reasoning: The paragraph contains generic statements about regulatory compliance risks that could apply to any company, without describing the company's specific cybersecurity governance, management roles, or internal risk management processes required by Item 1C. It lacks any firm-specific details, named frameworks, roles, or quantifiable information.


content_category: Management Role

category_confidence: high

specificity_confidence: high

reasoning: The paragraph focuses primarily on identifying Matson's cybersecurity leadership (CIO and CISO) and detailing their specific qualifications, tenure, prior employment at Charles Schwab, and professional certifications (CISSP, CISA, AWS), which constitutes the Management Role category. It contains multiple independently verifiable hard facts including specific durations (25, 18, and 7 years), a named third-party firm (Charles Schwab), and named certifications, meeting the threshold for Quantified-Verifiable specificity.

provider: moonshotai

stage: benchmark


content_category: Risk Management Process

reasoning: The paragraph primarily describes the company's internal risk management process for identifying, prioritizing, and monitoring cybersecurity risks. While it mentions the Board's oversight responsibility, this is generic and the focus is on the process itself. The disclosure contains no specific frameworks, named roles, dates, or quantifiable metrics that would distinguish it from standard boilerplate language applicable to any company.


content_category: Incident Disclosure

reasoning: Paragraph describes a specific past cybersecurity incident involving subsidiary ETI in June 2022, including the date, operational scope (limiting access to applications and services), and response actions (restoring systems, adopting enhancements), fitting the Incident Disclosure definition. Contains specific date and named entity details sufficient for Firm-Specific classification, but lacks a second hard verifiable fact (dollar amount, headcount, or named third-party firm) needed for Quantified-Verifiable.


content_category: Board Governance

reasoning: The paragraph describes Board and committee oversight of cybersecurity risk, with the full Board and Audit and Risk Committee as grammatical subjects. It identifies specific governance entities including the 'Audit and Risk Committee' (distinct from a standard Audit Committee) and the 'Response Team' that reports to it.


content_category: Strategy Integration

reasoning: The paragraph provides a standalone materiality disclaimer stating that cybersecurity threats and previous incidents have not materially affected the company, which falls under Strategy Integration per the tiebreaker rules. It contains only generic boilerplate language with self-references to the filing document and standard risk factor section titles, lacking any firm-specific details, named frameworks, or quantifiable facts.


reasoning: The paragraph describes the company's internal risk assessment, safeguard implementation, and monitoring processes, with the company ('we') as the grammatical subject. While it mentions the CIO, the focus is on the risk management activities (evaluate, re-design, monitor) rather than the individual's personal qualifications, making it Risk Management Process per the person-vs-function test. The identification of the CIO as the specific role overseeing these processes provides a firm-specific detail.


reasoning: The paragraph discusses cyber insurance coverage and its potential limitations, which falls under the Strategy Integration category (business/financial impact and insurance). The language is entirely generic boilerplate that could apply to any company, containing no specific details about coverage amounts, named insurers, policy terms, or actual incidents.


reasoning: The Audit Committee is the grammatical subject receiving periodic reports, describing board oversight and briefing cadence concerning cybersecurity risks. The specific identification of the Chief Information Officer (a cybersecurity-specific title) as the management role providing these reports makes the disclosure Firm-Specific.


reasoning: The paragraph's grammatical subject is a specific cybersecurity management role (Senior Vice President of Information Technology) and focuses on the individual's qualifications, experience, and the team's composition, satisfying the Management Role category. It includes firm-specific facts such as the exact title and specific duration of experience, but lacks the two hard verifiable facts (e.g., specific dates, dollar amounts, named third-party firms) required for Quantified-Verifiable classification.


reasoning: The paragraph narrates a specific ransomware attack that occurred in late May 2023, describing the incident type, affected systems, and specific response actions taken (investigation, expert engagement, law enforcement coordination), which fits Incident Disclosure. The specific date (month and year) qualifies as a firm-specific fact, making this Firm-Specific rather than generic boilerplate.


reasoning: The paragraph describes the company's internal incident response workflows, escalation procedures, and materiality assessment processes, which are core risk management activities. It contains firm-specific organizational details including the specific composition of the IRT (CFC, legal, corporate communications, finance), named internal programs (IRT, IRP), and references to the CSC committee.


