reasoning: The paragraph primarily describes the company's internal cybersecurity risk assessment processes, including tabletop exercises and penetration testing, which are overseen by a specific management committee.


content_category: Risk Management Process

category_confidence: high

specificity_confidence: high

reasoning: The paragraph describes the company's internal cybersecurity policies, incident response plan, and related processes for managing and mitigating cyber threats.

provider: google

stage: benchmark


content_category: Management Role

reasoning: The paragraph explicitly identifies the management roles responsible for cybersecurity (CIO, VP Information Technology, Manager of Security) and details their collective years of experience.


reasoning: The paragraph primarily details the management structure, specifically identifying the CIO, the Director of Information Security, and the reporting lines and composition of the Information Security Team.


reasoning: The paragraph explicitly identifies the CIO and VP of Information Security as the leaders of the cybersecurity program and details their professional experience and team expertise.


content_category: Board Governance

reasoning: The paragraph explicitly discusses the Board of Directors and the Audit Committee's roles in overseeing cybersecurity risks, making Board Governance the clear category.


reasoning: The paragraph describes the company's implementation of a cybersecurity risk management program to identify, assess, and mitigate risks to its data and systems.


content_category: Incident Disclosure

reasoning: The paragraph describes a specific cybersecurity incident involving a third-party vendor (Change Healthcare), detailing the operational impact on the company's billing processes, the response actions taken, and the materiality assessment of the event.


reasoning: The paragraph focuses exclusively on the qualifications, experience, and certifications of the Chief Information Security Officer (CISO).


reasoning: The paragraph primarily describes the company's risk management program, its integration into ERM, and its foundational frameworks, while also detailing the CISO's reporting structure.


reasoning: The paragraph details the company's internal cybersecurity processes, including monitoring, defense-in-depth safeguards, and incident response planning. Although the CISO is mentioned as the actor, the focus is on the functions and processes rather than the individual's qualifications.


reasoning: The paragraph focuses on the CEO's responsibility to brief the Audit Committee on cybersecurity risks and initiatives, making management the primary subject.


content_category: Third-Party Risk

reasoning: The paragraph focuses entirely on the company's vendor management program, detailing how third-party risks are assessed, evaluated by specific internal teams, and managed through contractual obligations.


reasoning: The paragraph primarily discusses the integration of cybersecurity risk assessment into the company's overall risk management processes, which aligns with the Risk Management Process category.


reasoning: The paragraph primarily details the composition of the management-level Cyber Incident Response Team and the specific responsibilities and reporting lines of the Executive Vice President of Information Technology.


reasoning: The paragraph focuses on the management-level cybersecurity committee, identifying its leader (Vice President, IT) and its cross-functional composition, which aligns with the Management Role category.


reasoning: The paragraph describes the integration of cybersecurity into the company's Enterprise Risk Management (ERM) program and outlines the internal functions and roles responsible for managing this risk.


reasoning: The paragraph details the company's internal cybersecurity risk management processes, including its framework adoption, controls, vulnerability assessments, and disaster recovery program.


reasoning: The paragraph focuses entirely on the board of directors and Audit Committee's oversight of cybersecurity risks, including their briefing cadence and discussions with management.


reasoning: The paragraph explicitly describes a past cybersecurity incident (2021 malware attack), detailing the operational impact (server outage, flight cancellations) and financial consequences, which clearly falls under Incident Disclosure.


reasoning: The paragraph focuses on the management roles (CIO and Director of Cybersecurity) and the cybersecurity team, detailing their combined years of experience and day-to-day responsibilities.


content_category: Strategy Integration

reasoning: The paragraph focuses on the materiality of cybersecurity risks and past incidents, concluding they have not materially affected the company, and explicitly notes the lack of cyber insurance coverage.


reasoning: The paragraph primarily describes the company's internal risk management programs, including how they evaluate cybersecurity risks, integrate with enterprise and energy commodity risks, and assess third-party service providers.


reasoning: The paragraph focuses entirely on the Board's role in overseeing cybersecurity risks, receiving incident updates, and approving policy changes.


reasoning: The paragraph focuses entirely on the Board of Directors and the Audit Committee's oversight of cybersecurity risks and their briefing cadences.


reasoning: The paragraph focuses on the Chief Technology Officer, detailing his responsibilities, reporting lines, and specific career background and qualifications.


