content_category: None/Other

category_confidence: high

specificity_confidence: high

reasoning: This paragraph is a cross-reference directing readers to Item 1A Risk Factors for cybersecurity risk discussion, which does not substantively answer any of the six category questions. As a pure cross-reference with no substantive cybersecurity content, it receives Generic Boilerplate specificity.

provider: z-ai

stage: benchmark


reasoning: This paragraph is purely a cross-reference directing readers to another section of the filing (MD&A Item 7, page 86) and contains no substantive cybersecurity disclosure content.


reasoning: This paragraph is a forward-looking disclaimer stating that no program can fully protect against all risks, followed by a cross-reference to the Risk Factors section. It does not substantively answer any of the six category questions. The paragraph contains only generic language without domain expertise, firm-specific facts, or verifiable claims.


reasoning: This paragraph is a pure cross-reference directing readers to Item 1A for risk factors, containing no substantive cybersecurity disclosure about governance, management, processes, or incidents.


reasoning: This paragraph provides background context about the company's technology and data environment without describing any cybersecurity governance, processes, or risk management. It sets the stage for cybersecurity discussion but contains no substantive cybersecurity disclosure. No domain-specific, firm-specific, or verifiable facts are present—only generic descriptions of technology systems and data types that any company could state.


content_category: Incident Disclosure

fact: June 13, 2023 - specific date of incident disclosure

fact: nine days - specific duration for resuming normal operations

fact: $80 million to $85 million - specific estimated lost revenue range

fact: $35 million to $40 million - specific estimated operating earnings impact

reasoning: This paragraph describes an actual cybersecurity incident with specific timeline, response actions, and financial impact, directly answering 'What happened in a cybersecurity incident?' The incident frame is dominant over the financial impact discussion. Multiple verifiable facts including the specific incident date, duration of operational disruption, and quantified financial impact elevate specificity to Level 4.


reasoning: This paragraph is purely a cross-reference directing readers to the Risk Factors section in Item 1A, which explicitly falls under None/Other per the guidelines. It contains no substantive cybersecurity disclosure, no domain terminology that passes the ERM test, and no verifiable facts.


content_category: Board Governance

fact: Vice-President of Information Technology (VPIT)

fact: Director - Information Security (DIS)

reasoning: This paragraph describes the Board's oversight structure for cybersecurity, including how information flows from the Audit Committee and through presentations from IT/security leadership, which directly answers the Board Governance question. Specificity reaches Firm-Specific (Level 3) due to the two named leadership roles with security-relevant titles: Vice-President of Information Technology and Director - Information Security.


content_category: Strategy Integration

reasoning: This paragraph is a negative materiality assertion stating the company's conclusion that no cybersecurity incidents have materially affected or are reasonably likely to materially affect the business, which per Rule 5 constitutes Strategy Integration. The specificity is Generic Boilerplate because the negative assertion about absence of incidents is not externally verifiable (you cannot independently confirm the absence of something), and the paragraph contains no domain-specific terminology, firm-specific facts, or quantified claims.


reasoning: This paragraph describes the Board's oversight structure for cybersecurity, including delegation to the Audit Committee and the flow of information from management to the Committee and then to the full Board. The Senior Director of Governance & Information Security title contains a security qualifier, making it a firm-specific fact that distinguishes this company's cybersecurity posture.


content_category: Management Role

fact: CISO

fact: Chief Risk Officer

reasoning: This paragraph identifies the specific management roles responsible for cybersecurity risk assessment and management, answering how management is organized to handle cybersecurity. The specificity reaches Level 3 because it names firm-specific executive roles (CISO, Chief Risk Officer, Chief Information and Technology Officer) that distinguish this company's organizational structure.


content_category: Risk Management Process

fact: ransomware

fact: malware

fact: phishing attacks

fact: operational technology

fact: layered technical protective capabilities

fact: detective surveillance controls

fact: social engineering

reasoning: This paragraph describes the company's cybersecurity risk assessment program and enumerates key components of their cybersecurity program, directly answering 'What does the cybersecurity program do?' The specificity reaches Level 2 due to multiple domain-specific terms that pass the ERM test, including ransomware, malware, phishing, operational technology, and detective surveillance controls.


reasoning: This paragraph describes the board's oversight structure for cybersecurity risks, including the Audit Committee's monitoring role and management's reporting flow to the Board—classic governance-chain content. The specificity reaches Level 3 due to the firm-specific VP title (Vice President, Information Systems and Technology), which distinguishes this company's organizational structure; no verifiable claims or domain-specific terminology are present.


fact: March 2021 - specific date of cybersecurity incident

fact: $2.4 million - specific incremental one-time costs

fact: year ended December 31, 2021 - specific fiscal period for costs

reasoning: This paragraph describes an actual cybersecurity incident (March 2021 systems outage), including the nature, timing, response actions, and business/financial impact, which directly answers 'What happened in a cybersecurity incident?' The specificity reaches Level 4 due to the specific incident date (March 2021) and quantified financial impact ($2.4 million in costs), both of which are externally verifiable facts.


fact: Cybersecurity Committee - named non-generic board committee

reasoning: The paragraph primarily describes board oversight of cybersecurity through a named Cybersecurity Committee, which answers how the board oversees cybersecurity risk. The materiality assessment in the fourth sentence is secondary content. Specificity reaches Firm-Specific due to the 'Cybersecurity Committee'—a named non-generic board committee that distinguishes this company's governance structure.


reasoning: This paragraph is a negative materiality assessment stating that no cybersecurity incidents have materially affected the company, which falls under Strategy Integration per Rule 5 (backward-looking assessment of business/financial impact). The paragraph contains no domain-specific terminology, firm-specific facts, or verifiable claims—only a negative self-assertion about absence of incidents and a reporting date context, resulting in Generic Boilerplate specificity.


reasoning: This paragraph describes oversight activities (reviewing regulatory reports, monitoring emerging issues) that are characteristic of board or committee governance responsibilities. The language is generic regulatory oversight terminology that any ERM professional would use—no cybersecurity domain expertise, firm-specific details, or verifiable claims are present.


fact: Enterprise & Technology Security (E&TS) organization

fact: Chief Information Security Officer (CISO) role

fact: CSIRT team

fact: Product Security Incident Response Team (PSIRT)

fact: Business Information Security Officers (BISO) role

fact: Office of the CISO

reasoning: This paragraph describes management's organizational structure for cybersecurity—the E&TS organization, CISO role, CSIRT, PSIRT, and BISO positions—which directly answers 'How is management organized to handle cybersecurity?' The paragraph contains multiple firm-specific facts including named organizational units (E&TS, Office of the CISO), named teams (CSIRT, PSIRT), and VP-level cybersecurity roles (CISO, BISO), placing it at Level 3.


reasoning: This paragraph is a materiality assessment stating the company has not experienced any material cybersecurity incidents, which per Rule 5 constitutes a Strategy Integration conclusion. The specificity is Generic Boilerplate because the negative assertion about absence of incidents is not externally verifiable, and the paragraph contains no domain terminology, firm-specific facts, or quantified claims—only a cross-reference to risk factors.


fact: forensic investigations

reasoning: This paragraph describes the company's incident response procedures—containment, remediation, recovery, third-party engagement for forensics, notification protocols, and plan review cadence—which directly answers 'What does the cybersecurity program do?' The specificity reaches Level 2 due to 'forensic investigations,' a cybersecurity-specific practice that passes the ERM test, while no firm-specific or verifiable facts are present.


reasoning: This paragraph is a high-level commitment statement that does not answer any of the six substantive questions—it describes neither governance, management structure, risk management activities, third-party oversight, incident details, nor business impact. The language is entirely generic (IT assets, cyber assets, stakeholder data, intellectual property) with no domain-specific terminology that would pass the ERM test, no firm-specific facts, and no verifiable claims.


fact: two-factor authentication

fact: passphrases

fact: isolated computer workstations

fact: independent authorizations

reasoning: The paragraph describes the Trust's cybersecurity protocols and security measures (passwords, passphrases, two-factor authentication, isolated workstations), which answers what the cybersecurity program does—placing it in Risk Management Process. The third-party mention is incidental, noting only that counterparties have their own protocols without describing vendor risk management practices. Specificity reaches Domain-Adapted because the paragraph uses cybersecurity-specific terminology (two-factor authentication, passphrases, isolated workstations) that demonstrates domain expertise beyond generic ERM language, but contains no firm-specific roles or verifiable claims.


fact: security operations team

fact: automated event-detection notifications

reasoning: This paragraph describes the operational detection and incident response processes of the cybersecurity program—specifically how incidents are identified and what steps the incident response team takes—answering 'What does the cybersecurity program do?' The specificity reaches Level 2 due to cybersecurity domain terminology like 'security operations team' (referring to SOC function) and 'automated event-detection notifications' that demonstrate technical understanding beyond generic ERM language.


reasoning: This paragraph is a general risk context statement that does not answer any of the six substantive cybersecurity disclosure questions—it describes why the company faces cyber threats but provides no information about governance, management structure, processes, third-party management, incidents, or business impact. The language uses only generic business and risk terminology (storage, transmission, security threats, insiders) that any ERM professional would naturally use, with no domain-specific cybersecurity terms, firm-specific facts, or verifiable claims.


reasoning: The paragraph primarily answers whether cybersecurity has affected the business by stating a negative materiality assessment ('not aware of any material cybersecurity incidents'). The remainder is generic risk language and a cross-reference. Specificity is Level 1 because the negative assertion about incident absence is not externally verifiable, and the threat types listed (ransomware, phishing, malware) are common business terms that do not pass the ERM test for domain expertise.


