvement of CEO and CTO, and information flow from CSIRT and PSIRT to the CISO. Specificity is Firm-Specific due to the CISO role and named Security Steering Committee, with domain terms including CSIRT, PSIRT, and incident handling lifecycle.


reasoning: This paragraph describes the information flow from senior management to the Audit Committee for oversight purposes, which directly answers how the board oversees cybersecurity (Board Governance). The paragraph contains only generic governance language—'Audit Committee' exists at every public company, 'senior management' is a generic term, and there are no domain-specific cybersecurity terms, firm-specific roles, or verifiable claims.


reasoning: This paragraph contains only speculative risk acknowledgment language ('could have a material impact') and a cross-reference to Item 1A, with no substantive disclosure about governance, management, processes, or actual incidents. Per Rule 5, 'could have a material adverse effect' is speculation rather than a materiality assessment, and per Rule 6, pure speculation without measures falls into None/Other.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers, including assessment criteria and contracting processes, which directly answers the Third-Party Risk question. The language is generic ERM-style risk management terminology without any domain-specific cybersecurity practices, firm-specific details, or verifiable claims.


fact: SOC type reports

reasoning: The paragraph describes the company's cybersecurity program activities—software deployment, internal audits, and vendor SOC report requirements—answering what the program does. The mention of SOC type reports demonstrates domain expertise (cybersecurity/audit-specific standard) that passes the ERM test, elevating specificity to Level 2.


reasoning: This is a SPAC explicitly stating it has no business operations and no cybersecurity program, which matches Rule 6 for None/Other classification. The paragraph contains no domain-specific cybersecurity terminology, no firm-specific facts beyond generic governance roles, and no verifiable claims.


reasoning: This paragraph is a cross-reference directing readers to Item 1A for cybersecurity risk information, which does not substantively answer any of the six content questions. It contains no domain terminology, firm-specific facts, or verifiable claims—only generic boilerplate language.


fact: CIO

fact: management committee on cybersecurity

reasoning: This paragraph describes the oversight structure for cybersecurity risk, detailing how information flows from management to the Board and Audit and Finance Committee through briefings and reviews. The specificity is Firm-Specific due to the named roles (Senior Director, Information Protection & Compliance; CIO) and the named committee (management committee on cybersecurity).


fact: external and internal penetration testing

fact: vulnerability remediation

fact: cybersecurity insurance coverage

reasoning: The paragraph describes multiple cybersecurity program activities: penetration testing, vulnerability remediation, third-party service provider oversight, and insurance coverage. While third-party oversight is substantial, it is presented as one component of the overall risk management program rather than the central topic. Domain terminology including penetration testing, vulnerability remediation, and cybersecurity insurance elevates specificity to Level 2.


fact: over 13 years previously serving as the Company's Chief Financial Officer

fact: over 20 years of work experience in cybersecurity at financial institutions

reasoning: The paragraph describes management-level cybersecurity roles (Chief Privacy Officer, Chief Information Security Officer), their responsibilities, reporting lines, and qualifications, answering how management is organized to handle cybersecurity. Specificity reaches Level 4 due to two verifiable career history claims with specific year counts.


fact: phishing security test

fact: phishing attempt simulations

reasoning: This paragraph describes employee security awareness training and phishing simulation exercises, which are operational activities of the cybersecurity program answering 'what does the program do.' The phishing simulation concept demonstrates cybersecurity domain expertise beyond generic ERM language, elevating specificity to Domain-Adapted.


fact: April 28, 2023 - specific date of incident identification

fact: $54,300 - exact dollar amount of unauthorized payment

fact: June 29, 2023 - specific date of fund recovery

fact: phishing attack - domain term for attack vector

fact: vendor verification - domain term for security control

reasoning: This paragraph describes an actual cybersecurity incident—a phishing attack resulting in unauthorized payment—answering 'What happened in a cybersecurity incident?' with specific details about nature, timing, scope, investigation, and remediation. Specificity is Quantified-Verifiable due to multiple hard facts: the specific incident date (April 28, 2023), exact dollar amount ($54,300), and specific recovery date (June 29, 2023)—all externally verifiable against bank records and internal reports.


reasoning: This is a SPAC explicitly stating it has no operations and no cybersecurity program, which matches Rule 6's N/O category for 'SPACs and no-operations companies with no program.' The paragraph contains no domain terminology passing the ERM test, no firm-specific facts (board is a generic governance role), and no verifiable claims (negative assertions about incident absence are not externally verifiable).


reasoning: The paragraph describes engaging third-party consultants as part of the company's risk assessment and risk management activities, which per Rule 3 falls under RMP when third parties are hired to serve the company. The second sentence mentions third-party risk oversight but does not describe specific vendor requirements or oversight mechanisms that would make it central to TP. Specificity is Generic Boilerplate because the language is entirely high-level with no domain-specific terminology passing the ERM test, no firm-specific facts, and no verifiable claims.


fact: grantor trust

fact: conducts no active operations

fact: has no customers

fact: maintains no personal or credit data

reasoning: This paragraph explains the Trust's business structure and how cybersecurity risks are minimal due to no operations, customers, or data—a materiality assessment fitting Strategy Integration. The specificity reaches Level 4 due to the verifiable legal classification 'grantor trust' (checkable against SEC filings and trust documents), supported by firm-specific facts about no operations, customers, or sensitive data.


fact: December 2022 - specific date when Company learned of cybersecurity threat

fact: personal data of employees - specific scope of extracted data

reasoning: This paragraph describes an actual cybersecurity incident—timing (December 2022), nature (data extraction from IT systems), scope (personal data of employees), and response actions—making it a clear Incident Disclosure. The specific date 'December 2022' tied to the incident discovery and the specific data scope 'personal data of employees' are verifiable facts that elevate specificity to Level 4.


reasoning: The paragraph primarily answers the Strategy Integration question by stating a materiality assessment - that the company does not believe there are currently known cybersecurity risks reasonably likely to materially affect the business. This matches Rule 5's explicit guidance that backward-looking negative assertions about material impact fall under SI. The cross-reference to Item 1A is secondary content. Specificity is Level 1 because the materiality assertion is a negative self-claim (not externally verifiable per the rules), and the paragraph contains no domain terms passing the ERM test, no firm-specific facts, and no quantified verifiable claims.


