content_category: None/Other

category_confidence: high

specificity_confidence: high

reasoning: The paragraph consists entirely of a forward-looking disclaimer and a cross-reference to the Risk Factors section, containing no substantive cybersecurity disclosure.

provider: google

stage: benchmark


content_category: Strategy Integration

reasoning: The paragraph states a conclusion about whether cybersecurity incidents have materially affected or are reasonably likely to materially affect the business strategy, results of operations, or financial condition, which falls under Strategy Integration. The text contains no domain terms, firm-specific facts, or verifiable claims, making it Generic Boilerplate.


reasoning: The paragraph explicitly states a conclusion about materiality ('to date the Company, including our business strategy, results of operations or financial condition, has not been materially affected by a cybersecurity breach'), which falls under Strategy Integration. It contains no specific facts, domain terms, or verifiable claims, making it Generic Boilerplate.


content_category: Management Role

fact: Enterprise Cybersecurity Management Review Group (Enterprise Cybersecurity MRG)

fact: Chief Information Security Officer

reasoning: The paragraph primarily describes the structure, membership, and responsibilities of a management-level committee (Enterprise Cybersecurity MRG) and its interaction with the CISO, making it Management Role. The specificity is Firm-Specific due to the named management committee and the CISO role.


content_category: Board Governance

fact: Head of Cyber Security

reasoning: The paragraph primarily describes the board's oversight structure, specifically the delegation to the Audit Committee and the reporting flow from the Head of Cyber Security to the committee and then to the full Board. The mention of the 'Head of Cyber Security' role elevates the specificity to Firm-Specific.


content_category: Risk Management Process

fact: security controls

fact: cybersecurity incident response plan

reasoning: The paragraph outlines the components of the cybersecurity risk management program, including risk assessments, a dedicated team, external service providers, training, an incident response plan, and third-party risk management, making it a clear Risk Management Process description. The specificity is Domain-Adapted due to the use of cybersecurity-specific terms like 'security controls' and 'cybersecurity incident response plan', but lacks firm-specific or verifiable details.


content_category: Incident Disclosure

fact: March 2021

fact: $ 2.4 million

type: quantified

fact: December 31, 2021

reasoning: The paragraph describes a specific past cybersecurity incident (March 2021 systems outage), its impact on operations, and the associated costs, making it an Incident Disclosure. The specificity is Quantified-Verifiable due to the specific dates and the exact dollar amount ($2.4 million) of incremental costs incurred.


fact: nine days

fact: $ 80 million to $ 85 million

fact: $ 35 million to $ 40 million

reasoning: The paragraph primarily describes a specific cybersecurity incident that occurred on June 13, 2023, including its timeline, response, and financial impact, making it an Incident Disclosure. The specificity is Quantified-Verifiable due to the specific date, duration (nine days), and exact dollar amounts for lost revenue and operating earnings.


fact: Director of Information Technology

fact: cybersecurity dashboard

fact: threat detection rates

fact: penetration tests

reasoning: The paragraph primarily describes how the Audit Committee oversees cybersecurity risk management, including the flow of information (dashboards, briefings, external reports) to the committee, making it Board Governance. The specificity is Firm-Specific due to the mention of the 'Director of Information Technology' and the 'cybersecurity dashboard', which distinguish the company's specific reporting mechanisms.


fact: Enterprise & Technology Security ("E&TS") organization

fact: Chief Information Security Officer ("CISO")

fact: CSIRT

fact: Product Security Incident Response Team ("PSIRT")

fact: Business Information Security Officers ("BISO")

fact: Office of the CISO

reasoning: The paragraph primarily describes the organizational structure and roles of management responsible for cybersecurity, including the E&TS organization, CISO, CSIRT, PSIRT, and BISOs. The specificity is Firm-Specific due to the numerous named roles and teams unique to IBM's organizational structure.


fact: CIO

reasoning: The paragraph primarily describes the board's oversight of cybersecurity risks, including coordination with management and the Audit Committee, and how information flows to the board via the CIO. The mention of the CIO role makes it Firm-Specific.


fact: EXCO

fact: Senior Leadership Team ("SLT")

fact: tabletop exercises

reasoning: The paragraph primarily describes the reporting structure and oversight activities involving the CISO, the Board of Directors, the EXCO, and the SLT, making it a Board Governance paragraph. The specificity is Firm-Specific due to the mention of the CISO role, EXCO, and SLT.


fact: ELT

fact: incident response processes

reasoning: The paragraph primarily describes the role of the CISO and their interactions with various leadership teams (ELT, SLT) and the Board, making it Management Role. The specificity is Firm-Specific due to the mention of the CISO role and specific internal leadership teams (ELT, SLT).


fact: security incident and event manager interface

fact: behavioral analytics

fact: firewalls

fact: anti-malware

fact: penetration testing

reasoning: The paragraph describes the company's cybersecurity program activities, including tools used (SIEM, firewalls, anti-malware) and testing processes (penetration testing), which falls under Risk Management Process. The specificity is Domain-Adapted because it uses specific cybersecurity terminology (SIEM, behavioral analytics, penetration testing) but lacks firm-specific or externally verifiable facts.


fact: April 2022

fact: exfiltration of certain confidential company and patient information

fact: Security Operations Center

fact: ransomware attacks

reasoning: The paragraph primarily describes a specific cybersecurity incident that occurred in April 2022, including its impact and remediation efforts, making it an Incident Disclosure. The specificity is Quantified-Verifiable due to the specific date (April 2022) tied to a real event.


reasoning: The paragraph states a conclusion about whether cybersecurity has affected business outcomes ('did not experience a material cybersecurity incident'), which falls under Strategy Integration according to Rule 5. It contains no domain terms, firm-specific facts, or verifiable claims, making it Generic Boilerplate.


fact: Senior Director of Governance & Information Security (Senior Director, GIS)

reasoning: The paragraph describes the board's oversight structure, specifically the delegation of cybersecurity risk oversight to the Audit Committee and the reporting chain from management to the committee and board. The specificity is Firm-Specific due to the inclusion of the specific management title 'Senior Director of Governance & Information Security'.


reasoning: The paragraph explicitly states a conclusion about the material impact of past cybersecurity incidents on the business and mentions cyber risk insurance, which falls under Strategy Integration. The language is entirely generic and lacks any domain-specific terminology, firm-specific details, or verifiable metrics, resulting in a Generic Boilerplate specificity.


fact: Emergency Incident Response Team

reasoning: The paragraph describes the activities of the incident response program, specifically reviewing and drilling on the plan, which falls under Risk Management Process. The mention of the specific 'Emergency Incident Response Team' elevates the specificity to Firm-Specific.


reasoning: The paragraph provides generic introductory context about the company's reliance on technology and data, without describing any specific cybersecurity measures, governance, or incidents.


reasoning: The paragraph provides a generic introductory statement about the company's exposure to cyber threats due to its business model, without detailing any specific cybersecurity measures, governance, or impacts.


fact: CISO

fact: Cybersecurity Executive Steering Body

reasoning: The paragraph describes the governance reporting chain from the CISO to the Cybersecurity Executive Steering Body and ultimately to the Audit Committee, making it Board Governance. Specificity is Firm-Specific due to the mention of the CISO role and a specifically named management committee.


reasoning: The paragraph is solely a cross-reference to the Risk Factors section in Item 1A, containing no substantive cybersecurity disclosures.


content_category: Third-Party Risk

reasoning: The paragraph explicitly discusses managing cybersecurity risks associated with third-party service providers, including conducting risk and compliance assessments, making it a clear fit for Third-Party Risk. The language is generic and lacks domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph focuses exclusively on the oversight of third-party service providers and vendor risk management. It is Firm-Specific because it names the company's specific 'Third-Party Risk Management (TPRM) program'.


reasoning: The paragraph explicitly states a conclusion regarding the material impact of cybersecurity incidents on the company's business strategy and financial condition, which falls under Strategy Integration. It contains no domain-specific terminology, firm-specific details, or verifiable facts, making it generic boilerplate.


fact: isolated computer workstations

fact: two-factor or independent authorizations

reasoning: The paragraph describes the Trust's cybersecurity protocols and tools, fitting Risk Management Process. Specificity is Domain-Adapted due to the mention of specific security controls like isolated workstations and two-factor authorizations.


reasoning: The paragraph is entirely a cross-reference to the Risk Factors section in Item 1A, containing no substantive cybersecurity program details.


fact: 24/7 security operations center

fact: insider threat protection program

fact: operational technology

reasoning: The paragraph describes the company's cybersecurity program activities, including incident response plans, a security operations center, an insider threat program, and employee training, which falls under Risk Management Process. The mention of a '24/7 security operations center' and 'insider threat protection program' elevates the specificity to Firm-Specific.


reasoning: The paragraph makes a negative assertion regarding the materiality of past cybersecurity incidents ('have not experienced any material cyber threats or incidents to date'), which falls under Strategy Integration. It contains only generic boilerplate language with no domain-specific terminology, firm-specific details, or externally verifiable facts.


reasoning: The paragraph explicitly describes the Board of Directors' oversight of cybersecurity risks, including integration with ERM and escalation processes. The language is entirely generic, lacking specific domain terminology, firm-specific details, or verifiable metrics.


reasoning: The paragraph explicitly states a conclusion regarding the material impact of cybersecurity incidents on the company's operations and financial condition, fitting the Strategy Integration category. It contains only a reporting-anchored negative assertion without any domain-specific, firm-specific, or verifiable cybersecurity facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph is a pure cross-reference to the MD&A section of the report, containing no substantive cybersecurity disclosures, and thus falls under None/Other with Generic Boilerplate specificity.


reasoning: The paragraph explains that the entity is a grantor trust with no active operations or personal data, lacking substantive cybersecurity disclosure, thus falling under None/Other.