reasoning: The paragraph details the company's internal processes for identifying, monitoring, evaluating, and mitigating cybersecurity threats, which are core components of its risk management program.


content_category: None/Other

reasoning: The paragraph consists entirely of generic risk acknowledgments and descriptions of general cyber threats, containing no substantive disclosure about the company's actual cybersecurity program, governance, or incidents.


reasoning: The paragraph explicitly describes a past cybersecurity incident, detailing the date (June 2018), the nature of the attack (unauthorized email access leading to fraudulent disbursements), and the financial impact ($10 million).


reasoning: The paragraph describes the company's internal cybersecurity program, detailing processes such as continuous monitoring, vulnerability management, use of security tools, and employee training.


reasoning: The paragraph primarily describes the company's internal cybersecurity processes, including the responsibilities of the IT security team, cross-functional training, internal audits, and the use of third-party consultants.


reasoning: The paragraph primarily details the management structure, roles, and committees responsible for cybersecurity, including the CISO's qualifications, the composition of the Enterprise Security Council, and the CEO's specific background in cyber strategy.


reasoning: The paragraph primarily describes the company's internal risk assessment, safeguard implementation, and mitigation processes, while noting that the Chief Information Officer manages these activities.


reasoning: The paragraph describes the company's internal cybersecurity processes, including the use of frameworks, a cybersecurity plan, and an information security policy.


reasoning: The paragraph primarily describes the company's internal cybersecurity processes, including its ISG Policy, the roles responsible for managing the program, and the various safeguards and measures implemented. While it mentions management roles, the focus is on what the program does and how it is structured.


reasoning: The paragraph provides a comprehensive list of the company's internal cybersecurity processes, policies, and controls used to manage and mitigate cyber risks.


reasoning: The paragraph details the company's internal cybersecurity risk management processes, including framework adoption, vulnerability management, and incident response planning.


reasoning: The paragraph explicitly describes a past cybersecurity incident that occurred in November 2023, detailing the resulting IT disruption and the company's subsequent investigation, remediation, and notification actions.


reasoning: The paragraph describes the company's internal processes for tracking, logging, reviewing, and escalating cybersecurity incidents, which falls squarely under Risk Management Process.


reasoning: The paragraph provides a detailed narrative of a specific cybersecurity incident involving the Targus subsidiary, including the date of discovery, response actions, operational impact, and a materiality assessment.


reasoning: The paragraph primarily describes the company's internal cybersecurity risk management processes, including its integration with enterprise risk management, adoption of the NIST framework, and internal policy structures.


reasoning: The paragraph outlines the company's cybersecurity governance structure, with a highly detailed focus on the CISO's identity, career history, and educational qualifications, making Management Role the most substantive category.


reasoning: The paragraph focuses exclusively on the company's oversight of third-party vendors and contractors, including annual risk assessments and security requirements.


reasoning: The paragraph describes internal processes for threat notification, security awareness training, and risk assessment responsibilities.


reasoning: The paragraph explicitly describes a past cybersecurity incident involving unauthorized email access and the fraudulent diversion of funds, detailing what happened and its impact.


reasoning: The paragraph focuses on the board of directors' responsibility for overseeing the risk management system and monitoring material exposure to cybersecurity risks.


reasoning: The paragraph focuses on the specific teams (IT and C&RM) responsible for cybersecurity and explicitly lists their professional certifications, aligning with management role qualifications and structure.


reasoning: The paragraph discusses the company's cyber insurance coverage and its potential limitations, which falls under Strategy Integration.


reasoning: The paragraph describes the company's internal processes for monitoring threat intelligence and utilizing third-party assessments to inform cybersecurity strategies and investments.


reasoning: The paragraph describes the company's internal processes for implementing and monitoring safeguards following risk assessments, and identifies the general role responsible for executing these processes.


reasoning: The paragraph explicitly describes a real cybersecurity incident, providing the specific dates of unauthorized access and detailing the threat actor's actions, which aligns with the Incident Disclosure category.


reasoning: The paragraph explicitly discusses the board of directors and their oversight responsibilities regarding risk management, making Board Governance the most appropriate category.


reasoning: The paragraph consists of a standalone materiality conclusion regarding cybersecurity threats and incidents, followed by a cross-reference to the Risk Factors section, which falls under Strategy Integration.


