fact: encryption

fact: data loss prevention technology

fact: authentication technology

fact: entitlement management

fact: access control

fact: anti-virus and anti-malware software

fact: transmission of data over private networks

fact: National Institute of Standards and Technology Cybersecurity Framework

reasoning: This paragraph describes the company's cybersecurity risk management processes, including specific security technologies deployed and the NIST CSF framework that informs the program. The specificity is Domain-Adapted due to multiple cybersecurity-specific terms (encryption, data loss prevention, authentication, entitlement management, anti-malware) and the named NIST CSF framework that demonstrate domain expertise beyond generic ERM language.


content_category: Risk Management Process

fact: security controls

fact: cybersecurity awareness training

fact: cybersecurity incident response plan

fact: data leakage

fact: unauthorized access

category_confidence: high

specificity_confidence: high

reasoning: The paragraph describes the key elements of the cybersecurity risk management program, answering what the program does through its listed components. Specificity is Domain-Adapted because the paragraph uses cybersecurity-specific terminology (security controls, cybersecurity awareness training, data leakage, unauthorized access) that demonstrates domain expertise beyond generic ERM language.

provider: z-ai

stage: benchmark


content_category: Management Role

fact: CISO role

fact: Enterprise Risk Committee (ERC)

fact: Operational Risk Committee (ORC)

fact: 17 years of experience at a major banking institution

fact: Bachelor of Science in Electrical Engineering and Mathematics from the University of Texas at Arlington

fact: CISSP certification

reasoning: This paragraph describes management-level organizational structure for cybersecurity oversight, including the ERC and ORC committees and the CISO's role, responsibilities, and qualifications—answering 'How is management organized to handle cybersecurity?' The specificity reaches Level 4 due to multiple verifiable claims: the CISO's 17 years of experience, specific degree from UT Arlington, and CISSP certification are all externally verifiable facts.


content_category: Strategy Integration

reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a backward-looking materiality assessment that no cybersecurity incidents have materially adversely affected business strategy, results of operations, or financial condition. No domain terms pass the ERM test (cyber attacks, information security, cybersecurity risk are all terms any ERM professional would use), no firm-specific facts are present, and the negative assertion about absence of material impact is not externally verifiable.


fact: Chief Information Security Officer

reasoning: The paragraph primarily describes management's organizational structure for cybersecurity, focusing on the CISO's role, coordination with management, and multidisciplinary teams. The CISO is a firm-specific named role that distinguishes this company's cybersecurity leadership structure.


reasoning: The paragraph primarily states a backward-looking materiality assessment that past cybersecurity incidents have not materially affected business strategy, results of operations, or financial condition, which falls under Strategy Integration per Rule 5. The language is entirely generic with no domain-specific terminology passing the ERM test, no firm-specific facts, and the negative assertion about material impact is not externally verifiable.


reasoning: This paragraph describes the company's incident response process—initial assessment, cross-functional team meetings, and materiality evaluation—which answers 'What does the cybersecurity program do?' The language is generic business risk management terminology that any ERM professional would use; it lacks cybersecurity-specific domain terms, firm-specific roles or committees, and any verifiable claims.


content_category: Board Governance

fact: Vice President of IT

fact: Information Security Manager

fact: United States Computer Emergency Readiness Team alerts

reasoning: This paragraph describes the governance chain—how cybersecurity oversight flows from the Information Security Manager through the VP of IT and CFO to the Board with specified reporting cadences—making it Board Governance. The specificity reaches Level 3 due to firm-specific roles (Vice President of IT, Information Security Manager) and Level 2 domain terminology (US-CERT alerts).


fact: ISO 27001:2022 information security standard

type: framework

fact: Security Operations Center (SOC)

fact: Ferguson maintains a Security Operations Center

reasoning: This paragraph describes the company's cybersecurity program activities including risk assessment methodology, framework adoption, and security operations, which directly answers 'What does the cybersecurity program do?' The ISO 27001:2022 framework reference and SOC terminology demonstrate domain expertise (Level 2), while the firm-specific claim that Ferguson maintains a SOC elevates this to Level 3.


content_category: Third-Party Risk

fact: vulnerability scans

reasoning: This paragraph centrally addresses how the company manages cybersecurity risks from third-party providers, detailing vendor assessment processes and contractual requirements imposed on vendors—clearly Third-Party Risk under Rule 3. Specificity reaches Level 2 due to 'vulnerability scans,' a technical cybersecurity practice that passes the ERM test; the remainder consists of generic vendor management language any ERM professional could write.


fact: Randy Jepsen

fact: over 25 years of experience in the IT industry

type: quantified

fact: 19 years at Smith Douglas and The SMART Builder Solutions

fact: Russell Devendorf

reasoning: This paragraph primarily answers how management is organized for cybersecurity by describing leadership roles (VP of IT, CFO), naming the individuals in those roles, and detailing their qualifications and career history. Specificity reaches Level 4 due to multiple verifiable facts: named individuals (Randy Jepsen, Russell Devendorf), quantified experience claims ('over 25 years', '19 years'), and specific date ranges ('2008 to 2017').


reasoning: This paragraph describes the cybersecurity program's risk identification process and employee training procedures, answering what the program does. The language is generic risk management terminology that any ERM professional could write—'internal threats,' 'cybersecurity program,' and 'onboarding and annually' training cadence do not demonstrate cybersecurity domain expertise or contain firm-specific or verifiable facts.


