reasoning: The paragraph focuses exclusively on the process for assessing third-party vendors' data security commitments prior to onboarding. The language used is generic risk management terminology without specific cybersecurity domain terms, firm-specific details, or verifiable metrics.


content_category: Strategy Integration

category_confidence: high

specificity_confidence: high

reasoning: The paragraph primarily discusses the potential impact of cybersecurity risks and includes a negative assertion that the company has not experienced a cybersecurity incident to date, which falls under Strategy Integration. The language is entirely generic boilerplate without any domain-specific terminology, firm-specific details, or verifiable facts.

provider: google

stage: benchmark


content_category: Board Governance

reasoning: The paragraph describes how the Audit Committee receives reports from management regarding cybersecurity risks and incidents, which is a clear description of board/committee oversight and information flow, fitting the Board Governance category. The language is entirely generic with no domain terms, firm-specific roles, or verifiable facts.


content_category: Third-Party Risk

fact: application vulnerability assessments

fact: public internet presence monitoring

fact: NIST

type: framework

fact: ISO

fact: HIPAA

fact: Payment Card Industry standards

reasoning: The paragraph focuses entirely on the requirements and oversight mechanisms applied to suppliers and vendors, making it Third-Party Risk. It includes domain-specific terminology like application vulnerability assessments and named standards (NIST, ISO, PCI), elevating it to Domain-Adapted specificity.


fact: Information Security Program ("ISP")

fact: Information Technology Board Committee ("ITBC")

fact: IT Steering Committee ("ITSC")

reasoning: The paragraph describes the oversight structure for cybersecurity, specifically naming the board and steering committees responsible, making it Board Governance. The specificity is Firm-Specific due to the inclusion of uniquely named internal committees like the ITBC and ITSC.


fact: technology committee of our board of directors

reasoning: The paragraph primarily describes the board's oversight structure, including the delegation of responsibilities to the Audit Committee and technology committee, and management's reporting obligations. The specificity is Firm-Specific due to the mention of a named, non-generic board committee (technology committee).


reasoning: The paragraph explicitly states a conclusion regarding the material impact of cybersecurity threats on the company's business strategy and financial condition, placing it in Strategy Integration. It contains no domain-specific terminology, firm-specific details, or externally verifiable facts, resulting in a Generic Boilerplate specificity level.


content_category: Risk Management Process

fact: data encryption

category_confidence: medium

reasoning: The paragraph describes the company's process for monitoring external legislative and regulatory developments to ensure cybersecurity compliance. It is classified as Domain-Adapted due to the specific mention of data encryption as a regulatory requirement.


fact: Security Incident Response Plan ("SIRP")

fact: encryption protocols

fact: multi-factor authentication

fact: data loss prevention controls

reasoning: The paragraph details the company's incident response planning, data protection measures, and business continuity plans, which are core components of the risk management process. The specificity is Firm-Specific due to the specifically named internal program (SIRP).


fact: CISO

reasoning: The paragraph describes the flow of cybersecurity information from management to the Board and Audit Committee, making it a Board Governance disclosure. The specificity is Firm-Specific due to the explicit mention of the CISO role.


fact: incident response plans

reasoning: The paragraph describes the flow of information from management to the audit committee, detailing the topics covered in quarterly briefings, which falls under Board Governance. The specificity is Domain-Adapted due to the mention of 'incident response plans'.


reasoning: The paragraph describes the board's oversight structure, specifically the Audit Committee's interaction with management regarding cybersecurity. It contains no domain-specific terminology or firm-specific facts, as 'Director of Information Technology' lacks a security qualifier and is considered generic.


fact: identity management and access control safeguards

reasoning: The paragraph lists specific technical and procedural measures implemented as part of the cybersecurity program, categorizing it as Risk Management Process. The inclusion of domain-specific terminology like 'encryption of data in transit and at rest' elevates the specificity to Domain-Adapted.


reasoning: The paragraph makes a negative assertion regarding the material impact of cybersecurity incidents on the business and financial condition, which falls under Strategy Integration. It contains only boilerplate risk disclaimers and cross-references with no specific cybersecurity facts or domain terminology.