fact: CISO

fact: Cybersecurity Executive Steering Body

reasoning: This paragraph describes the governance chain for cybersecurity oversight, showing how information flows from the CISO through the Cybersecurity Executive Steering Body to the Audit Committee of the Board. The CISO role and the named Cybersecurity Executive Steering Body are firm-specific facts that distinguish this company's oversight structure from generic disclosures.


reasoning: The paragraph concludes with a materiality assessment stating no material cybersecurity incidents have affected or are reasonably likely to affect the company, which is a backward-looking assessment under Rule 5. The preceding sentences are generic program and oversight language that don't rise to substantive disclosure. Specificity is Level 1 because the paragraph contains no domain terminology passing the ERM test, no firm-specific facts (Board and management are generic roles), and the negative assertion about incidents is not externally verifiable.


reasoning: The paragraph opens with a materiality assessment stating that cybersecurity threats have not materially affected and are not reasonably likely to affect business outcomes, which directly answers the Strategy Integration question about business/financial impact. Specificity is Generic Boilerplate because the paragraph contains only negative assertions (not externally verifiable), generic risk language, and vague references to 'frequently updates' and 'investments' without any domain-specific terminology, firm-specific facts, or quantified claims.


fact: Enterprise Cybersecurity Management Review Group (Enterprise Cybersecurity MRG)

fact: Chief Information Security Officer

reasoning: This paragraph describes a management-level steering committee (MRG), its composition, and its responsibilities for cybersecurity oversight, which fits Management Role under Rule 1. The named committee (Enterprise Cybersecurity MRG) and CISO role are firm-specific facts that elevate specificity to Level 3.


reasoning: The paragraph primarily answers 'How does cybersecurity affect the business or finances?' by stating a backward-looking materiality assessment that no incidents have materially affected the company, followed by forward-looking risk language about potential future impacts and cyber insurance coverage. Specificity is Level 1 because the paragraph contains only generic risk disclosure language—the negative assertion about no material incidents is not externally verifiable, 'cyber risk insurance' is standard business terminology that fails the ERM test, and there are no domain-specific terms, firm-specific organizational details, or quantified verifiable claims.


fact: CSO

fact: phishing tests

reasoning: The paragraph primarily describes what the cybersecurity program does—tools and processes for incident identification and remediation, employee training, phishing tests, and awareness initiatives—rather than organizational structure. Applying the person-removal test leaves substantial program activity content, confirming RMP over MR. Specificity reaches Level 3 due to the CSO role (a firm-specific C-level position), with phishing tests providing Level 2 domain expertise.


fact: CIO (Chief Information Officer)

reasoning: This paragraph describes the Board's oversight structure for cybersecurity, including the reporting chain from the CIO through senior executives to the Audit Committee and full Board, which is classic Board Governance content. The CIO role is a firm-specific leadership position that distinguishes this company's governance structure, elevating specificity to Firm-Specific.


fact: CISO (Chief Information Security Officer)

fact: Cybersecurity Incident Response Plan

fact: Crisis Response Team

fact: Public Disclosure Committee

reasoning: This paragraph describes the organizational structure for cybersecurity incident escalation, including the CISO role, the composition of the Crisis Response Team (a management-level committee), and reporting lines to the Public Disclosure Committee. The person-removal test leaves some process content but the paragraph's primary focus is on roles, responsibilities, and committee membership. Specificity reaches Level 3 due to firm-specific facts: the CISO role, named internal program (Cybersecurity Incident Response Plan), and named committees (Crisis Response Team, Public Disclosure Committee).


fact: threat intelligence

category_confidence: medium

reasoning: The paragraph describes how management stays informed about cybersecurity risks through various information sources, answering how management is organized to handle cybersecurity oversight. Specificity reaches Domain-Adapted due to the cybersecurity-specific term 'threat intelligence,' which demonstrates domain expertise beyond generic ERM language.


fact: security incident and event manager interface

fact: behavioral analytics

fact: penetration testing

fact: firewalls

fact: anti-malware

fact: authentication attempts

reasoning: This paragraph describes the company's cybersecurity program activities and tools, answering 'What does the cybersecurity program do?' — it covers incident identification, monitoring tools (SIEM with behavioral analytics), and testing practices including penetration testing. Specificity is Domain-Adapted because the paragraph uses cybersecurity-specific terminology (SIEM, behavioral analytics, penetration testing, firewalls, anti-malware) that demonstrates domain expertise beyond what a general ERM professional would naturally employ.


reasoning: The paragraph describes the Board's oversight structure for cybersecurity, including how the Board oversees ERM, receives updates from Management, has an escalation process for incidents, and engages third-party experts. The language is entirely generic oversight terminology that any business professional could write—no cybersecurity domain terms pass the ERM test, no firm-specific roles or committees are named, and no verifiable facts are provided.


content_category: Third-Party Risk

reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers through vendor assessments, answering the Third-Party Risk question. The language uses generic ERM terminology ('risk and compliance assessments,' 'information assets') without domain-specific security practices or firm-specific details, resulting in Level 1 specificity.


fact: penetration tests

reasoning: This paragraph describes the Audit Committee's oversight structure for cybersecurity, including information flows (dashboard, briefings) and reporting mechanisms, which directly answers how the board oversees cybersecurity. The specificity reaches Domain-Adapted due to 'penetration tests'—a specific security practice that demonstrates cybersecurity domain expertise beyond what a general ERM professional would naturally use.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers, including assessment processes and contractual security requirements. The language is entirely generic ERM-level terminology (risk assessments, data security controls, contractual language) that any business professional managing vendor risk would use, with no domain-specific security practices, firm-specific organizational details, or verifiable claims.


fact: 24/7 security operations center

fact: security operations center

fact: insider threat protection program

fact: operational technology

reasoning: This paragraph describes the cybersecurity program's operational activities (SOC, insider threat program, training, awareness program), answering 'What does the cybersecurity program do?' The 24/7 security operations center is explicitly listed as a firm-specific organizational claim in the specificity guidelines, establishing Level 3.


reasoning: The paragraph primarily provides a backward-looking materiality assessment stating that past cybersecurity incidents have not materially affected the company's financial position or operations, which fits Strategy Integration. No domain-specific terminology passes the ERM test, there are no firm-specific facts, and the negative assertion about material impact is not externally verifiable.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers through a vendor third-party risk management program, making Third-Party Risk the appropriate category. The language is generic risk management terminology that would be familiar to any ERM professional, with no domain-specific security practices, firm-specific details, or verifiable claims.


fact: Chief Information Officer (CIO)

fact: CIO is a member of the Company's Executive Committee

fact: Chief Information Security Officer (CISO)

reasoning: The paragraph describes management-level roles and responsibilities for cybersecurity (CIO and CISO), answering how management is organized to handle cybersecurity. Specificity reaches Level 3 due to firm-specific facts: the CIO and CISO positions, and the CIO's Executive Committee membership.


fact: network and perimeter defense

fact: endpoint protection

fact: network segmentation

fact: identity management

fact: cybersecurity threat intelligence

reasoning: The paragraph describes the tools, safeguards, and activities that comprise the cybersecurity program (network defense, endpoint protection, network segmentation, threat intelligence integration), answering 'what does the program do?' Specificity is Domain-Adapted because the paragraph uses multiple cybersecurity-specific architectural and operational terms that pass the ERM test and demonstrate domain expertise.


reasoning: The paragraph is entirely focused on how the company manages cybersecurity risks from third-party service providers, covering preliminary assessments, enhanced due diligence, security risk assessments at key lifecycle points, and security requirements for vendors—this is the central and dominant topic. The language is entirely generic ERM/vendor management terminology (due diligence, risk assessments, onboarding, contract renewal) with no domain-specific cybersecurity terms, firm-specific facts, or verifiable claims.


reasoning: This paragraph makes a negative assertion about material cybersecurity incidents (did not experience any during 2024), which per Rule 5 constitutes a materiality assessment falling under Strategy Integration. The paragraph contains no domain terminology passing the ERM test, no firm-specific facts, and no verifiable claims—the negative assertion about absence of incidents is not externally verifiable, and the cross-reference and 'Governance' header are boilerplate elements.


reasoning: This paragraph describes ADP's data handling activities and the general threat landscape without addressing any of the six substantive disclosure questions—it contains no governance structure, management roles, program activities, third-party oversight, incident details, or materiality assessments. The language is entirely generic business context and threat acknowledgment without domain-specific terminology, firm-specific cybersecurity facts, or verifiable claims.


reasoning: This paragraph is a backward-looking materiality assessment stating that cybersecurity issues have not materially affected the company's business, which falls under Strategy Integration per Rule 5. The specificity is Generic Boilerplate because the negative assertion about absence of material incidents cannot be externally verified, and the paragraph contains no domain terminology, firm-specific facts, or quantified claims.


fact: April 2022

fact: Security Operations Center

fact: ransomware attacks

reasoning: This paragraph describes an actual cybersecurity incident with specific details about timing (April 2022), nature (exfiltration of confidential company and patient information), scope (disruption to hospital operations), and impact (remediation costs, lost revenues), which directly answers the Incident Disclosure question. Specificity reaches Level 4 due to the verifiable date 'April 2022' tied to a real incident, plus domain terminology including 'Security Operations Center' and 'ransomware attacks'.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from vendors and partners, including vetting before engagement and ongoing monitoring for compliance with security standards—this is classic Third-Party Risk content. The language is generic oversight terminology (vetting, monitoring, reviews, security standards) that any ERM professional could write without demonstrating cybersecurity domain expertise, yielding no facts above Level 1.


reasoning: This paragraph is an introductory statement about the importance of cybersecurity governance that does not substantively answer any of the six key questions—it describes WHY governance matters in general terms, not HOW oversight works, how management is organized, what processes are in place, or any other substantive disclosure. The paragraph contains no domain-specific terminology passing the ERM test, no firm-specific facts, and no verifiable claims—it is purely generic boilerplate language.