reasoning: The paragraph describes the company's internal cybersecurity program, including its focus on defense, detection, remediation, and its crisis response plan, which falls under risk management processes.


reasoning: The paragraph focuses entirely on the Board and Audit Committee's oversight responsibilities regarding cybersecurity risks and policies.


reasoning: The paragraph describes the company's internal risk mitigation strategies, specifically detailing its access control limitations and network architecture to minimize cybersecurity risks.


reasoning: The paragraph provides a standalone materiality conclusion regarding cybersecurity risks and past incidents, along with a cross-reference to the risk factors section.


reasoning: The paragraph consists entirely of generic, forward-looking boilerplate regarding regulatory compliance and potential penalties, containing no substantive disclosure about the company's actual cybersecurity program.


reasoning: The paragraph primarily details the management-level committees (Information Technology Steering Committee, Operational Risk Management Committee) and the specific management roles (CIO, CISO, Chief Operational Risk Management Officer) responsible for overseeing the cybersecurity program, before noting their reporting line to the board.


reasoning: The paragraph focuses on the Board's oversight of cybersecurity risks, including the delegation of this responsibility to the Audit Committee and the reporting cadence.


reasoning: The paragraph identifies the information technology manager as the leader of the security team and outlines the role's responsibilities in managing cybersecurity processes.


reasoning: The paragraph describes the details of an actual cybersecurity incident, including unauthorized access, data exfiltration, extortion demands, and the company's response actions.


reasoning: The paragraph primarily discusses the board of directors and the Audit Committee's oversight of cybersecurity risks, including the reporting cadence from management.


reasoning: The paragraph is a pure cross-reference directing the reader to the Risk Factors section for information on materiality, without providing any substantive cybersecurity disclosure or actual materiality conclusion itself.


reasoning: The paragraph focuses on management's responsibilities for overseeing cybersecurity risks, their potential training, and their reporting cadence to the Board.


reasoning: The paragraph describes the company's internal risk management structures, specifically noting that cybersecurity is handled by an organization within the operations department.


reasoning: The paragraph explicitly discusses the board of directors' responsibility for oversight and their receipt of periodic updates from management regarding cybersecurity risks.


reasoning: The paragraph primarily discusses the expected role of the Board of Directors in overseeing cybersecurity risks, including their briefing cadence and engagement with management.


reasoning: The paragraph explicitly discusses the board's oversight of the enterprise risk management program and the formation and responsibilities of the cybersecurity risk committee.


reasoning: The paragraph details the company's internal data security practices, including where data is stored and how sensitive payment information is handled.


reasoning: The paragraph details the objectives and scope of the company's internal Enterprise Information Systems Security Policy, which governs their cybersecurity risk management and controls.


reasoning: The paragraph focuses on the specific management roles, their qualifications, team compositions, and reporting lines responsible for overseeing the company's cybersecurity program.


reasoning: The paragraph is entirely focused on the company's vendor management program, detailing how it assesses and manages cybersecurity risks associated with third-party service providers.


reasoning: The paragraph primarily describes the company's internal incident response plan and the processes for evaluating, escalating, and mitigating cybersecurity incidents.


reasoning: The paragraph primarily focuses on the specific management roles (Chief Technology Officer and Head of Technology Infrastructure) responsible for the cybersecurity program, detailing their specific years of experience and qualifications.


reasoning: The paragraph primarily details the qualifications, reporting lines, and responsibilities of specific management roles, including the Chief Digital and Technology Officer, Chief Information Officer, and a CISO consultant.


reasoning: The paragraph describes the oversight responsibilities and the reporting cadence to the Board of Directors and CEO regarding the company's cybersecurity program and threat landscape.


reasoning: The paragraph focuses on the management team's responsibilities for cybersecurity risk management, their lack of specialized backgrounds, and their reliance on a third-party provider.


reasoning: The paragraph provides a standalone materiality conclusion regarding cybersecurity threats and prior incidents, followed by a cross-reference to the Risk Factors section, which falls under Strategy Integration.


reasoning: The paragraph details the company's internal cybersecurity policies, risk assessment activities, and monitoring processes, which are core components of risk management.


reasoning: The paragraph primarily discusses the company's internal approach, policies, standards, and processes for assessing and managing cybersecurity risks.