reasoning: The paragraph describes the company's internal cybersecurity policies and processes, including IT asset management, access controls, and data protection. While third-party providers are mentioned, they are described as a component of the company's overall risk management infrastructure rather than being the central topic of vendor oversight or contractual requirements. The disclosure lacks any named frameworks (e.g., NIST, ISO), specific cybersecurity roles (e.g., CISO), named third-party firms, specific tools, dates, or quantifiable metrics, consisting entirely of generic security practices that could apply to any organization.


reasoning: The paragraph provides a standalone materiality conclusion stating that cybersecurity risks have not materially affected business strategy, results of operations, or financial condition, without describing any specific incident details. This is standard boilerplate language containing no named entities, dates, dollar amounts, or company-specific details that could not apply to any registrant.


reasoning: The paragraph describes the operational impact, containment efforts, and recovery timeline of an actual cybersecurity incident (systems taken offline, restoration within a week), which qualifies as Incident Disclosure. However, it contains no specific dates, dollar amounts, named third-party firms, products, or exact durations—only generic descriptions of affected systems and approximate timeframes ('within a week').


reasoning: The paragraph identifies specific management positions (Vice President of Compliance and Information Technology and IT Manager) responsible for the information security program, describes the interim transition between these roles, and provides the specific date (February 25, 2025) and duration (two years) of experience. The focus is on the individuals, their titles, and qualifications rather than on processes or board oversight.


reasoning: The paragraph describes the Audit Committee's oversight of material cybersecurity risks and the reporting cadence from management (CTO) to the board, which falls squarely under board governance of cyber risk. While the CTO is identified as a cybersecurity-specific role (making it Firm-Specific), there are no additional hard verifiable facts (specific dates, dollar amounts, headcounts, or named third-party firms/tools) to reach Quantified-Verifiable status.


reasoning: The paragraph describes a specific cybersecurity incident (business email compromise) with narrative details including the year (2023), the specific quantity and value of stolen assets (26 BTC worth approximately $560,000), and the involvement of named entities (Sphere 3D Corp., US Federal law enforcement), meeting the criteria for Incident Disclosure with multiple quantifiable, verifiable facts.


reasoning: The paragraph focuses on management's monitoring activities and reporting cadences to governance bodies. While it references the Board, the primary subject is management's role in overseeing the cybersecurity program. The naming of the 'Information Technology Steering Committee' (a non-generic committee) provides a firm-specific detail, distinguishing this from generic boilerplate.


reasoning: The paragraph focuses on the Risk Management Steering Committee (a management-level governance body), specific management roles (CFO and GC), their qualifications, and their reporting relationship to the Audit Committee. It identifies WHO is responsible for monitoring cybersecurity risks rather than describing the technical processes themselves.


reasoning: The paragraph focuses on the specific qualifications, educational background, and tenure of the VP of IT, making it about the person rather than just the function. It includes firm-specific details such as the exact cybersecurity-related title, specific degrees held, and the duration of experience (over 20 years), which satisfy the Person-vs-Function test for Management Role and meet the Firm-Specific threshold.


reasoning: The paragraph describes the company's internal processes for threat intelligence gathering and risk monitoring through collaboration with specific named government agencies (FBI, CISA, and the DOE Office of Cybersecurity). While it mentions third parties, the focus is on how the company informs its own cybersecurity processes, not on vendor oversight. The naming of specific government partners provides firm-specific detail.


reasoning: The paragraph describes the company's internal cybersecurity capabilities and processes (SOC operations, threat hunting, vulnerability scanning, threat detection technology) rather than focusing on the CISO's personal qualifications or background. While it identifies the CISO as managing the function, the content focuses on what the program does. It contains firm-specific elements (CISO title, SOC program name) but lacks quantifiable metrics, dates, or third-party details needed for Quantified-Verifiable.


content_category: None/Other

reasoning: The paragraph provides generic contextual language about the importance of data integrity and security to business operations without disclosing specific governance structures, management roles, risk management processes, or incidents. It serves as introductory background that could apply to any company.


reasoning: The paragraph focuses on Board and Audit Committee oversight activities, including reporting lines to the full Board and continuing education briefings. While management and the CTO are mentioned as sources of information, the Board and Committee are the grammatical subjects and primary focus. The identification of the Chief Technology Officer (a cybersecurity-specific title) as a presenter provides a firm-specific detail.


content_category: Third-Party Risk

reasoning: The paragraph centrally addresses vendor oversight, describing the vendor management program, security questionnaires, and contractual obligations imposed on vendors. It specifies the unique cross-functional team composition (corporate security, product security, and legal) responsible for vendor risk evaluation, which constitutes a firm-specific organizational detail.