fact: CISO (Chief Information Security Officer)

reasoning: The paragraph primarily describes the Board's oversight structure—how the CISO facilitates Board oversight through quarterly meetings, annual tabletop exercises, and ongoing threat landscape briefings. While the CISO role is mentioned, the focus is on the governance chain and information flow to the Board rather than management qualifications or organizational details. Specificity reaches Level 3 due to the CISO role, a firm-specific cybersecurity leadership position.


reasoning: This paragraph is a cross-reference directing readers to Item 7 for risk management disclosure, with only a generic statement about integrating cybersecurity into ERM that lacks substantive content about any specific governance, process, or strategy.


reasoning: The paragraph contains a materiality assessment stating the company has not experienced any material cyber threats or incidents to date, which is a backward-looking negative assertion about business impact under Rule 5. However, the rest is forward-looking disclaimer language and a cross-reference to Risk Factors, making the SI classification borderline. No domain terms pass the ERM test, no firm-specific facts are present, and the negative assertion about absence of incidents is not externally verifiable, resulting in Generic Boilerplate specificity.


fact: confidentiality, integrity and availability (CIA triad)

reasoning: The paragraph describes the company's cybersecurity program at a high level—policies and systems designed to identify and address cybersecurity risks—which answers 'What does the cybersecurity program do?' The CIA triad terminology (confidentiality, integrity, and availability) demonstrates cybersecurity domain expertise, elevating specificity to Level 2.


fact: two-factor authentication (2FA)

fact: real-time threat monitoring

fact: enhanced encryption

fact: formal policy for personal device access to corporate systems

fact: infrastructure simplification to minimize servers

fact: migration of ERP system to Tier-1 cloud service providers

reasoning: The paragraph describes the company's cybersecurity risk management activities including monitoring, software updates, policies, infrastructure changes, and security controls, answering what the program does. Specificity reaches Firm-Specific due to organizational claims about a formal personal device policy, infrastructure simplification, and ERP migration to cloud providers, plus domain terms like 2FA and endpoint protection that pass the ERM test.


reasoning: This paragraph describes the components of the company's cybersecurity risk management program, answering what the program does. It lists program elements (risk assessments, team responsibilities, external providers, training, incident response plan, third-party risk management) but uses only generic terminology that an ERM professional would naturally use, without demonstrating cybersecurity domain expertise through specific practices, tools, or frameworks.


fact: CISO

fact: Privacy and Data Governance Committee

fact: Chief Privacy Officer

reasoning: This paragraph describes management-level committee structure, leadership roles (CISO, Chief Privacy Officer), and reporting relationships, answering how management is organized to handle cybersecurity. Specificity is Firm-Specific due to multiple named committees (Security and Technology Risk Leadership Committee, Privacy and Data Governance Committee, Data Security and Privacy Governance Committee) and named leadership roles that distinguish this company's organizational structure.


fact: On February 22, 2024, we disclosed the occurrence of a cybersecurity incident

reasoning: This paragraph describes an actual cybersecurity incident with specific timeline (disclosed February 22, 2024), nature (committed by cybercrime threat actors), and current status (investigation ongoing), which directly answers 'What happened in a cybersecurity incident?' The specific disclosure date of February 22, 2024 tied to a real event is externally verifiable, establishing Level 4 specificity.


fact: Chief Information Security Officer (CISO)

reasoning: This paragraph describes board-level oversight of cybersecurity through the Audit Committee, including what information flows from management (CISO reports) to the board—classic Board Governance content. Specificity reaches Firm-Specific (Level 3) because the paragraph identifies a CISO role, which is a cybersecurity leadership position that distinguishes this company's organizational structure; however, no verifiable facts (certifications, named vendors, specific dates, or quantified claims) are present to reach Level 4.


fact: identity and access management

fact: cyber defense operations

fact: security engineering

fact: penetration testing

fact: incident response

fact: threat intelligence

fact: managed security services

fact: Executive Vice President/ Chief Information Security Officer

fact: Chief Information Officer

fact: Senior Executive Vice President / Chief Operating Officer

fact: over 25 years' experience in cybersecurity risk management

type: quantified

fact: over 27 years' experience in technology risk management

reasoning: The paragraph primarily answers how management is organized for cybersecurity, detailing leadership roles (CISO, CIO), their qualifications, reporting lines, and team composition. Specificity reaches Quantified-Verifiable due to the verifiable experience claims ('over 25 years' and 'over 27 years') tied to named officers.


fact: defense in depth strategy

fact: data loss prevention technology

fact: transport layer security encryption

fact: phishing

fact: malware

fact: social engineering

reasoning: The paragraph describes the company's cybersecurity program activities including encryption technologies, data loss prevention, and employee training, which directly answers what the cybersecurity program does. Specificity is Level 2 due to domain terminology including defense in depth architecture, data loss prevention technology, transport layer security encryption, and specific threat types (phishing, malware, social engineering) that demonstrate cybersecurity expertise beyond generic ERM language.


fact: Head of Cyber Security

reasoning: The paragraph primarily describes the Board's oversight structure for cybersecurity, including delegation to the Audit Committee, the reporting chain from the Head of Cyber Security to the Audit Committee to the full Board, and how oversight information flows through governance channels. The presence of 'Head of Cyber Security' as a named security-qualified leadership role elevates specificity to Firm-Specific.


fact: Emergency Incident Response Team

reasoning: The paragraph describes incident response planning activities (reviewing and drilling on a plan), which fits Risk Management Process. The named 'Emergency Incident Response Team' is a firm-specific team designation that elevates specificity to Level 3, though the paragraph is fragmentary and lacks detailed process description.


fact: RCSC

fact: CISO

reasoning: This paragraph describes how cybersecurity information flows to a board-level committee (RCSC) through quarterly CISO briefings, which is classic Board Governance content about oversight structure and reporting cadence. Specificity reaches Level 3 due to the named committee (RCSC) and VP-level cybersecurity leadership role (CISO), both firm-specific facts that distinguish this company's governance structure.


reasoning: The paragraph primarily answers how cybersecurity affects the business by providing a backward-looking materiality assessment stating no material impacts from cyberattacks, which is a Strategy Integration function under Rule 5. The specificity is Generic Boilerplate because the negative assertion about absence of material impacts is not externally verifiable, and the remaining language contains no domain-specific terminology, firm-specific facts, or quantified claims.


fact: SOC 1 audit

reasoning: The paragraph primarily answers how third-party cyber risks are managed, describing vendor oversight through mandated SOC 1 audits and review processes—central topic is requirements imposed ON vendors. Specificity is Domain-Adapted because 'SOC 1 audit' demonstrates cybersecurity domain knowledge (distinguishing specific audit types for security oversight) beyond generic ERM language.


fact: endpoint detection and response

fact: network anomaly detection

fact: multi-factor authentication

fact: defense-in-depth

fact: threat intelligence services

fact: phishing simulation exercises

reasoning: This paragraph describes the activities and capabilities of the cybersecurity program—assessment methodology, security tools deployed, threat intelligence, and employee training—which directly answers 'What does the cybersecurity program do?' Third-party consultants are mentioned as one component serving the program (Rule 3), not as the central topic. Specificity is Domain-Adapted because the paragraph contains multiple cybersecurity-specific terms (endpoint detection and response, network anomaly detection, multi-factor authentication, defense-in-depth, threat intelligence services, phishing simulation exercises) that pass the ERM test—these require domain knowledge to select and would not naturally be used by a general enterprise risk management professional.


reasoning: The paragraph makes a negative materiality assertion ('we have not experienced any material cybersecurity incidents'), which is a Strategy Integration disclosure under Rule 5. The cross-reference to risk factors is secondary. No domain terminology passes the ERM test (all terms are generic business/technology language), no firm-specific facts distinguish this company from others, and the negative assertion about incident absence is explicitly not externally verifiable.


reasoning: This paragraph is a backward-looking materiality assessment stating that cybersecurity risks have not materially affected the company's business strategy, results of operations, or financial condition, which fits the Strategy Integration category per Rule 5. The paragraph contains no domain terminology passing the ERM test, no firm-specific facts, and no verifiable claims—the negative assertion about absence of material impact is a self-reported claim that cannot be independently verified.


fact: threat intelligence

reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from suppliers and third parties, including supplier risk assessments, security scoring services, and threat intelligence monitoring—clearly fitting Third-Party Risk. Specificity is Domain-Adapted because terms like 'real-time security scoring of supplier technology services,' 'threat intelligence,' and 'continuous threat intelligence monitoring' demonstrate cybersecurity domain expertise beyond generic ERM language.


fact: ransomware

reasoning: This paragraph describes an actual cybersecurity incident (ransomware attack in May 2022), including the nature, timing, response actions, and outcome, which directly answers 'What happened in a cybersecurity incident?' The specific date 'May 2022' is a verifiable fact that elevates specificity to Quantified-Verifiable, while domain terms like 'ransomware' and 'multi-factor authentication' demonstrate cybersecurity expertise.


fact: February 2023

fact: cyberattack

reasoning: This paragraph describes an actual cybersecurity incident with specific timing (February 2023), nature (cyberattack), and impacts (system interruption, confidential information disclosure, litigation, governmental inquiries), directly answering what happened. The specific date tied to a real incident is externally verifiable through news reports, SEC filings, or public records, elevating specificity to Quantified-Verifiable.