fact: Vice-President of Information Technology ("VPIT")

fact: Director - Information Security ("DIS")

reasoning: The paragraph describes the flow of cybersecurity information to the Board from the Audit Committee and specific management roles, placing it in Board Governance. The specificity is Firm-Specific due to the naming of specific leadership titles (VPIT and DIS).


reasoning: The paragraph focuses entirely on the company's third-party risk management program for vetting and monitoring vendors. It lacks specific domain terminology, firm-specific details, or verifiable metrics, making it generic boilerplate.


fact: hacktivists

fact: state-sponsored organizations

fact: vulnerabilities

reasoning: The paragraph concludes with a backward-looking materiality assessment stating that cybersecurity risks have not had a material adverse effect on the company, which aligns with Strategy Integration. The specificity is Domain-Adapted due to the inclusion of specific threat actor terminology such as hacktivists and state-sponsored organizations.


reasoning: The paragraph is solely a cross-reference to the Risk Factors section and contains no substantive cybersecurity disclosure, making it None/Other with Generic Boilerplate specificity.


fact: Two members of the audit committee have obtained certifications in cybersecurity oversight

fact: chief information officer

fact: chief information security officer

fact: chief risk officer

fact: presents in person at board meetings twice each year

reasoning: The paragraph primarily describes the board's oversight structure and reporting cadence, making it Board Governance. It reaches Quantified-Verifiable specificity due to the specific count of audit committee members with certifications ('Two members') and the specific frequency of the CRO's in-person board presentations ('twice each year').


fact: CSO

fact: phishing tests

reasoning: The paragraph primarily describes the activities of the cybersecurity program, including incident response processes, employee training, and phishing tests, making it Risk Management Process. It is Firm-Specific due to the explicit mention of the CSO role.


fact: Vendor Management department

reasoning: The paragraph primarily discusses the vetting and oversight of third-party vendors, making it Third-Party Risk by text volume, despite concluding with a Strategy Integration materiality statement. Specificity is Firm-Specific due to the mention of the named Vendor Management department.


fact: security operations team

fact: incident response team

fact: automated event-detection notifications

reasoning: The paragraph describes the processes for detecting and analyzing cybersecurity incidents, falling under Risk Management Process. It includes firm-specific references to the company's internal 'security operations team' and 'incident response team'.


reasoning: The paragraph focuses exclusively on the company's efforts to monitor and manage cybersecurity risks associated with third-party service providers. The language is generic and lacks specific domain terminology, firm-specific details, or verifiable metrics.


fact: theft of personal information of U.S., Canadian and U.K. consumers

reasoning: The paragraph explicitly references a historical cybersecurity incident (the 2017 breach) and its scope, placing it in Incident Disclosure. The inclusion of the specific year (2017) makes it Quantified-Verifiable.


reasoning: The paragraph explicitly states a conclusion regarding the material impact of past cybersecurity incidents on the company's financial position, which falls under Strategy Integration. The language is entirely generic and contains no domain-specific terminology, firm-specific details, or verifiable facts.


reasoning: The paragraph provides generic business context and risk factor language about being targeted by cyber attacks due to the data and funds handled, without describing any actual cybersecurity measures, governance, or material impacts.


fact: ransomware

fact: malware

fact: phishing attacks

fact: operational technology

fact: social engineering

reasoning: The paragraph describes the components of the company's cybersecurity risk assessment program, including threat types, protective controls, and training, which falls under Risk Management Process. The specificity is Domain-Adapted due to the use of cybersecurity-specific terminology like ransomware, malware, phishing, and operational technology.


fact: threat intelligence

reasoning: The paragraph primarily describes how the management team monitors and stays informed about cybersecurity risks, fitting the Management Role category. The specificity is Domain-Adapted due to the inclusion of cybersecurity-specific terminology like 'threat intelligence'.


fact: CISO

fact: Managing Committee

reasoning: The paragraph primarily details the Board's oversight structure, including the roles of specific committees and reporting cadences. It is classified as Firm-Specific due to the mention of the CISO role and uniquely named committees like the Cybersecurity and Technology Subcommittee.


fact: endpoint protection

fact: two-factor authentication (2FA)

fact: real-time threat monitoring

fact: Tier-1 cloud service providers

reasoning: The paragraph details the company's cybersecurity risk management processes, including specific mitigation programs and tools. It is classified as Domain-Adapted due to the use of specialized cybersecurity terminology like endpoint protection, 2FA, and real-time threat monitoring.


reasoning: The paragraph concludes with a definitive assessment that no cybersecurity incidents have materially affected or are reasonably likely to materially affect the company's business strategy or financial condition, which aligns with Strategy Integration. The text relies entirely on generic terminology and reporting-anchored negative assertions, lacking any domain-specific, firm-specific, or verifiable facts.


fact: phishing attempts

reasoning: The paragraph makes a negative assertion regarding the occurrence of material cybersecurity incidents, which falls under Strategy Integration. It includes specific domain terminology regarding threat types (ransomware, malware, phishing) but lacks firm-specific or verifiable facts.


fact: identity and access management, cyber defense operations, security engineering

fact: Executive Vice President/ Chief Information Security Officer

fact: over 25 years' experience in cybersecurity risk management

fact: Chief Information Officer

fact: over 27 years' experience in technology risk management

fact: Senior Executive Vice President / Chief Operating Officer

fact: penetration testing, threat intelligence

reasoning: The paragraph primarily details the organizational structure, leadership roles (CISO, CIO), their qualifications, and reporting lines, making it a Management Role disclosure. The specificity is Quantified-Verifiable because it provides specific, verifiable lower bounds for the years of experience held by the CISO and CIO.


fact: cybersecurity maturity

reasoning: The paragraph primarily describes the board and committee oversight structure for cybersecurity risks, making it Board Governance. The specificity is Firm-Specific due to the inclusion of the specific management title 'Vice President, Information Systems and Technology'.


fact: Cybersecurity Committee

reasoning: The paragraph explicitly states a conclusion regarding the material impact of past cybersecurity incidents on the company's strategy and financial condition, classifying it as Strategy Integration. The specificity is Firm-Specific due to the mention of a dedicated Board-level 'Cybersecurity Committee'.


fact: forensic investigations

fact: containment

fact: remediation

reasoning: The paragraph primarily describes the company's incident response plan, including containment, remediation, and notification procedures, which falls under Risk Management Process. The specificity is Domain-Adapted due to the use of cybersecurity-specific terms like forensic investigations and containment/remediation, without any firm-specific or verifiable facts.


reasoning: The paragraph is a generic introductory statement expressing a commitment to protecting assets and data, without describing any substantive cybersecurity measures, processes, or governance structures.


fact: Information Security Team

fact: designated information security personnel from each segment

reasoning: The paragraph explicitly details the process for overseeing and mitigating cybersecurity risks associated with third-party service providers, making it a clear fit for Third-Party Risk. The specificity is Firm-Specific due to the mention of the internal 'Information Security Team' and the segment-based organizational structure for security personnel.


fact: Chief Information Officer (CIO)

fact: Executive Committee

fact: Chief Information Security Officer (CISO)

reasoning: The paragraph primarily describes management's responsibility for cybersecurity, specifically naming the CIO and CISO and their roles in assessing and managing risks. The specificity is Firm-Specific due to the mention of specific executive roles (CIO, CISO) and a specific management committee (Executive Committee).


fact: RCSC

fact: CISO

reasoning: The paragraph describes the reporting structure and frequency of cybersecurity updates from the CISO to the RCSC (a board-level committee), making it Board Governance. The specificity is Firm-Specific due to the mention of the specific committee acronym (RCSC) and the CISO role.


fact: Aerospace Safety Committee

fact: Chief Information Officer and Senior Vice President, Information Technology & Data Analytics (CIO)

fact: Chief Security Officer (CSO)

fact: Chief Engineer

fact: Chief Aerospace Safety Officer

fact: Chief Product Security Engineer

reasoning: The paragraph primarily describes the Board's oversight structure, detailing how cybersecurity risk oversight is delegated to the Audit and Aerospace Safety Committees and how management reports to them. The specificity is Firm-Specific because it names unique board committees and specific executive titles responsible for cybersecurity reporting.


fact: cyber-attack

fact: cyber intrusion

fact: insider threats

reasoning: The paragraph states a conclusion about whether cybersecurity has materially affected the business strategy, results of operations, or financial condition, which falls under Strategy Integration. The specificity is Domain-Adapted due to the use of cybersecurity-specific terms like 'cyber intrusion' and 'insider threats'.


fact: Cybersecurity team

specificity_confidence: medium

reasoning: The paragraph is entirely focused on the oversight of third-party service providers, including risk assessments and contractual security requirements, making it Third-Party Risk. The specificity is Firm-Specific due to the reference to the capitalized 'Cybersecurity team' as a distinct organizational unit.


fact: Cyber Security Group

fact: operational technology

fact: Department of Homeland Security's list of Prohibited Nations

type: framework

reasoning: The paragraph primarily discusses vendor screening, risk ranking, and supply chain protection, making Third-Party Risk the dominant category despite a brief mention of cyber insurance at the end. The specificity is Firm-Specific due to the mention of the named 'Cyber Security Group'.


category_confidence: medium

reasoning: The paragraph lists general oversight and monitoring activities, such as reviewing regulatory reports and discussing emerging risks, which form part of the risk management and oversight process. It lacks specific domain terminology, firm-specific details, or verifiable metrics.


fact: Chief Information Security Officer ("CISO")

reasoning: The paragraph primarily describes the Audit Committee's oversight of cybersecurity risks and the reporting cadence/content from the CISO to the committee, making it Board Governance. The specificity is Firm-Specific due to the explicit mention of the Chief Information Security Officer (CISO) role.


reasoning: The paragraph explicitly states a conclusion regarding the material impact of cybersecurity threats on the company's business strategy and financial condition, placing it in Strategy Integration. The language is entirely generic boilerplate with no specific domain terms, firm-specific details, or verifiable metrics.