reasoning: The paragraph describes the company's internal risk management processes by listing the types of third-party service providers it uses to identify and manage cybersecurity threats.


reasoning: The paragraph describes the company's internal risk assessment processes, including datacenter audits and the oversight of third-party service providers.


reasoning: The paragraph describes the company's internal cybersecurity program, risk assessment elements, and incident response policies, which are core components of its risk management process.


reasoning: The paragraph details the company's internal security controls, tools, and monitoring processes, such as MFA, firewalls, penetration testing, and a security operations center.


reasoning: The paragraph details the company's internal cybersecurity measures and technical controls, such as EDR, SIEM, and MFA, which are core components of its risk management process.


reasoning: The paragraph explicitly details the Board's and the Audit and Risk Committee's roles in overseeing cybersecurity risks and receiving reports from internal teams.


reasoning: The paragraph details the company's internal cybersecurity risk management processes, including its controls, monitoring activities, threat intelligence gathering, and employee training programs.


reasoning: The paragraph focuses on the roles of the CEO and CFO in directing the security governance structure and consulting with third-party experts to manage cybersecurity risks.


category_confidence: medium

reasoning: The paragraph primarily details the governance structure, specifically focusing on the Board's oversight of cybersecurity and the semiannual briefing cadence from the CIO and CISO.


reasoning: The paragraph describes the company's internal cybersecurity capabilities, including its Security Operations Center (SOC) and processes like threat hunting and vulnerability scanning, which falls under Risk Management Process.


reasoning: The paragraph explicitly describes a past cybersecurity incident (a 2019 wire fraud scheme via email compromise) and details the subsequent response actions taken by the company, such as implementing MFA.


reasoning: The paragraph primarily describes the Board and Audit Committee's oversight of cybersecurity risk, alongside general management responsibilities.


reasoning: The paragraph primarily discusses the audit committee and the board receiving reports on cybersecurity threats and incidents, which falls under board oversight.


reasoning: The paragraph focuses on the composition, leadership (CDO, General Counsel, IT Director), and reporting lines of the management team (CIMT) responsible for handling cybersecurity incidents.


reasoning: The paragraph focuses on the specific title, reporting structure, and professional experience of the management individual responsible for cybersecurity.


reasoning: The paragraph explicitly details the Board's Audit Committee and its role in overseeing cybersecurity risk management, making Board Governance the most applicable category.


reasoning: The paragraph provides a standalone materiality conclusion regarding the absence of material cybersecurity incidents and their impact on business strategy and financial condition, which falls under Strategy Integration.


reasoning: The paragraph describes a specific past data breach involving Progress software, customer notifications, and a subsequent SEC investigation, which aligns with the Incident Disclosure category.


reasoning: The paragraph describes the company's internal processes for gathering threat intelligence, benchmarking, and auditing to inform its cybersecurity program.


reasoning: The paragraph explicitly describes a past cybersecurity incident involving DISH Network, detailing the exact dates of the outage and data extraction, along with the company's response actions.


reasoning: The paragraph discusses the potential business and financial impact of cybersecurity threats and incidents, which aligns with the Strategy Integration category's inclusion of materiality and business impact assessments.


reasoning: The paragraph discusses the critical nature of data security and IT systems to the company's overall business operations and strategy, without detailing specific risk management processes or governance structures.


reasoning: The paragraph primarily focuses on the roles and qualifications of management, specifically detailing the CEO's 15 years of IT experience and the executive officers' responsibilities for oversight and reporting.


reasoning: The paragraph details the company's internal incident response processes, including the composition of the Incident Response Team, escalation protocols to the CSC, and materiality assessment procedures.


reasoning: The paragraph provides a standalone materiality conclusion regarding cybersecurity risks and cross-references the Risk Factors section, which falls under Strategy Integration.


reasoning: The paragraph describes the reporting cadence and oversight mechanisms involving the Enterprise Risk and Compliance Committee and the Board's Audit Committee.


reasoning: The paragraph describes the processes and methods used by the company to identify and assess cybersecurity risks, such as real-time monitoring and automated tools, making it a Risk Management Process disclosure despite the mention of the CFO.


reasoning: The paragraph is classified as Management Role because the grammatical subject is a specific management position (Vice President, Information Technology) and the text details their reporting responsibilities and cadence to a board committee.