fact: EVP, Chief Digital and Innovation Officer (CDIO)

fact: Vice President (VP) of Platforms, Infrastructure and Cybersecurity

fact: over 20 years of related experience

reasoning: This paragraph describes management roles responsible for cybersecurity (EVP/CDIO and VP of Platforms, Infrastructure and Cybersecurity) and their qualifications, directly answering how management is organized to handle cybersecurity. Specificity reaches Level 4 due to the verifiable 'over 20 years of related experience' claim, supported by two named VP-level roles with security-relevant portfolios.


fact: in 2023, one of our third-party vendors experienced a cybersecurity incident due to a zero-day vulnerability in MOVEit Transfer

fact: zero-day vulnerability

fact: MOVEit Transfer

fact: compromised credentials

reasoning: The paragraph primarily describes actual cybersecurity incidents the company has experienced, including specific incident types (fraud attempts, compromised credentials, unauthorized data access) and a named example (MOVEit Transfer vulnerability affecting a vendor in 2023). While the final sentence provides a materiality assessment, the incident description frame is dominant per Rule 4. Specificity reaches Level 3 due to the firm-specific claim about a 2023 MOVEit incident affecting their vendor, plus Level 2 domain terms (zero-day vulnerability, MOVEit Transfer, compromised credentials).


reasoning: The paragraph's central topic is managing cybersecurity risks from third-party service providers, including vendor assessments and contractual security requirements, which directly answers how third-party cyber risks are managed. The language is generic oversight content without specific domain terminology, firm-specific details, or verifiable claims, resulting in Generic Boilerplate specificity.


fact: Vendor Management Committee

reasoning: The paragraph centrally addresses how third-party vendor cyber risks are managed through due diligence processes and committee oversight, directly answering the TP question. Specificity is Firm-Specific due to the named 'Vendor Management Committee' — a non-generic committee that distinguishes this company's governance structure.


fact: Information Security Team

reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers, including pre-onboarding risk assessments and ongoing monitoring, which fits Third-Party Risk under Rule 3 (vendor oversight as central topic). Specificity reaches Firm-Specific due to the named 'Information Security Team' and the organizational structure of having designated information security personnel from each segment.


fact: NIST Cyber Security Framework

fact: vulnerability scanning

fact: penetration testing

fact: incident response exercises

fact: disaster recovery exercises

fact: encryption

fact: threat management

fact: multi-factor authentication

fact: cyber risk scoring

reasoning: This paragraph describes the company's cybersecurity program activities and methodology, including defense-in-depth architecture, NIST CSF alignment, and six operational focus areas—answering 'What does the cybersecurity program do?' Third-party risk management appears as one of six components, not the central topic. Specificity is Domain-Adapted due to multiple cybersecurity-specific terms that pass the ERM test, including defense-in-depth, NIST CSF, vulnerability scanning, penetration testing, MFA, and cyber risk scoring.


fact: No cybersecurity incidents have had a material adverse effect on the company

reasoning: The paragraph concludes with a backward-looking materiality assessment stating no cybersecurity incidents have materially affected the company, which per Rule 5 constitutes Strategy Integration. The firm-specific materiality claim elevates specificity to Level 3, though it is not externally verifiable as a negative assertion.


reasoning: This paragraph describes contractual requirements imposed ON vendors and suppliers regarding security controls and data use restrictions, which directly answers how third-party cyber risks are managed. The language is generic vendor management terminology—'appropriate security controls' and contractual data restrictions are phrases any ERM professional would use, not cybersecurity-specific domain expertise.


reasoning: This paragraph contains only speculative risk language about potential consequences of security failures without describing any actual cybersecurity processes, governance structure, or management practices. The text consists entirely of forward-looking risk statements ('could disrupt,' 'could result in') with no domain-specific terminology that would pass the ERM test, no firm-specific facts, and no verifiable claims.


fact: CISO

fact: CIO

reasoning: The paragraph describes Board and Audit Committee oversight of cybersecurity, including reporting cadences (dashboard at every Board meeting, bi-annual presentations) and information flows, which directly answers how the board oversees cybersecurity. Specificity reaches Firm-Specific due to the CISO and CIO roles, both VP-level leadership positions that distinguish this company's governance structure.


fact: Chief Information Security Officer (CISO)

fact: vulnerability assessments

reasoning: This paragraph describes the Board's oversight structure for cybersecurity, including the Risk Committee's role, reporting lines from the CISO to the committee, and the types of information the Board receives. The CISO role is a firm-specific fact that distinguishes this company's governance structure, while 'vulnerability assessments' demonstrates cybersecurity domain expertise.


fact: Two members of the audit committee have obtained certifications in cybersecurity oversight

fact: chief information officer

fact: chief information security officer

reasoning: This paragraph primarily answers how the board oversees cybersecurity, describing the audit committee's oversight role, board member expertise, and quarterly reporting flows from management to the board. Specificity reaches Firm-Specific due to the named CIO and CISO roles and the specific claim that two audit committee members hold cybersecurity oversight certifications.


fact: CISO role

fact: 30 years of information technology experience

fact: 17 years focused specifically on information security and risk management

reasoning: This paragraph describes the CISO's role responsibilities and professional qualifications, directly answering how management is organized to handle cybersecurity. Specificity reaches Level 4 due to the quantified years of experience (30 years IT, 17 years information security) that are externally verifiable claims.


fact: ransomware

fact: phishing

reasoning: This paragraph describes the general cyber threat landscape and risk context without addressing any of the six substantive disclosure questions (no board oversight, management structure, program activities, vendor management, incident details, or business impact assessment); specificity reaches Domain-Adapted due to cybersecurity-specific terminology (ransomware, phishing) that passes the ERM test.


fact: Enterprise Risk Management Committee

fact: SOC1 reports

reasoning: The paragraph primarily describes the company's cybersecurity risk management process, including risk identification, governance through the ERM Committee, and third-party oversight. The named Enterprise Risk Management Committee elevates specificity to firm-specific, while SOC1 reports demonstrate domain expertise.


fact: In 2017, experienced a material cybersecurity incident

fact: theft of personal information of U.S., Canadian and U.K. consumers

reasoning: The paragraph describes an actual cybersecurity incident (the 2017 Equifax breach) with specific details about timing and scope, satisfying Incident Disclosure despite the subsequent speculative language about future risks. Specificity reaches Quantified-Verifiable because the 2017 date and the geographic scope of affected consumers (U.S., Canadian, U.K.) are externally verifiable facts tied to a well-documented real-world event.


fact: cyber resiliency

fact: playbooks

fact: Risk Management Committee

fact: Managing Committee

reasoning: The paragraph describes the Board's oversight structure for cybersecurity risk, including the delegation to Risk Management Committee and its Cybersecurity and Technology Subcommittee, reporting cadences (quarterly reports, annual joint meetings), and board education sessions. Specificity is Firm-Specific due to named committees (Cybersecurity and Technology Subcommittee, Risk Management Committee, Managing Committee) and the CISO role, which distinguish this company's governance structure from generic oversight language.


fact: Cyber Security Group

fact: operational technology

fact: Department of Homeland Security's list of Prohibited Nations

reasoning: The paragraph primarily answers how third-party cyber risks are managed, covering vendor screening, risk ranking, attestations, prohibited nations sourcing, and cyber insurance. Specificity reaches Firm-Specific due to the named 'Cyber Security Group' organizational unit, with domain terminology including 'operational technology' and the DHS Prohibited Nations list.


reasoning: The paragraph contains a backward-looking materiality assessment stating the company has not been materially affected by cybersecurity breaches to date, which fits Strategy Integration under Rule 5. However, the paragraph lacks any domain terminology demonstrating cybersecurity expertise (all terms like 'cybersecurity breach' and 'unauthorized access' are generic business language an ERM professional would use), contains no firm-specific structural claims about roles or programs, and the negative assertion about absence of material incidents is not externally verifiable.


fact: Vice President of Cybersecurity

reasoning: The paragraph describes the Board's oversight structure, Audit Committee responsibilities, and reporting cadences—answering how the board oversees cybersecurity. Specificity reaches Level 3 due to the mention of 'Vice President of Cybersecurity,' a firm-specific cybersecurity leadership role at VP level.


reasoning: This paragraph is a negative materiality assessment stating that no cybersecurity breaches materially affected or are reasonably likely to materially affect the company, which per Rule 5 is a Strategy Integration conclusion. The paragraph contains no domain terminology passing the ERM test, no firm-specific facts, and the negative assertion about absence of incidents is not externally verifiable.


fact: over 30 years of IT experience

reasoning: This paragraph describes the leadership structure, qualifications, and reporting lines for cybersecurity management, answering how management is organized to handle cybersecurity. The specificity reaches Level 4 due to two quantified claims about experience ('over 30 years of IT experience' and 'over 20 years specializing in cybersecurity') that are verifiable lower bounds.


reasoning: The paragraph states materiality conclusions about cybersecurity impact on business outcomes—both backward-looking ('we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected') and forward-looking ('reasonably likely to materially affect')—which is the core content of Strategy Integration. The paragraph contains no domain terminology passing the ERM test, no firm-specific facts, and no externally verifiable claims—only generic materiality assertions and standard forward-looking disclaimer language.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers, including selection criteria, contractual obligations, and review of provider practices. The language is entirely generic vendor management terminology that any ERM professional would use, with no domain-specific security concepts, firm-specific details, or verifiable claims.


fact: cybersecurity due diligence reviews

fact: risk profile of a particular supplier or service provider

reasoning: The paragraph primarily describes the company's Third Party Risk Management (TPRM) program, including vendor due diligence reviews and ongoing monitoring of suppliers, directly answering how third-party cyber risks are managed. The last sentence is a section header for materiality assessment, not substantive content. Specificity is Domain-Adapted due to cybersecurity-specific terminology like 'cybersecurity due diligence reviews' and 'risk profile' that demonstrate domain expertise beyond generic ERM language.