reasoning: The paragraph describes the Board's ultimate oversight and the Audit Committee's delegated cybersecurity responsibilities, including monitoring the risk profile and receiving updates from management. While the CISO is mentioned, the focus is on governance structure and oversight rather than the individual's qualifications or operational processes. The mention of the CISO (a cybersecurity-specific role) elevates the disclosure from generic boilerplate to firm-specific, as this identifies a specific cybersecurity function within the company.


reasoning: Brief mention of a past ransomware attack (October 2021) combined with a materiality conclusion regarding its impact on business strategy and operations, cross-referencing Risk Factors without providing detailed incident narrative, scope, or response actions per the Strategy Integration tiebreaker.


reasoning: The paragraph describes the company's cybersecurity risk management procedures, including risk assessment, third-party provider engagement, incident monitoring, response protocols, and materiality determination. While management is the grammatical subject, the content focuses on the functions and processes rather than specific personnel qualifications or reporting structures, passing the person-vs-function test. The disclosure lacks specific dates, dollar amounts, named third-party firms, cybersecurity-specific roles (e.g., CISO), or recognized frameworks, consisting entirely of generic descriptions applicable to any company.


reasoning: The paragraph describes a specific cybersecurity incident occurring in November 2023, including details on system disruption, investigation procedures with external experts, law enforcement coordination, and remediation efforts, which constitutes Incident Disclosure. The inclusion of a specific date and reference to the company's specific cyber response protocol elevates the specificity to Firm-Specific.


reasoning: The paragraph focuses on the ISO's personal qualifications, tenure, and certifications, satisfying the PERSON-VS-FUNCTION TEST for Management Role. It contains multiple independently verifiable hard facts: a specific duration (25 years) and numerous named professional certifications, exceeding the two-fact threshold for Quantified-Verifiable.


reasoning: The paragraph provides a standalone materiality assessment stating that cybersecurity risks have not materially affected the company but could materially affect future business strategy, results of operations, or financial condition. This fits Strategy Integration per the rule that materiality disclaimers belong in this category even if boilerplate. The content consists entirely of generic SEC filing language with cross-references to Risk Factors, containing no named frameworks, specific dates, dollar amounts, cybersecurity-specific roles, or other firm-specific details.


reasoning: The paragraph primarily describes Board and Audit Committee oversight of cybersecurity risks, with the Board as the grammatical subject of the first two sentences. Management is mentioned only briefly regarding escalation protocols. The disclosure contains no specific facts—no named cybersecurity roles (e.g., CISO), dates, frameworks, or vendors—that would distinguish it from any other company's filing.


reasoning: The paragraph centers on vendor oversight, describing security assessments and monitoring of third-party providers, which aligns with the Third-Party Risk category. It contains no named frameworks, specific dates, dollar amounts, headcounts, named firms, or tools—only generic descriptions like 'stringent processes' and 'thorough security assessments' that could apply to any company.


reasoning: The paragraph describes the company's internal governance structure and risk management activities, including the ISMS Governance Committee and Data Protection Governance Committee's responsibilities for reviewing risks and monitoring remediation. While it mentions the interim CSO and DPO, the focus is on the functional processes and committee operations rather than the individuals' qualifications or backgrounds, and board oversight is only mentioned briefly as a reporting line rather than the primary topic.


reasoning: The paragraph describes the company's internal cybersecurity risk management governance and processes, specifically the Cybersecurity Steering Committee co-chaired by the CSO and Chief Legal Officer, and its responsibilities for risk oversight and policy review. While management titles appear, the focus is on the committee's functions (processes, activities, oversight) rather than the personal qualifications or reporting lines of the individuals, making Risk Management Process the appropriate category. The disclosure includes the cybersecurity-specific title 'CSO' and the named internal committee 'Cybersecurity Steering Committee', making it Firm-Specific.


reasoning: The paragraph describes the company's internal risk management processes and governance structures, including the specific committees (IT Operating Committee and IT Steering Committee) responsible for cybersecurity oversight and the roles of the CISO and Director of Information Technology in these processes, rather than focusing on the personal qualifications or background of these individuals.


reasoning: The paragraph describes specific response actions to an actual cybersecurity incident (system suspensions, restoration timeline) and provides multiple hard verifiable facts including exact dates (December 30, 2023, Q4 2024) and specific dollar amounts ($1.0 million costs, $0.6 million insurance recovery), clearly meeting the criteria for Incident Disclosure with Quantified-Verifiable specificity.