reasoning: The paragraph is entirely focused on managing cybersecurity risks associated with third-party service providers and vendors, including assessments and contractual requirements. It contains no domain-specific terminology, firm-specific roles, or verifiable facts, making it generic boilerplate.


reasoning: The paragraph explicitly states a conclusion regarding the material impact of cybersecurity risks on the company's business strategy and financial standing, which falls under Strategy Integration. It contains only a generic negative assertion with no specific domain terms, firm-specific details, or verifiable facts, resulting in Generic Boilerplate specificity.


fact: DTI organization

fact: CDT function

fact: CIO

fact: Incident Response team

reasoning: The paragraph primarily describes the roles, responsibilities, and reporting structure of management (CIO, CISO, DTI, CDT, Incident Response team) in handling cybersecurity, fitting the Management Role category. The specificity is Firm-Specific due to the naming of specific internal roles and teams.


fact: Enterprise Risk Management Committee ("ERM Committee")

fact: SOC1 reports

reasoning: The paragraph primarily outlines the company's risk management processes, including integration with the overall ERM system, oversight by the ERM Committee, and third-party risk management. The specificity is Firm-Specific due to the explicitly named Enterprise Risk Management Committee.


reasoning: The paragraph focuses entirely on the processes for assessing and managing cybersecurity risks associated with third-party service providers. The language used is generic and lacks specific domain terminology, firm-specific details, or verifiable metrics, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph focuses entirely on the contractual security requirements imposed on suppliers, vendors, and third parties, making it a clear fit for Third-Party Risk. The language used is generic and lacks any domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph explicitly states a conclusion about the materiality of past cybersecurity incidents ('have not... experienced a cybersecurity threat or incident that resulted in a material adverse impact'), which falls under Strategy Integration. The language is entirely generic and lacks specific domain terminology, firm-specific details, or verifiable facts.


fact: security operations center

fact: Chief Information Security Officer (CISO)

fact: Cybersecurity Incident Response Plan

fact: Crisis Response Team

fact: Chief Information Officer

fact: Public Disclosure Committee

reasoning: The paragraph primarily details management's organizational structure and escalation processes for cybersecurity incidents, focusing heavily on the roles of the CISO, Crisis Response Team, and General Counsel. It is classified as Firm-Specific due to the naming of specific management roles (CISO, CIO) and internal teams/committees (Crisis Response Team, Public Disclosure Committee).


reasoning: The paragraph primarily discusses the company's processes for overseeing and identifying cybersecurity risks associated with third-party service providers, making it a clear fit for Third-Party Risk. The mention of a specific 'Third Party Risk Management (TPRM) program' elevates the specificity to Firm-Specific.


fact: Previously Disclosed Cyber Incident

reasoning: The paragraph explicitly states conclusions about how cybersecurity threats and a specific incident have materially affected the company's results of operations and financial condition, which aligns with Strategy Integration. The capitalization of 'Previously Disclosed Cyber Incident' indicates a firm-specific named event.


reasoning: The paragraph explicitly states a conclusion about whether cybersecurity threats have materially affected or are reasonably likely to materially affect the company, which aligns with the Strategy Integration category. The language is generic and lacks any domain-specific terms, firm-specific facts, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: February 22, 2024

fact: cybercrime threat actors

reasoning: The paragraph describes a specific, actual cybersecurity incident that occurred on February 22, 2024, making it Incident Disclosure. The specificity is Quantified-Verifiable due to the specific date provided.


fact: defense-in-depth

fact: endpoint detection and response

fact: network anomaly detection

fact: multi-factor authentication

fact: threat intelligence services

fact: phishing simulation exercises

reasoning: The paragraph describes the components and activities of the company's cybersecurity risk management program, including specific security tools and employee training. The specificity is Domain-Adapted because it uses specialized cybersecurity terminology (e.g., defense-in-depth, endpoint detection and response, multi-factor authentication) but lacks firm-specific identifiers or externally verifiable metrics.


fact: real-time security scoring

fact: threat intelligence

reasoning: The paragraph focuses entirely on managing cybersecurity risks related to suppliers and third parties. It includes domain-specific terminology like 'real-time security scoring' and 'threat intelligence' but lacks firm-specific or verifiable details.


fact: Senior Manager of our Enterprise IT Security Risk and Compliance team

fact: Managing Director of Enterprise IT

fact: over 30 years of IT experience

fact: over 20 years specializing in cybersecurity

reasoning: The paragraph primarily describes management's organizational structure, leadership roles, reporting lines, and qualifications for handling cybersecurity, making it Management Role. The specificity is Quantified-Verifiable due to the specific, verifiable lower bounds of experience ('over 30 years', 'over 20 years').


fact: SOC 1 audit

reasoning: The paragraph focuses exclusively on the oversight of third-party service providers and the requirement for them to undergo SOC 1 audits. Specificity is Domain-Adapted due to the reference to the SOC 1 audit framework.


fact: outside-in, hacker perspective

reasoning: The paragraph primarily discusses the company's Third Party Risk Management (TPRM) program and how it oversees cybersecurity risks associated with third-party service providers, making it a Third-Party Risk category. The specificity is Firm-Specific due to the named 'Third Party Risk Management (TPRM) program'.


fact: endpoint protection

fact: network segmentation

fact: cybersecurity threat intelligence

reasoning: The paragraph details the technical safeguards and tools used in the company's cybersecurity program, categorizing it as Risk Management Process. The specificity is Domain-Adapted due to the use of specialized cybersecurity terminology like 'endpoint protection' and 'network segmentation'.


fact: John Bresney, EVP & CIO

fact: employed him for approximately 30 years

fact: bachelor's degree in information systems and business

fact: Master's Certificate in Project Management

fact: Columbia University CIO Program Certificate

fact: Robert McKenna, SVP of Enterprise Strategy and Execution

fact: Security Incident Response Plan ("IRP")

fact: employed him for approximately 21 years

fact: over 27 years of technology and information security experience

fact: master's degree in business administration

fact: Certificate in Project Management

fact: Certified Insurance Counselor

fact: Christopher Cunniff, SVP and CRO

fact: chairs the ERC and the Emerging Risk Committee

fact: employed him for approximately six years

fact: over 32 years of insurance industry experience

fact: bachelor's degree in mathematics

fact: fellow of the Casualty Actuarial Society

fact: member of the American Academy of Actuaries

reasoning: The paragraph explicitly details the roles, responsibilities, reporting lines, and qualifications of key management personnel (CIO, SVP of Enterprise Strategy and Execution, CRO) involved in cybersecurity, making it a clear Management Role paragraph. The specificity is Quantified-Verifiable due to the numerous verifiable facts, including specific years of experience, degrees, and certifications held by the named individuals.


fact: TEP's Enterprise Cybersecurity team

fact: Certified Information Systems Security Professional (CISSP)

fact: Global Industrial Cyber Security Professional (GICSP)

fact: Electricity Information Sharing and Analysis Center

fact: Cybersecurity and Infrastructure Security Agency

fact: network monitoring

fact: vulnerability scanning

reasoning: The paragraph describes the activities and tools used by the cybersecurity team to manage risk, including threat intelligence and vulnerability scanning, making it a Risk Management Process disclosure. The specificity is Quantified-Verifiable because it lists externally verifiable certifications (CISSP, GICSP) and specific named external intelligence sources (E-ISAC, CISA).


reasoning: The paragraph describes the implementation of policies and systems to manage cybersecurity risks, placing it in Risk Management Process. It includes the domain-specific concept of the CIA triad ('confidentiality, integrity and availability'), making it Domain-Adapted.


fact: February 21, 2024

fact: Change Healthcare

fact: UnitedHealth Group

reasoning: The paragraph primarily describes a specific cybersecurity incident involving a third-party vendor (Change Healthcare), detailing the timeline, response, and impact, making it an Incident Disclosure. The specificity is Quantified-Verifiable due to the inclusion of a specific date (February 21, 2024) and named external firms (Change Healthcare, UnitedHealth Group).


reasoning: The paragraph explicitly states a conclusion regarding the material impact of cybersecurity risks and incidents on the company's business strategy and financial condition, placing it in Strategy Integration. It contains no domain-specific terminology, firm-specific details, or verifiable facts, making it generic boilerplate.


reasoning: The paragraph explicitly discusses the material effects of cybersecurity risks on business strategy and financial condition, and includes a negative assertion regarding material incidents, placing it in Strategy Integration. It contains no domain-specific terminology, firm-specific details, or verifiable facts, making it generic boilerplate.


fact: CISO

fact: CIO

fact: cybersecurity dashboard

fact: Transportation Security Administration (TSA) compliance

reasoning: The paragraph primarily details the Board of Directors' and Audit Committee's oversight of cybersecurity, including reporting cadences and escalation protocols. Specificity is Firm-Specific due to the mention of specific leadership roles (CISO, CIO) and internal reporting tools (cybersecurity dashboard).


reasoning: The paragraph primarily describes the oversight structure for cybersecurity risks, detailing the roles of the Board of Directors and the Audit Committee, making it Board Governance. The mention of the 'CIO' elevates the specificity to Firm-Specific.


fact: EVP, Chief Digital and Innovation Officer (CDIO)

fact: Vice President (VP) of Platforms, Infrastructure and Cybersecurity

fact: over 20 years of related experience

reasoning: The paragraph focuses entirely on the leadership roles and experience of the management team responsible for the cybersecurity program, making it Management Role. It includes verifiable claims regarding the specific years of experience ('over 20 years') of the named executives, elevating the specificity to Quantified-Verifiable.


fact: February 2023

reasoning: The paragraph explicitly describes a real cybersecurity incident that occurred in February 2023, detailing its impacts such as system interruption and data disclosure. The inclusion of a specific date for the incident makes it Quantified-Verifiable.


fact: CSBDO

fact: over thirty years of experience

fact: CISO of two large retailers

fact: nearly twenty years of experience

reasoning: The paragraph provides a comprehensive overview of the company's cybersecurity program, including systems, training, third-party risk, and incident response, making it primarily about the Risk Management Process. It achieves Quantified-Verifiable specificity by including verifiable career history metrics for the CISO and CSBDO, such as 'over thirty years of experience'.