reasoning: The paragraph primarily details the company's internal cybersecurity risk assessment processes, including specific tools, frameworks, and procedures used to identify and mitigate risks, making Risk Management Process the most applicable category.


reasoning: The paragraph explicitly identifies the CISO, their reporting line to the GCSO, and their experience, making Management Role the most appropriate category.


reasoning: The paragraph details the activities and processes overseen by the management team, such as risk management, incident response, and policy development, making it a description of the risk management function rather than specific personnel qualifications.


reasoning: The paragraph exclusively details the qualifications, career history, tenure, and certifications of various management personnel responsible for cybersecurity and risk management.


reasoning: The paragraph focuses entirely on the qualifications, credentials, experience, and reporting structure of the CIO and CISO, which clearly falls under Management Role.


reasoning: The paragraph primarily focuses on the Information Security Officer, detailing their responsibilities, reporting lines, and specific career experience, which aligns with the Management Role category.


reasoning: The paragraph describes the company's internal risk management processes, specifically focusing on external assessments, audits, and penetration testing of its information security management system.


reasoning: The paragraph describes a specific physical security incident, detailing the method of entry, the lack of material impact, and the remediation actions taken, which triggers the Incident Disclosure category.


reasoning: The paragraph primarily discusses the Board of Directors and Audit Committee's oversight of cybersecurity risks, including the reporting cadence and updates received from management.


reasoning: The paragraph details the reporting cadence and governance structure, specifically focusing on how the Chief Security Officer provides quarterly and ad hoc updates to the Management Board and a specialized Supervisory Board committee.


reasoning: The paragraph explicitly identifies the management roles leading the cybersecurity program (Global IT Director, System Infrastructure Manager, Network Infrastructure Manager) and details their qualifications (over 20 years of experience).


reasoning: The paragraph provides a standalone materiality conclusion regarding cybersecurity risks and their impact on business strategy and financial condition, along with a cross-reference to the Risk Factors section.


reasoning: The paragraph primarily describes the oversight structure and reporting cadence involving the Board of Directors, the Audit Committee, and management.


reasoning: The paragraph explicitly references a past cybersecurity incident and discusses the subsequent response actions (implementing additional safeguards), fitting the Incident Disclosure category.


reasoning: The paragraph primarily details the composition and responsibilities of a management-level Cybersecurity Disclosure Committee, including its reporting line to the Audit Committee.


reasoning: The paragraph focuses entirely on the qualifications, educational background, and career history of the Chief Technology Officer.


reasoning: The paragraph extensively details the Board's oversight structure, specifically the 2025 shift of responsibility to the Sustainability & Safety Committee and its reporting cadence, while also covering management roles and credentials.


reasoning: The paragraph explicitly references actual past cybersecurity incidents and notes the subsequent response actions (implementing additional safeguards), fitting the Incident Disclosure category.


reasoning: The paragraph focuses exclusively on the qualifications, background, and experience of the Vice President of IT, fitting the Management Role category.


reasoning: The paragraph focuses entirely on the Audit Committee's oversight of cybersecurity risks and the reporting cadence from management.


reasoning: The paragraph describes the company's internal processes for designing, implementing, and monitoring safeguards based on risk assessments.


reasoning: The paragraph details the company's internal processes, safeguards, and policies for managing cybersecurity risks, including technical, physical, and organizational measures.


reasoning: The paragraph describes the internal process for monitoring, evaluating, and escalating cybersecurity incidents, making it a Risk Management Process.


reasoning: The paragraph focuses on management's responsibilities regarding the cybersecurity program, specifically under the direction of the Executive Vice President, Administration.


reasoning: The paragraph describes the company's internal cybersecurity incident response plan, including procedures for detection, analysis, containment, and recovery, which falls under Risk Management Process.


reasoning: The paragraph discusses the company's commitment to developing governance and oversight of cybersecurity risks, implementing processes and controls, and acknowledges the susceptibility of its IT infrastructure to cyber-attacks. It mentions the Vice President of IT's responsibility for the program, but the primary focus is on the overall risk management process and the nature of the risks faced.


reasoning: The paragraph focuses on the role of the Co-President in managing cybersecurity risk, developing mitigation strategies, and reporting to the Audit Committee. While it mentions the Audit Committee's oversight, the primary subject and actor in the paragraph is the management role (Co-President).