reasoning: The paragraph focuses on the CISO's personal qualifications, career history, and credentials (NSA, Army, degrees), making it Management Role. It contains multiple verifiable hard facts including the specific date October 2021 and two named former employers (National Security Agency and United States Army), satisfying the threshold for Quantified-Verifiable.


reasoning: The paragraph centers on the CIO as a person, detailing qualifications (CISSP certification), professional background (senior technical leadership roles), and reporting structure (reports to CEO). While it describes departmental functions, they are framed as activities conducted under the CIO's direction, satisfying the person-vs-function test for Management Role. It contains firm-specific details including the cyber-specific title (CIO), certification (CISSP), and reporting line, but lacks the second hard verifiable fact (dates, dollars, headcounts, percentages, or named third parties/tools) required for Quantified-Verifiable.


reasoning: The paragraph describes the company's internal processes for identifying, assessing, and monitoring cybersecurity risks as part of its enterprise risk management program, including specific technical controls and external threat intelligence services. It names specific external entities (US CISA, FBI InfraGard) in which the company is enrolled, making it firm-specific rather than generic boilerplate.


reasoning: The paragraph consists entirely of forward-looking expectations ('We expect,' 'will become,' 'will be responsible') regarding future cybersecurity governance and risk management processes, with no disclosure of current practices, specific roles, or implemented programs. It describes anticipated rather than existing board oversight and management reporting structures, functioning as a forward-looking disclaimer rather than substantive disclosure of current cybersecurity posture.


reasoning: The paragraph describes the composition, oversight responsibilities, and collective expertise of the Cybersecurity Committee, making the committee the grammatical subject. It identifies specific governance elements including the committee name, member count, and specialized roles (particularly the aviation-specific 'Director of IT, Infrastructure and Flight Systems'), distinguishing it from generic disclosures.


reasoning: The paragraph focuses on Board and Audit Committee oversight of cybersecurity risks, with the Board and Committee as grammatical subjects discussing delegation of responsibility and reporting cadences. It contains one specific fact (fiscal year 2024) but lacks a second hard verifiable fact required for Quantified-Verifiable classification.


reasoning: The paragraph describes the Nominating and Governance Committee's oversight activities and receipt of reports from the CISO, making the board committee the grammatical subject. It identifies the cybersecurity-specific role of CISO, which qualifies as a firm-specific fact, but contains only one such fact and no quantified data, dates, or named third parties.


reasoning: The paragraph satisfies the person-vs-function test by focusing on specific cybersecurity leadership roles (CDTO, CIO, and CISO consultant), their reporting structures, and detailed professional qualifications including tenure and academic credentials. While audit committee oversight is mentioned, the detailed discussion of management qualifications and experience is the primary focus. The disclosure meets the Quantified-Verifiable threshold by providing two specific numerical facts—over 25 years and approximately 15 years of experience—that an outsider could independently verify.


reasoning: The paragraph provides definitional background describing the company's IT infrastructure architecture and reliance on third-party hosting (including BD), but does not disclose governance structures, risk management processes, vendor oversight mechanisms, incident details, or strategic financial impacts. It functions as contextual setup rather than substantive cybersecurity risk disclosure.


reasoning: The paragraph describes the company's internal processes for evaluating cybersecurity risks, reporting cadences, and the content of risk assessments provided to the board, including controls, procedures, and third-party oversight. While it references the BDT & MSD CTO, the focus is on the risk management function rather than the individual's qualifications or background. The inclusion of the specific entity 'BDT & MSD' and the cybersecurity-specific 'CTO' title provides firm-specific detail, but there are not two hard verifiable facts (dates, dollar amounts, headcounts, percentages, or named third-party firms/tools) to qualify as Quantified-Verifiable.


reasoning: The paragraph briefly references two past material breaches but provides no incident narrative, scope, or response actions, instead focusing on materiality conclusions (no material incident in 2023) and potential business/financial impacts including costs, litigation, and reputational harm. It contains two hard verifiable facts: the specific date December 31, 2023, and the specific number of past breaches (two).


reasoning: The paragraph primarily describes the company's internal incident response plan and processes, and explicitly distinguishes the disclosed event as a 'physical security incident' rather than a cybersecurity incident, placing it outside the 'Incident Disclosure' category. It contains two hard verifiable facts: a specific date ('fiscal year ended September 30, 2025') and a specific quantity ('24 months'), meeting the threshold for Quantified-Verifiable.