reasoning: The paragraph explicitly states a backward-looking conclusion that cybersecurity risks have not materially affected the business or results of operations, which aligns with Strategy Integration. The text contains only generic disclaimers, negative assertions, and a cross-reference, lacking any domain-specific or verifiable facts.


fact: Security and Technology Risk Leadership Committee

fact: Privacy and Data Governance Committee

fact: Chief Privacy Officer

fact: Data Security and Privacy Governance Committee

reasoning: The paragraph is classified as Management Role because it exclusively details the structure, leadership (CISO, Chief Privacy Officer), and reporting lines of management-level cybersecurity and privacy committees. The specificity is Firm-Specific due to the inclusion of uniquely named internal committees and specific executive roles.


reasoning: The paragraph consists of a section header and generic risk factor boilerplate about the potential consequences of a breach, without describing any actual cybersecurity measures or processes.


reasoning: The paragraph describes the company's incident response plan, testing through simulation exercises, and the incident response team's activities, which falls under Risk Management Process. The language used is generic and lacks specific domain terminology, firm-specific details, or verifiable facts.


fact: ransomware

fact: phishing

fact: non-public information

reasoning: The paragraph describes the general cybersecurity threat landscape and industry risks rather than specific company processes, governance, or strategy, placing it in None/Other. It includes domain-specific terminology like ransomware and phishing, elevating the specificity to Domain-Adapted.


reasoning: The paragraph makes a negative assertion regarding the material impact of past cybersecurity incidents on the business, which falls under Strategy Integration. It contains only generic boilerplate language with no domain-specific terminology, firm-specific details, or verifiable facts.


reasoning: The paragraph explicitly assesses the material impact of cybersecurity incidents on the company's business strategy and financial condition, fitting the Strategy Integration category. It contains only generic boilerplate language with no domain-specific terminology, firm-specific details, or verifiable metrics.


fact: administrative, physical, and technical safeguards

fact: data security addendum

fact: mandatory incident reporting protocols

reasoning: The paragraph explicitly details the contractual and procedural requirements imposed on third-party vendors to manage cybersecurity risks, fitting squarely into Third-Party Risk. The specificity is Domain-Adapted due to the use of cybersecurity contracting and safeguard terminology without verifiable metrics or highly unique firm-specific identifiers.


fact: multi-factor authentication

reasoning: The paragraph primarily describes a specific historical cybersecurity incident (a ransomware attack in May 2022), detailing the response, remediation, and impact. Specificity is Quantified-Verifiable due to the specific date provided for the incident.


fact: Chief Information Security Officer ("CISO")

fact: vulnerability assessments

reasoning: The paragraph primarily describes the Board of Directors' and Risk Committee's oversight of cybersecurity, including reporting structures and cadences. It is Firm-Specific because it explicitly names the Chief Information Security Officer (CISO) role.


fact: Chief Innovation Officer

reasoning: The paragraph describes the oversight roles of the Board and Audit Committee regarding cybersecurity risks, making it Board Governance. The mention of the 'Chief Innovation Officer' elevates the specificity to Firm-Specific.


fact: August 2023

reasoning: The paragraph states a conclusion about the materiality of prior cybersecurity incidents ('have not materially affected us'), which falls under Strategy Integration. The mention of a specific date ('August 2023') makes it Quantified-Verifiable.


fact: CISO

fact: Core Cybersecurity Management Team (the "CCMT")

fact: CIRP

reasoning: The paragraph describes management's organizational structure for handling cybersecurity, specifically detailing the composition and responsibilities of the Core Cybersecurity Management Team (CCMT), making it Management Role. The specificity is Firm-Specific due to the naming of the CISO role, the specific CCMT committee, and the CIRP program.


fact: Progress Software Corporation

fact: MOVEit Transfer

reasoning: The paragraph details a specific, actual cybersecurity incident involving the MOVEit Transfer vulnerability at a third-party vendor, making it an Incident Disclosure. It includes verifiable facts such as the named software (MOVEit Transfer) and the vendor (Progress Software Corporation), elevating the specificity to Quantified-Verifiable.


fact: defense-in-depth

fact: National Institute of Standards and Technology Cyber Security Framework

fact: Written Information Security Program

fact: vulnerability scanning

fact: penetration testing

reasoning: The paragraph comprehensively details the company's cybersecurity risk management processes, including its defense-in-depth approach, NIST CSF alignment, and six key focus areas. It is classified as Firm-Specific due to the explicit naming of its internal 'Written Information Security Program'.


reasoning: The paragraph provides a high-level, introductory statement about the purpose of the company's cybersecurity governance and risk management program without detailing specific oversight structures or processes. It contains no specific facts or domain terminology, making it generic boilerplate.


reasoning: The paragraph explicitly assesses the likelihood of cybersecurity threats materially affecting the company's business strategy and financial condition, fitting the Strategy Integration category. It contains only generic boilerplate language and cross-references without specific domain terms or verifiable facts.


fact: forensic reviews

fact: independent security assessments

reasoning: The paragraph describes the use of external assessors and consultants as part of the overall information security program, which falls under Risk Management Process. The specificity is Domain-Adapted due to the use of cybersecurity-specific terms like 'forensic reviews' and 'independent security assessments'.


reasoning: The paragraph explicitly states a conclusion regarding the material impact of cybersecurity breaches on the company's business strategy and financial condition, fitting the Strategy Integration category. It contains no domain-specific terminology, firm-specific details, or externally verifiable facts, making it generic boilerplate.


fact: Vendor Management Committee

fact: Vendor Management team

reasoning: The paragraph focuses exclusively on the oversight and due diligence processes for managing cybersecurity risks associated with third-party vendors. Specificity is Firm-Specific due to the mention of the internal Vendor Management Committee and Vendor Management team.


fact: Vice President of Information Technology, Security and Business Intelligence

fact: over 18 years

fact: Biogen, AstraZeneca, Iron Mountain, Charles River Labs, Sunovion Pharmaceuticals, Agero and DentaQuest

fact: master's degree in business administration from Boston University

fact: master's degree in electrical and computer engineering from Utah State University

fact: bachelor's degree in electronics engineering from Mumbai University

fact: over 10 years of experience

reasoning: The paragraph focuses entirely on the roles, responsibilities, qualifications, and career history of management, specifically the VP of IT, Security and Business Intelligence, making it Management Role. The specificity is Quantified-Verifiable due to the numerous verifiable facts, including specific years of experience, named previous employers, and specific degrees from named universities.


reasoning: The paragraph primarily serves as a cross-reference to the Risk Management section in Item 7 and contains only generic boilerplate regarding ERM integration, lacking substantive cybersecurity disclosure.


reasoning: The paragraph explicitly states a conclusion about the historical materiality of cyber attacks on the company's operations and financial condition, which falls under Strategy Integration. It contains no domain-specific terminology, firm-specific cybersecurity details, or externally verifiable facts, making it generic boilerplate.


fact: Chief Information Security Officer (CISO)

fact: 30 years of information technology experience

fact: 17 years focused specifically on information security

reasoning: The paragraph focuses on the responsibilities and qualifications of the CISO, placing it in Management Role. It includes verifiable quantified facts regarding the CISO's years of experience, elevating the specificity to Quantified-Verifiable.


fact: Chief Capability Officer (CCO)

fact: Chief Information Officer (CIO)

reasoning: The paragraph primarily describes the board-level oversight structure, specifically how the Audit Committee receives reports and engages with management. It is classified as Firm-Specific due to the explicit naming of executive roles (CCO, CIO, CISO) involved in this reporting chain.


fact: CSO

fact: confidentiality, integrity, or availability

reasoning: The paragraph primarily describes the overarching design and objectives of the company's cybersecurity risk management program. It is classified as Firm-Specific due to the explicit mention of the CSO (Chief Security Office/Officer).


fact: Chief Security and Trust Officer

fact: Executive Vice President, Operations

fact: over 25 years

reasoning: The paragraph describes the roles, reporting lines, and qualifications of management (Chief Security and Trust Officer reporting to EVP, Operations), making it Management Role. The specificity is Quantified-Verifiable due to the verifiable claim of 'over 25 years' of experience.


fact: System and Organization Controls (SOC) 2

fact: ISO 27001 (Information and Security Certification)

reasoning: The paragraph is entirely focused on managing cybersecurity risks associated with third-party service providers, including vendor onboarding, due diligence, and security requirements imposed on suppliers. The specificity is Domain-Adapted because it references specific cybersecurity frameworks (SOC 2, ISO 27001) but lacks firm-specific or quantified-verifiable facts.


fact: vulnerability

reasoning: The paragraph focuses on managing third-party security risks, specifically detailing the security due diligence process for acquisition targets, making it Third-Party Risk. The specificity is Domain-Adapted due to the use of the domain term 'vulnerability'.


fact: Director of Cybersecurity

fact: over 20 years of cybersecurity oversight experience

reasoning: The paragraph details the management structure, roles, and qualifications for cybersecurity oversight, making it Management Role. It includes verifiable claims regarding the CIO and Director of Cybersecurity having over 20 years of experience.


fact: MOVEit Transfer

fact: zero-day

reasoning: The paragraph primarily describes actual past cybersecurity incidents, including a specific 2023 vendor incident, making it Incident Disclosure despite the concluding materiality statement. The specificity is Quantified-Verifiable due to the inclusion of a specific year (2023) and a named software system (MOVEit Transfer) involved in the incident.


fact: defense in depth

fact: data loss prevention technology

fact: transport layer security encryption

fact: phishing, malware and social engineering testing

reasoning: The paragraph details the technical and procedural measures of the cybersecurity program, including encryption, DLP, and employee training, placing it in Risk Management Process. The use of specific cybersecurity terminology like defense in depth, data loss prevention, and transport layer security encryption elevates the specificity to Domain-Adapted.