fact: malware detection

fact: phishing simulations

reasoning: This paragraph describes the company's security awareness program activities, which is a core component of cybersecurity risk management. The specificity reaches Domain-Adapted because 'malware detection' and 'phishing simulations' are cybersecurity-specific practices that would not naturally be used by a non-security ERM professional.


reasoning: The paragraph describes the company's IT systems environment and data collection context without addressing any of the six substantive cybersecurity disclosure questions (governance, management role, risk management processes, third-party risk, incident disclosure, or strategy integration). It contains only generic business and technology terminology with no cybersecurity domain expertise, firm-specific facts, or verifiable claims.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third parties (vendors, customers, third-party technology), with vendor security assessments as a key described measure. Specificity is Level 1 because the language is generic ERM-style ('security assessments,' 'risk assessments') without named domain tools, firm-specific organizational details, or verifiable claims.


reasoning: The paragraph primarily addresses how the company manages vendor cybersecurity risks through its vendor management process, including obtaining reports from vendors handling sensitive data and following up on issues—this is requirements imposed ON vendors with vendor oversight as the central topic. Specificity is Level 1 because the language uses generic business oversight terms ('vendor management process,' 'obtain reports,' 'efficacy and efficiency') that any ERM professional would use, without demonstrating cybersecurity domain expertise or providing firm-specific or verifiable details.


reasoning: The paragraph centrally addresses vendor cybersecurity oversight through due diligence, evaluation, and contractual requirements, which is the core of third-party risk management. The language is generic ERM-style phrasing that any business professional could write—no specific security practices, tools, standards, or firm-unique details are mentioned, failing the ERM test for domain expertise.


fact: February and April 2025 - specific dates of incident notification

fact: Microsoft notified the Company - named third party

fact: Azure environment - specific platform affected

fact: nation-state threat actor - domain terminology

fact: enhanced rotation of credentials - domain security practice

reasoning: The paragraph describes a specific cybersecurity incident—Microsoft notifying the company about unauthorized activity in their Azure environment by a suspected nation-state threat actor—including timeline, nature, and response actions, which makes it Incident Disclosure despite also containing a materiality assessment statement. Specificity reaches Level 4 due to multiple verifiable facts: specific dates (February and April 2025), named third party (Microsoft), and specific platform (Azure environment).


reasoning: This paragraph describes the Board's oversight structure for cybersecurity, including delegation to the Audit Review Committee and how information flows through regular management reviews, which directly answers the Board Governance question. The specificity is Generic Boilerplate because the paragraph contains no domain-specific terminology that passes the ERM test, no firm-specific facts (Audit Review Committee is a generic audit committee variant that exists at virtually every public company), and no verifiable claims such as specific dates, numbers, or named individuals.


fact: Fortra, LLC (named third-party vendor)

fact: GoAnywhere managed file transfer as a service system (MFTaaS) (named product)

fact: fiscal 2023 (specific incident timeframe)

fact: zero-day vulnerability (domain term)

fact: protected health information (domain term)

fact: Health Insurance Portability and Accountability Act (domain term)

fact: personally identifiable information (domain term)

reasoning: This paragraph describes an actual cybersecurity incident at a named third-party vendor (Fortra, LLC) involving a specific product (GoAnywhere MFTaaS), including the nature of the attack (zero-day vulnerability exploit), scope (customer employee and third-party data including PHI and PII), and response actions (engaged outside experts, provided notifications). The specificity reaches Level 4 due to multiple externally verifiable facts: the named vendor (Fortra, LLC), the named product (GoAnywhere), and the specific timeframe (fiscal 2023) — all of which could be independently confirmed against public reporting about this widely-reported incident.


reasoning: This paragraph is a backward-looking materiality assessment stating that cybersecurity risks and incidents have not materially affected the company, which directly answers the Strategy Integration question about business/financial impact. The language is entirely generic boilerplate with no domain-specific terminology passing the ERM test, no firm-specific facts, and the negative assertion about absence of material impacts is not externally verifiable.


reasoning: This paragraph describes the board oversight structure for cybersecurity, specifically the audit committee's role in overseeing the cybersecurity risk management program and the information flow from CFO to audit committee to the full board. The language is entirely generic governance boilerplate with no domain-specific terminology, firm-specific roles beyond standard corporate positions (Audit Committee, CFO, Board), or verifiable claims.


fact: the Adviser

fact: risk management, legal, information technology, and compliance personnel

reasoning: The paragraph addresses how third-party cyber risks are managed by describing reliance on Adviser personnel for oversight, making it Third-Party Risk with the organizational mechanism secondary to the topic. Specificity is Firm-Specific due to the reference to 'the Adviser' as a defined entity and the specific departmental composition involved in oversight.


fact: insider threat controls

fact: data loss prevention

reasoning: This paragraph describes what the cybersecurity program does—specifically the controls, tools, and processes for identifying and addressing insider threats and preventing data loss—which directly answers the RMP question 'What does the cybersecurity program do?' The specificity reaches Level 2 because 'insider threat' and 'data loss prevention' are cybersecurity domain terminology that pass the ERM test—a non-security ERM professional would use terms like 'internal controls' or 'fraud prevention' rather than these security-specific concepts.


fact: Chief Information Security Officer (CISO)

fact: Chief Information Officer (CIO)

fact: Chief Legal Officer

fact: over 30 years of experience in cybersecurity and intelligence

fact: CIO Program Certificate from the College of Information and Cyberspace, National Defense University

fact: Certified Information System Security Professional (CISSP) designation

fact: Certified Information Privacy Professional (CIPP) designation

reasoning: The paragraph describes the management structure for cybersecurity leadership, including the CISO role, reporting lines to the CIO and Chief Legal Officer, and detailed professional qualifications, which directly answers how management is organized to handle cybersecurity. Specificity reaches Quantified-Verifiable due to externally verifiable certifications (CISSP, CIPP) and a specific experience claim (over 30 years) that can be checked against the individual's professional history.