content_category: None/Other

reasoning: The paragraph discusses general information technology investments for customer experience and business growth without mentioning cybersecurity, making it non-cybersecurity content.


reasoning: The paragraph consists entirely of a generic disclaimer and a cross-reference to the Risk Factors section, containing no substantive cybersecurity disclosure.


reasoning: The paragraph explicitly states a conclusion regarding the material impact of cybersecurity threats on the company's business strategy and financial condition, which falls under Strategy Integration. It contains only generic boilerplate language and a cross-reference, lacking any specific domain terms or verifiable facts.


reasoning: The paragraph focuses entirely on the processes for reviewing and managing risks associated with third-party service providers and vendors. It lacks any specific cybersecurity domain terminology, firm-specific details, or verifiable metrics, making it generic boilerplate.


reasoning: The paragraph describes the company's general approach to identifying and mitigating cybersecurity risks, integrating with ERM, and conducting employee training, which falls under Risk Management Process. The language is entirely generic and lacks any domain-specific terminology, firm-specific details, or verifiable metrics.


fact: Critical Threat Committee

reasoning: The paragraph primarily describes the escalation process and how information regarding critical cybersecurity incidents flows from the Critical Threat Committee to the Board of Directors and Audit Committee, fitting Board Governance. The specificity is Firm-Specific due to the naming of the internal 'Critical Threat Committee'.


content_category: Incident Disclosure

fact: October 2023

fact: two-factor verification

reasoning: The paragraph describes a specific historical cybersecurity incident, including its timing, scope, and remediation efforts, making it an Incident Disclosure. It is Quantified-Verifiable because it provides a specific date (October 2023) for the incident.


reasoning: The paragraph explicitly states a conclusion regarding the material impact of cybersecurity risks and incidents on the company's business strategy and financial condition, which falls under Strategy Integration. The language consists entirely of generic boilerplate and negative assertions without any specific domain terms or verifiable facts.


fact: late May 2023

fact: ransomware attack

reasoning: The paragraph describes a specific, historical cybersecurity event (a ransomware attack) and the company's response to it, making it Incident Disclosure. The inclusion of a specific timeframe ('late May 2023') makes the claim externally verifiable.


fact: Cybersecurity Leadership Team

reasoning: The paragraph explicitly details the Board's oversight of cybersecurity, including delegation to the Audit Committee and reporting from management. The mention of the specific 'Cybersecurity Leadership Team' elevates the specificity to Firm-Specific.


fact: Security Committee

fact: Chief Security Officer (CSO)

fact: Cyber Risk Advisory Committee

reasoning: The paragraph primarily describes the governance chain and oversight structure, detailing the roles of the board, Security Committee, CSO, and Cyber Risk Advisory Committee. The specificity is Firm-Specific due to the naming of specific internal roles and committees like the CSO and Cyber Risk Advisory Committee.


fact: CCO of the Company

fact: CIO

fact: Operational Risk functions

fact: Morgan Stanley's Cybersecurity Program

reasoning: The paragraph explicitly describes the Board's oversight of cybersecurity risks and the flow of information to the Board from specific management roles, making it Board Governance. The specificity is Firm-Specific due to the mention of specific roles (CCO, CIO, CISO) and a named program (Morgan Stanley's Cybersecurity Program).


fact: patching and vulnerability management

fact: cybersecurity tabletop exercise

fact: cybersecurity threat assessment

reasoning: The paragraph details the frequency and topics of cybersecurity briefings provided to the Board of Directors, placing it in Board Governance. It includes domain-specific terminology like 'patching and vulnerability management' and 'tabletop exercise', making it Domain-Adapted.


fact: Pension Benefit Information, LLC ("PBI")

fact: Progress Software Corporation's MOVEit Transfer software

fact: approximately 850,000 of Jackson's customers

type: quantified

reasoning: The paragraph describes a specific historical cybersecurity incident involving a third-party vendor, making it Incident Disclosure. It contains multiple verifiable facts including named third parties (PBI, Progress Software), a specific software product (MOVEit), and a quantified impact (850,000 customers), elevating it to Quantified-Verifiable.