reasoning: The paragraph describes the Audit Committee's role in overseeing cybersecurity risks, which falls under Board Governance. It contains only generic boilerplate language with no specific domain terms, firm-specific details, or verifiable metrics.


fact: CDO

fact: CISO

fact: over 25 years of prior work experience

fact: ISACA Certified Information Security Manager

fact: ISC2 Certified Information Systems Security Professional

reasoning: The paragraph focuses on the leadership roles, responsibilities, and qualifications of the CDO and CISO, which clearly falls under Management Role. The specificity is Quantified-Verifiable due to the inclusion of a specific lower-bound number of years of experience (over 25 years) and externally verifiable certifications (CISM and CISSP).


reasoning: The paragraph focuses entirely on the evaluation and oversight of third-party service providers regarding cybersecurity risks. The language is highly generic, lacking any specific domain terminology, firm-specific details, or verifiable metrics.


fact: Vice President of Cybersecurity

reasoning: The paragraph primarily describes the Board and Audit Committee's oversight of cybersecurity risks and the frequency of their briefings, making it Board Governance. The specificity is Firm-Specific due to the mention of the 'Vice President of Cybersecurity', a specific leadership role.


reasoning: The paragraph is entirely focused on the process for managing cybersecurity risks associated with third-party service providers, making it Third-Party Risk. The mention of specific teams involved in the cross-functional effort (Legal, Privacy and Information Security teams) elevates the specificity to Firm-Specific.


fact: Information Security and Compliance teams

fact: CIO

fact: Vice President of Information Security

fact: vulnerability assessments

reasoning: The paragraph primarily describes the oversight structure and reporting cadence to the Board and Audit Committee, making it Board Governance. The specificity is Firm-Specific due to the inclusion of specific internal management roles and teams, such as the Vice President of Information Security and the Information Technology Senior Leadership Team.


reasoning: The paragraph is entirely focused on how the company manages cybersecurity risks associated with third-party service providers, making it Third-Party Risk. The language used is generic and lacks any domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph describes the roles of the Audit Committee and Risk Committee in overseeing cybersecurity governance and controls, which falls under Board Governance. The language relies on standard audit and risk management terminology without specific cybersecurity domain terms or unique firm details.


fact: FRB, FDIC and the DFR

reasoning: The paragraph introduces the company's cybersecurity risk management program and its integration with the broader enterprise risk management strategy. It includes specific named regulatory bodies (FRB, FDIC, DFR) that oversee the bank, which distinguishes its specific regulatory environment and elevates the specificity to Firm-Specific.


fact: ransomware attack

reasoning: The paragraph explicitly discloses a past cybersecurity event (a ransomware attack) and its subsequent impact, fitting Incident Disclosure. The specificity is Quantified-Verifiable because it provides a specific, verifiable year (2021) for the incident.


fact: cybersecurity insurance coverage

fact: security vulnerabilities

reasoning: The paragraph explicitly discusses the materiality of past incidents on financial condition and the impact of cyber risks on business strategy, including investments in cybersecurity insurance, which falls squarely under Strategy Integration.


fact: IT Security team

fact: over 30 years of experience

fact: Global Information Assurance Certification ("GIAC") Security Essentials

fact: GIAC Certified Enterprise Defender

fact: GIAC Certified Incident Handler Certification

fact: GIAC Certified Windows Security Administrator

fact: GIAC Critical Controls Certification

fact: Vice President of Information Technology

fact: over 19 years of experience

fact: Certified Information Systems Security Professional certification

reasoning: The paragraph primarily describes the roles, responsibilities, reporting lines, and qualifications of management personnel (Director of IT Infrastructure and Security, VP of Information Technology) handling cybersecurity, making it Management Role. The specificity is Quantified-Verifiable due to the inclusion of specific years of experience and verifiable certifications (GIAC, CISSP).


fact: denial of service attacks

reasoning: The paragraph begins with a direct conclusion about the material impact of cybersecurity incidents ('we have not been materially impacted by cyber incidents'), which classifies it as Strategy Integration under the materiality rule, despite the subsequent discussion of third-party risks. The specificity is Domain-Adapted due to the inclusion of cybersecurity-specific terminology like 'denial of service attacks'.


reasoning: The paragraph focuses exclusively on the oversight and risk assessment of third-party service providers, placing it in Third-Party Risk. The language used consists of generic risk management terminology without specific cybersecurity domain terms, firm-specific named entities, or verifiable metrics.


fact: pre-onboarding security assessments

fact: security controls

reasoning: The paragraph focuses exclusively on the oversight and assessment of IT vendors and service providers, fitting the Third-Party Risk category. It uses domain-specific terminology like pre-onboarding security assessments and security controls, making it Domain-Adapted.


fact: CISO

reasoning: The paragraph describes the frequency and sources of cybersecurity briefings to the Board, indicating Board Governance. The mention of the CISO role elevates the specificity to Firm-Specific.


reasoning: The paragraph explicitly discusses the materiality of cybersecurity threats on the company's financial condition and business strategy, fitting the Strategy Integration category. It contains no domain-specific terminology, firm-specific details, or verifiable metrics, making it generic boilerplate.


reasoning: The paragraph explicitly states a conclusion regarding the material impact of cybersecurity risks on the company's business strategy and financial condition, which falls under Strategy Integration. It contains only generic boilerplate language and a standard cross-reference, lacking any specific cybersecurity facts.


reasoning: The paragraph describes the board's oversight of cybersecurity, specifically detailing the roles of the Audit Committee and the Cybersecurity Sub-Committee, making it Board Governance. The mention of the 'Cybersecurity Sub-Committee of the Board of Directors' is a firm-specific fact, elevating the specificity to Firm-Specific.


fact: Umpqua Bank

fact: MOVEit

fact: August 2023

fact: 429,252 Umpqua Bank customers

reasoning: The paragraph describes a specific cybersecurity incident involving a vendor and MOVEit software, detailing the timeline, scope, and response, which clearly falls under Incident Disclosure. The specificity is Quantified-Verifiable due to the inclusion of specific dates (June 21, 2023), named systems (MOVEit), and exact numbers (429,252 customers).


fact: Corporate Risk Committee

fact: CIO

fact: ERM team

reasoning: The paragraph details the board's oversight structure, including the roles of the Corporate Risk Committee and Audit Committee, and the reporting cadence of the CIO and CISO to the board. It is classified as Firm-Specific due to the mention of specific internal roles (CIO, CISO) and a specific board committee (Corporate Risk Committee).


reasoning: The paragraph is solely a cross-reference directing the reader to the Risk Factors section in Item 1A for information on material impacts, which falls under None/Other and defaults to Generic Boilerplate specificity.


fact: ransomware

fact: malware

fact: phishing attempts

reasoning: The paragraph states a conclusion about the material impact of cybersecurity incidents ('we have not had any material cybersecurity incidents') and mentions carrying cyber insurance, which falls under Strategy Integration. The specificity is Domain-Adapted due to the inclusion of specific threat types like ransomware, malware, and phishing.


reasoning: The paragraph focuses exclusively on the oversight and assessment of third-party service providers' security measures, fitting the Third-Party Risk category. The language is entirely generic without any specific frameworks, roles, or verifiable metrics.


fact: Chief Information Officer (CIO)

fact: more than 30 years of experience

fact: Master's in Cybersecurity

fact: Certified Information Systems Security Professional

fact: Certified Information Security Manager

fact: Microsoft Certified Cybersecurity Architect Expert

fact: Security+

fact: Certified Information Systems Auditor

reasoning: The paragraph focuses on management's role by detailing the leadership and composition of the cybersecurity team, including the CIO's background and the team's qualifications. It reaches Quantified-Verifiable specificity by providing a verifiable lower bound for the CIO's experience ('more than 30 years') and listing specific, externally verifiable certifications held by the team (e.g., CISSP, CISM, Security+).


fact: February 21, 2024

fact: Change Healthcare

fact: UnitedHealth Group

fact: February 28, 2024

reasoning: The paragraph primarily describes a specific cybersecurity incident involving a third-party vendor (Change Healthcare), including the timeline, response actions, and impact assessment, making it an Incident Disclosure. The specificity is Quantified-Verifiable due to the inclusion of specific dates (February 21, 2024; February 28, 2024) and named external firms (Change Healthcare, UnitedHealth Group).


fact: Cyber ERM (Enterprise Risk Management) Committee

reasoning: The paragraph describes the establishment, composition, and responsibilities of a management-level committee (Cyber ERM Committee) for incident response and reporting, fitting the Management Role category. The naming of the specific committee makes it Firm-Specific.


fact: Retrieval-Masters Credit Bureau, Inc. d/b/a/ American Medical Collections Agency (AMCA)

fact: AMCA Incident

reasoning: The paragraph describes a specific historical cybersecurity incident involving a third-party collection agency (AMCA), including the date of notification and ongoing litigation/inquiries, making it an Incident Disclosure. The specificity is Quantified-Verifiable due to the specific date (May 14, 2019) and the named third-party firm (AMCA).


reasoning: The paragraph explicitly states a conclusion regarding the materiality of past cybersecurity incidents, which falls under Strategy Integration. It contains only generic disclaimers and negative assertions without any domain-specific terminology or verifiable facts, resulting in Generic Boilerplate specificity.


fact: dedicated department within its Enterprise Risk Management division

reasoning: The paragraph focuses entirely on the management of cybersecurity risks associated with third-party service providers. It is Firm-Specific because it names specific internal departments (a dedicated department within ERM and the Bank's Information Technology Department) responsible for this oversight.


fact: Chief Security Officer ("CSO")

fact: reports to the CFO

fact: since 2018

fact: over 14 years of global executive cybersecurity experience

reasoning: The paragraph details the role, reporting structure, and qualifications of the Chief Security Officer, placing it in Management Role. It includes verifiable facts such as the CSO's tenure since 2018 and over 14 years of experience, making it Quantified-Verifiable.


