content_category: Board Governance

fact: CISO

fact: Cybersecurity Executive Steering Body

category_confidence: high

specificity_confidence: high

reasoning: The paragraph describes the governance reporting structure for cybersecurity, specifically how information flows from the CISO to the Cybersecurity Executive Steering Body and the Audit Committee, making it Board Governance. It is Firm-Specific because it names a specific management-level committee ('Cybersecurity Executive Steering Body') and the CISO role.

provider: google

stage: benchmark


reasoning: The paragraph describes the governance structure for cybersecurity oversight, specifically the delegation of duties from the Board to the Audit Committee and the reporting lines, which falls under Board Governance. It is classified as Firm-Specific because it identifies a specific, non-generic management role ('Senior Director of Governance & Information Security') involved in the reporting chain.


content_category: Strategy Integration

reasoning: The paragraph provides a negative assertion regarding the material impact of past cybersecurity incidents on the company's business strategy and financial condition, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


content_category: Third-Party Risk

reasoning: The paragraph is primarily focused on the company's vendor management department and processes for vetting third parties, which falls under Third-Party Risk. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


content_category: None/Other

reasoning: This paragraph describes the company's business model and the general threat landscape (e.g., 'malicious tactics, code and viruses') rather than detailing governance, management, risk processes, or specific incidents. It serves as a contextual risk factor introduction rather than a substantive cybersecurity disclosure, thus falling under None/Other.


reasoning: The paragraph is a cross-reference to another section of the filing, which falls under the None/Other category and contains no substantive cybersecurity disclosure or specific facts.


fact: there have not been any that have had a material adverse effect on the company

reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the materiality of past cybersecurity incidents on the company's business. It is classified as Generic Boilerplate because the specific facts listed are negative assertions or cross-references, which do not meet the threshold for domain-adapted, firm-specific, or verifiable information.


content_category: Incident Disclosure

fact: material cybersecurity incident

reasoning: The paragraph is classified as Incident Disclosure because it explicitly describes a specific past event (the 2017 incident). It reaches the Quantified-Verifiable level because it cites a specific calendar year (2017) associated with a material incident.


reasoning: The paragraph is explicitly about the company's third-party risk management program, making it a clear fit for the Third-Party Risk category. It contains no domain-specific terminology, firm-specific identifiers, or verifiable claims, resulting in a Generic Boilerplate specificity level.


content_category: Management Role

fact: Enterprise Cybersecurity Management Review Group (Enterprise Cybersecurity MRG)

fact: Chief Information Security Officer

reasoning: The paragraph describes the structure and responsibilities of a management-level committee (the Enterprise Cybersecurity MRG), which falls under Management Role. It is classified as Firm-Specific because it names a specific internal committee (Enterprise Cybersecurity MRG) and the CISO role.


reasoning: The paragraph is primarily a negative assertion regarding the materiality of cybersecurity incidents, which falls under Strategy Integration per the materiality rule. It contains no domain-specific terminology, firm-specific organizational details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: Cyber Security Group

fact: operational technology

reasoning: The paragraph is primarily focused on third-party vendor screening and supply chain risk management, making it a clear Third-Party Risk category. It reaches Firm-Specific level because it names a specific internal entity ('Cyber Security Group') and references a specific external regulatory list ('Department of Homeland Security's list of Prohibited Nations').


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity incidents on the company's business and financial condition, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph describes the entity's lack of operations and data, which serves as a disclaimer explaining why a cybersecurity program is not applicable, rather than describing a program or governance structure. It contains no specific cybersecurity domain terminology, firm-specific facts, or verifiable claims.


reasoning: The paragraph is centrally focused on the oversight and management of third-party cybersecurity risks, specifically mentioning the initiation of a vendor third-party risk management program, which qualifies as a firm-specific initiative.


reasoning: The paragraph is a high-level, aspirational statement about the company's commitment to security without describing any specific governance, management, or risk management processes, thus falling into None/Other and Generic Boilerplate.


fact: Enterprise Risk Management program

reasoning: The paragraph is primarily about the Board's oversight structure and responsibilities regarding cybersecurity, fitting the Board Governance category. It reaches Domain-Adapted specificity by referencing the 'Enterprise Risk Management program' and the use of 'independent third-party technology experts' to test systems, which demonstrates cybersecurity domain knowledge beyond generic oversight language.


reasoning: This paragraph is a general risk disclosure statement describing the company's business model and the fact that they are a target for threats, which is standard boilerplate and does not describe a specific governance structure, management role, or risk management process.


