reasoning: The paragraph explicitly states conclusions regarding the material impact of cybersecurity risks and incidents on the company's business strategy and financial condition, fitting the Strategy Integration category. It contains only generic SEC-mandated materiality language with no specific facts or domain terminology.


content_category: Board Governance

fact: CISO

fact: CIO

category_confidence: high

specificity_confidence: high

reasoning: The paragraph describes the Board of Directors and Audit Committee's oversight of enterprise risk management and cybersecurity, including receiving updates from specific management roles. The presence of firm-specific roles like CISO, CIO, and Security & Resiliency global practice leader elevates the specificity to Firm-Specific.

provider: google

stage: benchmark


content_category: None/Other

reasoning: The paragraph is a pure cross-reference to the Risk Factors section, containing no substantive cybersecurity disclosure.


content_category: Strategy Integration

reasoning: The paragraph explicitly states a conclusion about the material impact of cybersecurity risks on the company's business strategy and financial condition, placing it in Strategy Integration. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity.


content_category: Third-Party Risk

fact: Third-party supplier risk assessments

fact: cybersecurity certifications

fact: third-party audit results

fact: technical and organizational controls

reasoning: The paragraph is entirely focused on how the company manages cybersecurity risks associated with its third-party suppliers, making it a clear fit for Third-Party Risk. The specificity is Domain-Adapted because it mentions specific cybersecurity concepts like 'cybersecurity certifications', 'third-party audit results', and 'technical and organizational controls', but lacks firm-specific or verifiable facts.


reasoning: The paragraph is solely a cross-reference to the Risk Factors section (Item 1A) and contains no substantive cybersecurity disclosure.


reasoning: The paragraph states a conclusion about whether cybersecurity incidents have materially affected or are reasonably likely to materially affect the company's business strategy, results of operations, or financial condition, which falls under Strategy Integration. It contains no domain terms, firm-specific facts, or verifiable claims, making it Generic Boilerplate.


content_category: Risk Management Process

fact: vulnerability scans

fact: penetration tests

reasoning: The paragraph primarily describes the company's approach to identifying and managing cybersecurity risks, making it Risk Management Process. The inclusion of specific cybersecurity practices like vulnerability scans and penetration tests elevates the specificity to Domain-Adapted.


reasoning: The paragraph is purely a cross-reference to a risk factor heading regarding material impacts, which falls under None/Other and therefore defaults to Generic Boilerplate specificity.


fact: annual third-party penetration testing

fact: malware risks

fact: monitoring of logs and events for our network perimeter

fact: scanning of both internal and externally facing systems

reasoning: The paragraph outlines the specific activities and technical measures comprising the company's cybersecurity program, placing it squarely in Risk Management Process. The use of terms like 'penetration testing', 'malware', and 'network perimeter' elevates the specificity to Domain-Adapted.


reasoning: The paragraph primarily consists of a general regulatory statement and a cross-reference to another section of the filing, fitting the None/Other category. It lacks specific cybersecurity domain terms, firm-specific details, or verifiable metrics, resulting in a Generic Boilerplate specificity.


reasoning: The paragraph explicitly states conclusions regarding the material impact of cybersecurity threats and incidents on the company's business strategy and financial condition, and discusses cybersecurity insurance, which aligns with Strategy Integration. The language used is entirely generic and lacks any domain-specific terminology, firm-specific details, or verifiable metrics.


fact: vulnerability assessments

reasoning: The paragraph primarily describes the Board and Audit Committee's oversight of cybersecurity risks, including the types of reports they receive and their interactions with management. The specificity is Domain-Adapted due to the inclusion of domain terminology like 'vulnerability assessments', while the 'Executive Director of IT' role lacks a security-specific qualifier to elevate it to Firm-Specific.


reasoning: The paragraph explicitly states a conclusion regarding the material impact of past cybersecurity incidents on the company, which falls under Strategy Integration. The language used is entirely generic and lacks any domain-specific terminology, firm-specific details, or verifiable metrics.


reasoning: The paragraph describes the company's use of third-party vendors to support its IT and cybersecurity operations, which is a component of its risk management process. The language is entirely generic, lacking any domain-specific terminology, firm-specific details, or verifiable facts.


content_category: Incident Disclosure

fact: DISH TV and SLING TV

reasoning: The paragraph describes the operational impact and restoration timeline of a specific past cybersecurity incident. It includes verifiable facts such as the specific date of system restoration (March 31, 2023).


reasoning: The paragraph focuses exclusively on the oversight, diligence, and contractual requirements for managing cybersecurity risks associated with third-party service providers. The language is high-level and lacks specific domain terminology, firm-specific details, or verifiable metrics.


fact: February 23, 2023

fact: February 28, 2023

fact: DISH Network IT systems

reasoning: The paragraph describes a specific historical cybersecurity incident, detailing the timeline, impact, and response actions. It includes verifiable dates (February 23 and 28, 2023), making it Quantified-Verifiable.


fact: DISH TV, SLING TV and Retail Wireless services

reasoning: The paragraph describes the operational impact and restoration timeline of a specific cybersecurity incident, making it Incident Disclosure. The inclusion of a specific date (March 31, 2023) for system restoration makes it Quantified-Verifiable.


reasoning: The paragraph is entirely focused on how the company manages cybersecurity risks associated with third-party service providers, including contractual requirements and vendor onboarding reviews. It contains no domain-specific terminology, firm-specific roles, or verifiable facts, making it generic boilerplate.


fact: managed security service monitoring

fact: penetration testing

fact: vulnerability assessment

fact: Management Enterprise Risk Committee

fact: Vendor Management Committee

reasoning: The paragraph focuses centrally on the oversight, due diligence, and contractual requirements for third-party vendors, making it Third-Party Risk. Specificity is Firm-Specific due to the mention of the Management Enterprise Risk Committee and Vendor Management Committee.


fact: network security

fact: data encryption

fact: large language models

fact: artificial intelligence systems

reasoning: The paragraph primarily describes the company's cybersecurity program activities, including network security, data encryption, and protecting data from AI systems, making it Risk Management Process. The specificity is Domain-Adapted due to the use of cybersecurity-specific terms like 'network security', 'data encryption', and 'large language models'.


fact: Chief Business Officer

reasoning: The paragraph describes the Audit Committee's oversight of cybersecurity risk and the reporting structure from the Chief Business Officer to the Board, making it Board Governance. The mention of the 'Chief Business Officer' is a firm-specific role, elevating the specificity to Firm-Specific.


reasoning: The paragraph explicitly states a conclusion regarding the material impact of cybersecurity risks on the company's business strategy and financial condition, aligning with Strategy Integration. It contains only boilerplate SEC language and cross-references, lacking any specific facts or domain terminology.


reasoning: The paragraph explicitly describes the Board of Directors and Audit Committee's roles in overseeing cybersecurity risks and their briefing cadence, which falls under Board Governance. The language relies entirely on generic governance terms without any domain-specific, firm-specific, or verifiable details.


fact: in 2019 we were the subject of a successful phishing attempt

fact: phishing

reasoning: The paragraph explicitly assesses the material impact of cybersecurity risks on the company's business strategy and financial condition, placing it in Strategy Integration. It reaches Quantified-Verifiable specificity by citing a specific past incident that occurred in 2019.


content_category: Management Role

reasoning: The paragraph primarily describes the responsibilities and reporting lines of management (the IT employee and the CEO) regarding cybersecurity monitoring. It lacks specific domain terminology, firm-unique titles, or verifiable metrics, making it generic boilerplate.


fact: Franklin Templeton

reasoning: The paragraph is entirely focused on how third-party cyber risks are managed, including vendor requirements and diligence. The mention of 'Franklin Templeton' as a specific named firm makes it Quantified-Verifiable.


fact: CIO/CDO

reasoning: The paragraph describes the Board and Audit Committee's oversight of the cybersecurity program, including reporting cadences and the flow of information from the CIO/CDO to the Audit Committee, making it Board Governance. The mention of the specific role 'CIO/CDO' elevates the specificity to Firm-Specific.


fact: backdoor

reasoning: The paragraph focuses exclusively on managing cybersecurity risks associated with third-party suppliers, including contractual addendums and deficiency remediation. The specificity is Domain-Adapted due to the use of the cybersecurity term 'backdoor'.


reasoning: The paragraph describes the reporting cadence and information flow from a committee to the Board of Directors regarding cybersecurity risks and incidents, which falls under Board Governance. The language relies entirely on generic terms without specific committee names, domain expertise, or verifiable metrics.


fact: Third-Party Risk Management Program

fact: Vendor Management Policy

fact: Interagency Guidance on Third-Party Relationships: Risk Management

type: framework

reasoning: The paragraph focuses entirely on the oversight and management of third-party vendor risks. It is Firm-Specific because it names the company's specific internal programs and policies, such as the Third-Party Risk Management Program and Vendor Management Policy.


reasoning: The paragraph consists entirely of a general statement about facing cyber risks and cross-references to the Risk Factors section, containing no substantive cybersecurity program details.


fact: CDIO

fact: security council

fact: Legal and Regulatory, Corporate Security, Network Engineering, Internal Audit, Finance & Accounting and Risk and IT Infrastructure

fact: April 2024 cyber-attack

reasoning: The paragraph primarily describes management's organizational structure for handling cybersecurity, detailing the CDIO's role, the security council's composition, and response teams. The specificity is Quantified-Verifiable due to the specific date reference to the 'April 2024 cyber-attack'.


reasoning: The paragraph focuses on the company's engagement with third-party service providers and the security requirements and breach reporting obligations imposed on them, fitting the Third-Party Risk category. The language consists entirely of generic risk management and contractual concepts without specific cybersecurity domain terminology, firm-specific details, or verifiable metrics.