fact: confidentiality, integrity, or availability (CIA triad)

reasoning: The paragraph describes the scope and components of the cybersecurity program—policies, platforms, procedures, risk assessment processes, and incident response capabilities—answering what the program does. Specificity reaches Firm-Specific due to the mention of CSO (Chief Security Officer organization), a named cybersecurity leadership role, while the CIA triad terminology demonstrates domain expertise.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from vendors and third-party providers, describing contractual security requirements, data security addendums, and mandatory incident reporting protocols imposed ON vendors. Specificity is Level 1 because the vocabulary (administrative/physical/technical safeguards, cybersecurity insurance, incident reporting protocols) consists of standard business and regulatory language that an ERM professional would naturally use, without demonstrating cybersecurity domain expertise.


reasoning: The paragraph primarily provides a materiality assessment stating that cybersecurity risks have not materially affected the company and are not reasonably likely to do so, which is a backward-looking and forward-looking conclusion about business impact under Rule 5. The paragraph contains no domain-specific terminology beyond generic cybersecurity references, no firm-specific facts about roles or programs, and the negative assertion about absence of material incidents is not externally verifiable.


fact: CDO and CISO roles

fact: over 25 years of collective experience

fact: CISM certification requirement

fact: CISSP certification requirement

reasoning: This paragraph answers 'How is management organized to handle cybersecurity?' by identifying the leadership roles (CDO, CISO), their collective experience, required certifications, and responsibilities. Specificity is Quantified-Verifiable due to 'over 25 years' (a verifiable lower bound on collective experience) and specifically named certifications (CISM, CISSP) that could be verified through ISACA and ISC2 registries.


fact: CISO

fact: Cyber Incident Response Plan (CIRP)

reasoning: The paragraph describes management's organizational structure for cybersecurity oversight, specifically the composition and responsibilities of the Core Cybersecurity Management Team (CCMT), a management-level committee. Specificity is driven by firm-specific facts: the CISO role, the named CCMT committee, and the named CIRP program.


reasoning: This paragraph describes the Audit Committee's oversight responsibility for cybersecurity and IT risks, which directly answers how the board oversees cybersecurity. No domain terminology, firm-specific facts, or verifiable claims are present—only generic governance language about oversight structure.


fact: outside-in, hacker perspective

fact: cybersecurity posture

reasoning: The paragraph primarily answers how third-party cyber risks are managed, describing a TPRM program integrated into procurement, vendor due diligence reviews based on risk profiles, and ongoing monitoring of suppliers. The last sentence is regulatory boilerplate restating the Item 106(b)(2) requirement without providing an assessment. Specificity is Level 2 due to domain terminology like 'outside-in, hacker perspective' and 'cybersecurity posture' that demonstrate cybersecurity expertise beyond what an ERM professional would naturally use.


reasoning: The paragraph primarily makes a backward-looking materiality assessment ('prior cybersecurity threats have not materially affected our business strategy, results of operations or financial condition'), which directly answers the Strategy Integration question about business/financial impact. The speculative language about potential future breaches and the cross-reference to Risk Factors are secondary. Specificity is Level 1 because the paragraph lacks domain-specific terminology demonstrating cybersecurity expertise (the threat types listed are generic risk disclosure language), contains no firm-specific organizational facts, and the negative assertion about absence of material impact is not externally verifiable.


reasoning: The paragraph primarily describes the existence and purpose of the company's cybersecurity risk management program, answering what the program does (safeguards data, transactions, and systems) and why it exists (regulatory compliance, risk mitigation). No domain terminology passes the ERM test—terms like 'cybersecurity incident,' 'cybersecurity risk management program,' and 'enterprise risk management' are generic language any ERM professional would use. The regulatory bodies (FRB, FDIC, DFR) are financial services regulators, not cybersecurity-specific domain terms, and apply industry-wide rather than being firm-specific.


fact: February 21, 2024 - specific date of Change Healthcare incident notification

fact: Change Healthcare, a subsidiary of UnitedHealth Group - named third party

reasoning: The paragraph primarily describes a real cybersecurity incident at Change Healthcare (a vendor), including the notification date, response actions taken (severing connections, conducting forensics), and impact assessment. While it includes materiality conclusions, the incident frame is dominant per Rule 4. Specificity reaches Level 4 due to the specific date (February 21, 2024) tied to the Change Healthcare incident notification and the named third party (Change Healthcare, subsidiary of UnitedHealth Group), both of which are externally verifiable.


reasoning: The paragraph contains a materiality assessment stating the company has not experienced a cybersecurity incident with material adverse impact, which is a negative assertion that qualifies as Strategy Integration per Rule 5. The remainder is speculative forward-looking risk language (explicitly NOT SI per Rule 5) and generic statements about detection efforts. Specificity is Level 1 because the paragraph uses only generic business/ERM language—terms like 'cyberattack,' 'threats,' and 'unauthorized attempts' fail the ERM test as non-specialists commonly use them, and the negative assertion about absence of incidents is not externally verifiable.


fact: Director of Cybersecurity

fact: Chief Information Officer (CIO)

reasoning: This paragraph describes management roles responsible for cybersecurity (Director of Cybersecurity and CIO), their reporting lines, qualifications, and career history, which directly answers how management is organized to handle cybersecurity. The specificity reaches Quantified-Verifiable due to the 'over 20 years of cybersecurity oversight experience' claim, which sets a verifiable lower bound threshold.


reasoning: This paragraph primarily addresses how cybersecurity affects the business and finances, containing multiple materiality assessments including the backward-looking statement that results have not been materially affected and the forward-looking statement that cybersecurity threats have materially affected business strategy and processes. The specificity is Level 1 because the paragraph contains no domain-specific terminology passing the ERM test, no firm-specific facts, and no externally verifiable claims—the negative assertions about material impact are self-reported claims that cannot be independently verified.


reasoning: This paragraph contains only forward-looking risk disclaimers and a cross-reference to Item 1A Risk Factors, with no substantive disclosure about governance, management structure, risk management processes, third-party oversight, actual incidents, or materiality assessments. The conditional language 'if realized, are reasonably likely to materially affect' is generic speculation rather than an actual assessment under Rule 5, and no domain terminology, firm-specific facts, or verifiable claims are present.


fact: John Bresney, EVP & CIO

fact: Robert McKenna, SVP of Enterprise Strategy and Execution

fact: Christopher Cunniff, SVP and CRO

fact: ERC (Enterprise Risk Committee)

fact: Emerging Risk Committee

fact: Security Incident Response Plan (IRP)

fact: over 27 years of technology and information security experience (McKenna)

fact: over 32 years of insurance industry experience (Cunniff)

fact: Certified Insurance Counselor (McKenna)

fact: Fellow of the Casualty Actuarial Society (Cunniff)

fact: Member of the American Academy of Actuaries (Cunniff)

fact: Columbia University CIO Program Certificate (Bresney)

fact: cybersecurity program

fact: Security Incident Response Plan

fact: enterprise IT risk management

reasoning: This paragraph describes the qualifications, reporting lines, and responsibilities of three named executives involved in cybersecurity oversight, which directly answers how management is organized to handle cybersecurity (Management Role). Specificity reaches Level 4 due to multiple verifiable claims including named professional certifications (Certified Insurance Counselor, Fellow of the Casualty Actuarial Society), lower-bound experience claims ('over 27 years', 'over 32 years'), and named credentials (Columbia University CIO Program Certificate).


fact: confidentiality, integrity and continued availability (CIA triad)

fact: CISO role

fact: CSBDO role

fact: over thirty years of experience

fact: experience as CISO of two large retailers

reasoning: The paragraph primarily describes the cybersecurity program's elements—systems for securing information, training programs, incident response planning, and third-party engagement—with management qualifications woven in as supporting detail. Applying the person-removal test leaves substantive program content, so RMP is the primary category. Specificity reaches Level 4 due to verifiable claims about the CISO's experience (over thirty years, former CISO of two large retailers).


reasoning: This paragraph describes the company's incident response capabilities—plan maintenance, testing through crisis simulations, and team training—which directly answers 'What does the cybersecurity program do?' The language is entirely generic process description without any domain-specific terminology, firm-specific details, or verifiable claims, resulting in Level 1 specificity.


fact: Aerospace Safety Committee

fact: Chief Information Officer and Senior Vice President, Information Technology & Data Analytics (CIO)

fact: Chief Security Officer (CSO)

fact: Chief Product Security Engineer

reasoning: This paragraph answers how the Board oversees cybersecurity by describing delegation to two Board committees (Audit Committee and Aerospace Safety Committee), briefing cadences, and information flows from management to the Board. The Aerospace Safety Committee is a named Board committee specific to Boeing, and the paragraph identifies multiple VP-level cybersecurity leadership roles (CIO, CSO, Chief Product Security Engineer), establishing Firm-Specific specificity.


reasoning: This paragraph is a cross-reference directing readers to Item 1A for materiality assessments related to cybersecurity threats, which falls under None/Other per Rule 5. The paragraph contains no domain-specific terminology passing the ERM test, no firm-specific facts, and no verifiable claims—only generic cross-reference language.


fact: ransomware attack

reasoning: This paragraph describes an actual cybersecurity incident (ransomware attack), including when it occurred and its impact, which directly answers 'What happened in a cybersecurity incident?' The specificity reaches Level 4 because 'In 2021' is a specific year tied to an affirmed real event that could be independently verified through news reports, cybersecurity databases, or other filings.


reasoning: The paragraph centrally addresses how third-party cybersecurity risks are managed through due diligence, contractual review, and ongoing monitoring, fitting Third-Party Risk. The language describes WHAT the program does in generic terms an ERM professional would use ('due diligence,' 'contractual terms,' 'ongoing monitoring'), without domain-specific terminology passing the ERM test; 'TPRM' is a standard industry acronym, not a firm-specific distinguishing identifier.