fact: threat intelligence briefings

fact: CISO

fact: FedEx Executive Committee

fact: DTRC

fact: CyTOC

reasoning: The paragraph primarily answers how management is organized for cybersecurity, describing the CISO role, reporting lines to the CEO, and named management-level committees (DTRC, CyTOC) involved in incident response communication. Specificity reaches Firm-Specific due to named roles (CISO) and multiple named non-generic committees (DTRC, CyTOC, FedEx Executive Committee) that distinguish this company's cybersecurity governance structure.


fact: 24x7 Security Operations Center (SOC)

fact: Security Information and Event Management (SIEM)

reasoning: This paragraph describes security monitoring tools and operations (SOC, SIEM), answering what the cybersecurity program does. The 24x7 SOC claim is firm-specific organizational capability that distinguishes this company's posture, while SIEM is a domain term demonstrating cybersecurity expertise.


reasoning: This is a SPAC (blank check company) explaining it has no operations and therefore no cybersecurity threats to disclose, which fits the N/O category per Rule 6. The paragraph contains no domain terminology, firm-specific cybersecurity facts, or verifiable claims—just a standard explanation for why no cybersecurity program exists.


reasoning: This paragraph describes the company's cybersecurity program scope and activities—specifically, processes to identify, assess, and manage risks to their information systems and data—which directly answers 'What does the cybersecurity program do?' The language is entirely generic business/IT terminology that any ERM professional would use; no cybersecurity domain expertise, firm-specific details, or verifiable claims are present.


reasoning: This paragraph is a cross-reference to Item 1A Risk Factors with generic risk language about IT dependence and cybersecurity risks, containing no substantive cybersecurity disclosure about governance, management, processes, or incidents.


reasoning: This paragraph describes the Audit Committee's oversight role in cybersecurity, including the frequency of discussions with management and the scope of annual program reviews, which directly answers how the board oversees cybersecurity risks.


reasoning: The paragraph centrally addresses how the company manages vendor cybersecurity risks through due diligence and monitoring, placing it firmly in Third-Party Risk. However, the language is entirely generic—'comprehensive due diligence process,' 'continuous monitoring,' and 'stringent standards' could describe any vendor risk management program and fail the ERM test for domain expertise, yielding no facts above Level 1.


reasoning: This paragraph describes how information flows from management to the Board, the Board's oversight activities, and the governance structure for cybersecurity—answering 'How does the board oversee cybersecurity?' The Director of Internal Audit and Director of Information Technology titles do not qualify as firm-specific (no security qualifier at Director level), and the briefing topics and governance cadences are generic language any ERM professional would use, with no domain-specific terminology or externally verifiable claims.


reasoning: The paragraph's primary content is a materiality assessment stating the company is not aware of cybersecurity risks that have materially affected or are reasonably likely to materially affect the business, which directly answers the Strategy Integration question about business/financial impact. The first two sentences describe planned measures but are generic future intent ('plan to establish'). Specificity is Level 1 because the confidentiality framework and agreements are generic business practices that fail the ERM test, and the negative materiality assertion is a self-reported claim about absence that cannot be externally verified.


fact: 5 years of experience in roles that include oversight of cybersecurity risk management programs

reasoning: This paragraph primarily describes management organization for cybersecurity—the IT Lead role, their qualifications, and external support structure—making it Management Role. The specificity reaches Level 4 because '5 years of experience' is a hard number that could be verified against the individual's resume, meeting the Quantified-Verifiable threshold.


reasoning: This paragraph states a conclusion about whether cybersecurity risks have materially affected or are reasonably likely to materially affect the company's business strategy, results of operations, or financial condition, which is a materiality assessment under Rule 5 for Strategy Integration. The paragraph contains no domain terminology passing the ERM test, no firm-specific facts, and the negative assertions about absence of material impact are not externally verifiable claims.


fact: MIS consultant

fact: MIS supervisor

reasoning: The paragraph describes management's organizational structure for cybersecurity—specifically the roles of CEO, MIS consultant, and MIS supervisor, along with their reporting relationships—answering how management is organized to handle cybersecurity. Specificity is Firm-Specific due to the unique role titles 'MIS consultant' and 'MIS supervisor' that distinguish this company's organizational structure.


reasoning: This paragraph provides background context about the company's IT systems and data dependencies without describing any cybersecurity governance, management structure, risk management processes, or assessments. It does not answer any of the six substantive questions. The language is entirely generic business description with no cybersecurity domain terminology, firm-specific facts, or verifiable claims.


reasoning: This paragraph describes activities of the cybersecurity program—risk assessment, security controls maintenance, incident response coordination, and engagement with external providers—which answers 'What does the cybersecurity program do?' Per Rule 3, third parties hired to serve the company (consultants, external service providers) are classified as RMP, not Third-Party Risk. The paragraph contains only generic ERM terminology that any business professional would use, with no domain-specific terms, firm-specific facts, or verifiable claims.


reasoning: This paragraph merely describes what types of information the company handles in the normal course of business, which does not substantively answer any of the six cybersecurity disclosure questions about governance, management, processes, third-party risk, incidents, or strategy integration. The paragraph contains only generic business terminology (customer information, proprietary and confidential business information) with no domain-specific cybersecurity terms, firm-specific facts, or verifiable claims.


reasoning: The paragraph describes management roles and responsibilities for cybersecurity, identifying specific positions (Senior Director of IT, CEO, General Counsel, CFO) and their duties in overseeing cybersecurity processes, budgets, and incident escalation. None of the named roles qualify as firm-specific under the rules—CEO, CFO, and General Counsel are generic governance roles, and Senior Director of Information Technology is a Director-level IT title without a security qualifier. The vocabulary uses ERM-level language (cybersecurity risk assessment, security assessments, cybersecurity incidents) rather than domain-specific cybersecurity terminology.


reasoning: This paragraph explains that as a blank check company (SPAC) with no operations, the company has no cybersecurity personnel or processes and relies entirely on third parties by default—it does not describe any substantive cybersecurity governance, management, or program. Per Rule 6, SPACs with no program are classified as None/Other, and N/O paragraphs always receive Generic Boilerplate specificity.