reasoning: The paragraph primarily describes the company's processes for overseeing third-party cybersecurity risks through vendor due diligence and ongoing monitoring. The language used is generic and lacks specific domain terminology, firm-specific details, or verifiable metrics.


fact: Software Approval Board

fact: Quality, Internal Audit, Information Security, Business Systems, and R&D

reasoning: The paragraph primarily describes the company's processes for managing third-party cybersecurity risks, including vendor diligence and contractual requirements. It is Firm-Specific because it names a unique internal committee (Software Approval Board) and lists the specific departments that comprise it.


fact: approximately 20 years or more of experience

type: quantified

fact: CTO

reasoning: The paragraph details the qualifications and experience of specific management officers, placing it in Management Role. The inclusion of a verifiable lower bound of experience ('20 years or more') elevates the specificity to Quantified-Verifiable.


reasoning: The paragraph explicitly states a backward-looking conclusion that no cybersecurity incident has had a material adverse impact to date, which falls under Strategy Integration. The language is entirely generic and lacks any domain-specific terminology, firm-specific details, or verifiable facts.


fact: Security & Technology Committee

reasoning: The paragraph describes the flow of information regarding cybersecurity incidents to the Board and a specific committee, which falls under Board Governance. The mention of the 'Security & Technology Committee' elevates the specificity to Firm-Specific.


fact: Third Party Cyber Risk Management Plan

fact: SOC2 T2

fact: penetration testing

reasoning: The paragraph explicitly details the processes and requirements for managing third-party cyber risks, including vendor assessments and contract clauses. Specificity is Firm-Specific due to the named internal 'Third Party Cyber Risk Management Plan', alongside domain-specific terms like SOC2 T2 and ISO 27001.


fact: Chief Information Officer

fact: quarterly scorecard assessments

reasoning: The paragraph describes the Board's oversight responsibilities and the reporting structure from management to the Board. It is classified as Firm-Specific due to the mention of the Chief Information Officer and the specific use of 'quarterly scorecard assessments'.


fact: Information Security Officer

fact: Chief Risk Officer

fact: Information Technology Steering Committee

reasoning: The paragraph primarily details the organizational structure and reporting lines of management responsible for cybersecurity, specifically the Information Security Officer. Specificity is Firm-Specific due to the naming of specific internal roles and committees.


reasoning: The paragraph explicitly states a conclusion regarding the material impact of cybersecurity risks and incidents on the company's business strategy and financial condition, aligning with Strategy Integration. It contains only generic boilerplate language with no domain-specific terms, firm-specific details, or verifiable facts.


fact: vendor-provided software fixes, commonly called patches

fact: security configurations

fact: exploitable files and services

fact: vulnerability scanning

fact: intrusion detection tools

reasoning: The paragraph describes the specific activities and tools used in the company's vulnerability management and risk mitigation processes, classifying it as Risk Management Process. It uses domain-specific terminology like vulnerability scanning and intrusion detection tools, making it Domain-Adapted.


reasoning: The paragraph describes the Audit Committee's oversight of cybersecurity risks and its receipt of periodic reports from management, which falls squarely under Board Governance. The language is entirely generic, lacking any domain-specific terminology, firm-specific details, or verifiable metrics.


fact: IT Security team

reasoning: The paragraph is entirely focused on how the company manages cybersecurity risks associated with third-party providers, including due diligence, contractual rights, and ongoing monitoring. The mention of the 'IT Security team' elevates the specificity to Firm-Specific.


reasoning: The paragraph explicitly assesses the material impact of cybersecurity risks and incidents on the company's business strategy and financial condition, placing it in Strategy Integration. It contains only generic boilerplate language and negative assertions without any specific domain terms, firm-specific details, or verifiable facts.


fact: Kroll

fact: November 2022

fact: penetration tests

fact: Century Communities Information Security Team

fact: Information Security Incident Response Policy

fact: September 2023

reasoning: The paragraph describes the company's risk management process, specifically detailing a security maturity assessment, penetration tests, and tabletop exercises conducted with a third party. The specificity is Quantified-Verifiable due to the inclusion of specific dates (November 2022, September 2023) and a named third-party firm (Kroll).


reasoning: The paragraph is entirely focused on how the company manages cybersecurity risks associated with third-party vendors, suppliers, and service providers, making it Third-Party Risk. The mention of specific internal teams ('information security and enterprise risk management teams') elevates the specificity to Firm-Specific.


fact: National Institute of Standards and Technology ("NIST") Cybersecurity Framework

fact: Federal Financial Institutions Examination Council ("FFIEC") Information Technology Examination Handbooks

fact: FFIEC Cybersecurity Assessment Tool

fact: Information Technology Officer

reasoning: The paragraph primarily describes the cybersecurity program's objectives and framework alignments, making it Risk Management Process. It reaches Firm-Specific specificity by naming the specific internal roles (Information Security Officer, Information Technology Officer) that lead the program.


category_confidence: medium

reasoning: The paragraph primarily describes the company's risk management process, specifically noting the use of external consultants to assist with risk assessments, policy design, and safeguard testing, while also mentioning future plans for third-party vendor oversight.


reasoning: The paragraph focuses entirely on managing cybersecurity risks associated with third parties, including suppliers and subcontractors, and the contractual requirements imposed on them. The language is generic and lacks specific domain terms, firm-specific details, or verifiable facts.


reasoning: The paragraph describes the Board's oversight of cybersecurity risk, including delegation to the Audit Committee and the reporting cadence from management to the Committee and the full Board, making it Board Governance. The mention of the 'Vice President and Chief Information Security Officer (CISO)' elevates the specificity to Firm-Specific.


fact: February 2023 cyberattack

reasoning: The paragraph explicitly states a conclusion regarding the materiality of a past cyber incident on the company's financial position, placing it in Strategy Integration. It includes a specific, verifiable date for a past incident (February 2023), making it Quantified-Verifiable.


fact: early in Fiscal 2024

fact: $2.7 million of loss

reasoning: The paragraph describes a specific historical incident involving fraudulent wire transfers, detailing the company's response and the resulting financial impact, which aligns with Incident Disclosure. The specificity is Quantified-Verifiable due to the exact financial loss figure ($2.7 million) provided.


reasoning: The paragraph discusses the maintenance of cybersecurity insurance to cover incident-related costs, which falls under Strategy Integration. The language is entirely generic with no specific details about the policy or coverage amounts.


reasoning: The paragraph is entirely focused on the company's approach to identifying and overseeing cybersecurity threats related to third-party vendors, service providers, and external users, making it a clear fit for Third-Party Risk. The language used is generic and lacks any domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: Note 14 'Commitments and Contingencies'

reasoning: The paragraph is classified as Incident Disclosure because it describes an actual cybersecurity event involving unauthorized access and resulting expenses. The specificity is Quantified-Verifiable due to the inclusion of the exact, verifiable date (June 30, 2024) when the incident was detected.


fact: more than 5 years

fact: We, and our third-party service providers, are exposed to risks related to information technology infrastructure, information management and protection, cybersecurity threats, and cyber incident; if we or our third-party providers fail to protect confidential information and/or experience a cyber incident, there may be damage to our brand and reputation, material financial penalties, and legal liability.

reasoning: The paragraph explicitly discusses the material impact of cybersecurity threats on the company's business strategy and financial condition, making it Strategy Integration. It includes a verifiable timeframe ('more than 5 years') regarding the absence of material impacts, elevating it to Quantified-Verifiable.


reasoning: The paragraph describes the audit committee's oversight role and reporting cadence regarding cybersecurity, placing it in Board Governance. It contains only generic governance terms and cadences, lacking domain expertise, firm-specific details, or verifiable metrics.


fact: CISO

reasoning: The paragraph describes the reporting structure to the board's audit committee, placing it in Board Governance. Specificity is Firm-Specific due to the mention of the CISO role.


reasoning: The paragraph describes the Audit Committee's oversight of cybersecurity risks and its review of the enterprise risk management matrix, placing it in Board Governance. The language relies entirely on generic risk management terminology without specific cybersecurity domain terms or verifiable facts.


reasoning: The paragraph explicitly states a conclusion regarding the material impact of cybersecurity threats and incidents on the company's business strategy and financial condition, which falls under Strategy Integration. It contains only generic negative assertions and boilerplate disclaimers without any specific domain terms or verifiable facts.


reasoning: The paragraph primarily describes the Audit Committee's oversight role and the reports it receives regarding cybersecurity risks, making it Board Governance by word count, though it also includes a standard materiality conclusion. The language relies entirely on generic terms without any domain-specific terminology, firm-unique details, or verifiable metrics.


fact: Franklin Templeton

fact: containment and remediation

reasoning: The paragraph describes the use of third-party service providers to assist with incident response activities (containment and remediation), which is part of the Risk Management Process. The mention of the specific entity 'Franklin Templeton' elevates the specificity to Firm-Specific.


fact: phishing sites

fact: threat actors

reasoning: The paragraph describes a specific cyber attack campaign involving look-alike phishing sites targeting the bank's online platform and its impact, categorizing it as Incident Disclosure. The specificity is Domain-Adapted due to the use of cybersecurity terms like 'phishing sites' and 'threat actors'.


reasoning: The paragraph explicitly assesses that cybersecurity threats are reasonably likely to materially affect the company's business strategy and financial condition, which aligns with the Strategy Integration category. The text lacks any specific domain terminology, firm-unique details, or verifiable metrics, making it Generic Boilerplate.


reasoning: The paragraph is a pure cross-reference to the Risk Factors section in Item 1A, containing no substantive cybersecurity disclosure.


fact: Director, IT

reasoning: The paragraph focuses on the responsibilities of the Director, IT regarding cybersecurity, making it Management Role. The specificity is Firm-Specific due to the named role 'Director, IT' (though borderline without a security qualifier, it is the specific title used for the management role here).