fact: CIO

fact: Chief Accounting Officer

fact: Chief Financial Officer

fact: Chief Executive Officer

reasoning: The paragraph primarily describes the governance structure and reporting lines for cybersecurity oversight, placing it in Board Governance. It is classified as Firm-Specific because it explicitly names specific executive roles (CIO, Chief Accounting Officer, etc.) involved in the reporting chain.


reasoning: This paragraph is a generic description of business operations and data reliance, lacking specific details about cybersecurity governance, management, or risk management processes, and thus falls under None/Other.


fact: Enterprise & Technology Security ("E&TS") organization

fact: Chief Information Security Officer ("CISO")

fact: CSIRT

fact: Product Security Incident Response Team ("PSIRT")

fact: Business Information Security Officers ("BISO")

fact: product vulnerabilities

reasoning: The paragraph is primarily about the organizational structure and roles (E&TS, CISO, BISO, CSIRT, PSIRT) responsible for cybersecurity, fitting the Management Role category. It is Firm-Specific because it names specific internal organizational units and roles unique to IBM's structure.


fact: information security related regulatory findings

reasoning: The paragraph outlines specific oversight responsibilities of a board or committee regarding regulatory reports and risk monitoring, placing it in Board Governance. It reaches Domain-Adapted specificity by referencing specific cybersecurity-related concepts like 'information security examination reports' and 'regulatory findings' rather than generic risk language.


content_category: Risk Management Process

fact: incident response plan

fact: forensic investigations

fact: containment and remediation

reasoning: The paragraph describes the company's operational procedures for handling cybersecurity incidents, which falls under Risk Management Process. It reaches Domain-Adapted specificity by referencing specific cybersecurity practices like forensic investigations and incident response planning, which demonstrate domain expertise beyond generic risk management language.


fact: Two members of the audit committee have obtained certifications in cybersecurity oversight

type: quantified

fact: chief information officer

fact: chief information security officer

fact: chief risk officer

fact: risk committee

fact: disclosure committee

reasoning: The paragraph is primarily about board and committee oversight of cybersecurity, fitting the Board Governance category. It reaches the Quantified-Verifiable level because it specifies that exactly two members of the audit committee hold cybersecurity oversight certifications, which is a verifiable claim.


fact: ELT

fact: Senior Leadership Team ("SLT")

fact: tabletop exercises

reasoning: The paragraph focuses on the leadership role of the CISO and their reporting lines to specific management teams (ELT, SLT), making it primarily about Management Role. It reaches Firm-Specific level due to the mention of named internal leadership teams (ELT, SLT) and the specific CISO role.


fact: April 2022

fact: Security Operations Center

fact: ransomware attacks

reasoning: The paragraph is primarily an Incident Disclosure because it describes a specific past cybersecurity event (April 2022) and its operational/financial impacts. It reaches Quantified-Verifiable specificity because it cites a specific date for the incident.


fact: CSO

fact: phishing tests

reasoning: The paragraph describes the activities and responsibilities of the information security team and the CSO, which falls under Risk Management Process. It is classified as Firm-Specific because it explicitly names the 'CSO' (Chief Security Officer) role, which is a specific leadership title.


fact: security incident and event manager interface

fact: behavioral analytics

fact: firewalls

fact: anti-malware

fact: penetration testing

reasoning: The paragraph describes the company's cybersecurity program activities, specifically tools and testing methodologies, placing it in Risk Management Process. It reaches Domain-Adapted specificity by referencing specific cybersecurity technologies like SIEM, behavioral analytics, and penetration testing.


fact: Aerospace Safety Committee

fact: Chief Information Officer and Senior Vice President, Information Technology & Data Analytics

fact: Chief Security Officer

fact: Chief Engineer

fact: Chief Aerospace Safety Officer

fact: Chief Product Security Engineer

fact: threat landscape

reasoning: The paragraph is primarily about the Board's delegation of cybersecurity oversight to specific committees (Audit and Aerospace Safety) and the reporting structure, which falls under Board Governance. It reaches Firm-Specific level due to the inclusion of company-specific committee names and unique executive titles like 'Chief Product Security Engineer' and 'Chief Aerospace Safety Officer'.


fact: identity and access management

fact: cyber defense operations

fact: security engineering

fact: Executive Vice President/ Chief Information Security Officer

fact: over 25 years' experience

fact: Chief Information Officer

fact: over 27 years' experience

fact: threat intelligence

fact: managed security services

reasoning: The paragraph is primarily about the organizational structure and leadership of the cybersecurity team, fitting the Management Role category. It reaches Quantified-Verifiable specificity due to the inclusion of specific years of experience for the CISO and CIO, which are verifiable claims.