fact: National Institute on Standards and Technology Cybersecurity Framework

fact: security operation center

fact: multi-factor authentication

fact: firewalls

fact: intrusion prevention and detection systems

fact: partitioning and encryption of information

fact: malware defenses

fact: patching

reasoning: The paragraph details the company's cybersecurity defenses, tools, and training programs, fitting the Risk Management Process category. It includes numerous domain-specific terms like NIST CSF, SOC, MFA, and IDS/IPS, making it Domain-Adapted.


reasoning: The paragraph is a pure cross-reference to the risk factors section regarding material impacts, containing no substantive cybersecurity disclosures or assessments itself.


fact: SHUSA's Head of Technology & Operations

fact: SHUSA's Chief Technology Officer

reasoning: The paragraph primarily details the structure and membership of management-level committees responsible for cybersecurity oversight, fitting Management Role. It includes firm-specific details such as the Information Security and Data Management Committee and specific executive titles like SHUSA's Chief Technology Officer.


reasoning: The paragraph explicitly states a conclusion regarding the material impact of cybersecurity threats on the company's operations and financial position, which aligns with the Strategy Integration category. The language used is generic and lacks specific domain terminology, firm-unique identifiers, or verifiable metrics.


fact: Chief Information Officer (CIO)

fact: CSO

fact: March 2022

fact: nearly 20 years of experience

reasoning: The paragraph describes the CIO's reporting structure, responsibilities, and background, which falls under Management Role. It includes verifiable facts such as the CIO's appointment date (March 2022) and quantified experience (nearly 20 years), making it Quantified-Verifiable.


fact: CISO

fact: cybersecurity subcommittee

fact: board enterprise risk committee

fact: more than 20 years of experience

fact: Master's degree in Business Administration with a focus on Information Technology

fact: Certified Information Security Manager (CISM) certification

fact: Senior Vice President – Enterprise Risk Officer

reasoning: The paragraph primarily details the CISO's responsibilities, qualifications, and reporting structure, making it a Management Role disclosure. The specificity is Quantified-Verifiable because it includes externally verifiable facts such as the CISO's specific certification (CISM), degree, and a quantified lower bound of experience (>20 years).


fact: threat intelligence services

fact: Third-Party Risk Management program

reasoning: The paragraph primarily discusses managing cybersecurity threats at third parties and the requirements imposed on them through the Third-Party Risk Management program, making it Third-Party Risk. The specificity is Firm-Specific due to the capitalized 'Third-Party Risk Management program'.


reasoning: The paragraph explicitly states a conclusion about the material impact of cybersecurity risks and incidents on the company's business strategy and financial condition, fitting the Strategy Integration category. It contains only a reporting-anchored negative assertion and a cross-reference, lacking specific domain terminology, firm-specific cybersecurity facts, or verifiable claims.


fact: Employee Self Service portal

reasoning: The paragraph primarily details the board and committee oversight structure for cybersecurity, including the audit committee's role and briefing cadences. It reaches Quantified-Verifiable specificity by citing the specific year (2022) an internal portal was developed.


reasoning: The paragraph focuses exclusively on the company's vendor due diligence process and how it assesses and manages cybersecurity risks associated with third-party vendors. The language is generic and lacks specific domain terminology, firm-unique details, or verifiable metrics.


reasoning: The paragraph describes the oversight role of the Risk Committee in providing assurances to the Board and management, making it Board Governance. It includes a firm-specific named internal plan (Incident Management and Information Security Plan), elevating the specificity to Firm-Specific.


reasoning: The paragraph primarily describes the integration of cybersecurity into the company's overall enterprise risk management (ERM) process and its annual risk assessments, fitting the Risk Management Process category. The specificity is Generic Boilerplate because it relies entirely on standard corporate governance and risk management terminology (ERM, Audit Committee, incident response, business continuity) without demonstrating specialized cybersecurity domain expertise, firm-specific details, or verifiable metrics.


reasoning: The paragraph is an introductory statement providing an overview of the disclosure's purpose without detailing any specific cybersecurity measures, governance, or processes.


reasoning: The paragraph consists entirely of forward-looking risk disclaimers and generic references to regulatory definitions, lacking substantive disclosure about the company's actual cybersecurity program.


fact: ISC

fact: CIO

fact: combined 20 years of risk management experience

fact: threat assessments

fact: vulnerability management

reasoning: The paragraph details the qualifications and specific roles of management personnel (CIO and Director of IT Security, Risk and Compliance) responsible for cybersecurity. It includes a verifiable quantified claim regarding their combined 20 years of experience, elevating the specificity to Quantified-Verifiable.


fact: over 20 years of information technology and cybersecurity experience

fact: technical degree in computer science from an accredited public university

reasoning: The paragraph primarily details the management structure, specifically the CISO's qualifications and the composition of the cybersecurity team. It reaches Quantified-Verifiable specificity by stating the CISO has over 20 years of experience and a specific degree.


reasoning: The paragraph explicitly states a conclusion regarding the material impact of cybersecurity incidents on the company's business strategy and financial condition, placing it in Strategy Integration. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity.


fact: ransomware

fact: denial-of-service

fact: advanced and persistent, highly organized adversaries

fact: nation state actors

reasoning: The paragraph discusses the business context of cybersecurity, its criticality to the company's vision, the types of threats faced, and the potential material adverse effects on operations and performance, which aligns with Strategy Integration. The specificity is Domain-Adapted due to the inclusion of specific cybersecurity threat terms like ransomware, denial-of-service, and nation state actors.


fact: Chief Information Officer

reasoning: The paragraph focuses on the responsibilities and qualifications of the management team, specifically the Chief Information Officer, making it Management Role. The specificity is Firm-Specific due to the explicit mention of the Chief Information Officer role.


fact: Federal Financial Institutions Examination Council (FFIEC)

fact: National Institute of Standards and Technology (NIST)

fact: Information Security Program

reasoning: The paragraph primarily discusses the design of the company's Information Security Program and its alignment with industry frameworks (FFIEC and NIST), which falls under Risk Management Process. The specificity is Firm-Specific due to the mention of the named 'Information Security Program' and the specific frameworks adopted.


fact: vulnerabilities

reasoning: The paragraph focuses entirely on the processes for assessing and monitoring cybersecurity risks associated with third-party service providers. It includes basic domain terminology like 'vulnerabilities' but lacks firm-specific details or verifiable metrics.


fact: National Institute of Standards and Technology Cybersecurity Framework

fact: Center for Internet Security – Top 18 Critical Security Controls – Control Level Framework

fact: biannual employee information security assessments

reasoning: The paragraph provides a comprehensive overview of the company's cybersecurity risk management program, detailing its frameworks, training, testing, and operational procedures. It includes firm-specific details such as biannual employee assessments and specific framework alignments.


fact: February 16, 2022

fact: February 2022 cybersecurity intrusion

reasoning: The paragraph primarily describes a specific historical cybersecurity incident (the February 16, 2022 intrusion), its impact, and the response, making it Incident Disclosure. The inclusion of a specific, verifiable date (February 16, 2022) elevates the specificity to Quantified-Verifiable.


reasoning: The paragraph makes a negative assertion regarding the absence of recent material cybersecurity incidents, which falls under Strategy Integration. It contains only generic disclaimers and cross-references without any specific cybersecurity facts or domain terminology, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily describes a specific cybersecurity incident that occurred on February 16, 2022, including the response and impact, making it Incident Disclosure. The inclusion of a specific date (February 16, 2022) makes the paragraph Quantified-Verifiable.


fact: CRO

fact: Chief Information Officer ("CIO")

fact: CISO

fact: over 15 years experience

fact: Executive Committee

fact: more than 30 years of experience

fact: Global Chief Risk Officer

reasoning: The paragraph details the roles, responsibilities, and career histories of the CRO, CIO, and CISO, placing it squarely in the Management Role category. The inclusion of specific, verifiable years of experience ('over 15 years', 'more than 30 years') elevates the specificity to Quantified-Verifiable.


reasoning: The paragraph explicitly states a conclusion regarding the material impact of cybersecurity risks and incidents on the company's business strategy and financial condition, placing it in Strategy Integration. It contains only generic boilerplate language and negative assertions without any specific domain terms, firm-specific details, or verifiable facts.


reasoning: The paragraph consists of generic, forward-looking speculation about the potential adverse effects of a cybersecurity attack, which falls under None/Other as it lacks substantive disclosure of actual cybersecurity measures or definitive materiality assessments.


reasoning: The paragraph is a pure cross-reference to the Risk Factors section, warranting a None/Other classification, which automatically defaults to Generic Boilerplate specificity.


reasoning: The paragraph is an executive biography that contains no substantive cybersecurity disclosure, so it is classified as None/Other and defaults to Generic Boilerplate.


fact: Head of Global IT

fact: IT Security Team

fact: CompTIA

fact: over 20 years of combined infrastructure architecture experience

fact: PCI, SOC1 and SOC2

reasoning: The paragraph primarily details the roles, responsibilities, and qualifications of the Head of Global IT and the IT Security Team, making it Management Role. It reaches Quantified-Verifiable specificity by including verifiable claims such as 'over 20 years' of experience and specific certifications like CompTIA.


fact: two years

fact: identity protection services, including credit monitoring

reasoning: The paragraph describes the ongoing response and remediation efforts for a specific cybersecurity incident, including litigation defense and customer assistance. It includes a verifiable quantified fact regarding the two-year duration of credit monitoring services offered.


reasoning: The paragraph describes the board of directors' oversight of cybersecurity risk, including receiving quarterly reports and updates from management, making it a clear Board Governance paragraph. The language is generic and lacks any domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: System Organization and Control Reports (SOC Reports)

reasoning: The paragraph focuses exclusively on managing cybersecurity risks associated with third-party providers and platforms. It includes domain-specific terminology like SOC Reports, elevating the specificity to Domain-Adapted.