reasoning: The paragraph describes the company's internal processes for cybersecurity risk management, including periodic third-party assessments, threat intelligence monitoring, and strategic planning to protect against incidents. While it identifies specific cybersecurity leadership roles (CISO and CDO), the focus is on the functions and processes performed rather than the individuals' qualifications or reporting structures.


reasoning: The paragraph primarily describes the company's internal Cybersecurity Program procedures for notification, escalation, and incident review thresholds, which constitute risk management processes. While it mentions the Audit Committee and Board as recipients of notifications, the focus is on the operational process rather than governance oversight. The disclosure is firm-specific due to the unique description of an independent director's specific IT management experience in the mortgage acquisition, servicing, and securitization sector.


reasoning: The paragraph focuses on the qualifications, tenure, and reporting structure of specific management roles (CFO, CCO, and CIO), including specific years of experience and tenure durations. It identifies GC Advisors as the external party providing the CIO function, providing multiple verifiable numeric facts and a named third-party entity.


reasoning: The paragraph identifies the CISO as the grammatical subject and focuses on role definition, reporting structure (to the Chief Risk Officer), and departmental organization (Information Security Department), which aligns with the Management Role category. It contains firm-specific details including the cybersecurity-specific title (CISO), named internal programs (BC/DR Programs), and specific governance terminology (second line of defense), but lacks two hard verifiable facts (dates, dollar amounts, headcounts, percentages, or named third parties/tools) required for Quantified-Verifiable.


reasoning: The paragraph identifies the 'Director of IT' as the manager of internal security professionals and third-party providers, and specifies team qualifications including a 'certified information system security professional,' fitting the Management Role category focused on role identification and credentials. These specific titles and qualifications distinguish it from generic boilerplate.


reasoning: The paragraph describes the company's internal cybersecurity processes, including security awareness training, employee education, and incident response capabilities, which aligns with Risk Management Process. It contains no specific dates, named roles, frameworks, tools, or quantifiable metrics—only generic references to 'quarterly exercises,' 'annual attestation,' and standard training programs that could apply to any company.


reasoning: The paragraph is centrally focused on the company's reliance on third-party software vendors (specifically Microsoft) and its process for assessing vendor security controls through SOC report reviews, rather than describing internal risk management processes or board oversight. It names Microsoft as a specific third-party firm, making it Firm-Specific.


reasoning: Although the CISO is identified with specific qualifications, the paragraph primarily describes the company's internal risk management functions, tools, and frameworks (ERM program, SecurityScorecard assessments, NIST alignment, penetration testing). Per the person-vs-function test, the content remains coherent if the specific role is removed, confirming this is about the risk management process rather than the individual. The disclosure includes firm-specific details including the CISO title, CISSP certification, SecurityScorecard vendor, and NIST framework adoption, but contains only one hard verifiable fact (SecurityScorecard) and lacks a second required element (dates, dollar amounts, headcounts, or additional named firms) for Quantified-Verifiable classification.


reasoning: The paragraph provides a detailed narrative of two specific cybersecurity incidents occurring in September 2022, including dates, affected subsidiaries (Rockstar Games and 2K Games), specific compromised content (Grand Theft Auto development footage and vendor platform credentials), scope (certain players), and response actions (user notification, service restoration). While it includes materiality assessments, the central focus is describing what happened in these real events. Specificity is Quantified-Verifiable due to the presence of two hard verifiable facts: the specific date (September 2022) and the named product (Grand Theft Auto), alongside other firm-specific details like the affected subsidiaries.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including risk mitigation strategies, quarterly update cadences, and incident response protocols, rather than focusing on specific personnel qualifications (Management Role) or board oversight mechanisms (Board Governance). It contains no named entities, specific dates, frameworks, or quantifiable details—only generic references to 'the Board,' 'CFO,' 'third-party IT service provider,' and standard cadences like 'quarterly' and 'periodically' that could apply to any company.


reasoning: The paragraph centers on the Chief Security Officer's responsibilities, reporting lines (to CFO and Technology Committee), and professional qualifications (tenure and banking background), fitting the Management Role category. It includes firm-specific details such as named non-standard committees (Technology Committee, Management Risk Committee) and specific tenure metrics, distinguishing it from generic boilerplate.