reasoning: The paragraph describes the board's oversight structure, specifically the audit committee's responsibilities and reporting cadence. It is classified as Firm-Specific due to the mention of the Vice President of Information Technology.


reasoning: The paragraph primarily describes the governance chain for cybersecurity risk oversight, detailing the roles of the Board, Audit Committee, and CFO. It contains only generic corporate roles and boilerplate language, lacking any domain-specific terminology or firm-unique details.


reasoning: The paragraph makes a negative assertion regarding the material impact of cybersecurity incidents on the company's business strategy and financial condition, which falls under Strategy Integration. It contains no domain-specific, firm-specific, or externally verifiable facts, making it generic boilerplate.


content_category: Management Role

fact: Chief Information Security Officer (CISO)

fact: Chief Risk Officer (CRO)

fact: Chief Technology Officer (CTO)

reasoning: The paragraph primarily details the management-level reporting structure and roles responsible for the cybersecurity program, specifically the CISO, CRO, and CTO. The specificity is Firm-Specific due to the naming of these specific executive roles.


fact: security, confidentiality, integrity, and availability

fact: cyber incident response plan

reasoning: The paragraph primarily outlines the company's overall cybersecurity risk management processes, including the use of third-party assessors and incident response planning. The specificity is Domain-Adapted due to the use of standard information security concepts like the CIA triad (confidentiality, integrity, and availability) and a cyber-specific incident response plan, though it lacks firm-specific or externally verifiable details.


fact: data leakage

fact: artificial intelligence (AI) and generative AI (GenAI)

reasoning: The paragraph outlines the core components of the company's cybersecurity risk management program, including risk assessments, training, incident response, and third-party risk management. It includes domain-specific terminology such as data leakage and securing generative AI, making it Domain-Adapted.


fact: CISO

fact: over 20 years of experience

fact: CIO Executive Education Certificate from Stanford University

reasoning: The paragraph details the roles and qualifications of management, specifically the CISO and the steering committee on information security. It includes verifiable facts such as the CISO's 20+ years of experience and a specific certificate from Stanford University, making it Quantified-Verifiable.


fact: vulnerability management policy

fact: encryption of data

reasoning: The paragraph describes the technical and organizational measures comprising the company's cybersecurity program, classifying it as Risk Management Process. It includes domain-specific terminology like vulnerability management and data encryption, making it Domain-Adapted.


fact: extended detection and response

fact: vulnerability scanning

fact: phishing simulations

fact: penetration tests

reasoning: The paragraph details the specific components and activities of the company's cybersecurity program, clearly falling under Risk Management Process. The specificity is Domain-Adapted due to the use of specialized cybersecurity terminology like 'extended detection and response' and 'penetration tests' that go beyond generic risk management language.


fact: VP of IT

reasoning: The paragraph primarily describes the board's oversight structure, including delegation to the Audit Committee and reporting from management. Specificity is Firm-Specific due to the mention of the VP of IT role.


fact: Chief Information Officer

reasoning: The paragraph primarily describes the Board and Audit Committee's oversight of cybersecurity risks, including reporting cadences and escalation protocols, which falls under Board Governance. The specificity is Firm-Specific due to the explicit mention of the CISO and Chief Information Officer roles.


reasoning: The paragraph describes the use of a third-party IT consultant to assist with the company's internal risk assessment, policy design, and safeguard testing, which falls under the risk management process. The language is entirely generic, lacking specific domain terminology, firm-specific details, or verifiable facts.


fact: over 24 years

fact: Chief Information Security Officer

fact: cyber emergency response team

fact: NVP of Finance

fact: Cybersecurity Response Committee

fact: over 50 years of collective experience

reasoning: The paragraph details the career history, qualifications, and credentials of management personnel responsible for cybersecurity, fitting the Management Role category. It includes verifiable quantified facts such as 'over 24 years' and 'over 50 years of collective experience'.