fact: Enterprise Risk Management Committee ("ERM Committee")

fact: SOC1 reports

reasoning: The paragraph is primarily about the governance structure for risk oversight, specifically the role of the ERM Committee and its reporting line to the Audit Committee. It reaches Firm-Specific specificity by naming the 'Enterprise Risk Management Committee' and Domain-Adapted by referencing 'SOC1 reports'.


fact: Head of Cyber Security

fact: third-party risk assessments

reasoning: The paragraph is primarily about the governance structure, specifically the delegation of oversight to the Audit Committee and the reporting lines from the Head of Cyber Security, which places it in Board Governance. It reaches Firm-Specific level because it identifies a specific management role ('Head of Cyber Security') that is distinct from generic titles.


fact: March 2021

fact: $ 2.4 million

fact: year ended December 31, 2021

reasoning: The paragraph describes a specific past cybersecurity incident, including its timing, operational impact, and financial costs, making it a clear Incident Disclosure. It reaches the Quantified-Verifiable level due to the inclusion of specific dates and a precise dollar amount for incident-related costs.


fact: Director of Information Technology

fact: threat detection rates

fact: response times

fact: penetration tests

reasoning: The paragraph is primarily about the Board's oversight structure and the flow of information to the Audit Committee, making it Board Governance. It reaches Firm-Specific specificity because it identifies a specific management role ('Director of Information Technology') responsible for reporting to the board, and includes domain-specific terminology like 'threat detection rates' and 'penetration tests'.


fact: security operations center

fact: Chief Information Security Officer (CISO)

fact: Cybersecurity Incident Response Plan

fact: cybersecurity crisis response team

fact: Public Disclosure Committee

reasoning: The paragraph is primarily about the organizational structure and roles involved in managing cybersecurity incidents, specifically detailing the escalation path and the composition of the 'Crisis Response Team' and 'Public Disclosure Committee'. It reaches Firm-Specific specificity due to the naming of these specific internal committees and the CISO role.


reasoning: This paragraph is a cross-reference to the Risk Factors section and contains no substantive cybersecurity disclosure, thus falling under None/Other and Generic Boilerplate.


reasoning: The paragraph is a cross-reference directing the reader to Item 1A for risk factors, which contains no substantive cybersecurity disclosure and thus falls under the None/Other category.


fact: Risk Management Committee

fact: Audit Committee

fact: CISO

fact: cyber resiliency

fact: risk appetite statement

fact: playbooks

reasoning: The paragraph is primarily about the Board's oversight structure and committee responsibilities, fitting the Board Governance category. It reaches Firm-Specific specificity by naming unique internal bodies like the 'Cybersecurity and Technology Subcommittee' and specific roles like the 'CISO'.


reasoning: The paragraph is a standard disclaimer regarding the limitations of cybersecurity programs and a cross-reference to the Risk Factors section, containing no substantive cybersecurity disclosure.


fact: Vice-President of Information Technology

fact: Director - Information Security

reasoning: The paragraph describes the governance structure and information flow regarding cybersecurity oversight by the Board and Audit Committee, placing it in Board Governance. It is classified as Firm-Specific because it identifies specific leadership roles (VP of IT and Director of Information Security) involved in the reporting process.


reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the material impact of cybersecurity threats on the company's business strategy and financial condition. It is Generic Boilerplate because it lacks any specific domain terminology, firm-unique facts, or verifiable claims.


reasoning: The paragraph is primarily a generic risk disclosure, but it includes a negative assertion regarding the absence of material cybersecurity incidents to date, which classifies it as Strategy Integration under Rule 5. It contains no specific, verifiable, or domain-unique facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is centrally focused on the management of third-party cybersecurity risks. It contains no domain-specific terminology, firm-specific entities, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: ransomware

fact: malware

fact: phishing attacks

fact: operational technology

fact: detective surveillance controls

fact: social engineering

reasoning: The paragraph describes the components and methodology of the company's cybersecurity program, placing it squarely in Risk Management Process. It achieves Domain-Adapted specificity by referencing specific cybersecurity threats (ransomware, malware, phishing) and architectural concepts (layered technical protective capabilities, detective surveillance controls) that demonstrate domain expertise.


fact: automated event-detection notifications

reasoning: The paragraph describes the operational activities of the company's cybersecurity program, specifically incident detection and analysis, placing it in Risk Management Process. It reaches Domain-Adapted specificity by referencing specific technical practices like 'automated event-detection notifications' which demonstrate cybersecurity domain knowledge.


reasoning: The paragraph consists of a negative assertion regarding material incidents and a cross-reference to another section, neither of which constitutes substantive cybersecurity disclosure under the provided rules.