reasoning: The paragraph focuses exclusively on the oversight of third-party cybersecurity risks, including due diligence and contractual requirements. It uses generic language without any specific domain terminology, firm-specific details, or verifiable metrics.


reasoning: The paragraph describes the general processes for identifying and managing cybersecurity risks and their integration into the enterprise risk management function, fitting the Risk Management Process category. The language is entirely generic boilerplate without any specific domain terminology, firm-specific details, or verifiable metrics.


fact: CDO

fact: interim CISO

fact: over 20 years of both leading and transforming technology

fact: master's degree in business administration and management from Ecole Sup rieure de Commerce de Chamb ry, Rh ne-Alpes, France

fact: nearly 20 years of experience developing and leading security and risk programs

fact: bachelor's degree in management information systems and marketing from Miami University

reasoning: The paragraph focuses entirely on the reporting structure, career history, and educational qualifications of the CDO and interim CISO, which clearly falls under Management Role. The specificity is Quantified-Verifiable due to the inclusion of specific, verifiable educational degrees from named universities and quantified years of experience.


reasoning: The paragraph describes the reporting line from management to the audit committee regarding cybersecurity risks, which falls under board governance. It contains only generic terms and standard board committee names, lacking any domain-specific, firm-specific, or verifiable details.


fact: services agreement with LMC

fact: Information Security Steering Committee (ISSC)

fact: Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments

reasoning: The paragraph primarily describes management's organizational structure for cybersecurity oversight, detailing the establishment and responsibilities of the ISSC. The specificity is Quantified-Verifiable because it references a specific services agreement with a named entity (LMC), alongside firm-specific details like the named committee and its exact departmental composition.


reasoning: The paragraph focuses on managing cybersecurity risks associated with third-party technology service providers and the outreach conducted to assess downstream impacts of breaches. The language is entirely generic, lacking specific domain terminology, firm-specific details, or verifiable metrics.


fact: penetration testing firms

fact: forensic investigators

reasoning: The paragraph primarily discusses the company's vendor management standard, including security assessments, questionnaires, and contractual obligations to manage cybersecurity risks associated with third-party service providers. Specificity is Domain-Adapted due to the inclusion of cybersecurity-specific terms like penetration testing and forensic investigators.


reasoning: The paragraph concludes with a materiality assessment stating that the company is not aware of any cybersecurity risks that have materially affected or are reasonably likely to materially affect its business strategy, results of operations, or financial condition, which falls under Strategy Integration. The text contains no domain-specific terminology, firm-specific details, or verifiable facts, making it Generic Boilerplate.


fact: Chief Technology Officer (CTO)

fact: Chief Information Security Officer (CISO)

reasoning: The paragraph describes the board of directors' oversight of the cybersecurity program and reporting structure, making it Board Governance. It includes firm-specific named roles (CTO and CISO), elevating the specificity to Firm-Specific.


fact: System and Organization Controls ("SOC") 1 or SOC 2 report

reasoning: The paragraph is entirely focused on how the company manages cybersecurity risks associated with third-party vendors and hosted software platforms, making it Third-Party Risk. The mention of SOC 1 and SOC 2 reports demonstrates domain expertise, elevating the specificity to Domain-Adapted.


fact: Marco Technologies

fact: monthly basis

fact: Red Canary

fact: 24/7 monitoring

fact: High Point Networks

fact: Return to Operations objectives of less than 24 hours

reasoning: The paragraph primarily describes the company's risk management processes and tools, specifically detailing the third-party providers used to execute the cybersecurity program. It reaches Quantified-Verifiable specificity by naming specific third-party vendors (Marco Technologies, Red Canary, High Point Networks) and providing specific metrics (less than 24 hours return to operations).


fact: chief information officer ("CIO")

fact: Contran

fact: ISA

fact: cyber threat detection and response

reasoning: The paragraph primarily details the management structure, leadership roles (CIO, Director of IT), and reporting lines for the cybersecurity programs across the company's various entities. It is Firm-Specific because it identifies specific executive roles (CIO) and unique corporate entities/agreements (Contran, ISA) involved in managing the systems.


reasoning: The paragraph serves as a high-level introduction to the company's cybersecurity program and its general importance to the business. It contains no specific domain terminology, firm-specific details, or verifiable facts, making it generic boilerplate.


fact: three times per year

reasoning: The paragraph primarily describes the board's oversight of cybersecurity, including the audit committee's role, reporting cadences, and board member expertise, making it Board Governance. The specificity is Quantified-Verifiable due to the verifiable claim that an audit committee member earned the NACD's CERT Certificate in Cybersecurity Oversight in 2023, as well as the specific reporting cadence of three times per year.


fact: Information Security group

fact: CISO

fact: Information Security Program

fact: Audit, Risk and Finance Committee

fact: Internal Audit functions

reasoning: The paragraph primarily describes the reporting structure and flow of information regarding cybersecurity from management (CISO, Information Security group, Internal Audit) to the board-level committee (Audit, Risk and Finance Committee), making it Board Governance. The specificity is Firm-Specific due to the mention of the CISO role and the specifically named 'Audit, Risk and Finance Committee'.


fact: advanced and persistent threat actors

reasoning: The paragraph serves as a general introduction to the company's threat landscape and generic resource expenditure, without detailing specific governance, management, or risk processes. It includes the domain term 'advanced and persistent threat actors' (APT), elevating it to Domain-Adapted.


fact: David Shear

fact: President International of RBI

fact: January 2021

fact: President EMEA

fact: September 2016

fact: President of Burger King APAC

fact: Charles River Associates

reasoning: The paragraph is a biographical description of an executive (David Shear) with no mention of cybersecurity responsibilities or oversight, making it None/Other. It contains multiple verifiable facts, including specific dates of employment and named previous employers, elevating it to Quantified-Verifiable.


fact: National Institute of Standards & Technology Cybersecurity Framework ("NIST CSF")

fact: Global Information Security Policy

fact: endpoint detection

fact: security incident response and event management

fact: privileged access management

reasoning: The paragraph primarily describes the components, frameworks, and tools of the cybersecurity program (NIST CSF, endpoint detection, PAM), making it Risk Management Process despite the mention of the CISO's responsibilities. The specificity is Firm-Specific due to the inclusion of the CISO role and a specifically named internal policy, alongside several domain-specific security terms.


reasoning: The paragraph focuses entirely on managing cybersecurity risks associated with third-party service providers, including risk assessments and questionnaires. It lacks any domain-specific terminology, firm-specific details, or verifiable facts, making it generic boilerplate.


fact: September 14, 2023

fact: social engineering attack

fact: loyalty program database

reasoning: The paragraph explicitly details a past cybersecurity incident, including its timeline, nature, and the company's response, making it an Incident Disclosure. The inclusion of a specific date (September 14, 2023) makes the claim externally verifiable.


reasoning: The paragraph focuses entirely on the oversight and management of cybersecurity risks associated with third-party service providers, including diligence and contractual requirements. The language used is generic and lacks specific domain terminology, firm-specific details, or verifiable metrics.


reasoning: The paragraph describes the Board's oversight of cybersecurity risk, delegation to the Audit Committee, and management's reporting to the Audit Committee, which clearly falls under Board Governance. The language is generic and lacks any domain-specific terminology, firm-specific details, or verifiable facts.


fact: CISO

fact: CIO

fact: over 20 years

fact: undergraduate degree in Information Systems from Xavier University

fact: MBA from Michigan State

fact: over 25 Information Technology and Cybersecurity certifications

fact: Certified Information Systems Security Professional

fact: Certified Cloud Security Professional

fact: Certified Information Security Manager

reasoning: The paragraph focuses entirely on the roles, reporting lines, experience, and qualifications of management (CISO, CIO, and the security team), making it Management Role. The specificity is Quantified-Verifiable due to the inclusion of specific years of experience, named universities, and specific verifiable certifications.


reasoning: The paragraph focuses entirely on the oversight and risk assessment of third-party service providers. The language is highly generic and lacks any specific cybersecurity domain terminology, firm-specific details, or verifiable metrics.


fact: approximately 20 years of experience

reasoning: The paragraph focuses on the responsibilities and qualifications of the Director of Operations & Information Technology, making it Management Role. The specificity is Quantified-Verifiable due to the specific number of years of experience (approximately 20 years).


fact: Koichi

reasoning: The paragraph is primarily a forward-looking disclaimer about the potential for breaches despite security measures, lacking substantive disclosure of actual processes or governance. It includes the specific name of an individual ('Koichi'), elevating the specificity to Firm-Specific.


fact: National Institute of Standards and Technology (NIST) governance requirements and cybersecurity framework

reasoning: The paragraph primarily describes the integration of cybersecurity into the broader risk management framework and alignment with NIST standards, categorizing it as Risk Management Process. Specificity is Domain-Adapted due to the reference to the NIST cybersecurity framework.


reasoning: The paragraph is a pure cross-reference to the Risk Factors section and contains no substantive cybersecurity disclosure, defaulting to None/Other and Generic Boilerplate.


reasoning: The paragraph explicitly describes the board's oversight structure and delegation to the Audit Committee, fitting Board Governance. It contains only generic governance terms with no domain-specific, firm-specific, or verifiable facts.


reasoning: The paragraph explicitly addresses the potential material impact of cybersecurity threats on the company's business strategy and financial condition, aligning with the Strategy Integration category. It contains only generic boilerplate language mirroring SEC requirements with no specific facts.


fact: malware

fact: ransomware

reasoning: The paragraph explicitly states a conclusion regarding the material impact of cybersecurity risks and incidents on the company's business strategy and financial condition, placing it in Strategy Integration. The specificity is Domain-Adapted due to the inclusion of specific threat types like malware and ransomware.