fact: data breaches

reasoning: The paragraph primarily describes third-party cybersecurity risk management processes including pre-engagement security assessments and ongoing monitoring, which directly answers how third-party cyber risks are managed. Specificity is Domain-Adapted due to the use of 'data breaches' as cybersecurity-specific terminology that passes the ERM test; 'Cybersecurity Manager' is below VP/Director level and does not qualify as firm-specific, and 'quarterly assessments' is a generic cadence.


reasoning: This paragraph describes the information flow from management to the Audit Committee, including briefing frequency and scope of reports, which directly answers how the board committee oversees cybersecurity. The language is generic oversight terminology that any business professional could write—terms like 'incident response plans,' 'threat landscape,' and 'breaches' describe cybersecurity as a topic but do not demonstrate domain expertise in how cybersecurity actually works, and there are no firm-specific facts or verifiable claims.


fact: CISSP certification held by management team members

fact: CCNP certification held by management team members

fact: CISA certification held by management team members

fact: CySA+ certification held by management team members

reasoning: This paragraph describes the qualifications and credentials of the management team responsible for cybersecurity, which directly answers the Management Role question about how management is organized. The specificity reaches Level 4 because the named certifications (CISSP, CCNP, CISA, CySA+) are specific credentials that can be independently verified through their respective certification bodies' registries.


fact: VP of IT

fact: over 24 years of experience in information technology and information security

fact: Chief Information Security Officer

fact: cyber emergency response team

fact: NVP of Finance

fact: Cybersecurity Response Committee

fact: over 50 years of collective experience

reasoning: This paragraph describes the qualifications, credentials, and career history of specific management roles (VP of IT, NVP of Finance) and a named committee (Cybersecurity Response Committee), which directly answers how management is organized to handle cybersecurity. Specificity reaches Level 4 due to two verifiable quantified claims: over 24 years of individual experience and over 50 years of collective experience, both of which are lower bounds that could be checked against resumes or employment records.


category_confidence: medium

reasoning: The paragraph contains a negative assertion about incident history ('To date, we have not had a cybersecurity incident'), which per Rule 5 constitutes a Strategy Integration materiality assessment. The detection and prevention language is generic RMP content but secondary to the overall risk acknowledgment framing. No domain terminology passes the ERM test, no firm-specific facts appear, and the negative incident assertion is not externally verifiable, resulting in Generic Boilerplate specificity.


fact: CISO

fact: CIO

fact: CCO

fact: Morgan Stanley's Cybersecurity Program

reasoning: This paragraph describes Board oversight of cybersecurity risks, including who provides updates (CCO, CIO, CISO, Operational Risk functions) and what topics are covered. Specificity reaches Level 4 due to the named third party Morgan Stanley whose Cybersecurity Program is referenced, plus Level 3 firm-specific roles (CISO, CIO, CCO).


fact: dedicated management-level cybersecurity risk committees

fact: Non-Financial Risk Committee

fact: Head of Operational Risk

fact: Firm Risk Committee

fact: BOTC

reasoning: The paragraph primarily describes management-level committee structure, composition, and reporting lines for cybersecurity oversight, fitting Management Role; specificity reaches Firm-Specific due to multiple named non-generic committees (Non-Financial Risk Committee, Firm Risk Committee, BOTC) and named leadership roles (CIO, Head of Operational Risk) that distinguish this company's organizational structure.


fact: Risk Committee

specificity_confidence: medium

reasoning: The paragraph describes how cybersecurity information flows to the board—management provides regular updates, quarterly briefings on material cyber events, an annual program overview, and the board reviews the enterprise risk assessment—answering the Board Governance question of how the board oversees cybersecurity. Specificity reaches Firm-Specific because 'Risk Committee' is a named committee that not every company has, distinguishing this disclosure from generic boilerplate, though no domain-specific terminology or verifiable facts are present.


fact: fiscal year ended September 30, 2025

fact: physical break-in through a firemen's access conduit

reasoning: The paragraph primarily describes the incident response plan's structure and components, which is a risk management process; the materiality statement and physical break-in are secondary. Specificity reaches Level 4 due to the verifiable fiscal year end date (September 30, 2025) anchoring the physical incident disclosure.


fact: executive risk committee comprised of CFO, Chief Legal Officer, and Senior Vice President, Engineering Operations

reasoning: The paragraph describes a management-level committee structure, membership composition, and member qualifications, which directly answers how management is organized to handle cybersecurity. The named executive risk committee with its specific three-member composition distinguishes this company's governance structure.


fact: Ann Bordelon, Chair of the Audit Committee, has cybersecurity risk management experience

fact: Paulette Dodson has cybersecurity risk management experience

fact: Noah Glass has cybersecurity risk management experience

reasoning: This paragraph describes Board and Audit Committee oversight of cybersecurity, including briefing processes and director expertise, which is classic Board Governance content. The named directors with cybersecurity experience are firm-specific facts, though the experience claim is qualitative rather than a hard verifiable certification like CISSP or a specific number of years.


fact: The Company maintains a cyber liability insurance policy

reasoning: This paragraph addresses cybersecurity insurance, which falls under Strategy Integration as a financial/business matter related to cybersecurity risk. The specificity is Firm-Specific because the company makes a specific organizational claim about maintaining a cyber liability insurance policy, which distinguishes their cybersecurity posture.


content_category: None/Other

reasoning: This paragraph is generic risk acknowledgment language that does not answer any of the six substantive questions—it merely states that cybersecurity is important and poses potential risks without describing governance, management structure, processes, third-party oversight, incidents, or strategic assessments. No domain terminology, firm-specific facts, or verifiable claims are present; the language is entirely boilerplate that any company could include.