reasoning: The paragraph primarily functions as a negative assertion regarding material cybersecurity incidents, which falls under Strategy Integration per the materiality rule. It contains no domain-specific terminology, firm-specific facts, or externally verifiable claims, resulting in Generic Boilerplate specificity.


fact: real-time security scoring

fact: threat intelligence

fact: Continuous threat intelligence monitoring

reasoning: The paragraph is centrally focused on the company's approach to managing cybersecurity risks associated with third-party suppliers. It reaches the Domain-Adapted level by referencing specific cybersecurity practices like 'real-time security scoring' and 'threat intelligence monitoring' which demonstrate domain expertise beyond generic risk management language.


reasoning: The paragraph is classified as Strategy Integration because it makes a negative assertion regarding the material impact of cybersecurity incidents on the company's business and financial condition. It is Generic Boilerplate because it contains no domain-specific terminology, firm-specific details, or verifiable facts.


reasoning: The paragraph provides a high-level, aspirational statement about the importance of cybersecurity governance without describing any specific oversight structure, management roles, or operational processes, making it generic boilerplate.


reasoning: The paragraph is classified as Strategy Integration because it makes a negative assertion regarding the material impact of cybersecurity risks on the company's business and operations. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: defense-in-depth

fact: endpoint detection and response

fact: network anomaly detection

fact: multi-factor authentication

fact: threat intelligence services

fact: phishing simulation exercises

reasoning: The paragraph describes the company's cybersecurity program activities, such as specific security tools and practices, placing it in Risk Management Process. It reaches Domain-Adapted specificity by referencing cybersecurity-specific concepts like 'endpoint detection and response' and 'defense-in-depth' that pass the ERM test.


fact: Information Security Team

reasoning: The paragraph is primarily focused on the oversight and assessment of third-party service providers, making it a clear Third-Party Risk disclosure. It reaches Firm-Specific specificity because it references a named internal entity, the 'Information Security Team', which distinguishes the company's organizational structure.


fact: supplier risk management program

fact: risk-based approach

fact: formal risk assessments

fact: data security controls

reasoning: The paragraph is primarily focused on the company's oversight of third-party service providers, making 'Third-Party Risk' the correct category. It is classified as 'Domain-Adapted' because it uses specific cybersecurity terminology like 'data security controls' and 'risk-based approach' to describe the assessment process, which goes beyond generic boilerplate.


fact: SOC 1 audit

reasoning: The paragraph is centrally focused on the oversight and management of third-party service providers, specifically detailing audit requirements. It reaches the Domain-Adapted level by referencing 'SOC 1 audit,' which is a specific cybersecurity/compliance domain term that passes the ERM test.


fact: enhanced due diligence procedures

fact: security risk assessments

reasoning: The paragraph is centrally focused on the management of cybersecurity risks related to third-party service providers, fitting the Third-Party Risk category. It reaches Domain-Adapted specificity by referencing specific cybersecurity practices like 'enhanced due diligence procedures' and 'security risk assessments' in the context of vendor management, which demonstrates domain knowledge beyond generic risk management language.


fact: Audit Committee

fact: Chief Information Security Officer

fact: independent third-party assessments

reasoning: The paragraph primarily describes the Board's oversight structure and the flow of information from management to the Audit Committee, fitting the Board Governance category. It is classified as Firm-Specific because it explicitly names the Audit Committee and the Chief Information Security Officer (CISO) as the key actors in this governance chain.


fact: CISO

fact: CIO

fact: Transportation Security Administration (TSA) compliance

fact: cybersecurity dashboard

fact: key performance indicators

reasoning: The paragraph is primarily about the Board's oversight structure and the reporting cadence between management (CISO/CIO) and the Board/Audit Committee, fitting the Board Governance category. It reaches Firm-Specific specificity because it identifies specific roles (CISO, CIO) and a specific regulatory body (TSA) relevant to the company's operations.


fact: DTI organization

fact: CDT function

fact: Incident Response team

reasoning: The paragraph focuses on the organizational structure and responsibilities of specific management roles (CIO, CISO) and internal teams (DTI, CDT, Incident Response team), fitting the Management Role category. It is classified as Firm-Specific because it names these specific internal organizational units and leadership roles.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity threats on the company's business strategy and financial condition, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: Enterprise Cybersecurity team

fact: Certified Information Systems Security Professional (CISSP)

fact: Global Industrial Cyber Security Professional (GICSP)

fact: Electricity Information Sharing and Analysis Center

fact: Cybersecurity and Infrastructure Security Agency

fact: network monitoring

fact: vulnerability scanning

reasoning: The paragraph is primarily about the composition and role of the 'Enterprise Cybersecurity team', making it Management Role. It reaches Firm-Specific specificity because it names a specific internal team and lists specific professional certifications held by its members.