fact: over 20 years of information security experience

fact: over four years as a director in the information security management practice of a big four accounting firm

fact: B.S. in Network Security

fact: Information Security Steering Committee (ISSC)

reasoning: The paragraph primarily details the CISO's reporting structure, qualifications, and leadership of the management-level Information Security Steering Committee, fitting the Management Role category. It includes externally verifiable facts such as the CISO's specific years of experience and degree, elevating the specificity to Quantified-Verifiable.


reasoning: The paragraph primarily describes the reporting lines and escalation processes involving the CFO, CEO, and cybersecurity team, which falls under Management Role. It contains only generic corporate titles (CFO, CEO, Audit Committee) and standard risk management phrasing, resulting in Generic Boilerplate specificity.


fact: ERMC

fact: Vice President of Information Technology

fact: over 20 years of experience

reasoning: The paragraph details the roles, responsibilities, and qualifications of management personnel overseeing cybersecurity, making it Management Role. It includes a verifiable claim regarding a key employee having over 20 years of experience, elevating the specificity to Quantified-Verifiable.


fact: The Business Continuity Institute (BCI)

fact: Disaster Recovery Institute International (DRII)

fact: International Organization for Standardization (ISO) 22301

fact: business resilience team

reasoning: The paragraph describes the company's business resilience and continuity planning processes, which falls under Risk Management Process. It reaches Firm-Specific specificity by naming the internal 'business resilience team' and citing specific external frameworks like ISO 22301.


reasoning: The paragraph is entirely a cross-reference directing the reader to the Risk Factors section in Item 1A for information on material impacts, which falls under None/Other. It contains no specific cybersecurity practices, firm-specific details, or verifiable facts, making it Generic Boilerplate.


reasoning: The paragraph describes the education and expertise of the Audit Committee regarding information security, which falls under Board Governance. The language is entirely generic, lacking any specific domain terminology, firm-specific details, or verifiable metrics.


fact: security questionnaires

fact: information security addenda

fact: network infrastructure

reasoning: The paragraph is entirely focused on managing cybersecurity risks associated with third-party service providers, including the use of security questionnaires and contractual obligations. The specificity is Domain-Adapted because it uses specific cybersecurity and IT procurement terminology like 'information security addenda' and 'network infrastructure' that pass the ERM test, but lacks firm-specific named roles or verifiable metrics.


reasoning: The paragraph is a pure cross-reference to the Risk Factors section in Item 1A, containing no substantive cybersecurity program details.


reasoning: The paragraph focuses exclusively on the oversight and due diligence of third-party service providers, placing it in Third-Party Risk. The language is entirely generic and lacks any specific domain terminology, firm-specific details, or verifiable metrics.


reasoning: The paragraph describes the high-level oversight structure involving the Board, Audit Committee, and senior leadership, fitting the Board Governance category. It contains only generic boilerplate language with no domain-specific terminology or firm-specific details.


fact: Chief Information Officer (CIO)

fact: since 2016

fact: more than 20 years of experience

reasoning: The paragraph details the management structure for cybersecurity, specifically focusing on the CIO's background, experience, and reporting lines. It includes verifiable facts such as the CIO's tenure starting in 2016 and having more than 20 years of experience, elevating it to Quantified-Verifiable.


fact: Incident Response Team

reasoning: The paragraph describes the activities and procedures of the Incident Response Team during a cybersecurity incident, making it Risk Management Process. The mention of a specific 'Incident Response Team' elevates the specificity to Firm-Specific.


fact: VP of Information Technology

reasoning: The paragraph details the management-level team responsible for cybersecurity, including their roles and collective experience, fitting the Management Role category. The inclusion of the specific 'VP of Information Technology' role elevates the specificity to Firm-Specific.


fact: managed cybersecurity service providers

fact: penetration testing

reasoning: The paragraph describes the use of third-party services (consultants, software providers, pen testers) to support the company's internal cybersecurity program, which falls under Risk Management Process rather than Third-Party Risk. The specificity is Domain-Adapted due to the inclusion of domain-specific terms like penetration testing and managed cybersecurity service providers.


fact: Task Force

reasoning: The paragraph describes the reporting structure and information flow from the management-level Task Force to the board-level Audit Committee, making it Board Governance. The specificity is Firm-Specific due to the mention of the named 'Task Force'.


reasoning: The paragraph describes the Audit Committee's oversight of cybersecurity risks, including the frequency of briefings and topics covered, which clearly falls under Board Governance. The language used is generic and lacks domain-specific terminology, firm-specific roles, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: National Institute of Standards and Technology Cybersecurity Framework

fact: monitoring and patching of vulnerabilities

reasoning: The paragraph primarily describes the activities and framework of the cybersecurity program, making it Risk Management Process. Specificity is Domain-Adapted due to the mention of the NIST Cybersecurity Framework and vulnerability patching.


reasoning: The paragraph explicitly states a conclusion about whether cybersecurity risks have materially affected or are reasonably likely to materially affect the company's business strategy, results of operations, or financial condition, which falls under Strategy Integration. The text contains no domain-specific terminology, firm-specific facts, or verifiable claims, making it Generic Boilerplate.


fact: Chief Risk Officer

reasoning: The paragraph describes the integration of the cybersecurity program into the broader enterprise risk management framework, classifying it as Risk Management Process. It includes the firm-specific named role of Chief Risk Officer.


fact: Chief Information Officer

fact: vCISO

reasoning: The paragraph describes the Board and Audit Committee's oversight of cybersecurity risks, including delegation and reporting structures, making it Board Governance. The mention of specific roles like Chief Information Officer and vCISO elevates the specificity to Firm-Specific.


reasoning: The paragraph describes the use of third-party service providers to assist with the company's internal risk management process. It contains only generic boilerplate language without any domain-specific terminology, firm-specific details, or verifiable facts.


reasoning: The paragraph focuses exclusively on the oversight of third-party cybersecurity risks, detailing vendor assessments and contractual obligations. The language used is generic and lacks specific domain terminology, firm-specific details, or verifiable metrics.


reasoning: The paragraph primarily discusses the company's management of third parties, both in utilizing them for internal risk assessments and in imposing security and breach-reporting requirements on them. The language used is highly generalized and lacks specific domain terminology, firm-specific details, or verifiable metrics, resulting in a Generic Boilerplate classification.


reasoning: The paragraph is entirely a cross-reference to the Risk Factors section (Item 1A) and contains no substantive cybersecurity program disclosures.


reasoning: The paragraph solely discusses general regulatory requirements (SEC rules and banking agency oversight) without describing the company's specific cybersecurity program, resulting in a None/Other classification and Generic Boilerplate specificity.


fact: malware

fact: computer virus attacks

reasoning: The paragraph explicitly states a conclusion about the material impact of cybersecurity risks on the company's business strategy and financial condition, placing it in Strategy Integration. Specificity is Domain-Adapted due to the mention of specific threat types like malware and computer viruses.


reasoning: The paragraph is a pure cross-reference to the Risk Factors section and contains no substantive cybersecurity disclosure.


fact: NEE Management

fact: NEER

reasoning: The paragraph primarily explains how the cybersecurity function is organized and staffed, specifically noting that it is provided by affiliated entities. The naming of specific entities (NEE Management and NEER) providing these services constitutes externally verifiable facts, elevating the specificity to Quantified-Verifiable.


reasoning: The paragraph explicitly states a backward-looking conclusion about the material impact of cybersecurity risks on the company's business strategy and financial condition, placing it in Strategy Integration. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: Chief Financial Officer

fact: Vice President, Finance and Controller

reasoning: The paragraph describes the reporting structure to the audit committee regarding cybersecurity threats and risks, which falls under Board Governance. The specificity is Firm-Specific due to the mention of specific management roles (Senior Vice President and General Counsel, Vice President, Finance and Controller) reporting to the committee.


reasoning: The paragraph primarily describes the reporting structure and information flow between management (the COO) and the board (the Audit Committee) regarding cybersecurity risks, placing it in Board Governance. The language relies entirely on generic governance terms and cadences without specific domain expertise, firm-unique cyber roles, or verifiable metrics.


fact: Audit and Finance Committee

fact: Chief Information Security Officer

fact: Chief Technology and Digital Officer

reasoning: The paragraph primarily describes the board's oversight of cybersecurity, including the role of the Audit and Finance Committee and the frequency of briefings from management. The specificity is Firm-Specific due to the mention of specific executive roles (CISO, Chief Technology and Digital Officer) and a specific committee name (Audit and Finance Committee).


reasoning: The paragraph explicitly states a conclusion about the material impact of cybersecurity risks on the company's business strategy and financial condition, placing it in Strategy Integration. It contains only generic boilerplate language and reporting period dates, lacking any domain-specific, firm-specific, or verifiable cybersecurity facts.


fact: data exfiltration

reasoning: The paragraph details the factors considered during materiality assessments of cybersecurity incidents, including financial and operational impacts, which aligns with Strategy Integration. The specificity is Domain-Adapted due to the inclusion of the cybersecurity-specific term 'data exfiltration'.


fact: Senior Vice President Internal Audit

reasoning: The paragraph details the Board and Audit Committee's oversight of cybersecurity, including briefing cadences and topics. Specificity is Firm-Specific due to the mention of specific executive roles like the Chief Information Officer and Senior Vice President Internal Audit.


fact: Chief Technology Officer

fact: in 2023, management hosted an expert during the annual board of directors' retreat

reasoning: The paragraph primarily describes the board's oversight of cybersecurity, including the audit committee's role, reporting from the CTO, and board briefings/retreats, making it Board Governance. The mention of a specific event in 2023 (hosting an expert at the annual board retreat) provides a verifiable fact, elevating the specificity to Quantified-Verifiable.


fact: CTO

reasoning: The paragraph primarily describes how the Board of Directors oversees cybersecurity, specifically detailing the reporting cadence and topics provided by the CTO to the Board. The mention of the 'CTO' role elevates the specificity to Firm-Specific.