reasoning: The paragraph discusses the general cybersecurity threats the company faces, the potential adverse effects, and the expenditure of resources on cybersecurity risk management, strategy, and governance, which aligns with Strategy Integration.


reasoning: The paragraph focuses on the CIO's responsibilities, including leading the cybersecurity team, overseeing monitoring processes, and implementing security measures.


reasoning: The paragraph describes the company's internal incident response and vulnerability management processes, including escalation procedures to management and the board.


reasoning: The paragraph primarily describes the roles, responsibilities, and composition of the cybersecurity team, Incident Response Team, and Strategy Board, led by the CISO and CIO, making it a Management Role classification.


reasoning: The paragraph focuses on the qualifications and reporting lines of the Risk Management Steering Committee, CFO, and GC regarding cybersecurity threats, making Management Role the most appropriate category.


reasoning: The paragraph describes the company's internal cybersecurity processes, including training, policies, mock testing, and incident response procedures.


reasoning: The paragraph explicitly discusses the Audit Committee of the Board and its oversight role regarding cybersecurity risk management.


reasoning: The paragraph discusses the potential material adverse effect of cyber incidents and the maintenance of cybersecurity insurance, which aligns with the Strategy Integration category.


reasoning: The paragraph briefly mentions a past ransomware attack and focuses on its material adverse impact on the company's business strategy and financial condition, along with a cross-reference to Risk Factors, aligning with Strategy Integration.


reasoning: The paragraph focuses entirely on the processes used to assess and oversee cybersecurity risks associated with third-party service providers.


reasoning: The paragraph explicitly discusses the Board and Audit Committee's oversight of cybersecurity risk management and their interaction with management, making Board Governance the most applicable category.


reasoning: The paragraph outlines the company's internal cybersecurity processes, including vulnerability scanning, employee training, incident response planning, and third-party risk management.


reasoning: The paragraph is a generic introductory statement acknowledging the existence of cybersecurity risks and threat actors, without providing any substantive disclosure about the company's actual cybersecurity processes, governance, or strategy.


reasoning: The paragraph explicitly describes a past ransomware attack, including the date it occurred and the immediate response actions taken.


reasoning: The paragraph discusses the potential business and financial impacts of future cyber-attacks and the costs associated with compliance and heightened protections, which falls under Strategy Integration.


reasoning: The paragraph focuses on the Nominating and Governance Committee's oversight of cybersecurity risks and the reports it receives from the CISO.


reasoning: The paragraph briefly mentions the Board's oversight but primarily focuses on the establishment and responsibilities of a management-level Risk Committee, making Management Role the most appropriate category.


reasoning: The paragraph focuses on management-level oversight, specifically detailing the roles of the interim CSO, interim DPO, and specific management committees (ISMS Governance Committee, Data Protection Governance Committee) in managing cybersecurity risk.


reasoning: The paragraph explicitly details the Board of Directors' and its various committees' (Audit, Technology and Innovation, Governance) roles and responsibilities in overseeing cybersecurity risks.


reasoning: The paragraph explicitly identifies the management role responsible for cybersecurity (head of IT) and describes their reporting structure and responsibilities.


reasoning: The paragraph primarily discusses the Board of Directors' oversight of cybersecurity risks, its delegation of enterprise risk management to the Audit Committee, and the escalation of risks from management to the Board.


reasoning: The paragraph focuses on the Board and Audit Committee's oversight of cybersecurity, including briefings received from management and the CTO, as well as the committee members' relevant experience.


reasoning: The paragraph provides a standalone materiality conclusion regarding cybersecurity threats and past incidents, which falls under Strategy Integration according to the guidelines.


reasoning: The paragraph explicitly describes a past ransomware attack that occurred in March 2020, detailing the nature of the access, the theft of confidential information, and the subsequent restoration of operations.


reasoning: The paragraph details the reporting cadence and topics presented to the Audit Committee by the CISO, focusing on board-level oversight of cybersecurity risks.


reasoning: The paragraph primarily discusses the company's internal cybersecurity risk management processes, including their integration into the broader enterprise risk management program and alignment with industry frameworks.


reasoning: The paragraph focuses on the responsibilities of various management roles, including the General Counsel, CEO, and IT leaders, in identifying and mitigating cybersecurity risks.