fact: testing of vulnerabilities

fact: targeted attack simulations

reasoning: The paragraph describes the activities and components of the cybersecurity program, such as vulnerability testing and phishing simulations, placing it in Risk Management Process. The specificity is Domain-Adapted due to the use of cybersecurity-specific terminology like 'phishing simulations' and 'targeted attack simulations'.


fact: March 2020

fact: ransomware

reasoning: The paragraph primarily discloses a specific past cybersecurity incident (the March 2020 ransomware attack), detailing its occurrence, remediation efforts, and assessing its material impact on the business.


fact: Senior Vice President of Engineering and Chief Information Security Officer

fact: Chief Privacy Officer

fact: Privacy and Security Council

reasoning: The paragraph primarily describes the management-level organizational structure for cybersecurity, detailing specific roles, reporting lines, and a management committee. The specificity is Firm-Specific due to the naming of specific executive roles (SVP of Engineering and CISO, Chief Privacy Officer) and a specific internal committee (Privacy and Security Council).


reasoning: The paragraph primarily describes the board-level oversight structure, detailing how the Audit Committee receives reports from management and informs the Board of Directors. Specificity is Firm-Specific due to the explicit mention of the Chief Information Officer and Chief Information Security Officer roles.


reasoning: The paragraph makes a negative assertion regarding the absence of material cybersecurity breaches and discusses potential financial impacts, which falls under Strategy Integration. It contains no domain-specific terminology, firm-specific details, or externally verifiable facts, making it generic boilerplate.


reasoning: The paragraph primarily consists of a cross-reference to the Risk Factors section and contains no substantive cybersecurity disclosure.


reasoning: The paragraph explicitly states a conclusion about whether cybersecurity risks have materially affected the company's business strategy, results of operations, or financial condition, which falls under Strategy Integration. It contains no domain terms, firm-specific facts, or verifiable claims, making it Generic Boilerplate.


fact: third-party risk management (TPRM) program

fact: security controls

reasoning: The paragraph explicitly describes the company's third-party risk management program and how it assesses vendor security controls, making it a clear fit for Third-Party Risk. The specificity is Domain-Adapted due to the use of standard risk management terminology like TPRM and security controls.


fact: Chief Information Security Officer ("CISO")

reasoning: The paragraph details the responsibilities, coordination efforts, and communication duties of the Chief Information Security Officer (CISO), which directly addresses management's role in cybersecurity. The specificity is Firm-Specific due to the explicit mention of the CISO role.


fact: cybersecurity audits

specificity_confidence: medium

reasoning: The paragraph focuses exclusively on the oversight and management of cybersecurity risks associated with third-party service providers. It includes domain-specific terminology such as cybersecurity audits.


fact: Enterprise Risk Committee ("ERC")

fact: Operational Risk Committee ("ORC")

fact: Compliance, Human Resources, Internal Audit and Legal

reasoning: The paragraph primarily describes management's organizational structure for cybersecurity, detailing the roles of the ERC, ORC, CISO, and cross-departmental coordination. It is classified as Firm-Specific due to the naming of specific internal committees, the CISO role, and the specific departments involved in coordination.


fact: over 7 years of experience

fact: ITD

fact: Director of ITD

reasoning: The paragraph primarily details management's role in cybersecurity, specifically the Director of ITD's responsibilities, reporting lines, and qualifications, while also mentioning board reporting. The specificity is Quantified-Verifiable due to the specific, checkable claim of 'over 7 years of experience' for the Director of ITD.


reasoning: The paragraph consists of generic boilerplate language acknowledging general exposure to cybersecurity risks and a vague commitment to improve controls, lacking substantive disclosure.


reasoning: The paragraph primarily describes the frequency and scope of cybersecurity updates provided to the board of directors, fitting the Board Governance category. The language relies on generic cadences and standard risk management terminology without specific domain expertise or firm-unique details.


fact: December 30, 2023

fact: $1.0 million

fact: $0.6 million

reasoning: The paragraph details a specific past cybersecurity incident, including containment actions, restoration timelines, and financial impacts, fitting the Incident Disclosure category. It contains verifiable financial figures and a specific remediation conclusion date, making it Quantified-Verifiable.