reasoning: The paragraph's central topic is managing cybersecurity risks from third parties (vendors, CROs, service providers, external users), directly answering how third-party cyber risks are managed. Specificity is Level 1 because the language is generic ERM-style risk management terminology that any business professional could write—no cybersecurity domain expertise, firm-specific details, or verifiable claims are present.


reasoning: This paragraph explains that the company is a SPAC with no operations and therefore has no cybersecurity program or formal processes to disclose. Per Rule 6, SPACs and no-operations companies with no program fall under None/Other. The paragraph contains only generic cybersecurity terminology that fails the ERM test (no domain expertise demonstrated), no firm-specific cybersecurity roles or structures, and the negative assertion about no incidents is not externally verifiable.


fact: SOC reports

fact: complementary controls

reasoning: The paragraph centrally addresses how the company manages third-party cybersecurity risks through pre-engagement assessments, ongoing monitoring, and annual SOC report reviews. Specificity reaches Domain-Adapted due to cybersecurity-specific terminology (SOC reports, complementary controls) that demonstrates domain expertise beyond generic ERM language.


reasoning: This paragraph describes how third-party consultants and providers are integrated into the company's cybersecurity program, which falls under RMP per Rule 3 (third parties hired to serve the company). The language is entirely generic—'cyber risk advisory' and 'industry recognized cybersecurity providers' do not demonstrate domain expertise beyond what an ERM professional would use, and no firm-specific or verifiable facts are present.


fact: SomaLogic's ongoing ISO 27001 compliance certification

reasoning: The paragraph describes cybersecurity integration activities following a merger, including review of policies, procedures, and tools for the combined cybersecurity environment, which fits Risk Management Process. The claim about SomaLogic's ISO 27001 certification is externally verifiable through certification registries, elevating specificity to Level 4.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party providers through reports and ongoing monitoring, fitting Third-Party Risk. The language is entirely generic vendor oversight terminology that any ERM professional would use, with no domain-specific security practices, named standards, firm-specific details, or verifiable claims.


fact: information security practices and protocols

fact: cybersecurity breaches

fact: cyber and information security control environment

fact: intrusion to their systems

reasoning: The paragraph is entirely focused on how the company manages vendor cybersecurity risks through assessments, tiered categorization, due diligence questionnaires, and incident response procedures, making Third-Party Risk the clear category. Specificity is Domain-Adapted because the paragraph uses cybersecurity-specific terminology (information security control environment, cybersecurity breaches, intrusion) that demonstrates domain expertise beyond generic ERM language, but contains no firm-specific organizational facts or verifiable claims.


reasoning: This paragraph describes external regulatory requirements (financial privacy laws, federal banking agency oversight, SEC disclosure rules) rather than the company's actual cybersecurity program, governance structure, or processes. The SEC rule effective date of December 18, 2023 and four-business-day disclosure requirement are facts about external regulations applicable to all public companies, not facts about this company's cybersecurity posture, so no facts elevate specificity above Level 1.


reasoning: The paragraph describes the oversight chain from monitoring through management to the Audit Committee and Board, answering how the board oversees cybersecurity. No domain-specific terminology passes the ERM test, and all governance bodies mentioned (Audit Committee, Board) are generic roles that exist at every public company.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a backward-looking materiality assessment that no incidents have materially affected business outcomes, followed by forward-looking risk speculation. No domain terminology passes the ERM test (threat actors is generic risk language), no firm-specific facts are present, and the negative assertion about absence of incidents is not externally verifiable.


reasoning: The paragraph describes the Audit Committee's responsibility to report cybersecurity risks to the Board and the Board's annual review of material cybersecurity risks, which directly answers how the board oversees cybersecurity. No domain-specific terminology, firm-specific facts, or verifiable claims are present—only generic governance language (Audit Committee, Board of Directors, annual review) that exists at every public company.


fact: privileged access policies

fact: multi-factor authentication

reasoning: The paragraph primarily describes security measures implemented (privileged access policies, multi-factor authentication), answering what the cybersecurity program does. The incident reference is contextual, and the forward-looking disclaimer and cross-reference are secondary. Specificity is Domain-Adapted due to cybersecurity-specific terminology that passes the ERM test.


reasoning: This paragraph makes backward-looking materiality assessments about cybersecurity's impact on business outcomes and the absence of material incidents, which fits Strategy Integration under Rule 5. The paragraph contains no domain terminology passing the ERM test, no firm-specific facts, and no verifiable claims—the negative assertions about not experiencing incidents are self-reported and cannot be independently verified.


fact: 26 BTC stolen

fact: approximately $560,000 value at time of theft

fact: US Federal law enforcement engaged for recovery

fact: Gryphon (named entity) engaged law enforcement via counsel

fact: Sphere 3D Corp. CFO impersonated in attack

fact: Sphere 3D CEO involved in email exchange

fact: Company's former CEO involved in email exchange

reasoning: This paragraph describes an actual cybersecurity incident—a business email compromise where a threat actor impersonated a CFO and caused 26 BTC to be transferred to a fraudulent wallet. It provides specific details about the nature, timing, scope, and impact of the incident, as well as the response efforts. The specificity reaches Level 4 due to multiple verifiable facts: the exact amount stolen (26 BTC), the dollar value at the time (~$560,000), and the engagement of US Federal law enforcement—all of which could be independently verified through blockchain records and law enforcement records.


reasoning: This paragraph is pure speculative risk disclosure language describing hypothetical harms that 'could' occur from cyberattacks, without describing any actual cybersecurity measures, processes, governance, or assessments. Under Rule 5, 'could have a material adverse effect' is speculation that appears in virtually every 10-K and does not constitute a Strategy Integration assessment.


reasoning: This paragraph describes the board oversight structure for cybersecurity (Board delegates to Audit Committee, which receives updates from CFO), which is a classic Board Governance disclosure. The specificity is Generic Boilerplate because all mentioned roles (Board, Audit Committee, CFO) are generic governance positions that exist at every public company, and the language uses standard ERM terminology without demonstrating cybersecurity domain expertise.