fact: ransomware

fact: multi-factor authentication

reasoning: The paragraph is primarily an Incident Disclosure because it details a specific past cybersecurity event (the May 2022 ransomware attack) and the company's response to it. The specificity is Domain-Adapted because it includes technical terminology like 'ransomware' and 'multi-factor authentication' that demonstrates cybersecurity expertise beyond generic risk management language.


fact: CISO

fact: Privacy and Data Governance Committee

fact: Chief Privacy Officer

fact: Data Security and Privacy Governance Committee

reasoning: The paragraph describes the organizational structure and leadership of cybersecurity and privacy committees, which falls under Management Role. It is classified as Firm-Specific because it names specific internal committees (e.g., Security and Technology Risk Leadership Committee) and specific leadership roles (CISO, Chief Privacy Officer).


reasoning: This paragraph is a cross-reference to the Risk Factors section (Item 1A) and does not contain any substantive cybersecurity disclosure.


fact: phishing

fact: malware

reasoning: The paragraph is classified as Strategy Integration because it provides a negative assertion regarding the materiality of past cybersecurity incidents. It is Domain-Adapted because it lists specific cybersecurity threat vectors like phishing, ransomware, and malware, which demonstrate domain expertise beyond generic risk language.


fact: cybersecurity due diligence

fact: ongoing monitoring

reasoning: The paragraph is centrally focused on the management of third-party cybersecurity risks, fitting the Third-Party Risk category. It is classified as Firm-Specific because it explicitly names the company's internal 'Third-Party Risk Management (TPRM) program'.


fact: defense-in-depth

fact: National Institute of Standards and Technology Cyber Security Framework

type: framework

fact: Written Information Security Program

fact: penetration testing

fact: encryption

reasoning: The paragraph is primarily a description of the company's cybersecurity program activities and framework alignment, placing it in Risk Management Process. It reaches Domain-Adapted specificity by referencing specific cybersecurity concepts like 'defense-in-depth', 'vulnerability scanning', 'penetration testing', and 'multi-factor authentication' that pass the ERM test.


fact: endpoint protection

fact: two-factor authentication (2FA)

fact: real-time threat monitoring

fact: Tier-1 cloud service providers

fact: ERP system

reasoning: The paragraph details the company's cybersecurity program activities, including specific technical measures like 2FA, encryption, and endpoint protection, which classifies it as Risk Management Process. It achieves Domain-Adapted specificity by referencing these specific cybersecurity tools and architectural concepts that go beyond generic risk management language.


reasoning: The paragraph describes the governance structure and reporting lines between the Board, Audit Committee, and management, which falls under Board Governance. It is classified as Firm-Specific because it identifies a specific executive role (Vice President, Information Systems and Technology) responsible for reporting to the Board.


fact: FRB

fact: FDIC

fact: DFR

reasoning: The paragraph describes the company's cybersecurity risk management program and its integration with enterprise risk management, placing it in Risk Management Process. It reaches Firm-Specific specificity by naming the specific regulatory bodies (FRB, FDIC, DFR) that govern the company's compliance environment.


fact: Cybersecurity Committee

reasoning: The paragraph primarily describes the Board's oversight structure, specifically identifying the 'Cybersecurity Committee,' which is a named, non-generic committee that elevates the specificity to Firm-Specific.


reasoning: The paragraph is classified as Strategy Integration because it explicitly states that prior cybersecurity threats have not materially affected the company's business strategy or financial condition, which is a backward-looking materiality assessment. It is Generic Boilerplate because it contains no domain-specific terminology, firm-specific organizational details, or verifiable facts.


reasoning: The paragraph is classified as Strategy Integration because it makes a negative assertion regarding the material impact of past cybersecurity incidents on the company's financial position. It is Generic Boilerplate because it contains no domain-specific terminology, firm-specific organizational details, or verifiable facts.


reasoning: The paragraph serves as a cross-reference to other sections of the filing and provides a generic statement about risk management integration, containing no substantive cybersecurity program details or specific facts.


fact: MOVEit Transfer

fact: zero-day

reasoning: The paragraph is primarily an Incident Disclosure because it details specific past cybersecurity incidents, including a named third-party event (MOVEit Transfer in 2023). The specificity is Quantified-Verifiable due to the inclusion of the specific year and the named software product involved in the incident.


fact: isolated computer workstations

fact: two-factor or independent authorizations

reasoning: The paragraph describes specific cybersecurity measures such as isolated workstations and two-factor authentication, which classifies it as Risk Management Process and demonstrates domain-specific knowledge.