fact: three Directors

fact: Ann Bordelon

fact: Paulette Dodson

fact: Noah Glass

reasoning: The paragraph describes the Board and Audit Committee's oversight role and details the specific cybersecurity experience of board members. It is Quantified-Verifiable because it names three specific directors (Ann Bordelon, Paulette Dodson, Noah Glass) and quantifies the number of directors with relevant experience.


reasoning: The paragraph explicitly states a conclusion regarding the material impact of cybersecurity incidents on the company's business strategy and financial condition, which falls under Strategy Integration. The text contains only generic statements and a cross-reference, lacking any domain-specific terminology, firm-specific details, or verifiable facts.


reasoning: The paragraph explicitly states a conclusion regarding the material impact of past cybersecurity incidents on the company's business strategy and financial condition, placing it in Strategy Integration. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: Chief Information Security Officer

reasoning: The paragraph primarily describes the responsibilities of the Chief Information Security Officer and management in implementing the cybersecurity program and reporting to the Audit Committee, fitting the Management Role category. Specificity is Firm-Specific due to the explicit mention of the CISO role.


reasoning: The paragraph describes the company's overall cybersecurity risk management processes, including ERM integration and general protective measures. Specificity is Domain-Adapted due to the use of the foundational cybersecurity concept of the CIA triad (confidentiality, integrity, and availability).


reasoning: The paragraph consists entirely of a forward-looking disclaimer regarding the effectiveness of the cybersecurity program and a cross-reference to the Risk Factors section, containing no substantive disclosure.


reasoning: The paragraph describes the company's incident response process, detailing the steps taken during an initial assessment. It lacks specific domain terminology, firm-specific roles, or verifiable facts, resulting in a generic boilerplate classification.


fact: CSO

fact: Executive Vice President and Chief Operations Officer

fact: over 20 years of security experience

fact: Certified Information Systems Security Professional

fact: Certified Information Security Manager

reasoning: While the paragraph begins with board oversight, the majority of the text details management's role, including the CSO's reporting structure, responsibilities, and specific verifiable qualifications (20 years experience, CISSP, CISM).


fact: Cybersecurity Manager

fact: security engineers

reasoning: The paragraph primarily details the company's processes for overseeing and managing risks associated with third-party service providers, making it Third-Party Risk despite a brief concluding sentence on materiality. The specificity is Firm-Specific due to the mention of the internal 'Cybersecurity Manager' role and 'security engineers'.


reasoning: The paragraph primarily details the processes and contractual requirements for managing cybersecurity risks associated with third-party service providers. The language used is generic and lacks specific domain terminology, firm-unique identifiers, or verifiable metrics.


fact: CISSP certification

fact: CCNP certification

fact: CISA certification

fact: CySA+ certification

reasoning: The paragraph describes the qualifications and credentials of the management team responsible for cybersecurity, fitting the Management Role category. The specific, externally verifiable certifications (CISSP, CCNP, CISA, CySA+) elevate the specificity to Quantified-Verifiable.


reasoning: The paragraph explicitly states a conclusion regarding the materiality of past cybersecurity incidents, which falls under Strategy Integration. The language used throughout is entirely generic, lacking any domain-specific terminology, firm-specific details, or verifiable metrics.


fact: January 2023

reasoning: The paragraph describes a specific, actual cybersecurity incident experienced by the company's advisor, including its timing and remediation, which clearly falls under Incident Disclosure. The inclusion of a specific date ('January 2023') makes the claim externally verifiable, elevating the specificity to Quantified-Verifiable.


fact: Enterprise Risk Committee ("ERC")

fact: Operational Risk Committee ("ORC")

fact: Chief Information Security Officer ("CISO")

fact: 17-year period

fact: Bachelor of Science in Electrical Engineering and Mathematics from the University of Texas at Arlington

fact: Certified Information Systems Security Professional (CISSP)

reasoning: The paragraph primarily details the management-level committees (ERC, ORC), the CISO's responsibilities, and the CISO's specific qualifications, fitting the Management Role category. The specificity is Quantified-Verifiable due to the inclusion of the CISO's specific degree, university, years of experience, and CISSP certification.