reasoning: The paragraph explicitly states a conclusion regarding the material impact of cybersecurity risks and incidents on the company's business strategy and financial condition, placing it in Strategy Integration. It contains only generic materiality statements and cross-references, lacking any specific domain, firm-specific, or verifiable facts.


fact: ISO

fact: penetration testing

fact: service organization controls (SOC) reports

fact: vulnerability and penetration testing

fact: encryption standards

reasoning: The paragraph primarily details the processes for assessing and managing cybersecurity risks associated with third-party service providers, including reviewing SOC reports and assigning vendor risk ratings. It is Firm-Specific due to the explicit mention of the ISO (Information Security Officer) executing these assessments, alongside several domain-specific terms like SOC reports and penetration testing.


fact: advanced persistent threats

fact: September 2022

fact: Rockstar Games' systems

fact: early development footage for the next Grand Theft Auto

fact: 2K Games

reasoning: The paragraph primarily details specific historical cybersecurity incidents that occurred in September 2022 involving Rockstar Games and 2K Games, making it an Incident Disclosure. The specificity is Quantified-Verifiable due to the inclusion of specific dates (September 2022) and named entities/assets (Rockstar Games, Grand Theft Auto, 2K Games) that can be externally verified.


fact: IT Security Director

fact: Chief Information Officer

fact: threat intelligence

reasoning: The paragraph primarily describes the reporting structure, responsibilities, and expertise of management roles (IT Security Director, CIO, and the cybersecurity team), fitting the Management Role category. Specificity is Firm-Specific due to the identification of specific leadership titles.


fact: vulnerability scanning

fact: Penetration testing

fact: threat intelligence feeds

reasoning: The paragraph primarily describes the activities and components of the company's cybersecurity risk management program, including vulnerability scanning, penetration testing, and threat intelligence. The specificity is Domain-Adapted due to the use of specific cybersecurity terminology that passes the ERM test.


reasoning: The paragraph focuses exclusively on managing cybersecurity risks associated with third-party vendors. The language is highly generic, lacking specific domain terminology, firm-specific details, or verifiable metrics.


reasoning: The paragraph is solely a cross-reference to the Risk Factors section and contains no substantive cybersecurity disclosures or specific facts.


reasoning: The paragraph describes the frequency and scope of cybersecurity updates provided to the Audit Committee and Board of Directors, falling under Board Governance. It lacks specific domain terminology, firm-specific details, or verifiable metrics, making it generic boilerplate.


fact: Chief Information Officer ("CIO")

fact: 25 years of experience

fact: information systems department

reasoning: The paragraph describes the governance chain from the Board and Audit Committee down to the CIO and management teams, making it primarily about Board Governance oversight structure. It reaches Quantified-Verifiable specificity by stating the verifiable fact that the CIO has 25 years of experience.


reasoning: The paragraph describes the Audit Committee's role in overseeing cybersecurity risks, assessing management's steps, and reporting to the Board of Directors, which clearly falls under Board Governance. The language used is generic and lacks any domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: December 15, 2020

fact: ransomware

reasoning: The paragraph primarily discloses a specific past cybersecurity event (the 2020 ransomware incident) and its impacts, fitting the Incident Disclosure category. The inclusion of an exact, verifiable date (December 15, 2020) elevates the specificity to Quantified-Verifiable.


reasoning: The paragraph explicitly states a conclusion regarding the material impact of cybersecurity risks on the company's business strategy and financial condition, placing it in Strategy Integration. It contains only generic boilerplate language and cross-references without any specific domain terms or verifiable facts.


fact: intrusion detection/prevention systems (IDS/IPS)

fact: data loss prevention (DLP)

fact: Mobile Device Management

fact: principle of least privilege

fact: encryption solutions... at rest and in transit

reasoning: The paragraph details the technical controls and practices comprising the cybersecurity program, categorizing it as Risk Management Process. It uses specific cybersecurity terminology (IDS/IPS, DLP, least privilege) but lacks firm-specific identifiers or externally verifiable metrics, making it Domain-Adapted.


reasoning: The paragraph primarily discusses the company's requirements for third-party service providers regarding security measures and breach reporting, making it Third-Party Risk. The language is generic and lacks specific domain terms, firm-specific details, or verifiable facts.


reasoning: The paragraph describes the board and audit committee's oversight responsibilities and the frequency and topics of their cybersecurity updates, fitting Board Governance. The language relies entirely on generic governance and risk management terminology without any domain-specific, firm-specific, or verifiable details.


fact: Technology & Operations Committee

fact: CISO

fact: CIO

reasoning: The paragraph describes the reporting structure and frequency of cybersecurity updates provided by management to board-level committees, making it Board Governance. It includes firm-specific details such as the Technology & Operations Committee, CISO, and CIO.


fact: Vice President of IT

fact: denial-of-service attacks

fact: phishing

fact: social engineering

reasoning: The paragraph establishes the high-level governance chain, noting the Vice President of IT's responsibility and the Board/Audit Committee's oversight, making it primarily a Board Governance overview. The specificity is Firm-Specific due to the identification of the Vice President of IT as the responsible management role.


reasoning: The paragraph explicitly states a conclusion regarding the material impact of cybersecurity threats on the company, which falls under Strategy Integration. It contains no domain-specific terminology, firm-specific details, or externally verifiable facts, making it generic boilerplate.


reasoning: The paragraph describes the use of external service providers to support the company's internal cybersecurity program, which falls under Risk Management Process. The language is entirely generic and lacks any domain-specific terminology, firm-specific details, or verifiable metrics.


fact: defense in depth

fact: zero trust

fact: phishing email simulations

reasoning: The paragraph primarily describes the company's cybersecurity program activities, including risk assessment, defense strategies, training, and phishing simulations, making it Risk Management Process. The specificity is Domain-Adapted due to the use of cybersecurity-specific terms like 'defense in depth', 'zero trust', and 'phishing email simulations'.


fact: over 20 years of cybersecurity experience

fact: last 10 years in leadership positions

fact: Veteran Volunteer Instructor for US Cyber Army Command (ARCYBER)

fact: Information Systems Security Association (ISSA)

fact: Forum of Incident Response and Security Teams (FIRST)

fact: Strategic Planning, Policy, and Leadership (GSTRT)

fact: Certified Information Systems Security Professional (CISSP)

fact: Certified Cloud Security Professional (CCSP)

fact: Certified Information Systems Security Architecture Professional (CISSP-ISSAP)

fact: Certified in the Governance of Enterprise IT (CGEIT)

fact: Certified Data Privacy Solutions Engineer (CDPSE)

fact: Certified Ethical Hacker (CEH)

reasoning: The paragraph primarily describes the roles, responsibilities, and extensive qualifications of management (specifically the Senior Director of Information Technology) and third-party vendors in managing cybersecurity risks, making it Management Role. The specificity is Quantified-Verifiable due to the numerous verifiable certifications (CISSP, CCSP, CEH, etc.), specific organizational affiliations (ARCYBER, ISSA, FIRST), and quantified experience (over 20 years).


reasoning: The paragraph makes a negative assertion regarding the material impact and expenses of past cybersecurity incidents, which falls under Strategy Integration. It contains no domain-specific terminology, firm-specific details, or externally verifiable facts, making it generic boilerplate.


fact: Change Healthcare

fact: UnitedHealth Group

fact: Exogen device

reasoning: The paragraph primarily discloses a specific third-party cybersecurity incident (Change Healthcare) and its operational impact on the company's billing processes, making it Incident Disclosure. It reaches Quantified-Verifiable specificity by naming the affected third parties, a specific company product (Exogen device), and exact dates regarding the incident response timeline.


reasoning: The paragraph merely recites SEC disclosure requirements for future material cybersecurity incidents, containing no substantive information about the company's actual cybersecurity program or past incidents.


reasoning: The paragraph primarily discusses the oversight and management of risks associated with third-party service providers, including security assessments and ongoing reviews. It lacks specific domain terms, firm-specific details, or verifiable facts, making it Generic Boilerplate.


reasoning: The paragraph focuses entirely on the Board of Directors' oversight of cybersecurity risks and reporting structures involving the Audit Committee. It contains only generic governance language and cadences, lacking any domain-specific terminology or firm-unique details.


fact: Director of IT Security and Compliance

fact: IT Steering Committee

fact: vulnerability assessments

fact: continuous monitoring techniques

reasoning: The paragraph primarily describes the activities of the cybersecurity program, including internal assessments, third-party tests, vulnerability assessments, and continuous monitoring, making it Risk Management Process. The specificity is Firm-Specific due to the mention of the 'Director of IT Security and Compliance' and the 'IT Steering Committee'.


reasoning: The paragraph outlines the high-level goals of the company's cybersecurity and incident response efforts, placing it in Risk Management Process. It contains only generic, high-level objectives without any domain-specific terminology or firm-specific details, resulting in a Generic Boilerplate specificity.


reasoning: The paragraph explicitly states a conclusion regarding the material impact of cybersecurity risks on the company's business strategy and financial condition, aligning with Strategy Integration. It contains only standard legal boilerplate and a reporting-anchored negative assertion, lacking any domain-specific, firm-specific, or verifiable facts.


fact: Chief Information Officer

fact: IT Security Director

fact: threat intelligence

reasoning: The paragraph primarily describes the organizational structure, reporting lines, and qualifications of the cybersecurity management team. It is Firm-Specific because it names specific leadership roles such as the Vice President, IT Security and Compliance and the IT Security Director.


fact: Risk and Governance Committee

fact: Certified Information Systems Security Professional

reasoning: The paragraph primarily describes the board's oversight structure, delegating to the Risk and Governance Committee, making it Board Governance. It achieves Quantified-Verifiable specificity by stating the Head of IT holds a verifiable CISSP certification.