fact: threat intelligence

reasoning: The paragraph describes the operational activities and inputs used to monitor cybersecurity risks, which aligns with Risk Management Process. It reaches Domain-Adapted specificity by referencing 'threat intelligence,' a specific cybersecurity practice that distinguishes it from generic enterprise risk management language.


reasoning: The paragraph provides a negative assertion regarding the materiality of cybersecurity incidents, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific organizational details, or externally verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: ransomware

fact: Phishing

reasoning: The paragraph is a general discussion of the threat landscape and the inherent risks of operating in the banking sector, rather than a description of the company's specific governance, management, or risk management processes. It qualifies as Domain-Adapted because it explicitly references specific cyber threats like 'ransomware' and 'phishing' which pass the ERM test.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity incidents, which is classified as Strategy Integration per the materiality rule. It contains no specific domain terminology, firm-unique facts, or verifiable claims, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is classified as Strategy Integration because it makes a negative assertion regarding the materiality of past cybersecurity incidents, which falls under the SI materiality rule. It is Generic Boilerplate because it contains no domain-specific terminology, firm-specific details, or verifiable facts.


fact: global incident involving Progress Software Corporation ("MOVEit Transfer")

reasoning: The paragraph describes a specific cybersecurity incident (the MOVEit Transfer event) and its impact, which falls squarely under Incident Disclosure. It reaches the Quantified-Verifiable level because it names a specific third-party vendor and incident (Progress Software Corporation/MOVEit Transfer) and a specific year (2023), which are verifiable facts.


reasoning: The paragraph is classified as Strategy Integration because it provides a negative assertion regarding the materiality of past incidents and discusses the financial implications of potential future ones. It is Generic Boilerplate as it contains no specific, verifiable, or unique details about the company's cybersecurity posture or insurance coverage.


fact: Emergency Incident Response Team

reasoning: The paragraph describes the operational activity of reviewing and drilling on the incident response plan, which is a core component of the Risk Management Process. It is classified as Firm-Specific because it identifies a named internal entity, the 'Emergency Incident Response Team'.


fact: lost revenue of approximately $ 80 million to $ 85 million

fact: operating earnings of $ 35 million to $ 40 million

fact: nine days

reasoning: The paragraph describes a specific cybersecurity incident, including the date, operational impact, and financial consequences, making it a clear Incident Disclosure. It reaches the Quantified-Verifiable level due to the inclusion of specific dates and dollar amounts related to the incident's impact.


fact: John Bresney, EVP & CIO

fact: Robert McKenna, SVP of Enterprise Strategy and Execution

fact: Christopher Cunniff, SVP and CRO

fact: Board's Risk Committee

fact: ERC

fact: Emerging Risk Committee

fact: Security Incident Response Plan ("IRP")

fact: 30 years

fact: 21 years

fact: 27 years

fact: 32 years

reasoning: The paragraph is primarily focused on describing the roles, responsibilities, and qualifications of specific management personnel, fitting the Management Role category. It reaches the Quantified-Verifiable level of specificity due to the inclusion of specific tenure durations (e.g., '30 years', '21 years') and named internal committees and programs.


reasoning: The paragraph is primarily a forward-looking disclaimer regarding potential future risks and a negative assertion about past material incidents, which does not constitute a substantive cybersecurity disclosure. It also includes a cross-reference to Item 1A, which is explicitly excluded from substantive categorization.


fact: RCSC

fact: CISO

reasoning: The paragraph describes the governance structure and reporting lines between the CISO and the RCSC, which falls under Board Governance. It is classified as Firm-Specific because it identifies the specific committee (RCSC) and the specific role (CISO) involved in the oversight process.


fact: Risk Committee

fact: Chief Information Security Officer ("CISO")

fact: vulnerability assessments

fact: key risk indicators

reasoning: The paragraph is primarily about the Board's oversight structure and the role of the Risk Committee, placing it in Board Governance. It reaches Firm-Specific specificity because it names the specific committee (Risk Committee) and the specific officer (CISO) responsible for reporting to that committee.


fact: defense in depth

fact: data loss prevention

fact: transport layer security

fact: phishing

fact: malware

fact: social engineering testing

fact: S&T Information Security Program

reasoning: The paragraph describes the operational components of the company's cybersecurity program, fitting the Risk Management Process category. It reaches Firm-Specific specificity because it names the internal program ('S&T Information Security Program') and includes multiple domain-adapted terms like 'defense in depth', 'data loss prevention', and 'transport layer security'.