reasoning: The paragraph directly addresses how the company manages third-party cyber risks by describing their process for assessing vendor data protection practices, which fits the Third-Party Risk category. The language is entirely generic ERM-style vendor oversight terminology with no domain-specific security concepts, firm-specific organizational details, or verifiable claims.


fact: CFO has been responsible for oversight function for three years

fact: CFO has worked in financial services industry for more than 30 years

fact: CCO has been serving since April 2025

fact: CCO has worked in financial services industry for more than 35 years

reasoning: The paragraph describes management's organizational structure for cybersecurity oversight, specifically the CFO and CCO's responsibilities, their reliance on the Adviser's IT staff and consultants, and their qualifications and experience. This directly answers 'How is management organized to handle cybersecurity?'


fact: Chief Information Officer

reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers, including pre-engagement security assessments and ongoing monitoring—this is classic Third-Party Risk content. Specificity reaches Level 3 due to the mention of the Chief Information Officer, a firm-specific leadership role; the remaining language (security assessments, ongoing monitoring, data breaches) is generic and does not demonstrate domain expertise or contain verifiable claims.


fact: Global Corporate Continuity Program

fact: penetration testing

fact: forensic analysis

fact: NIST framework

reasoning: The paragraph primarily describes FRI's approach to managing cybersecurity risks from third parties (vendors, service providers, counterparties, clients), including their risk-based oversight approach, due diligence process, and integration with their broader framework. While it also mentions penetration testing and forensic analysis (RMP content per Rule 3), the third-party risk management content spans multiple detailed sentences and is the central topic. Specificity reaches Level 3 due to the named internal program 'Global Corporate Continuity Program', with Level 2 domain terms including 'penetration testing', 'forensic analysis', and 'NIST framework'.


fact: CTO

fact: CISO

fact: internal working group

reasoning: This paragraph describes the qualifications and credentials of cybersecurity leadership (CTO, CISO) and team members, directly answering how management is organized for cybersecurity. The presence of named VP-level roles (CTO, CISO) and a named internal team structure establishes Firm-Specific specificity.


fact: CCDC

reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from vendors and suppliers through a formal Vendor Management Program with due diligence, requirements, and ongoing monitoring, making Third-Party Risk the appropriate category. The named committee 'CCDC' is a firm-specific fact that distinguishes this company's governance structure.


reasoning: The paragraph primarily addresses how the company manages cybersecurity risks from third-party service providers, including monitoring threats at vendors, incorporating cybersecurity into vendor selection, and maintaining a Board-approved vendor management policy. The language uses generic risk management terminology without cybersecurity domain expertise (no specific tools, practices, or frameworks), no firm-specific facts (Cybersecurity Program Manager is below Director level), and no verifiable claims.


fact: Form 8-K filed on February 29, 2024

fact: PBI

fact: approximately 2.5 million to 2.7 million policyholders' or other customers' personal information exposed

fact: social security numbers exposed

fact: DSCP (named internal program)

fact: threat actor

fact: MOVEit Cybersecurity Incident

reasoning: This paragraph primarily describes an actual cybersecurity incident (MOVEit), including its scope, investigation, and impact, which answers 'What happened in a cybersecurity incident?' The specificity reaches Level 4 due to multiple verifiable facts: a specific SEC filing date (February 29, 2024), a named third-party firm (PBI), and quantified impact numbers (2.5-2.7 million records exposed).


fact: $14.3 million of costs

fact: forensic investigation

reasoning: The paragraph primarily describes an actual cybersecurity incident with specific timing, investigation, and conclusion, making it Incident Disclosure with the incident frame dominant over the financial impact discussion. Specificity is Quantified-Verifiable due to the specific incident date (July 23, 2023) and exact cost figure ($14.3 million), both externally verifiable.


reasoning: The paragraph describes the company's third-party vendor management program for cybersecurity risks, with vendor oversight as the central topic. The language uses generic risk management terminology without demonstrating cybersecurity domain expertise or providing firm-specific details that would elevate specificity above Level 1.


reasoning: This paragraph is a definitional statement explaining what 'cybersecurity threat' means, rather than answering any of the six substantive questions about governance, management, processes, third-party risk, incidents, or strategy. Per the rules, None/Other paragraphs always receive Generic Boilerplate specificity regardless of terminology present.


reasoning: This paragraph describes board-level oversight structure, specifically how the Board delegates cybersecurity risk oversight to the Audit Committee, which is the classic Board Governance pattern. The paragraph contains only generic governance language (Board of Directors, Audit Committee, cybersecurity program, risks and mitigations) with no domain-specific terminology, firm-specific facts, or verifiable claims.


fact: vulnerability management

reasoning: This paragraph describes the oversight structure—CEO direction of cybersecurity programs and Audit Committee receiving regular updates—which is classic board governance content per Rule 1. Specificity is Level 2 due to the domain term 'vulnerability management' which demonstrates cybersecurity expertise beyond generic ERM language.


reasoning: The paragraph primarily provides a materiality assessment stating that no cybersecurity incidents have materially affected the company, which per Rule 5 is a Strategy Integration negative assertion. No specific facts elevate specificity above Level 1: 'Business Continuity' and 'Incident Response' are explicitly listed as failing the ERM test, and the negative assertion about no material incidents is not externally verifiable.


reasoning: This paragraph is general risk awareness language describing reliance on information systems and acknowledging cybersecurity threats exist, without answering any of the six substantive disclosure questions; as a None/Other paragraph, it receives Generic Boilerplate specificity per the rules.


fact: Cyber Risk Committee (named management-level committee)

fact: CIO (VP-level role)

fact: more than twenty years of experience as an information technology professional

fact: CIO since 2007

reasoning: The paragraph primarily describes management's organizational structure for cybersecurity oversight, including the Cyber Risk Committee composition and CIO role/responsibilities, which answers 'How is management organized to handle cybersecurity?' Specificity reaches Level 4 due to verifiable claims about the CIO's tenure ('since 2007') and experience ('more than twenty years').