fact: CIO

fact: 19 years of experience

fact: 11 of which have been with the Company

fact: SANS Global Information Security Leader

fact: Certified Information Systems Auditor

reasoning: The paragraph primarily describes the CIO's responsibilities, qualifications, and the management team structure, placing it squarely in Management Role. The specificity is Quantified-Verifiable due to the inclusion of specific years of experience and named, verifiable professional certifications (SANS GSLC, CISA).


fact: Chief Information Security Officer ("CISO")

reasoning: The paragraph describes the governance chain, detailing how the Board, Audit Committee, and Legal team oversee cybersecurity, and how the CISO and CIO report up to these governance structures. The presence of specific named roles (CIO, CISO) elevates the specificity to Firm-Specific.


reasoning: The paragraph is a standard cross-reference to the Risk Factors section and contains no substantive cybersecurity disclosure, making it None/Other with Generic Boilerplate specificity.


fact: CISO

reasoning: The paragraph primarily describes the Board and Audit Committee's oversight of cybersecurity risks and the reporting structure from the CISO. The mention of the CISO role makes it Firm-Specific.


reasoning: The paragraph is a generic summary statement about the disclosure itself, containing no substantive details about cybersecurity processes, governance, or strategy.


fact: vulnerability testing

fact: scanning our internal network and infrastructure

reasoning: The paragraph describes the company's risk management activities, including vulnerability scanning and testing. The specificity is Domain-Adapted due to the use of cybersecurity-specific practices like vulnerability testing and network scanning, without any firm-specific or externally verifiable claims.


fact: Marriott brand standards relating to information security

reasoning: The paragraph primarily addresses cybersecurity risk management concerning third parties (franchisees and licensees), detailing their responsibilities and compliance requirements. It is Firm-Specific because it references Marriott's proprietary brand standards for information security.


fact: forensic investigation

reasoning: The paragraph describes a specific past cybersecurity incident involving suspicious websites and its containment, fitting Incident Disclosure. Specificity is Domain-Adapted due to the use of the cybersecurity term 'forensic investigation'.


fact: advanced persistent threats

reasoning: The paragraph explicitly states a conclusion regarding the materiality of past incidents ('have not experienced a material cybersecurity incident'), which falls under Strategy Integration. Specificity is Domain-Adapted due to the use of the cybersecurity term 'advanced persistent threats'.


fact: Risk Management Committee

fact: EVP ERM

reasoning: Although the paragraph begins by describing the Board's Risk Management Committee and its reporting structure, the majority of the text focuses on a backward-looking materiality conclusion for 2024 and the potential financial and operational impacts of future breaches, making Strategy Integration the dominant category. The specificity is Firm-Specific due to the mention of the specific 'EVP ERM' role and the 'Risk Management Committee'.


fact: October 2023

fact: two-step verification

reasoning: The paragraph explicitly describes a past cybersecurity incident that occurred in October 2023 and the subsequent remediation efforts, making it an Incident Disclosure. The inclusion of a specific date (October 2023) makes the claim externally verifiable.


reasoning: The paragraph makes a negative assertion about the historical absence of impactful cybersecurity incidents, which falls under Strategy Integration. It contains no domain-specific terminology, firm-specific details, or externally verifiable cybersecurity facts, making it generic boilerplate.


fact: Chief Technology Officer (CTO)

fact: Chief Operating Officer (COO)

fact: over 10 years of experience

fact: over 5 years of experience

reasoning: The paragraph primarily describes the board's oversight structure, including delegation to the Audit Committee and reporting from management, making it Board Governance. It achieves Quantified-Verifiable specificity by stating verifiable lower bounds for the CTO and COO's years of experience.


reasoning: The paragraph primarily discusses the material impact of cybersecurity incidents, stating that past incidents have not materially affected the company's operations, business strategy, results of operations, or financial condition, which aligns with the Strategy Integration category. The text lacks specific domain terms, firm-specific facts, or verifiable claims, making it Generic Boilerplate.


fact: ORIX USA

fact: ORIX

reasoning: The paragraph primarily describes the company's organizational and management structure as an externally managed entity, explaining how its executive officers and Manager rely on the parent affiliate (ORIX USA) for cybersecurity risk management. The specificity is Firm-Specific due to the explicit naming of its affiliate and program provider, ORIX USA.


reasoning: The paragraph provides a backward-looking materiality assessment stating that prior incidents have not had a material impact, which falls under Strategy Integration. The language consists entirely of generic boilerplate and cross-references without any specific domain terms, firm-specific details, or verifiable facts.


fact: intelligence sharing about emerging threats

fact: Arizona Cyber Threat Response Alliance ("ACTRA")

fact: The Internet and Television Association ("NCTA")

reasoning: The paragraph describes threat intelligence gathering activities, falling under Risk Management Process. It includes externally verifiable memberships in specific named organizations (ACTRA and NCTA), elevating the specificity to Quantified-Verifiable.


reasoning: The paragraph describes executive management's responsibility for overseeing cybersecurity strategy, fitting the Management Role category. The language consists entirely of generic boilerplate without any domain-specific terminology, firm-specific roles, or verifiable facts.


fact: penetration testing

fact: threat monitoring

reasoning: The paragraph discusses both the use of third-party cybersecurity firms for internal assessments and the security requirements imposed on vendors to manage third-party risk. Specificity is Domain-Adapted due to the inclusion of cybersecurity terms like penetration testing and threat monitoring.


fact: ELT

reasoning: The paragraph primarily describes the evaluation and continuous improvement activities of the information security program, classifying it as Risk Management Process. It reaches Firm-Specific specificity by naming the ELT (Executive Leadership Team) as a specific management body receiving reports.


fact: ransomware

reasoning: The paragraph primarily consists of forward-looking risk disclaimers and cross-references to the Risk Factors section, without describing any actual cybersecurity measures, processes, or assessments, making it None/Other. It contains the domain term 'ransomware', elevating its specificity to Domain-Adapted.


reasoning: The paragraph explicitly states a conclusion regarding the material impact of cybersecurity risks and incidents on the company's business strategy and financial condition, aligning with Strategy Integration. It contains only boilerplate materiality assessments and cross-references to risk factors, lacking specific domain terminology or verifiable facts.


reasoning: The paragraph explicitly discusses the process for reviewing the cybersecurity measures of third-party IT service providers, placing it squarely in Third-Party Risk. The language is entirely generic and lacks any domain-specific terminology, firm-specific details, or verifiable metrics.


reasoning: The paragraph describes the company's general procedures for threat detection and incident response, which falls under Risk Management Process. The language is entirely generic and lacks any specific domain terminology, firm-specific details, or verifiable facts.


reasoning: The paragraph explicitly discusses the company's processes for managing cybersecurity risks associated with third-party service providers and vendors. It contains only generic language without any domain-specific terminology or firm-specific details, resulting in a Generic Boilerplate specificity.


reasoning: The paragraph explicitly states conclusions regarding the material impact of cybersecurity risks and incidents on the company's business strategy and financial condition, fitting the Strategy Integration category. It contains only boilerplate negative assertions and reporting period dates, resulting in Generic Boilerplate specificity.


reasoning: The paragraph focuses exclusively on the oversight, due diligence, and contractual requirements for third-party suppliers and business partners, fitting the Third-Party Risk category. It uses generic language without specific domain terminology, firm-specific details, or verifiable metrics.


reasoning: The paragraph provides a high-level, introductory overview of the company's commitment to implementing policies and security measures to mitigate cyber risks, placing it in Risk Management Process. The language is entirely generic boilerplate with no specific domain terms, firm-specific details, or verifiable facts.


reasoning: The paragraph consists entirely of a cross-reference to the Risk Factors section and contains no substantive cybersecurity disclosure.


reasoning: The paragraph describes the integration of cybersecurity into overall risk management and the general methods used (assessments, audits), fitting the Risk Management Process category. The language relies entirely on generic risk and compliance terminology without specific cybersecurity domain terms, firm-specific details, or verifiable metrics.


fact: SOC2 report evaluations

reasoning: The paragraph primarily details the company's processes for assessing and managing cybersecurity risks associated with third-party service providers and vendors. Specificity is Domain-Adapted due to the mention of evaluating SOC2 reports.


fact: November 2023

fact: LivaNova's cyber response protocol

reasoning: The paragraph primarily describes a specific past cybersecurity incident from November 2023, detailing the response, investigation, and remediation efforts, making it Incident Disclosure. It contains a verifiable date (November 2023), elevating the specificity to Quantified-Verifiable.


fact: 2025 Cybersecurity Incident

reasoning: The paragraph primarily describes a specific, actual cybersecurity event, detailing the timeline of unauthorized access and the status of the forensic investigation. It is classified as Quantified-Verifiable due to the inclusion of specific dates (August 5-8, 2025) for the incident.


reasoning: The paragraph explicitly states a conclusion about the material impact of cybersecurity incidents on the company's business strategy and financial condition, placing it in Strategy Integration. It contains only a negative assertion and reporting period context, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily provides a negative assertion regarding the material impact of past cybersecurity incidents, which falls under Strategy Integration, followed by generic cross-references to risk factors.


fact: January 2020

fact: more than 20 years of experience

fact: information security team

reasoning: The paragraph describes management's organizational structure, specifically the CEO's leadership of the information security team and his reporting line to the board. Specificity is Quantified-Verifiable due to the inclusion of a specific date (January 2020) and a verifiable lower bound of experience (more than 20 years).


fact: Operations Officer (COO) leads cybersecurity strategy

fact: over 15 years of experience in cybersecurity

reasoning: The paragraph details the responsibilities, reporting structure, and qualifications of the COO regarding cybersecurity, fitting the Management Role category. It includes a verifiable quantified claim regarding the COO's years of experience.