fact: Chief Risk Officer

reasoning: The paragraph is classified as Management Role because it explicitly identifies the specific management positions responsible for cybersecurity oversight. It is Firm-Specific because it names specific executive roles (CISO, Chief Risk Officer, Chief Information and Technology Officer) that define the company's management structure.


reasoning: The paragraph provides a negative assertion regarding the materiality of cybersecurity incidents, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific organizational details, or externally verifiable facts, resulting in Generic Boilerplate specificity.


fact: Vendor Management Committee

fact: Vendor Management team

reasoning: The paragraph is centrally focused on the oversight and management of third-party vendor risks, making it a clear Third-Party Risk category. It reaches Firm-Specific specificity because it names internal organizational entities ('Vendor Management Committee' and 'Vendor Management team') that are specific to this company's structure.


fact: cyber assessments on potential vendors

fact: contractually required to manage their cybersecurity risks

fact: provide notification in the event of a cybersecurity incident

reasoning: The paragraph is centrally focused on the management of third-party cybersecurity risks, specifically vendor assessments and contractual requirements. It reaches the Domain-Adapted level by referencing specific cybersecurity practices like conducting cyber assessments and requiring incident notification, which demonstrates domain knowledge beyond generic risk management.


fact: Chief Information Officer (CIO)

fact: Executive Committee

fact: Chief Information Security Officer (CISO)

reasoning: The paragraph is classified as Management Role because it explicitly defines the responsibilities of the CIO and CISO. It is Firm-Specific because it identifies these specific leadership roles and the Executive Committee, which distinguishes the company's management structure.


fact: cybersecurity due diligence reviews

reasoning: The paragraph is primarily focused on the company's Third Party Risk Management (TPRM) program and vendor oversight processes, making 'Third-Party Risk' the correct category. It is classified as 'Firm-Specific' because it names the specific 'Third Party Risk Management (TPRM) program' used by the company.


reasoning: The paragraph is classified as Strategy Integration because it makes a negative assertion regarding the material impact of cybersecurity risks on the company's business and financial condition. It contains no specific cybersecurity domain terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: maintaining cybersecurity insurance coverage

reasoning: The paragraph is classified as Strategy Integration because it explicitly addresses the materiality of cybersecurity threats on the company's financial condition and business strategy. It is Domain-Adapted because it mentions 'cybersecurity insurance coverage,' which demonstrates domain knowledge beyond generic risk management language.


fact: Senior Manager of our Enterprise IT Security Risk and Compliance team

fact: Managing Director of Enterprise IT

fact: over 30 years of IT experience

fact: over 20 years specializing in cybersecurity

reasoning: The paragraph is primarily about the management structure and leadership qualifications for the cybersecurity program, fitting the Management Role category. It reaches Quantified-Verifiable specificity because it includes specific, verifiable tenure claims (e.g., 'over 30 years of IT experience').


fact: 24/7 security operations center

fact: insider threat protection program

fact: operational technology

reasoning: The paragraph describes the operational components of the company's cybersecurity program, such as the 24/7 security operations center and insider threat protection program, which falls under Risk Management Process. The mention of a '24/7 security operations center' is a firm-specific organizational claim, elevating the specificity to Level 3.


fact: 30 years of information technology experience

fact: 17 years focused specifically on information security and risk management

reasoning: The paragraph focuses on the responsibilities and qualifications of the CISO, placing it squarely in Management Role. It reaches Quantified-Verifiable specificity because it provides specific, verifiable numbers regarding the CISO's years of experience.


reasoning: The paragraph is classified as Strategy Integration because it explicitly addresses the materiality of cybersecurity threats on the company's financial condition and business strategy. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: strategic risk management committees

reasoning: The paragraph focuses on the company's approach to managing cybersecurity risks associated with third-party service providers, making it a clear Third-Party Risk disclosure. It is classified as Firm-Specific because it references a specific internal body, the 'strategic risk management committees,' which distinguishes the company's governance structure.


fact: crisis simulation exercises

fact: shipboard and shoreside employees

reasoning: The paragraph describes the company's incident response program and testing procedures, which falls under Risk Management Process. It reaches Domain-Adapted specificity by referencing 'crisis simulation exercises,' a specific cybersecurity practice that passes the ERM test, and includes firm-specific context regarding 'shipboard and shoreside employees'.


reasoning: The paragraph is classified as Strategy Integration because it explicitly addresses the potential for cybersecurity risks to materially affect the company's business strategy and financial condition, aligning with the SEC's forward-looking materiality disclosure requirements. It contains no specific cybersecurity practices, firm-unique details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: February 22, 2024

reasoning: The paragraph is primarily an Incident Disclosure as it describes the occurrence and ongoing investigation of a specific cybersecurity event. The inclusion of the specific disclosure date (February 22, 2024) makes the paragraph Quantified-Verifiable.