reasoning: The paragraph primarily states a backward-looking materiality assessment—a negative assertion that cybersecurity threats and incidents have not materially affected the company's business strategy, results of operations, or financial condition. This directly answers the Strategy Integration question about business/financial impact. Specificity is Level 1 because the paragraph contains only a non-verifiable negative assertion and generic cybersecurity terminology; no domain-specific terms pass the ERM test, and there are no firm-specific or externally verifiable facts.


fact: CIO

reasoning: This paragraph describes the governance chain for cybersecurity oversight, detailing how the Board directly oversees cybersecurity risks with annual reviews and how the Audit Committee receives quarterly updates, making it Board Governance. The CIO is a firm-specific leadership role that distinguishes this company's cybersecurity structure, elevating specificity to Firm-Specific.


fact: Chief Security Officer (CSO) role

fact: Reports to CFO

fact: CSO has served since 2018

fact: Over 14 years of global executive cybersecurity experience

reasoning: This paragraph describes a senior leadership role (CSO), their responsibilities, reporting structure, and professional qualifications—directly answering how management is organized to handle cybersecurity. Specificity reaches Level 4 due to verifiable facts: the CSO's tenure since 2018 and over 14 years of experience are specific quantities that could be independently checked.


reasoning: This paragraph provides a materiality assessment stating that cybersecurity risks have not materially affected and are not reasonably likely to materially affect the company's business, which directly answers the Strategy Integration question about business/financial impact. The specificity is Generic Boilerplate because the negative assertion about absence of material impact is a self-reported claim that cannot be externally verified, and no domain terminology, firm-specific facts, or verifiable claims are present.


fact: cybersecurity insurance coverage

fact: security vulnerabilities

reasoning: This paragraph primarily answers how cybersecurity affects the business and finances, containing explicit materiality assessments about operations, financial condition, and business strategy impact, plus mention of cybersecurity insurance. Specificity is Domain-Adapted because the paragraph uses cybersecurity-specific terminology (cybersecurity insurance, security vulnerabilities) that demonstrates domain expertise, but contains no firm-specific roles or verifiable claims.


fact: pre-onboarding security assessments

fact: third-party security controls

reasoning: This paragraph centrally addresses how the company manages cybersecurity risks from vendors and service providers, including pre-onboarding assessments, annual re-assessments, and tracking of third-party security controls—this is vendor oversight as the primary topic, not third parties as one component of an internal program. Specificity is Domain-Adapted because the paragraph uses cybersecurity-specific terminology like 'pre-onboarding security assessments' and 'third-party security controls' that demonstrate domain expertise beyond what a general ERM professional would naturally use.


reasoning: The paragraph contains a materiality assessment stating the company has not experienced material cyber attacks, which is a Strategy Integration statement under Rule 5, though surrounded by forward-looking disclaimer language and a cross-reference. No domain expertise is demonstrated ('cyber attacks' fails the ERM test), no firm-specific organizational facts are provided, and the negative assertion about incident absence is not externally verifiable.


fact: Corporate Risk Committee

fact: CISO

fact: ERM team

reasoning: This paragraph describes board and committee oversight structure for cybersecurity, including which committees have oversight responsibilities and how information flows from management to the board. It contains firm-specific facts including the named Corporate Risk Committee, CIO and CISO roles, and ERM team, elevating it to Firm-Specific specificity.


fact: February 21, 2024

fact: Change Healthcare, a subsidiary of UnitedHealth Group

fact: forensics

reasoning: This paragraph primarily describes a specific cybersecurity incident involving Change Healthcare, including the date, nature of the incident, response actions taken, and impact on operations, making it Incident Disclosure under Rule 4 (incident frame dominant over the materiality assessment at the end). Specificity reaches Quantified-Verifiable due to the specific date (February 21, 2024) and named third-party firm (Change Healthcare), both of which are externally verifiable facts.


fact: Chief Capability Officer (CCO)

fact: Chief Information Officer (CIO)

fact: Chief Information Security Officer (CISO)

reasoning: This paragraph describes the Audit Committee's oversight of cybersecurity, including reporting frequency (quarterly), direct engagement with named management roles, and topics covered—classic Board Governance content. Specificity reaches Firm-Specific due to three named C-level roles (CCO, CIO, CISO) that distinguish this company's cybersecurity leadership structure.


fact: over 30 years of experience

fact: GIAC Security Essentials certification

fact: GIAC Certified Enterprise Defender certification

fact: GIAC Certified Incident Handler Certification

fact: GIAC Certified Windows Security Administrator certification

fact: GIAC Critical Controls Certification

fact: Vice President of Information Technology

fact: over 19 years of experience

fact: CISSP certification

reasoning: This paragraph describes the organizational structure, reporting lines, and qualifications of cybersecurity leadership (Director of IT Infrastructure and Security reporting to VP of Information Technology), answering how management is organized to handle cybersecurity. The specificity reaches Level 4 due to multiple externally verifiable facts: named certifications (five GIAC certifications and CISSP) and quantified years of experience (over 30 years, over 19 years).


reasoning: The paragraph is entirely focused on how the company manages cybersecurity risks from third-party service providers, including performing risk assessments, requesting security policy information, and monitoring incidents—making Third-Party Risk the central topic. The language is generic ERM-style oversight terminology that any business professional could write; no domain-specific security terms, firm-specific facts, or verifiable claims are present.


fact: appointed to the role in March 2022

fact: CIO role

fact: nearly 20 years of experience in managing IT functions

reasoning: This paragraph describes the CIO's organizational position, reporting relationships, responsibilities, and professional qualifications—directly answering how management is organized to handle cybersecurity. The March 2022 appointment date is a verifiable fact (Level 4), while the CIO role and experience claim are firm-specific details.


reasoning: This paragraph describes board-level committee oversight of cybersecurity, with the Audit Committee monitoring internal audit coverage and the Risk Committee coordinating on information security matters—answering how the board oversees cybersecurity. The language is generic governance terminology (Audit Committee, Risk Committee, internal audit coverage) that any ERM professional would use; there are no cybersecurity domain terms, firm-specific details, or verifiable claims.


reasoning: This is an introductory paragraph that sets up the cybersecurity disclosure without answering any of the six substantive category questions—it contains no board oversight, management structure, program details, third-party risk, incident information, or materiality assessment. The paragraph uses only generic language about protecting systems and data with no domain-specific terminology, firm-specific facts, or verifiable claims.


reasoning: The paragraph primarily addresses how third-party cybersecurity risks are managed through pre-engagement and periodic assessments, fitting the Third-Party Risk category. The language uses generic ERM-style vendor risk management terminology without cybersecurity domain expertise, and the committee reference is not clearly firm-specific.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party vendors through due diligence and review of vendor security practices, fitting the Third-Party Risk category. The language is generic risk management terminology that any ERM professional would use—terms like 'vendor due diligence,' 'control environments,' and 'information security practices' do not demonstrate cybersecurity domain expertise or contain any firm-specific or verifiable facts.


fact: System and Organization Controls (SOC) 2

type: framework

fact: ISO 27001 (Information and Security Certification)

reasoning: The paragraph centrally addresses how the company manages cybersecurity risks associated with third-party vendors, including onboarding due diligence, security requirements imposed on suppliers, and reviews of third-party hosted applications. Specificity reaches Domain-Adapted due to references to SOC 2 and ISO 27001, which are cybersecurity-specific frameworks that demonstrate domain expertise beyond generic ERM language.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from vendors and service providers, covering due diligence reviews, security risk assessments before engagement, supplemental reviews triggered by third-party incidents, and continuous monitoring of third-party service providers. The language is generic risk management terminology that any ERM professional would use for vendor oversight, without specific cybersecurity practices, tools, or firm-unique details.


reasoning: This paragraph makes explicit materiality assessments—both backward-looking ('not aware of any cybersecurity threats or incidents... that have had a material impact') and forward-looking ('reasonably likely to materially affect us')—which directly answers the Strategy Integration question about how cybersecurity affects business and financial outcomes. Specificity is Level 1 because the paragraph contains only generic materiality language with no domain-specific terminology, firm-specific facts, or externally verifiable claims; negative assertions about incident absence are not verifiable.


reasoning: This paragraph is a cross-reference directing readers to risk factor disclosures in Item 1A, without providing any substantive cybersecurity content about governance, management, processes, or actual incidents.


fact: aligned with the National Institute on Standards and Technology Cybersecurity Framework

fact: third party security operation center

fact: multi-factor authentication

fact: email filtering

fact: firewalls

fact: intrusion prevention and detection systems

fact: encryption of information

fact: malware defenses

fact: patching

reasoning: This paragraph describes the company's cybersecurity program activities, tools, and defenses, answering 'what does the cybersecurity program do?' which fits Risk Management Process. Specificity is Domain-Adapted due to multiple cybersecurity-specific terms (NIST CSF, SOC, MFA, IDS/IPS, encryption, malware defenses, patching) that demonstrate domain expertise beyond generic ERM language.


fact: June 21, 2023 - date Umpqua Bank was informed of the incident

fact: June 22, 2023 - date customer email notification was sent

fact: August 2023 - date mailed notice was sent to affected customers

fact: 429,252 Umpqua Bank customers affected

fact: MOVEit filesharing software

fact: Umpqua Bank - named subsidiary

reasoning: This paragraph describes a specific cybersecurity incident (MOVEit vulnerability) with detailed facts about timing, scope, and response, clearly answering 'what happened.' Specificity is Level 4 due to multiple verifiable facts including specific dates (June 21, 2023; June 22, 2023; August 2023), a precise affected customer count (429,252), and named systems (MOVEit).