reasoning: This paragraph contains only vague forward-looking language about periodic meetings without specifying what cybersecurity topic is being addressed or what the 'fluid situation' refers to, making it procedural boilerplate rather than substantive disclosure answering any of the six key questions.


fact: email spoofing

fact: Chief Information Security Officer

fact: 10:25 p.m., local Hong Kong SAR time

reasoning: This paragraph describes a specific cybersecurity incident (email spoofing) with detailed timeline, financial impact, and remediation actions, which directly answers 'What happened in a cybersecurity incident?' The specificity reaches Level 4 due to multiple verifiable facts including the exact dollar amount ($30,825), specific dates (April 9, 2024; March 27, 2024; April 11, 2024; April 12, 2024), and precise time (10:25 p.m. Hong Kong SAR time).


fact: ransomware

fact: denial-of-service

reasoning: This paragraph is speculative threat acknowledgment language without substantive disclosure about governance, management structure, risk processes, or actual incidents—standard boilerplate that appears in nearly every 10-K. The specificity reaches Domain-Adapted because ransomware and denial-of-service are cybersecurity-specific threat types that demonstrate domain knowledge beyond generic ERM language.


fact: system scans

fact: threat intelligence analysis

reasoning: The paragraph primarily describes cybersecurity program activities (employee training, system scans, threat intelligence) with third-party support, which is RMP content; the contractual requirements on vendors (TP) are secondary. Specificity reaches Level 2 due to domain terminology like 'system scans' and 'threat intelligence analysis' that demonstrate cybersecurity expertise beyond generic ERM language.


fact: penetration testing

fact: vulnerability scanning

reasoning: The paragraph describes cybersecurity program activities—workforce training, penetration testing, vulnerability scanning, and remediation processes—which directly answers 'what does the cybersecurity program do?' Domain terms like penetration testing and vulnerability scanning pass the ERM test and demonstrate cybersecurity expertise beyond generic risk language.


fact: IASME Cyber Essentials framework

fact: NCSC (National Cyber Security Centre)

fact: NIST framework

reasoning: This paragraph describes the company's cybersecurity assessment methodology and framework adoption, answering 'What does the cybersecurity program do?' — the core question for Risk Management Process. Specificity reaches Level 2 because the paragraph demonstrates cybersecurity domain expertise through specific named frameworks (IASME Cyber Essentials, ISO 27001, NIST) and the UK NCSC, but the hedged language ('based on,' 'understanding of') stops short of firm-specific claims or verifiable certifications.


reasoning: The paragraph's central topic is vendor oversight—describing pre-engagement security assessments and ongoing monitoring of third-party providers to mitigate risks from external sources—which directly answers how third-party cyber risks are managed. Specificity is Level 1 because the language ('security assessments,' 'ongoing monitoring,' 'data breaches,' 'security incidents') consists of general business terms that any ERM professional would naturally use; no domain-specific practices, tools, or standards are named.


fact: Chief Information Officer (CIO)

fact: more than 20 years of experience in information and operational technology

reasoning: This paragraph describes management organization for cybersecurity—identifying the CIO as the responsible leader and detailing their qualifications—which directly answers 'How is management organized to handle cybersecurity?' The CIO title is firm-specific (Level 3), and 'more than 20 years of experience' is a quantified lower bound verifiable against the individual's professional history (Level 4).


fact: vice president of information technology services

reasoning: The paragraph describes board and audit committee oversight structure, including how cybersecurity information flows to the board through senior leadership updates. The VP-level IT role is firm-specific, but no externally verifiable facts are present.


fact: managed service provider

reasoning: The paragraph centrally addresses how the company manages third-party cyber risks through due diligence, continuous monitoring, aligned protocols, and scheduled meetings with service providers. Specificity is Domain-Adapted based on 'managed service provider' which is a cybersecurity-specific term that would not naturally be used by a non-security ERM professional.


reasoning: This paragraph contains only general commitment language, risk acknowledgments, and a definition of cybersecurity threats without describing any substantive governance structure, management roles, risk management processes, third-party oversight, actual incidents, or materiality assessments. None/Other paragraphs receive Generic Boilerplate specificity by rule.


fact: attack vectors

reasoning: The paragraph primarily describes what the cybersecurity program does—risk identification, monitoring, mitigation activities, ERM integration, and quarterly expert briefings—which answers the question 'What does the cybersecurity program do?' The term 'attack vectors' demonstrates cybersecurity domain expertise that would not naturally be used by a non-security ERM professional, elevating specificity to Domain-Adapted.


reasoning: This paragraph is a generic recognition statement that does not answer any of the six substantive questions—it merely acknowledges the importance of cybersecurity without describing governance, management roles, processes, third-party risk, incidents, or strategy integration. The language is entirely boilerplate with no domain-specific terminology beyond the basic CIA triad (confidentiality, integrity, availability), no firm-specific facts, and no verifiable claims.


reasoning: The paragraph is a materiality assessment stating that no material cybersecurity incidents occurred during fiscal year 2025, which falls under Strategy Integration per Rule 5 (negative assertion about business impact). The specificity is Generic Boilerplate because the negative assertion about absence of incidents is not externally verifiable, 'fiscal year 2025' is reporting period context rather than a cybersecurity fact, and no domain terminology, firm-specific roles, or quantified verifiable claims are present.


reasoning: The paragraph primarily describes the Board's role in establishing cybersecurity oversight, noting the Board was reshaped after an Acquisition and will develop, adopt, and implement a cybersecurity risk management program. While it touches on strategy elements (not collecting personal data, investing in measures), the Board's governance role is the central thread. The paragraph contains no domain-specific terminology passing the ERM test, no firm-specific cybersecurity facts, and no verifiable claims—only generic governance language and future intentions.


reasoning: The paragraph's central topic is vendor cybersecurity oversight—describing pre-engagement evaluation and SOC report requests—which directly answers how third-party cyber risks are managed. Specificity is Domain-Adapted because 'System and Organization Controls reports' demonstrates cybersecurity/IT audit domain expertise beyond generic ERM language.