reasoning: The paragraph explicitly details the roles, qualifications, and reporting structure of the Director of Information Technology and the third-party CISO, making Management Role the clear category.


reasoning: The paragraph focuses on the CISO and senior management as the grammatical subjects, detailing their reporting responsibilities to the Audit Committee and the Board.


reasoning: The paragraph's grammatical subject is the Vice President of Corporate Development & Administration, detailing this management role's responsibility to report to the board on cybersecurity matters.


reasoning: The paragraph describes the company's internal cybersecurity policies, processes, and the use of third-party providers to execute various security functions, which falls under the Risk Management Process category.


reasoning: The paragraph describes the internal and external assessment, auditing, and regulatory examination of the cybersecurity program, which falls under risk management processes.


reasoning: The paragraph explicitly describes a past cybersecurity incident that occurred in October 2023, detailing the unauthorized access to user accounts and the subsequent response actions taken by the company.


reasoning: The paragraph explicitly describes a past ransomware attack, including when it occurred and the immediate response actions taken.


reasoning: The paragraph focuses entirely on the qualifications, experience, and career history of the CTO and Senior Director of Information Security, fitting the Management Role category.


reasoning: The paragraph describes the company's IT environment and its reliance on third-party systems, which establishes the scope of its risk management processes.


reasoning: The paragraph primarily discusses the Board of Directors and Audit Committee's oversight of cybersecurity risks, including the reporting cadence from management.


reasoning: The paragraph describes the company's internal cybersecurity program, focusing on employee training, cyber-event simulations, and policy attestations.


reasoning: The paragraph primarily focuses on the management roles and committees responsible for cybersecurity, specifically detailing the leadership of the CISO, the composition of the Incident Response Team, and reporting lines to the Disclosure Committee and Strategy Board.


reasoning: The paragraph details the cadence and content of cybersecurity briefings provided by management to the audit committee, which falls under board oversight.


reasoning: The paragraph explicitly discusses the board of directors and the audit committee's role in overseeing cybersecurity risk.


reasoning: The paragraph primarily details the role, reporting structure, and qualifications of the CIO, making Management Role the most applicable category.


reasoning: The paragraph focuses entirely on the management team's responsibilities, supervision of personnel, and their prior work experience and expertise in cybersecurity.


reasoning: The paragraph explicitly details the board of directors' oversight role and its reporting cadence from the cybersecurity committee.


reasoning: The paragraph focuses entirely on the qualifications, years of experience, and specific certifications of the CDIO, CISO, and cybersecurity team members.


reasoning: The paragraph focuses on management-level oversight of cybersecurity, specifically detailing the roles of the Director of Information Technology and the CISO, as well as the specific management committees they lead.


reasoning: The paragraph focuses entirely on the specific management roles responsible for cybersecurity, detailing their titles, years of experience, and professional certifications.


reasoning: The paragraph focuses entirely on the oversight of third-party service providers, including due diligence processes and contractual security requirements.


reasoning: The paragraph describes the company's internal cybersecurity risk assessments, monitoring mechanisms, and use of third-party testing, which are core components of its risk management process.


reasoning: The paragraph details the company's internal risk management processes, specifically focusing on the responsibilities and activities of the Cybersecurity Steering Committee in overseeing and mitigating cyber risks.


reasoning: The paragraph primarily describes the company's internal cybersecurity processes, including risk management, access control, vulnerability testing, and benchmarking, making it a Risk Management Process disclosure.


reasoning: The paragraph primarily details the responsibilities of a specific management committee (the DPIRC) and the reporting lines of the CISO to the Enterprise Risk Committee.


reasoning: The paragraph describes the company's internal risk management framework and its guidelines for identifying and mitigating security risks.


reasoning: The paragraph describes the company's internal cybersecurity program, security monitoring, and enterprise-wide risk assessment processes.


reasoning: The paragraph is entirely focused on identifying the CISO and detailing his specific qualifications, career history, and educational background.


reasoning: The paragraph focuses entirely on the qualifications, background, and education of the Chief Security and Cash Operations Officer, fitting the Management Role category.


reasoning: The paragraph is a high-level, introductory preamble stating the general importance of cybersecurity to the business, containing no substantive disclosure about actual processes, governance, or strategy.