fact: Incident Management and Information Security Plan - named internal program with distinguishing identifier

reasoning: This paragraph describes the Risk Committee's oversight role in providing assurances to the Board about risk identification and control implementation, which is classic board-level governance structure. The specificity reaches Level 3 due to the named internal program 'Incident Management and Information Security Plan' which serves as a firm-specific identifier distinguishing this company's cybersecurity documentation.


fact: over 15 years experience in managing cybersecurity, information technology and other risk management processes

fact: more than 30 years of experience

fact: CRO, CIO, and CISO roles

fact: member of RGA's Executive Committee

fact: Global Chief Risk Officer position

reasoning: This paragraph describes the qualifications, experience, and responsibilities of three cybersecurity leadership positions (CRO, CIO, CISO), directly answering how management is organized to handle cybersecurity. The specificity reaches Level 4 due to verifiable claims about years of experience ('over 15 years' for all three executives and 'more than 30 years' for the CRO), which are hard lower bounds that could be independently checked against professional histories.


fact: firewall

fact: cyber maturity

reasoning: The paragraph primarily describes how the cybersecurity program operates by engaging external parties for incident response, assessments, and infrastructure support—these are third parties hired to serve the company, which per Rule 3 falls under RMP. The vendor oversight mentioned in the final sentence is secondary, addressing risk mitigation rather than being the central topic. Specificity reaches Level 2 due to domain terminology like 'firewall' and 'cyber maturity' that demonstrate cybersecurity expertise beyond generic ERM language.


reasoning: This paragraph contains forward-looking risk disclosure language describing what 'could' happen in a hypothetical cybersecurity attack, without describing any actual governance structure, management role, risk management process, third-party oversight, incident, or materiality assessment. The language is generic speculation that does not demonstrate cybersecurity domain expertise or contain any firm-specific or verifiable facts.


fact: NIST Cybersecurity Framework

fact: CIS Top 18 Critical Security Controls

fact: phishing tests

fact: cyber incident response plan

reasoning: This paragraph comprehensively describes the company's cybersecurity risk management program—its framework adoption, goals, and specific activities—answering 'What does the cybersecurity program do?' The specificity reaches Level 2 due to named cybersecurity frameworks (NIST CSF, CIS Top 18) and domain-specific practices like phishing tests that demonstrate cybersecurity expertise beyond generic ERM language.


fact: combined 20 years of risk management experience

fact: CIO

fact: threat assessments

fact: cybersecurity insurance

fact: incident response

fact: end user awareness

fact: vulnerability management

reasoning: This paragraph describes the composition of the Information Security Committee (ISC) and the qualifications of its members, answering 'How is management organized to handle cybersecurity?' The specificity reaches Level 4 due to the verifiable 'combined 20 years of experience' claim, with additional firm-specific facts (CIO, Director of IT Security, Risk and Compliance roles) and domain terminology throughout.


fact: CISO

reasoning: This paragraph describes how the Board receives cybersecurity information (briefings from CISO, external expert presentations), directly answering the Board Governance question of oversight structure and information flow. The mention of 'CISO' is a firm-specific fact—a VP-level cybersecurity leadership role that distinguishes this company's governance structure—elevating specificity to Level 3.


reasoning: This paragraph is purely a cross-reference directing readers to Item 1A Risk Factors for cybersecurity discussion, with no substantive disclosure content. It contains no specific facts about the company's cybersecurity posture, governance, or processes.


reasoning: This paragraph describes board-level oversight structure, including the Audit Committee's oversight responsibilities for cybersecurity risks and the creation of a Cybersecurity Sub-Committee for incident response oversight. The specificity reaches Level 3 due to the named 'Cybersecurity Sub-Committee of the Board of Directors,' which is a firm-specific committee structure not present at every company.


reasoning: The paragraph primarily describes how cybersecurity risks are assessed and managed through integration with ERM, the annual risk assessment cycle, and the areas covered by annual security reviews. The Audit Committee oversight mention is one component but the bulk of the content answers 'What does the cybersecurity program do?' Specificity is Level 1 because all terminology (ERM, risk assessment, incident response, business continuity) fails the ERM test—this is language any business professional would use, not cybersecurity domain expertise.


fact: ransomware

fact: malware

fact: computer viruses

fact: phishing attempts

reasoning: The paragraph opens with a materiality assessment stating no material cybersecurity incidents have occurred as of December 31, 2023, which under Rule 5 is a backward-looking assessment about business impact. The insurance mention further supports Strategy Integration. Specificity is Level 2 due to domain-specific threat terminology (ransomware, malware, phishing) that passes the ERM test, but no firm-specific or verifiable facts are present.


fact: over 20 years of information technology and cybersecurity experience

fact: security engineers

fact: detection specialists

reasoning: The paragraph primarily describes management organization—the CISO's qualifications and team composition—with incident response process mentioned secondarily, so Management Role fits best. Specificity reaches Level 4 due to the verifiable 'over 20 years of experience' claim, plus the CISO role (Level 3) and domain terms like 'security engineers' and 'detection specialists' (Level 2).


reasoning: The paragraph primarily answers whether the company has experienced material cybersecurity incidents, stating a negative assertion ('there have been no material incidents incurred to-date') which constitutes a materiality assessment under Strategy Integration per Rule 5. The paragraph contains no domain terminology passing the ERM test, no firm-specific facts, and no verifiable claims—the negative assertion about absence of incidents is not externally verifiable, and the remaining language is generic risk factor speculation and cross-references.


fact: vulnerability

fact: independent testing of target technology

reasoning: The paragraph centrally addresses how the company manages third-party security risks in the M&A context—due diligence, independent testing, remediation requirements, and contractual protections for acquisition targets—making it Third-Party Risk under Rule 3. Specificity reaches Level 2 due to cybersecurity domain terminology ('vulnerability', 'independent testing' in security context) that demonstrates expertise beyond generic ERM language, but lacks firm-specific organizational details or verifiable claims.


fact: Operational Risk Committees

fact: Enterprise Risk Management Committee

fact: Head of Technology & Operations

fact: Chief Risk Officer

fact: Chief Technology Officer

reasoning: The paragraph primarily describes management-level committee structure and membership for cybersecurity risk oversight, including named committees (Operational Risk Committees, Enterprise Risk Management Committee, Information Security and Data Management Committee) and their chairs, which constitutes management organization rather than board governance. Multiple firm-specific facts including named committees and VP-level roles elevate specificity to Firm-Specific.


reasoning: The paragraph describes cybersecurity monitoring activities, security measures, system audits, and incident response planning—answering what the cybersecurity program does. Applying the person-removal test, substantive program content remains after extracting the SVP IT role. Specificity reaches Firm-Specific due to the Senior Vice President of Information Technology title, a VP-level role that distinguishes this company's cybersecurity posture.


fact: May 14, 2019 - specific date AMCA notified the Company about the security incident

fact: Retrieval-Masters Credit Bureau, Inc. d/b/a American Medical Collections Agency (AMCA)

fact: AMCA Incident - named incident identifier

reasoning: This paragraph describes an actual cybersecurity incident (the AMCA Incident) with specific details about timing, nature, and impact, answering 'What happened in a cybersecurity incident?' The specific notification date of May 14, 2019 and the named third-party firm AMCA are externally verifiable facts that elevate this to Quantified-Verifiable specificity.


fact: CIO

fact: Vice President of Information Security

fact: vulnerability assessments

reasoning: This paragraph describes the Board and Audit Committee's oversight of cybersecurity risks, including reporting cadences and the flow of information from management to the Board, making it a clear Board Governance paragraph. Specificity reaches Firm-Specific due to named cybersecurity leadership roles (CIO, Vice President of Information Security) and a named internal team (Information Technology Senior Leadership Team).


fact: July 2018

fact: ransomware

reasoning: This paragraph describes an actual cybersecurity incident (ransomware attack in July 2018) with details on timing, scope, investigation findings, and impact, which directly answers 'What happened in a cybersecurity incident?' The specific date 'July 2018' tied to a real event is externally verifiable through news reports and SEC filings, elevating this to Quantified-Verifiable.


fact: cross-functional team composition for third-party risk assessment: end-user, Legal, Privacy and Information Security teams

reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers, covering vendor assessment processes, risk prioritization, and ongoing monitoring—clearly Third-Party Risk. Specificity reaches Firm-Specific (Level 3) based on the detailed team composition for third-party risk assessments (end-user, Legal, Privacy and Information Security teams), which distinguishes this company's organizational approach.


reasoning: This paragraph is a materiality assessment stating that cybersecurity risks have not materially affected and are not reasonably likely to materially affect the company's business strategy, results of operations, or financial condition, which per Rule 5 is Strategy Integration. The paragraph contains no domain terminology, firm-specific facts, or verifiable claims—only negative self-assertions about absence of incidents and forward-looking disclaimers that do not elevate specificity above Level 1.


reasoning: This paragraph describes activities the cybersecurity program undertakes—engaging external assessors, evaluating threats, and conducting forensic reviews—which fits Risk Management Process. Under Rule 3, third parties hired to serve the company (assessors, consultants) fall under RMP rather than Third-Party Risk. The language is generic business prose that any ERM professional could write; terms like 'forensic reviews' and 'security assessments' do not pass the ERM test as they lack the specific cybersecurity expertise shown by terms like 'penetration testing' or 'SIEM.'


reasoning: This paragraph is a standard executive biography describing Travis Smith's manufacturing, engineering, and HSE responsibilities with no cybersecurity content whatsoever - his title and career history contain no reference to IT, information security, or cybersecurity roles.