reasoning: The paragraph describes the reporting structure from management to the Audit Committee regarding cybersecurity risks, which falls under Board Governance. The specificity is Firm-Specific due to the inclusion of the specific management title 'Senior Director, Global Information Security'.


reasoning: The paragraph explicitly states a conclusion regarding the material impact of past cybersecurity incidents on the company's operations and financial performance, which falls under Strategy Integration. It contains only generic boilerplate language with no domain-specific terminology, firm-specific details, or verifiable facts.


reasoning: The paragraph describes the company's security monitoring and incident response processes, placing it in Risk Management Process. The language is highly generic, lacking specific domain terminology, firm-specific roles, or verifiable metrics.


reasoning: The paragraph primarily discusses the potential material adverse impacts of hypothetical breaches and concludes with a negative assertion that the company has not experienced any cybersecurity incidents, which classifies as Strategy Integration.


fact: unauthorized access of an employee's email account

fact: fraudulently divert Company funds

reasoning: The paragraph primarily discloses a specific historical cybersecurity incident (unauthorized email access and fund diversion) that occurred in 2024, making it Incident Disclosure. The specificity is Quantified-Verifiable due to the specific year (2024) tied to a real, verifiable event.


fact: scanning

fact: phishing attempts

fact: vulnerabilities

reasoning: The paragraph states a conclusion about the lack of material impact from cybersecurity incidents on the company's financial condition, which falls under Strategy Integration. It includes domain-specific terminology like 'scanning' and 'phishing attempts', making it Domain-Adapted.


reasoning: The paragraph explicitly states a backward-looking conclusion that cybersecurity risks have not materially affected the company's business strategy or financial condition, which falls under Strategy Integration. It contains only generic boilerplate language with no specific domain terms, firm-specific details, or verifiable facts.


reasoning: The paragraph explicitly states a conclusion regarding the material impact of past cybersecurity incidents on the business, which falls under Strategy Integration. The text consists entirely of generic disclaimers, negative assertions, and cross-references without any specific domain terminology or verifiable facts.


reasoning: The paragraph explicitly states conclusions regarding the material impact of cybersecurity incidents and risks on the company's business strategy and financial condition, fitting the Strategy Integration category. It contains no domain-specific terminology, firm-specific details, or externally verifiable facts, making it generic boilerplate.


reasoning: The paragraph states a conclusion regarding the material impact of past cybersecurity challenges on operations and financial standing, which falls under Strategy Integration. It contains no domain-specific terminology, firm-specific details, or externally verifiable facts, making it generic boilerplate.


reasoning: The paragraph explicitly states conclusions regarding the material impact of cybersecurity risks and incidents on the company's business strategy and financial condition, fitting the Strategy Integration category. It contains no domain-specific terminology, firm-specific details, or verifiable facts, making it generic boilerplate.


fact: subservice organizations

reasoning: The paragraph focuses entirely on the oversight and assessment of third-party vendors and contractors, making it Third-Party Risk. The use of the term 'subservice organizations' indicates domain-adapted terminology typical of SOC reporting and IT vendor management.


reasoning: The paragraph discusses the cost and resource constraints related to cybersecurity, stating the company lacks the manpower and financial resources to manage these risks, which falls under Strategy Integration (budget/investment allocation and business impact). The language is generic and lacks any domain-specific terms, firm-specific details, or verifiable facts.


reasoning: The paragraph makes a negative assertion regarding the material impact of cybersecurity incidents on the company's business strategy and financial condition, which falls under Strategy Integration. It contains no domain-specific, firm-specific, or externally verifiable facts, making it generic boilerplate.


fact: principle of least-privilege

fact: phishing awareness exercises

fact: security-by-design principles

reasoning: The paragraph describes the company's cybersecurity risk management processes, including framework alignment, access controls, and employee training. It includes several domain-specific terms like ISO 27001, least-privilege, and security-by-design, making it Domain-Adapted.


reasoning: The paragraph is a pure cross-reference to the Risk Factors section (Item 1A) and contains no substantive cybersecurity program disclosures.


fact: protection, detection, response, and recovery capabilities

reasoning: The paragraph primarily describes the company's cybersecurity risk management program, its integration into ERM, and its general capabilities. Specificity is Domain-Adapted due to the use of standard cybersecurity lifecycle terminology (protection, detection, response, recovery).


reasoning: The paragraph is entirely a cross-reference to the Risk Factors section and lists hypothetical consequences of a breach, containing no substantive cybersecurity program details.


reasoning: The paragraph is entirely a cross-reference to the Risk Factors section, which falls under None/Other. It contains no substantive cybersecurity details, resulting in Generic Boilerplate specificity.


fact: one cybersecurity incident in the last decade

fact: ransomware virus

reasoning: The paragraph describes a specific historical ransomware incident, detailing the attack, response, and recovery, making it an Incident Disclosure. It includes a quantified, verifiable claim regarding the number of incidents in the past decade.


fact: over 20 years of experience

reasoning: The paragraph primarily describes the responsibilities and qualifications of the Director of Information Technology and supporting management, making it Management Role. Specificity is Quantified-Verifiable due to the specific, checkable claim of 'over 20 years of experience' regarding the DIT's background.


fact: Change Healthcare

fact: UnitedHealth Group

fact: EXOGEN device

reasoning: The paragraph explicitly assesses the materiality of cybersecurity risks and details the business and financial impact (billing disruptions, delayed cash remittances) of a specific incident, concluding it did not have a material effect, which aligns with Strategy Integration. The naming of specific external entities (Change Healthcare, UnitedHealth Group) makes the claims externally verifiable.


reasoning: The paragraph describes the integration of the cybersecurity program into the broader enterprise risk management (ERM) framework, which falls under Risk Management Process. The language is entirely generic and lacks any domain-specific terminology, firm-specific details, or verifiable metrics.


reasoning: The paragraph describes the company's information security processes designed to identify, assess, and manage cybersecurity risks to its systems and data, which falls under Risk Management Process. The language is generic and lacks specific domain terms, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph merely provides a definition for the term 'systems' and does not contain substantive cybersecurity disclosure.


fact: CISO

fact: Security Governance Committee

fact: over 20 years of cybersecurity and technology management experience

reasoning: The paragraph describes the selection of the CISO and Security Governance Committee members, as well as the CISO's qualifications, which falls under Management Role. The specificity is Quantified-Verifiable due to the verifiable claim of 'over 20 years' of experience.


fact: subset of the full Board of Directors, specifically the independent board members

reasoning: The paragraph describes the Board's oversight structure and reporting cadence, placing it in Board Governance. It reaches Firm-Specific specificity by identifying the exact subset of the board (independent board members) responsible for this oversight.


reasoning: The paragraph is entirely a cross-reference directing the reader to the Risk Factors section (Item 1A) for information on material impacts, which falls under None/Other. It contains no substantive cybersecurity details, resulting in Generic Boilerplate specificity.


reasoning: The paragraph explicitly describes the Board's oversight of cybersecurity risk and its delegation to the Audit Committee, placing it squarely in Board Governance. It contains only generic governance terms and no domain-specific, firm-specific, or verifiable facts, resulting in a Generic Boilerplate specificity.


fact: threat intelligence

reasoning: While the paragraph begins by mentioning the Audit Committee and Board, the majority of the text focuses on the management team's responsibilities for assessing risks, developing methodology, and supervising internal/external personnel and security efforts. The inclusion of domain-specific concepts like 'threat intelligence' elevates the specificity to Domain-Adapted.


fact: chief technology officer

fact: over a decade of industry experience

fact: information security team

reasoning: The paragraph primarily details the responsibilities, experience, and reporting structure of the Chief Technology Officer and the information security team, fitting the Management Role category. The specificity is Quantified-Verifiable because it states the CTO has 'over a decade' of experience, which is a verifiable lower bound.


reasoning: The paragraph explicitly focuses on managing risks associated with third-party service providers. It lacks specific domain terminology, firm-specific roles, or verifiable metrics, relying instead on generic risk management language.


reasoning: The paragraph provides general background information on the company's IT and OT infrastructure and business operations without discussing any substantive cybersecurity measures, risks, or oversight.


reasoning: The paragraph explicitly focuses on the company's approach to assessing and overseeing cybersecurity risks presented by third parties and vendors.


reasoning: The paragraph is split between a materiality assessment of past incidents and security requirements for third-party service providers, with the third-party requirements occupying the majority of the text. The language used is entirely generic, lacking any domain-specific terminology, firm-specific details, or externally verifiable claims.


reasoning: The paragraph explicitly describes the Board's oversight of cybersecurity risks and its delegation to the Audit Committee, placing it squarely in Board Governance. The language is entirely generic, lacking any domain-specific terminology, firm-unique details, or verifiable metrics.


fact: executive risk committee

fact: Senior Vice President, Engineering Operations

fact: computer science, cybersecurity assurance or other cybersecurity degrees

fact: technical education in computer engineering

reasoning: The paragraph primarily describes the composition, qualifications, and responsibilities of management-level committees and personnel (executive risk committee, cybersecurity team, SVP Engineering Operations), fitting the Management Role category. It reaches Quantified-Verifiable specificity by citing specific, verifiable educational degrees (computer engineering, computer science, cybersecurity assurance) held by management and team members.


fact: Namecheap

fact: Godaddy

fact: Cloudflare

reasoning: The paragraph is categorized as Third-Party Risk because it focuses entirely on the company's reliance on external vendors for website hosting and related cybersecurity risks. The specificity is Quantified-Verifiable due to the explicit naming of third-party service providers (Namecheap, Godaddy, and Cloudflare).