fact: ransomware attack

fact: self-hosted environment

reasoning: This paragraph describes an actual cybersecurity incident (ransomware attack in May 2020) including its nature, timing, and ongoing legal consequences, which directly answers 'What happened in a cybersecurity incident?' The specific date 'May 2020' tied to the ransomware attack is an externally verifiable fact, elevating specificity to Level 4.


fact: posture and intelligence reviews

reasoning: The paragraph centrally addresses vendor cybersecurity oversight through monitoring services, posture reviews, security evaluations of critical vendors, and embedding controls in service level agreements—clearly answering how third-party cyber risks are managed. Specificity reaches Level 2 due to domain terminology like 'open-source intelligence risk assessments' and 'posture and intelligence reviews' that demonstrate cybersecurity expertise beyond generic ERM language.


fact: May 2025 - specific date of incident detection

fact: DNS - domain terminology

fact: data exfiltration - domain terminology

fact: unauthorized changes to domain, DNS, and email configurations via former employee credentials - firm-specific incident details

reasoning: This paragraph describes a specific cybersecurity incident with nature (unauthorized domain/DNS/email configuration changes), cause (former employee credentials), impact (email-routing disruption), and remediation timeline (contained same day), clearly answering 'what happened in a cybersecurity incident.' Specificity reaches Level 4 due to the specific date 'May 2025' tied to a real incident, which is externally verifiable; the paragraph also contains domain terminology (DNS, data exfiltration) and firm-specific incident details.


fact: May 2014 - specific date of email spoofing incident

fact: email spoofing - domain terminology for attack type

reasoning: This paragraph describes an actual cybersecurity incident (email spoofing attack in May 2014), making it Incident Disclosure. The specific date 'May 2014' tied to a real event is a verifiable fact, and 'email spoofing' is domain terminology demonstrating cybersecurity expertise.


reasoning: The paragraph describes the cybersecurity risk management program's structure and activities (integration with ERM, assessments, team responsibilities, external providers), answering 'what does the program do?' → RMP. All terminology is generic business/ERM language (assessments, security controls, incident response, external service providers) that fails the ERM test for domain expertise, with no firm-specific organizational details or verifiable facts.


reasoning: This paragraph describes board-level oversight structure, specifically how the Board delegates cybersecurity oversight to the Audit Committee and receives reports from management, which directly answers the question of how the board oversees cybersecurity. The specificity is Generic Boilerplate because all mentioned elements (Board of Directors, Audit Committee, periodic reports, management updates) are standard governance structures that exist at every public company, with no domain-specific terminology, firm-specific details, or verifiable facts.


reasoning: This paragraph is a materiality assessment under SEC Item 106(b)(2), stating conclusions about whether cybersecurity risks have materially affected or are reasonably likely to materially affect business outcomes, which fits Strategy Integration per Rule 5. The paragraph contains only generic risk acknowledgment language and negative self-assertions that are not externally verifiable, with no domain-specific terminology passing the ERM test or firm-specific facts.


fact: December 13, 2023 - date forensic investigation completed

fact: November 20, 2023 - last confirmed date of unauthorized third-party activity

fact: malware that is not self-propagating

reasoning: This paragraph describes an actual cybersecurity incident with specific timeline details (investigation completion date, last unauthorized activity date), nature of the attack (malware deployment, data exfiltration), and impact assessment, which directly answers 'What happened in a cybersecurity incident?' The presence of two specific dates tied to real events makes this Quantified-Verifiable, as these are hard facts that could be independently verified through investigation records or regulatory filings.


fact: Executive Vice President of Technology

fact: reports directly to the Chief Executive Officer

fact: over 16 years of experience managing information technology and cybersecurity matters

reasoning: The paragraph primarily answers 'How is management organized to handle cybersecurity?' by introducing the EVP of Technology, their reporting line to the CEO, their qualifications (16+ years experience), and their responsibility for assessing and managing cyber risks. The materiality assessment statement (SI content) is secondary and largely boilerplate SEC requirement language. Specificity reaches Level 4 due to the 'over 16 years of experience' claim—a hard number that sets a verifiable lower bound checkable against the individual's resume.


fact: CISO

fact: joined Workday in 2010

fact: served as CISO since April 2018

fact: more than 15 years of experience in cybersecurity and information technology risk management

reasoning: This paragraph describes the CISO's leadership role, responsibilities, tenure, and qualifications, directly answering how management is organized for cybersecurity. Specificity reaches Level 4 due to multiple verifiable facts: specific employment dates (2010, April 2018) and a quantified experience claim (more than 15 years) that can be independently checked.


fact: December 13, 2023 (forensic investigation completion date)

fact: November 20, 2023 (last confirmed date of unauthorized activity)

fact: exfiltrated

reasoning: This paragraph describes an actual cybersecurity incident with specific details about nature (malware deployment, data exfiltration), timing (last unauthorized activity November 20, 2023; investigation completed December 13, 2023), and impact scope, directly answering 'What happened in a cybersecurity incident?' Specificity is Quantified-Verifiable due to two hard dates tied to specific events that could be externally verified.


fact: Information Technology Committee

reasoning: The paragraph describes Board oversight of cybersecurity, including the governance structure (Board and IT Committee involvement), information flow (monthly updates with metrics and trends), and Board activities (reviewing and approving risk assessments and policies). The named 'Information Technology Committee' is a non-universal committee structure that distinguishes this company's governance, elevating specificity to Firm-Specific.


fact: management committee on cybersecurity

reasoning: This paragraph describes management-level organizational structure for cybersecurity oversight, including the Senior Director and Head of IT's responsibilities and the management committee on cybersecurity, answering how management is organized to handle cybersecurity. The 'management committee on cybersecurity' is a firm-specific committee that distinguishes this company's governance structure, elevating specificity to Level 3.


reasoning: This paragraph is purely a cross-reference directing readers to risk factors in Item 1A, with no substantive cybersecurity disclosure about governance, management, processes, or incidents. None/Other paragraphs receive Generic Boilerplate specificity by definition, as they contain no verifiable or firm-specific facts about the company's cybersecurity posture.


reasoning: This paragraph contains a backward-looking materiality assessment stating the company has not experienced cybersecurity incidents that materially affected business outcomes, which per Rule 5 is Strategy Integration. The specificity is Generic Boilerplate because the negative assertion about no material incidents is not externally verifiable, and no domain terminology, firm-specific facts, or quantified claims are present.