fact: Certified Information Systems Security Professional (CISSP)

fact: Global Industrial Cyber Security Professional (GICSP)

fact: Electricity Information Sharing and Analysis Center

fact: Cybersecurity and Infrastructure Security Agency

fact: Enterprise Cybersecurity team

fact: network monitoring

fact: vulnerability scanning

reasoning: The paragraph describes the cybersecurity team's risk management activities including threat intelligence sources and security tools, making it Risk Management Process. It contains verifiable facts including named certifications (CISSP, GICSP) that can be independently verified through certification registries, plus named threat intelligence sources (E-ISAC, CISA) and domain terms like network monitoring and vulnerability scanning.


fact: CISO

fact: cybersecurity subcommittee

fact: Senior Vice President – Enterprise Risk Officer

fact: more than 20 years of experience in cybersecurity and information technology

fact: CISM certification

fact: Master's degree in Business Administration with a focus on Information Technology

reasoning: The paragraph primarily describes the CISO's role, qualifications, and reporting structure, making it Management Role. Specificity reaches Quantified-Verifiable due to multiple externally verifiable claims: CISM certification (checkable via ISACA registry), more than 20 years of experience (specific lower bound), and MBA with IT focus (verifiable credential).


reasoning: This paragraph is primarily forward-looking risk disclaimer language describing hypothetical negative consequences ('could disrupt,' 'could damage,' 'could have a material adverse effect') rather than substantive disclosure about cybersecurity governance, processes, or incidents. The brief mention of having implemented processes and controls is generic boilerplate without any specific detail, and no domain terminology, firm-specific facts, or verifiable claims are present.


fact: Chief Information Officer

reasoning: This paragraph describes management's organizational role for cybersecurity—the CIO's responsibilities, supervisory authority over internal personnel and external consultants, and professional qualifications—which directly answers how management is organized to handle cybersecurity. The CIO title is a firm-specific leadership role at the VP-or-above level, elevating specificity to Level 3, while the experience description ('many years') is too vague to be verifiable.


fact: On October 11, 2023, we announced that we had experienced disruptions in our Information Technology (IT) infrastructure and applications resulting from a cybersecurity incident

fact: disruption of our business operations for approximately three days

fact: fulfill our backlog of orders caused by the operational disruption within one week

reasoning: This paragraph describes a specific cybersecurity incident that occurred in October 2023, including the nature of unauthorized activity, timeline of disruption, remediation steps, and resolution—directly answering 'What happened in a cybersecurity incident?' The incident frame dominates over the financial impact conclusion at the end. Specificity reaches Level 4 due to the specific October 11, 2023 announcement date and quantified operational disruption duration (three days, one week recovery), which are externally verifiable facts.


fact: threat intelligence services

reasoning: The paragraph primarily addresses how the company manages cybersecurity risks at third parties, with two of three sentences describing vendor security requirements and compliance assessment under a Third-Party Risk Management program. The threat intelligence reference in the first sentence is a domain term that elevates specificity to Level 2.


reasoning: This paragraph centrally addresses how Tredegar manages cybersecurity risks from third-party service providers, including requiring vendors to implement security measures and conducting periodic assessments of vendor security frameworks. The language is generic vendor oversight terminology that could apply to any risk domain without demonstrating cybersecurity-specific expertise or firm-unique details.


reasoning: The paragraph contains a negative materiality assertion ('we have not experienced any material adverse events related to a security breach or cyber-attack'), which per Rule 5 qualifies as a Strategy Integration assessment about whether cybersecurity has affected business outcomes. The specificity is Generic Boilerplate because the paragraph lacks domain terminology that passes the ERM test (terms like 'security breach' and 'cyber-attack' are generic business language any ERM professional would use), contains no firm-specific facts, and the negative assertion about absence of incidents is not externally verifiable.


fact: Chief Technology Officer

fact: Technology Leadership Centre

fact: Chief Risk Officer

fact: Risk Committee of the board of directors

fact: Controlling Department

reasoning: This paragraph describes a three lines of defense governance model for cybersecurity risk oversight, explaining how oversight flows from management through risk management to audit functions, with board-level committees (Risk Committee, Audit Committee) explicitly identified in the structure. Specificity reaches Level 3 due to named C-level roles (Chief Technology Officer, Chief Risk Officer) and firm-specific organizational units (Technology Leadership Centre, Controlling Department, Risk Committee of the board).


fact: February 16, 2022 - specific date of cybersecurity intrusion detection

fact: cybersecurity intrusion that caused a network disruption and impacted certain of our systems

reasoning: This paragraph describes an actual cybersecurity incident with specific details about timing (February 16, 2022), nature (intrusion causing network disruption), and response (engaging internal resources and third-party experts), which directly answers 'What happened in a cybersecurity incident?' The specificity reaches Level 4 because the specific date 'February 16, 2022' tied to a real cybersecurity incident is externally verifiable through news reports, SEC filings, or other public sources.


fact: credit monitoring

fact: two years

reasoning: This paragraph describes ongoing post-incident response activities including law enforcement engagement, litigation defense, and customer remediation measures, which directly answers what happened following a cybersecurity incident. The specificity reaches Quantified-Verifiable due to the specific two-year duration for identity protection services, which is an externally verifiable claim about the remediation offer.


fact: FFIEC framework

fact: NIST cybersecurity framework

reasoning: This paragraph describes the company's cybersecurity program design methodology and framework adoption (FFIEC and NIST), answering 'What does the cybersecurity program do?' The named frameworks (FFIEC, NIST) pass the ERM test as domain-specific terminology that a non-security ERM professional would not naturally use, establishing Level 2 specificity with no firm-specific or verifiable facts present.


reasoning: This paragraph describes the Board and Audit Committee's oversight structure for cybersecurity, including what topics are reviewed and the reporting chain from management through the Audit Committee to the full Board. The paragraph contains only generic governance language without domain-specific cybersecurity terminology that passes the ERM test, and the roles mentioned (Audit Committee, Chief Innovation Officer) are either explicitly excluded as generic or not clearly cybersecurity leadership roles under the specificity rules.


reasoning: This paragraph is a standard executive biography for the Chief Human Resources Officer with no connection to cybersecurity—his responsibilities (employee engagement, total rewards, talent acquisition) are entirely HR-focused with no mention of IT or security functions. Since this is classified as None/Other, specificity defaults to Generic Boilerplate regardless of the verifiable biographical facts present.


fact: CIO has more than 30 years of experience

fact: CIO held prior roles at Aegon N.V., Citigroup, Inc. and JP Morgan Chase & Company

fact: CISO has more than 20 years of cybersecurity experience

fact: CISO was Senior Vice President, Chief Information Security Officer at Brighthouse Financial

fact: CISO served as Technology Vice President & Chief Information Security Officer for GE Healthcare

fact: CISO started his career at Allstate Insurance Company

fact: CISO holds Certified Information Systems Auditor certification

fact: CISO holds Certified Information Security Manager certification

fact: CISO holds Certified Information Systems Security Professional certification

reasoning: This paragraph describes the qualifications, career history, and certifications of the CIO and CISO, directly answering how management is organized to handle cybersecurity. The specificity is Level 4 due to multiple verifiable facts: named certifications (CISA, CISM, CISSP) that can be checked in professional registries, specific years of experience as lower bounds (30+ and 20+ years), and named prior employers (Aegon, Citigroup, JP Morgan Chase, Brighthouse Financial, GE Healthcare, Allstate).


reasoning: The paragraph is entirely focused on how the company manages cybersecurity risks from third-party service providers, including evaluation of vendor security practices, contractual safeguards, and review of internal control reports—this directly answers 'How are third-party cyber risks managed?' The language is generic risk management terminology without domain-specific vocabulary that passes the ERM test, no firm-specific organizational details, and no verifiable claims.


fact: Chief Risk Officer

specificity_confidence: medium

reasoning: This paragraph describes a management leadership role (Chief Risk Officer) and their responsibilities within the ERM structure, which directly answers how management is organized to handle risk including cybersecurity. The CRO is a named C-level position that qualifies as firm-specific, though it is a broader risk role rather than exclusively cybersecurity-focused.


reasoning: This paragraph is a backward-looking materiality assessment stating that no cybersecurity incidents have materially affected the company, which fits Strategy Integration under Rule 5. The negative assertion about absence of material incidents is not externally verifiable, and the language contains no domain terminology or firm-specific facts that would elevate specificity above Level 1.


fact: dedicated department within Enterprise Risk Management division for third-party cybersecurity risk management

reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers, describing both the organizational structure (dedicated ERM department) and the evaluation process for vendor cybersecurity risks. The specific organizational claim of a dedicated department within the Enterprise Risk Management division for third-party risk management distinguishes this company's approach.


fact: System Organization and Control Reports (SOC Reports)

reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party providers, describing vendor oversight processes including pre-acquisition diligence, contractual obligations, and SOC Reports monitoring. SOC Reports is domain-specific cybersecurity/IT audit terminology that passes the ERM test, establishing Level 2 specificity.


fact: Vice President of Information Technology, Security and Business Intelligence

fact: over 18 years of experience in information technology and information security

fact: Biogen, AstraZeneca, Iron Mountain, Charles River Labs, Sunovion Pharmaceuticals, Agero, DentaQuest

fact: master's degree in business administration from Boston University

fact: master's degree in electrical and computer engineering from Utah State University

fact: bachelor's degree in electronics engineering from Mumbai University

fact: over 10 years of experience managing cybersecurity risks for IT team

reasoning: This paragraph describes the management role responsible for cybersecurity oversight (VP of IT, Security and Business Intelligence), their qualifications, career history, and coordination with senior leadership, which directly answers how management is organized to handle cybersecurity. The specificity is Quantified-Verifiable due to multiple verifiable facts including 'over 18 years' of experience, named previous employers, named universities for degrees, and 'over 10 years' for the IT team.