reasoning: The paragraph primarily describes the company's Incident Response Plan and its coordination, which falls under risk management processes. The text relies entirely on generic terminology and standard corporate roles (COO, Board) without detailing specific cybersecurity frameworks, tools, or verifiable metrics, resulting in a Generic Boilerplate specificity.


fact: scan and analyze for vulnerable software or misconfigurations

reasoning: The paragraph primarily details the processes used to manage third-party cybersecurity risks, including questionnaires, contractual requirements, and vendor monitoring, making it Third-Party Risk. The specificity is Domain-Adapted due to the use of cybersecurity terminology like scanning for vulnerable software and misconfigurations.


reasoning: The paragraph describes the delegation of cybersecurity oversight to the Audit Committee and the frequency of updates provided by senior management, which falls under Board Governance. The language is entirely generic, lacking any domain-specific terminology, firm-specific roles, or verifiable metrics.


fact: Chief Information Officer

reasoning: The paragraph describes the reporting structure and frequency of cybersecurity updates to the Audit Committee and the full Board, placing it in Board Governance. Specificity is Firm-Specific due to the mention of the Chief Information Officer.


reasoning: The paragraph discusses the company's use of cybersecurity insurance to manage financial risk, which falls under Strategy Integration. The language is entirely generic boilerplate with no specific details about the insurance policy or program.


fact: third-party security scoring system

reasoning: The paragraph explicitly details the company's processes for overseeing and managing cybersecurity risks associated with vendors and service providers. Specificity is Domain-Adapted due to the mention of utilizing a third-party security scoring system.


fact: ransomware

fact: malware

fact: phishing

reasoning: The paragraph makes a negative assertion regarding the absence of material cybersecurity incidents, which classifies it as Strategy Integration. The specificity is Domain-Adapted due to the inclusion of specific threat types like ransomware, malware, and phishing.


reasoning: The paragraph explicitly describes the Board of Directors' oversight of cybersecurity risks, expertise, and reporting mechanisms. It contains only generic boilerplate language without any specific domain terms, firm-specific details, or verifiable metrics.


fact: fiscal year ended September 30, 2025

fact: physically broken into through a firemen's access conduit

reasoning: The paragraph details a specific physical security incident, including the method of entry (firemen's access conduit), impact (no assets taken), and remediation, making it an Incident Disclosure despite the initial sentences about the incident response plan.


reasoning: The paragraph focuses exclusively on the company's processes for assessing and managing cybersecurity risks associated with third-party vendors. It contains only generic descriptions of these processes without any domain-specific terminology or firm-specific details.


fact: attest reports covering cyber-related controls

fact: complementary user entity controls

reasoning: The paragraph primarily details how the company manages cybersecurity risks associated with third-party service providers, including reviewing attest reports and implementing contractual safeguards. The specificity is Domain-Adapted due to the use of specialized audit and IT terminology like 'complementary user entity controls'.


reasoning: The paragraph primarily describes the integration of cybersecurity risk management into the broader enterprise risk management framework and lists the types of assessments conducted.


reasoning: The paragraph focuses on how the company collaborates with third-party vendors to manage cybersecurity risks, placing it in Third-Party Risk. The language is entirely generic, lacking specific domain terminology, firm-specific roles, or verifiable metrics.


reasoning: The paragraph describes the Board of Directors' oversight of cybersecurity risk and its delegation to the Audit Committee, which falls under Board Governance. The language is entirely generic, lacking any domain-specific terminology or firm-unique details.


reasoning: The paragraph describes the components and activities of the cybersecurity program, such as risk assessments, training, and incident response planning, placing it in Risk Management Process. The language is entirely generic and lacks specific domain terminology, firm-specific details, or verifiable metrics.


fact: Director of Information Technology

fact: more than 20 years' experience

fact: degree from the University of California, Santa Barbara

fact: Certified Information Systems Security Professional from ISC2 Organization

reasoning: The paragraph focuses entirely on the responsibilities, experience, and qualifications of the Director of Information Technology, making it a Management Role disclosure. It achieves Quantified-Verifiable specificity by including externally verifiable facts such as a specific university degree, a CISSP certification from ISC2, and a quantified lower bound of >20 years of experience.


fact: in 2019, we were a victim of a wire fraud scheme

fact: multi-factor authentication (MFA)

reasoning: The paragraph primarily describes a specific historical cybersecurity incident (a 2019 wire fraud scheme) and its remediation, making it Incident Disclosure. The inclusion of a specific year (2019) for the incident makes it Quantified-Verifiable.


reasoning: The paragraph is a generic introductory statement about the company's commitment to protecting IT assets and data, containing no substantive cybersecurity processes, governance structures, or strategic impacts.


reasoning: The paragraph describes the integration of cybersecurity into the broader enterprise risk management framework, which falls under Risk Management Process. The specificity is Domain-Adapted due to the use of the cybersecurity CIA triad ('confidentiality, integrity, and availability').


fact: Progress software

fact: February 26, 2024

reasoning: The paragraph describes the aftermath and regulatory investigation of a specific, real cybersecurity incident involving Progress software. It includes a verifiable date (February 26, 2024) regarding an SEC document request, elevating the specificity to Quantified-Verifiable.


reasoning: The paragraph explicitly states a conclusion regarding the material impact of cybersecurity risks and incidents on the company's business strategy and financial condition, fitting the Strategy Integration category. It contains only regulatory definitions and a negative materiality assertion, lacking specific facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph discusses the company's maintenance of cybersecurity insurance and the potential financial impact of uninsured costs, which falls under Strategy Integration. The language used is entirely generic and lacks any domain-specific terminology, firm-specific details, or verifiable metrics.


fact: Chief Information Officer (CIO)

fact: Chief Information Security Officer (CISO)

fact: Information Security team

fact: Cyber Incident Response Teams

reasoning: The paragraph primarily describes the organizational structure, reporting lines, and responsibilities of management roles including the CIO, CISO, and specific security teams. It is classified as Firm-Specific due to the naming of specific executive roles and internal teams.


reasoning: The paragraph explicitly states a conclusion regarding the material impact of cybersecurity risks on the company's business strategy and financial condition, placing it in Strategy Integration. It contains no specific facts or domain terminology, making it Generic Boilerplate.


fact: Form 8-K filed on July 14, 2023

fact: zero-day vulnerability

fact: MOVEit

fact: First National 1870 and Guardian Mortgage divisions

reasoning: The paragraph describes a specific historical cybersecurity incident involving a third-party vendor's software, making it Incident Disclosure. It is Quantified-Verifiable because it includes specific dates (July 14, 2023, May 31, 2023) and names the specific software involved (MOVEit).


fact: Chief Technology Officer (CTO)

fact: over 26 years of extensive information technology experience

fact: Director of Technology, Information Technology Manager, Technical Manager, and Systems Analyst

reasoning: The paragraph focuses on management's organizational structure and the specific qualifications of the CTO, making it Management Role. Specificity is Quantified-Verifiable because it states the CTO has over 26 years of experience, which is an externally verifiable claim.


fact: malware, viruses, worms and ransomware

fact: password spraying

fact: phishing

fact: denial-of-service attacks

fact: advanced persistent threat intrusions

reasoning: The paragraph describes the general cybersecurity threat landscape without detailing specific risk management processes, governance, or strategy, placing it in None/Other. It contains several cybersecurity domain terms like password spraying, denial-of-service, and advanced persistent threats, making it Domain-Adapted.


reasoning: The paragraph explicitly states a conclusion about the historical impact of cybersecurity threats on the business ('we have not experienced any significant impacts'), which classifies it as Strategy Integration under the materiality rule. The text contains only generic risk statements and cross-references without any specific domain terminology, firm-specific details, or verifiable facts.


fact: DPT

fact: Incident Response Team (IRT)

fact: Chief Information Officer

reasoning: The paragraph primarily describes the mechanics of the company's Incident Response Plan, detailing the operational phases (containment, review, escalation, recovery, remediation) and the escalation pathway through specific management teams.


reasoning: The paragraph explicitly states a conclusion regarding the material impact of cybersecurity incidents and expenses on the business, which falls under Strategy Integration. It contains no domain-specific terminology, firm-specific details, or externally verifiable cybersecurity facts, making it generic boilerplate.


fact: security threat intelligence system

fact: vulnerability management tools

fact: patch management standard

fact: Security Operations Center

fact: event correlation

reasoning: The paragraph describes the operational components of the company's cybersecurity program, including threat intelligence and patch management, classifying it as Risk Management Process. The specificity is Domain-Adapted due to the use of specialized cybersecurity terminology like 'Security Operations Center', 'vulnerability management tools', and 'event correlation'.


reasoning: The paragraph describes the responsibilities and qualifications of a Director managing the information security program, as well as their collaboration with the CFO, which falls under Management Role. The language is entirely generic, lacking specific domain terminology, verifiable qualifications, or explicitly named security titles.


reasoning: The paragraph is a generic introductory statement about the threat landscape and does not contain substantive cybersecurity disclosure.


fact: GISO

fact: Chief Information Security Officer

fact: cybersecurity maturity assessments

reasoning: The paragraph primarily describes the cybersecurity program's use of third-party vendors and assessors, which falls under Risk Management Process (as third parties hired to serve the company are RMP, not TP). The specificity is Firm-Specific due to the explicit mention of the GISO and Chief Information Security Officer roles.


fact: Brian Fellon

fact: Vice President, Chief Information Officer and Chief Information Security Officer (VP, CIO and CISO)

fact: September 2024

fact: 28 years of experience

fact: Puget Sound Energy

fact: from 2016 to September 2024

reasoning: The paragraph focuses entirely on the management structure, specifically detailing the CISO's role, reporting lines, and professional background, which clearly falls under Management Role. The specificity is Quantified-Verifiable due to the inclusion of hard, verifiable facts such as the CISO's name, exact years of experience (28 years), and specific prior employment history at a named firm (Puget Sound Energy).