reasoning: The paragraph focuses entirely on the oversight and management of cybersecurity risks associated with third-party service providers. The language used is generic and lacks specific domain terminology, firm-specific details, or verifiable metrics.


fact: Chief Risk Officer

reasoning: The paragraph describes the role and oversight responsibilities of the Chief Risk Officer, which falls under Management Role. The explicit mention of the Chief Risk Officer title elevates the specificity to Firm-Specific.


fact: audit and risk committee

fact: Chief Information Officer

fact: ISMS

reasoning: The paragraph describes the board of directors' and the audit and risk committee's oversight of risk management, including cybersecurity, and the reporting structure from management to the board, making it Board Governance. The specificity is Firm-Specific due to the mention of specific roles like the Chief Information Officer and Executive Director of Information Security.


reasoning: The paragraph explicitly states a conclusion regarding the material impact of cybersecurity incidents on the company's business strategy and financial condition, which falls under Strategy Integration. It contains no domain-specific terminology, firm-specific details, or verifiable facts, making it generic boilerplate.


fact: CISO

fact: Cybersecurity Executive Committee

reasoning: The paragraph describes the CISO briefing the Audit Committee and the composition of the Audit Committee regarding cybersecurity oversight, which falls under Board Governance. The mention of the CISO and the Cybersecurity Executive Committee elevates the specificity to Firm-Specific.


fact: contract research organizations

fact: contract manufacturing organizations

reasoning: The paragraph is entirely focused on how the company manages cybersecurity risks associated with third-party service providers, making it Third-Party Risk. The mention of specific types of vendors relevant to their industry (contract research organizations and contract manufacturing organizations) elevates the specificity to Firm-Specific.


reasoning: The paragraph explicitly states a negative assertion regarding past material cybersecurity incidents and discusses the potential business impact of system failures, aligning with Strategy Integration. It contains no domain-specific terminology, firm-specific details, or verifiable facts, making it generic boilerplate.


fact: Senior Vice President of Information Technology ("SVP IT")

reasoning: The paragraph primarily details the responsibilities and continuous knowledge acquisition of the SVP IT regarding cybersecurity monitoring and incident response, fitting the Management Role category. The specificity is Firm-Specific due to the explicit naming of the Senior Vice President of Information Technology role.


reasoning: The paragraph is a standard executive biography for the Chief Human Resources Officer and contains no cybersecurity-related information, placing it in None/Other. Per the rules, None/Other paragraphs are assigned Generic Boilerplate specificity.


fact: July 2018

fact: ransomware

fact: Dx information technology systems

reasoning: The paragraph primarily describes a specific historical cybersecurity incident, including its timeline, scope, and investigation results, which classifies it as Incident Disclosure. The inclusion of a specific, verifiable date (July 2018) elevates the specificity to Quantified-Verifiable.


fact: Vice President of IT & Digitization

reasoning: The paragraph describes the management structure and qualifications for overseeing the cybersecurity program, specifically naming the Vice President of IT & Digitization and the IT Team, making it Management Role. The specific title 'Vice President of IT & Digitization' elevates the specificity to Firm-Specific.


fact: February 2022

fact: approximately three weeks

fact: Chief Information Security Officer (CISO)

reasoning: The paragraph primarily describes a specific cybersecurity incident that occurred in February 2022, detailing its operational impact and subsequent remediation efforts, making it Incident Disclosure. The specificity is Quantified-Verifiable due to the specific date (February 2022) and quantified duration (approximately three weeks).


reasoning: The paragraph focuses exclusively on the processes and contractual requirements for managing cybersecurity risks associated with third-party service providers. The language used is generic and lacks specific domain terminology, firm-specific details, or verifiable metrics.


reasoning: The paragraph outlines the company's general philosophy and organizational responsibility for protecting data and systems, fitting into Risk Management Process. It is Domain-Adapted because it explicitly references the 'CIA triad' (confidentiality, integrity, and availability), a core cybersecurity concept.


fact: access control

reasoning: The paragraph outlines the company's processes and policies for identifying and managing cybersecurity risks, placing it in the Risk Management Process category. It includes domain-specific terminology such as 'access control', elevating the specificity to Domain-Adapted.


fact: Vice President and Chief Information Officer ("CIO")

fact: Chief Information Security Officer ("CISO")

fact: 27 years of cybersecurity experience

fact: 17 of which are in the oil and gas industry

fact: less than 400 CISOs globally

fact: graduated from the FBI's CISO Academy in Quantico, Virginia

reasoning: The paragraph details the organizational structure, roles, and qualifications of the cybersecurity management team, including the CIO, CISO, and Cybersecurity Executive Committee, making it Management Role. The specificity is Quantified-Verifiable due to the specific years of experience (27 and 17) and the verifiable claim of graduating from the FBI's CISO Academy.


fact: penetration testing

fact: vendor management group

fact: third party service provider monitoring program

reasoning: The paragraph primarily focuses on how the company manages cybersecurity risks associated with third-party service providers, including assessments, monitoring, and contractual terms. Specificity is Firm-Specific due to the mention of the internal 'vendor management group' and specific monitoring program.


reasoning: The paragraph makes a backward-looking negative assertion regarding the material impact of cybersecurity incidents on the business, which falls under Strategy Integration. It contains no domain-specific terminology, firm-specific details, or verifiable facts, making it generic boilerplate.


reasoning: The paragraph explicitly details the Board of Directors' oversight responsibilities for cybersecurity risks and the reporting cadence from management, placing it squarely in Board Governance. The language relies entirely on generic corporate governance terms without any domain-specific cybersecurity terminology or firm-unique details.


fact: October 11, 2023

fact: three days

fact: one week

reasoning: The paragraph primarily details a specific past cybersecurity incident, including its timeline, operational disruption, and resolution, classifying it as Incident Disclosure. The inclusion of a specific date (October 11, 2023) and quantified durations (three days, one week) elevates the specificity to Quantified-Verifiable.


reasoning: The paragraph is entirely focused on the evaluation and oversight of third-party vendors, including contractual obligations for confidentiality, making it Third-Party Risk. The language is generic and lacks any domain-specific terminology, firm-specific details, or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph consists of forward-looking risk disclaimers and a cross-reference to the Risk Factors section, containing no substantive disclosure of the company's actual cybersecurity program or governance.


fact: operational technology

reasoning: The paragraph primarily consists of generic risk disclaimers and a cross-reference to the Risk Factors section, lacking substantive description of the company's actual cybersecurity program or governance. It includes the domain term 'operational technology', elevating its specificity slightly above generic boilerplate.


fact: Director - Information Systems

fact: chief information officer

reasoning: The paragraph describes the Board and Audit and Compliance Committee's oversight of cybersecurity risk, placing it in Board Governance. It includes firm-specific leadership titles such as Director - Information Systems and chief information officer.


reasoning: The paragraph consists entirely of a generic forward-looking disclaimer about potential material adverse effects and a cross-reference to the Risk Factors section, containing no substantive cybersecurity disclosure.


fact: attack vectors

reasoning: The paragraph makes a negative assertion regarding material cybersecurity incidents and discusses potential impacts on business strategy and financial condition, placing it in Strategy Integration. Specificity is Domain-Adapted due to the use of the cybersecurity term 'attack vectors'.


fact: firewall maintenance

fact: cyber maturity

fact: incident response

reasoning: The paragraph primarily describes the company's risk management process by detailing how it uses external parties to supplement internal capabilities for incident response, assessments, and firewall maintenance. Specificity is Domain-Adapted due to the use of cybersecurity-specific terminology like firewall maintenance and cyber maturity.


fact: February 13, 2023

reasoning: The paragraph explicitly describes a past security breach involving a third-party vendor, making it an Incident Disclosure. The inclusion of a specific date (February 13, 2023) makes the claim externally verifiable.


fact: incident response plan

fact: data collection and evidence handling

reasoning: The paragraph describes the company's incident response plan and protocols, which falls under Risk Management Process. The specificity is Domain-Adapted due to the use of cybersecurity-specific terms like 'data collection and evidence handling' in the context of incident response.


fact: CIO

fact: more than 30 years of experience

fact: Aegon N.V., Citigroup, Inc. and JP Morgan Chase & Company

fact: CISO

fact: more than 20 years of cybersecurity experience

fact: Brighthouse Financial, GE Healthcare, Allstate Insurance Company

fact: Certified Information Systems Auditor, Certified Information Security Manager and Certified Information Systems Security Professional

reasoning: The paragraph exclusively details the career history, years of experience, and specific certifications of the CIO and CISO, placing it squarely in Management Role. The inclusion of specific years of experience, named prior employers, and verifiable certifications (like CISSP and CISM) makes it Quantified-Verifiable.


reasoning: The paragraph describes how cybersecurity risks are integrated into the broader enterprise risk management (ERM) process and risk-based audit plan, categorizing it as Risk Management Process. It lacks cybersecurity-specific domain terminology, firm-specific cyber roles, or verifiable metrics, resulting in a Generic Boilerplate specificity.


reasoning: The paragraph focuses entirely on the company's processes for managing cybersecurity risks associated with third-party service providers. The language used is generic and lacks specific domain terminology, firm-specific details, or verifiable metrics.


reasoning: The paragraph describes the reporting structure from the Audit Committee and management to the full Board regarding cybersecurity, which falls under Board Governance. It contains only generic boilerplate language with no domain-specific terms, firm-specific details, or verifiable metrics.


fact: Chief Technology and Digital Officer

fact: Senior Vice President, Technology

fact: over 10 and 25 years, respectively, of networking and information technology management or executive experience

fact: Cybersecurity Committee

reasoning: The paragraph primarily describes the management structure for cybersecurity, detailing the roles of the Chief Technology and Digital Officer, SVP of Technology, and the Cybersecurity Committee. The specificity is Quantified-Verifiable due to the specific years of experience provided for the executives.


reasoning: The paragraph concludes with a direct materiality assessment regarding the impact of cybersecurity risks on the company's business strategy and financial condition, which dictates a Strategy Integration classification. The language used is entirely generic SEC boilerplate with no specific domain terms, firm-specific details, or verifiable metrics.