reasoning: This paragraph describes what the cybersecurity program does—evaluating and improving security posture—answering the RMP question about program activities. The language is entirely high-level and generic; 'confidentiality, integrity, and availability' is the basic CIA triad vocabulary that does not demonstrate domain expertise beyond what any business professional might know, and there are no firm-specific or verifiable facts.


fact: ransomware

fact: threat actors

reasoning: The paragraph opens with a backward-looking materiality assessment stating no cybersecurity incidents have materially impacted the Company's business strategy, results of operations, or financial conditions, which per Rule 5 is a Strategy Integration conclusion. The domain terminology 'ransomware' and 'threat actors' demonstrates cybersecurity expertise beyond generic ERM language, establishing Level 2 specificity.


reasoning: This paragraph describes the Board's oversight structure for cybersecurity risk, including delegation to the Audit Committee, which directly answers how the board oversees cybersecurity. The language is entirely generic business governance terminology with no domain-specific cybersecurity expertise, firm-specific roles beyond standard corporate governance positions, or verifiable claims.


fact: Chief Information Security Officer (CISO)

fact: penetration test

reasoning: This paragraph describes the Board's oversight structure for cybersecurity, including the Board's ultimate oversight role, the Information Technology Committee's review responsibilities, and how information flows from the CISO to the Board and Committee. The presence of a named committee (Information Technology Committee) and a named cybersecurity leadership role (CISO) elevates specificity to Firm-Specific, with 'penetration test' providing domain terminology.


fact: Chief Operating Officer

fact: Chief Compliance Officer

reasoning: The paragraph describes management's organizational responsibility for cybersecurity, specifically naming the COO and CCO as responsible for assessing and managing cybersecurity risks, which directly answers how management is organized to handle cybersecurity. Specificity reaches Firm-Specific because two C-level executives with cybersecurity responsibility are named, distinguishing this company's governance structure from generic disclosures.


reasoning: The paragraph primarily answers how management is organized to handle cybersecurity, describing internal leadership's responsibilities and coordination with an external IT specialist—this is about roles and organizational structure (MR), not specific program activities. No domain terms pass the ERM test (incident response planning, business continuity, and operational risk mitigation are generic ERM concepts), no firm-specific facts are present (external IT specialist is unnamed), and no verifiable claims exist.


fact: Cybersecurity Committee

fact: ten years of cybersecurity experience

fact: thirty-five years of experience in various technology domains

reasoning: This paragraph describes management-level organizational structure for cybersecurity oversight, including a named Cybersecurity Committee and a senior IT executive with detailed qualifications and experience credentials. Specificity reaches Level 4 due to verifiable quantified claims about the executive's experience (10 years cybersecurity, 35 years technology domains), plus the firm-specific Cybersecurity Committee.


fact: Technology Committee of our Board

reasoning: This paragraph describes Board-level oversight structure, including the Board's responsibility for information security program oversight and the Technology Committee's role in approving policies and monitoring implementation, which directly answers how the board oversees cybersecurity. The Technology Committee is a named, non-generic Board committee that distinguishes this company's governance structure from companies with only standard Audit Committee oversight.


reasoning: This paragraph is primarily a risk acknowledgment that describes potential cybersecurity threats and their possible consequences, with only a single generic sentence about monitoring activities. It does not substantively answer any of the six category questions—the monitoring reference is too vague to qualify as a Risk Management Process disclosure, and the material adverse effect language is speculative rather than an actual assessment. The paragraph ends with a cross-reference to Risk Factors, indicating the real disclosure is elsewhere.


fact: October 28, 2023 incident announcement date

fact: mid-December 2023 operational recovery

fact: $1.5 million in incident-related expenses

fact: first quarter of fiscal 2024 timing for expenses

reasoning: The paragraph primarily describes a specific cybersecurity incident announced on October 28, 2023, including its operational impact, recovery timeline, and financial costs—answering 'What happened in a cybersecurity incident?' The incident frame is dominant over the materiality assessment and strategy mentions. Specificity is Level 4 due to multiple verifiable facts: specific dates tied to the incident and a quantified expense amount.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers through contractual requirements, which directly answers the third-party risk question. The language is generic vendor oversight terminology that any ERM professional would use—no cybersecurity domain expertise, firm-specific details, or verifiable claims are present.


reasoning: The paragraph is a materiality assessment stating that no cybersecurity risks have materially affected or are reasonably likely to materially affect the company's business strategy, results of operations, or financial condition, which fits Strategy Integration under Rule 5. The language is entirely generic risk boilerplate without domain-specific terminology, firm-specific facts, or verifiable claims—just a negative self-assertion and standard risk factor cross-reference.


fact: October 28, 2023 - date incident was announced

fact: first quarter of fiscal 2024 - period when shipping was affected

fact: mid-December 2023 - recovery timeline for all facilities

fact: $1.5 million of expenses related to the cybersecurity incident

reasoning: This paragraph primarily describes a specific cybersecurity incident with timeline (October 2023 discovery, mid-December recovery), operational impact (shipping delays in Q1 fiscal 2024), and quantified financial impact ($1.5 million in expenses), making it Incident Disclosure under Rule 4. Specificity is Quantified-Verifiable due to multiple externally verifiable facts including specific dates and a precise dollar amount.


fact: Annual IT Program Status Report

fact: Cybersecurity Risk Assessment

fact: Vendor Management Risk Assessment

fact: Internal Vulnerability Reports

fact: Cyber Events briefings

fact: IT Risk Assessment

reasoning: This paragraph describes the Board-level Risk Management Committee's oversight responsibilities for cybersecurity, including what reports it receives and its decision-making authority, which directly answers how the board oversees cybersecurity. Specificity reaches Level 3 due to the named internal report 'Annual IT Program Status Report' that is unique to this company, while domain terminology like 'Cybersecurity Risk Assessment,' 'Internal Vulnerability Reports,' and 'Cyber Events briefings' demonstrate cybersecurity expertise at Level 2.