reasoning: The paragraph is a purely forward-looking disclaimer about the potential future impact of cybersecurity threats on the company and its supply chain, containing no substantive disclosure about actual processes, governance, or incidents.


reasoning: The paragraph introduces the internal committees and management positions, specifically naming the Enterprise Risk Management Committee, responsible for assessing and managing cybersecurity risks.


reasoning: The paragraph describes the company's internal cybersecurity training processes, including phishing campaigns and mandatory awareness courses.


reasoning: The paragraph describes the operational impact and response actions of a specific cybersecurity incident, including system suspension and restoration, making it an Incident Disclosure.


reasoning: The paragraph details the briefing cadence and the specific content of cybersecurity reports provided to the Board of Directors, which aligns with board oversight and governance.


reasoning: The paragraph focuses entirely on the management roles (CFO, CCO, and CIO) responsible for cybersecurity oversight, detailing their specific tenures and years of industry experience.


reasoning: The paragraph explicitly details the management personnel responsible for the information security program, including the departure of the VP and the interim appointment of the IT Manager.


reasoning: The paragraph focuses on the oversight responsibilities of a specific committee (EROC) regarding cybersecurity risks and the reports it receives.


reasoning: The paragraph primarily focuses on the board of directors and audit committee's oversight of cybersecurity risks, including policy adoption, director expertise, and briefing cadences, making Board Governance the most applicable category despite the mention of the CTO.


reasoning: The paragraph describes the company's incident response plan and escalation procedures, which are core components of its internal risk management processes.


reasoning: The paragraph describes the integration of cybersecurity into the company's broader enterprise risk management processes through the Enterprise Risk Council, focusing on the function and composition of this internal committee.


reasoning: The paragraph explicitly describes a past cybersecurity incident, detailing the operational disruptions to online ordering, the recovery status of retail shops, and the specific financial impacts incurred.


reasoning: The paragraph focuses on the specific qualifications, tenure, and career history of the Chief Information Officer and the Strategy Committee Chair, making it primarily about the individuals managing and overseeing cyber risk.


reasoning: The paragraph primarily details the board's oversight structure and the briefing cadence, specifically how the CIO and Head of Information Security report to the Audit Committee regarding cybersecurity risks.


reasoning: The paragraph primarily details the governance structure for cybersecurity, focusing on the Audit Committee's oversight authority and the reporting cadence from the CISO and internal Risk Committee to the board.


reasoning: The paragraph primarily details the management-level structure, including specific roles like the CIO and Head of Operational Risk, and their reporting lines to various risk committees and the board.


reasoning: The paragraph details the company's internal procedures for monitoring, detecting, and responding to cybersecurity incidents, including the specific cross-functional composition of its incident response teams.


reasoning: The paragraph explicitly identifies specific management roles (Chief Security & Cash Operations Officer, Chief Risk Officer, Chief Compliance Officer) and describes their responsibilities, organizational structure, and reporting channels to the Board.


reasoning: The paragraph describes the company's internal cybersecurity processes, including assessments, internal audits, threat intelligence utilization, and employee training.


reasoning: The paragraph details the company's internal processes for monitoring systems, conducting audits, and maintaining an incident response plan. Applying the person-vs-function test, the focus is on the activities and processes executed rather than the personal qualifications of the Director of Infrastructure.


reasoning: The paragraph focuses on the reporting structure, responsibilities, and specific qualifications of management roles, particularly the Chief Information Security Officer and Chief Information Officer.


reasoning: The paragraph identifies the specific management teams and departments responsible for overseeing the company's cybersecurity risk management and strategy processes.


reasoning: The paragraph provides a generic introduction acknowledging the importance of cybersecurity measures and the company's dependence on information technology, serving as a high-level preamble to its risk management approach.


reasoning: The paragraph details the escalation protocols for notifying the Board and Audit Committee about cybersecurity incidents, and explicitly highlights the specific IT management experience of an independent Board member.


reasoning: The paragraph explicitly identifies the management roles responsible for cybersecurity, specifically naming the Chief Technology Officer & Digital Officer/Chief Information Officer and the Chief Information Security Officer, while also noting their integration with the ERM program.


reasoning: The paragraph primarily details the specific responsibilities, incident response duties, and reporting lines of a designated management role (the SVP, Head of Legal and Compliance) regarding cybersecurity.