reasoning: The paragraph describes the process for identifying internal risks and mitigating them through employee communication and training, which falls under Risk Management Process. The language is generic and lacks specific domain terminology, firm-specific details, or verifiable metrics.


fact: Vice President of IT

fact: Randy Jepsen

fact: over 25 years of experience in the IT industry

fact: 19 years at Smith Douglas and The SMART Builder Solutions

fact: Russell Devendorf

fact: combined experience of almost 50 years

reasoning: The paragraph primarily describes the roles, responsibilities, and detailed career histories of the management team overseeing cybersecurity, fitting the Management Role category. It reaches Quantified-Verifiable specificity due to the inclusion of specific names, exact years of experience, and specific date ranges of past employment.


fact: legal, finance, and internal audit

fact: threat intelligence

reasoning: The paragraph primarily describes the composition and supervisory responsibilities of the management team regarding cybersecurity. It is Firm-Specific because it identifies the specific departments (legal, finance, internal audit) involved in this oversight.


fact: data loss prevention technology

fact: entitlement management

fact: anti-virus and anti-malware software

fact: National Institute of Standards and Technology Cybersecurity Framework

reasoning: The paragraph details the specific technologies and processes used in the company's cybersecurity program, categorizing it as Risk Management Process. The specificity is Domain-Adapted due to the inclusion of specialized cybersecurity terms like data loss prevention, entitlement management, and the NIST Cybersecurity Framework.


fact: vulnerability scans

fact: security questionnaires

reasoning: The paragraph focuses exclusively on the company's vendor management program and how it assesses and mitigates cybersecurity risks associated with third-party service providers. The specificity is Domain-Adapted due to the inclusion of cybersecurity-specific practices like vulnerability scans and security questionnaires.


reasoning: The paragraph discusses the potential financial impact of cybersecurity incidents and explicitly mentions maintaining cybersecurity insurance, which falls under Strategy Integration. The language is entirely generic and contains no domain-specific terminology, firm-unique details, or verifiable metrics.


reasoning: The paragraph provides a high-level, generic introduction to the company's cybersecurity goals (protecting systems and data), which falls under Risk Management Process. It contains no specific domain terminology, firm-specific details, or verifiable facts, making it generic boilerplate.


fact: CIO

fact: over two decades of experience

fact: over 15 years of experience

reasoning: The paragraph details the qualifications and experience of management, specifically the CIO, CEO, CFO, and GC, placing it in the Management Role category. It includes verifiable lower bounds for years of experience ('over two decades', 'over 15 years'), making it Quantified-Verifiable.


fact: CISO

reasoning: The paragraph primarily describes the Audit & Finance Committee's oversight of cybersecurity and the briefing process, fitting Board Governance. Specificity is Firm-Specific due to the explicit mention of the CISO and CIO roles.


fact: Security Operations Center (SOC)

reasoning: The paragraph primarily describes the company's cybersecurity risk management processes, including framework adoption and security operations. Specificity is Domain-Adapted due to the mention of the ISO 27001:2022 standard and a Security Operations Center (SOC).


fact: Morgan Stanley's Non-Financial Risk Committee

fact: Head of Operational Risk

fact: Firm Risk Committee

fact: BOTC

reasoning: The paragraph describes the governance chain and escalation of cybersecurity risks from management committees up to the Board, making it Board Governance. It includes firm-specific details such as the Non-Financial Risk Committee, BOTC, and specific executive roles like the CIO and Head of Operational Risk.


fact: Vice President of IT

fact: Information Security Manager

fact: United States Computer Emergency Readiness Team alerts

reasoning: The paragraph describes the governance reporting chain, detailing how cybersecurity information flows from the Information Security Manager up through management to the Board of Directors.


reasoning: The paragraph explicitly lists the management-level roles responsible for cybersecurity risk management, fitting the Management Role category. Specificity is Firm-Specific due to the inclusion of specific executive titles like CISO and Chief Information and Technology Officer.