fact: The Custodian

fact: MetLife, Inc.

reasoning: The paragraph is entirely focused on the contractual cybersecurity and incident reporting requirements imposed on a third party (the Custodian) and its vendors, making it Third-Party Risk. The specificity is Firm-Specific because it names the specific entities involved in this unique trust arrangement (The Custodian and MetLife, Inc.).


reasoning: The paragraph focuses exclusively on the oversight of cybersecurity risks presented by third-party vendors and service providers. It uses generic language without any specific domain terminology, firm-specific details, or verifiable metrics.


reasoning: The paragraph explicitly states conclusions regarding the material impact of past cybersecurity incidents and the likelihood of future threats affecting business strategy and financial condition, fitting the Strategy Integration category. It contains no domain-specific terminology, firm-specific details, or verifiable facts, as the date merely bounds an unverifiable negative assertion.


fact: early April 2023

reasoning: The paragraph describes a specific cybersecurity incident that occurred in early April 2023, including detection, response, and investigation, making it an Incident Disclosure. The inclusion of a specific date ('early April 2023') makes it Quantified-Verifiable.


reasoning: The paragraph focuses entirely on the company's vendor management process for identifying and managing cybersecurity risks associated with third-party service providers. The language used describes standard vendor risk management practices without any specific cybersecurity domain terminology, firm-specific details, or verifiable metrics, resulting in a Generic Boilerplate specificity.


reasoning: The paragraph focuses entirely on the processes for assessing and managing cybersecurity risks associated with third-party service providers. It includes the firm-specific named team 'Information Technology Automated Solutions (ITAS)' responsible for validating vendor certifications.


reasoning: The paragraph explicitly assesses the material impact of cybersecurity risks on the company's business strategy and financial condition, fitting the Strategy Integration category. It contains only generic boilerplate language and negative assertions without any specific domain terms, firm-specific details, or verifiable facts.


reasoning: The paragraph is purely a cross-reference to the Risk Factors section (Item 1A) and contains no substantive cybersecurity disclosure, making it None/Other. It lacks any domain-specific terminology, firm-specific details, or verifiable metrics, resulting in Generic Boilerplate specificity.


fact: CSO

fact: Chief Information Officer

reasoning: The paragraph primarily describes the roles, responsibilities, and reporting lines of management (the CSO and CIO) regarding cybersecurity oversight. The specificity is Firm-Specific due to the explicit mention of the CSO and Chief Information Officer roles.


fact: Chief Information Security Officer

fact: Cybersecurity Risk Management Team

reasoning: The paragraph focuses on the management structure and teams responsible for cybersecurity, specifically naming the CISO and relevant departments. It is classified as Firm-Specific due to the inclusion of uniquely named internal teams like the Trust, Security and Reliability department.


fact: Our Adviser

reasoning: The paragraph explicitly focuses on the oversight of cybersecurity risks presented by third parties, making it Third-Party Risk. The specificity is Firm-Specific because it references 'Our Adviser', reflecting the company's specific external management structure.


fact: firewalls

fact: intrusion prevention

fact: endpoint detection and response systems

fact: vulnerability assessments

fact: cybersecurity threat intelligence

reasoning: The paragraph details the technical tools and processes used in the company's cybersecurity program, placing it in Risk Management Process. It includes several domain-specific terms like endpoint detection and response and intrusion prevention, making it Domain-Adapted.


reasoning: The paragraph explicitly states a conclusion about the material impact of past cybersecurity incidents and discusses cyber risk insurance, placing it in Strategy Integration. It contains no domain-specific terminology, firm-specific details, or externally verifiable facts, making it generic boilerplate.


fact: CISO

reasoning: The paragraph details the reporting cadence and flow of cybersecurity information from management (CISO) to the Audit and Risk Committee and the Board of Directors, placing it in Board Governance. The mention of the CISO role elevates the specificity to Firm-Specific.


fact: ransomware

fact: exfiltrated

reasoning: The paragraph describes the investigation, data exfiltration, and notification process for a specific past cybersecurity incident. The specificity is Domain-Adapted due to the use of cybersecurity-specific terminology such as 'ransomware' and 'exfiltrated'.


reasoning: The paragraph primarily discusses the potential impact of cybersecurity risks on the business and includes a definitive statement assessing that past incidents have not materially affected the company's business strategy or financial condition, placing it in Strategy Integration. The language consists entirely of generic risk descriptions and boilerplate negative assertions without any domain-specific terminology, firm-specific details, or verifiable facts.


reasoning: The paragraph contains generic, forward-looking statements about potential cybersecurity risks and the importance of keeping systems secure, without describing any actual cybersecurity measures, processes, or assessments.


fact: Chief Information Security Officer ("CISO")

fact: Executive Vice President and Chief Information Officer ("CIO")

reasoning: Applying the person-removal test, the paragraph primarily establishes the management roles (CISO and EVP/CIO) responsible for maintaining and overseeing the cybersecurity program. The inclusion of these specific executive titles elevates the specificity to Firm-Specific.


fact: IS Steering Committee

reasoning: The paragraph is entirely focused on the company's vendor management program and how it handles risks associated with third-party service providers, making it Third-Party Risk. The specificity is Firm-Specific due to the mention of the IS Steering Committee and the Chief Information Officer.


reasoning: The paragraph introduces the company's cybersecurity risk management principles, fitting the Risk Management Process category. It includes the domain-specific CIA triad ('confidentiality, integrity, and availability'), elevating the specificity to Domain-Adapted.


fact: fourth quarter of fiscal year 2019

fact: Note 18 to the consolidated financial statements

reasoning: The paragraph describes a specific past cybersecurity event (a Q4 2019 ransomware incident), detailing its nature, response, and impact, which classifies it as Incident Disclosure. It includes verifiable details such as the specific quarter and year of the incident and a reference to a specific financial statement note, making it Quantified-Verifiable.


fact: Investment Adviser

reasoning: The paragraph describes the company's processes to assess, identify, and manage cybersecurity risks, noting reliance on the Investment Adviser's cybersecurity program, which falls under Risk Management Process. The mention of the 'Investment Adviser' managing day-to-day operations and implementing the program is a firm-specific detail.


reasoning: The paragraph primarily describes the management roles (CEO and CFO) responsible for overseeing incident response procedures and the reporting chain to the Board of Managers. It relies entirely on generic corporate titles and standard risk management phrasing without specific domain terminology or verifiable facts.


fact: CPO

fact: CIO

fact: VP of Global IT Security

fact: Certified Information Systems Auditor

fact: Fellow of Information Privacy

fact: Certified Information Privacy Professional

fact: Incident Response team

reasoning: The paragraph primarily describes the roles, responsibilities, and qualifications of management (CISO, CPO, CIO, VP of Global IT Security) in leading cybersecurity risk management, making it Management Role. The specificity is Quantified-Verifiable because it lists specific, externally verifiable certifications held by these leaders (e.g., Certified Information Systems Security Professional).


reasoning: The paragraph describes the Board's ultimate oversight responsibility for risk management and its delegation to standing committees and senior management, fitting the Board Governance category. It contains only generic corporate governance language with no cybersecurity-specific domain terms or firm-specific details.


reasoning: The paragraph explicitly details the company's processes for overseeing and managing cybersecurity risks associated with third-party service providers. Specificity is Firm-Specific due to the mention of the Chief Information Security Officer (CISO) role.


fact: over 25 years of work experience

fact: Chief Financial Officer

reasoning: The paragraph primarily describes the roles and qualifications of management personnel (Senior Director of Information Technology and CFO) responsible for cybersecurity, making it Management Role. The specificity is Quantified-Verifiable due to the verifiable claim of 'over 25 years of work experience'.


reasoning: The paragraph is entirely a cross-reference to the Risk Factors section (Item 1A) and does not provide substantive cybersecurity disclosure itself, making it None/Other. It contains no specific facts, domain terms, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph explicitly states a conclusion about whether cybersecurity incidents have materially affected the business strategy, results of operations, or financial condition, which aligns with the Strategy Integration category. The language is generic and lacks any domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph identifies the Chief Operating Officer as the management figure responsible for overseeing cybersecurity policies, placing it in the Management Role category. It contains only generic executive titles and boilerplate language, lacking domain-specific terminology or firm-specific cybersecurity details.


fact: Lead IT Systems Specialist

fact: Directors of Banking and Mortgage

fact: Corporate Security

fact: Corporate Communications

reasoning: The paragraph describes the composition of incident response teams, listing specific management roles and departments involved, which falls under Management Role. The specificity is Firm-Specific due to the mention of unique roles like 'Lead IT Systems Specialist' and 'Directors of Banking and Mortgage'.


reasoning: The paragraph is a pure cross-reference to the Risk Factors section and contains no substantive cybersecurity program details, making it None/Other with generic boilerplate specificity.


reasoning: The paragraph describes the company's risk assessment methodology, placing it in Risk Management Process. The language used is entirely generic risk management terminology that lacks specific cybersecurity domain expertise, firm-specific details, or verifiable metrics.


reasoning: The paragraph provides a high-level introduction to the company's information security program and its integration with privacy objectives, fitting the Risk Management Process category. It contains no domain-specific terminology, firm-specific details, or verifiable facts, making it generic boilerplate.


reasoning: The paragraph describes the board of directors' oversight of cybersecurity risk and its delegation to the audit committee, placing it in Board Governance. The language is entirely generic, lacking any domain-specific terminology, firm-unique details, or verifiable metrics.


fact: Director of Information Security

fact: over 30 years

fact: Certified Information Systems Security Professional (CISSP)

fact: OD Technology Department

reasoning: The paragraph primarily describes the qualifications, responsibilities, and reporting structure of the Director of Information Security and the OD Technology Department, fitting the Management Role category. It reaches Quantified-Verifiable specificity by stating the Director has over 30 years of experience and holds a verifiable CISSP certification.