fact: Audit Committee of the Board

fact: Risk Committee

reasoning: The paragraph describes the oversight responsibilities of specific board-level committees (Audit Committee and Risk Committee) regarding cybersecurity, which falls under Board Governance. It is classified as Firm-Specific because it identifies the specific committees responsible for oversight, which distinguishes the governance structure.


fact: In 2021, we suffered a ransomware attack

fact: ransomware

reasoning: The paragraph is classified as Incident Disclosure because it describes a specific past cybersecurity event (a 2021 ransomware attack). It reaches the Quantified-Verifiable level because it cites a specific year (2021) for the occurrence of the incident.


reasoning: The paragraph outlines the components of the company's cybersecurity program, which is a classic description of a Risk Management Process. The language used is high-level and generic, lacking specific technical details, frameworks, or unique identifiers that would elevate it beyond boilerplate.


fact: contractually imposed obligations on the provider

fact: vendor management process

reasoning: The paragraph is primarily focused on the company's approach to managing cybersecurity risks associated with third-party service providers, fitting the Third-Party Risk category. It reaches Domain-Adapted specificity by referencing specific cybersecurity-relevant vendor management practices like 'contractually imposed obligations' and 'vendor management process' in a security context.


fact: Change Healthcare, a subsidiary of UnitedHealth Group

fact: February 21, 2024

fact: February 28, 2024

fact: severed those business service connections

fact: conducted forensics

reasoning: The paragraph is primarily an Incident Disclosure because it details a specific, real-world cybersecurity event involving a third party (Change Healthcare) and the company's response to it. It reaches Quantified-Verifiable specificity because it includes specific, verifiable dates (February 21 and 28, 2024) and names the specific third-party entity involved.


fact: Director of Cybersecurity

fact: Chief Information Officer

fact: over 20 years of cybersecurity oversight experience

reasoning: The paragraph focuses on defining the management roles responsible for cybersecurity, fitting the Management Role category. It reaches Quantified-Verifiable specificity because it cites specific, verifiable experience thresholds ('over 20 years') for the named officers.


fact: forensics

reasoning: The paragraph is primarily an Incident Disclosure because it details a specific, real-world cybersecurity event (the Change Healthcare incident) and its operational impact on the company. It reaches Quantified-Verifiable specificity because it cites a specific date and a named third-party entity involved in the incident.


reasoning: The paragraph describes the board-level oversight structure for cybersecurity, which falls under Board Governance. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity incidents on the company's financial condition and business strategy, which falls under Strategy Integration per Rule 5. It is classified as Quantified-Verifiable because it includes a specific reporting date (March 31, 2024) anchoring the assessment.


fact: CIO

fact: Vice President of Information Security

fact: vulnerability assessments

reasoning: The paragraph primarily describes the governance structure and oversight responsibilities of the Board and Audit Committee regarding cybersecurity, fitting the Board Governance category. It reaches Firm-Specific specificity by naming specific leadership roles (CIO, VP of Information Security) and a specific internal team (Information Technology Senior Leadership Team).


fact: Chief Innovation Officer

reasoning: The paragraph primarily describes the Board and Audit Committee's oversight responsibilities regarding cybersecurity, fitting the Board Governance category. It is classified as Firm-Specific because it identifies a specific executive role, the 'Chief Innovation Officer,' as the individual reporting to the committee.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity risks on the company's business strategy and financial condition, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific facts, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: Corporate Risk Committee

fact: CISO

reasoning: The paragraph is primarily about board-level oversight of cybersecurity, fitting the Board Governance category. It reaches Firm-Specific specificity because it names specific committees (Corporate Risk Committee) and specific leadership roles (CIO, CISO) involved in the governance structure.


fact: network and perimeter defense

fact: infrastructure security

fact: cloud security

fact: endpoint protection

fact: data protection

fact: identity management

fact: network segmentation

fact: cybersecurity threat intelligence

reasoning: The paragraph describes the operational components and tools of the company's cybersecurity program, which falls under Risk Management Process. It achieves Domain-Adapted specificity by listing specific technical security domains such as endpoint protection, network segmentation, and threat intelligence that demonstrate cybersecurity expertise.


fact: incident in August 2023

reasoning: The paragraph is classified as Incident Disclosure because it describes a specific past cybersecurity event (August 2023). It is Quantified-Verifiable because it cites a specific date for a real incident, which is a verifiable fact.


fact: EVP, Chief Digital and Innovation Officer (CDIO)

fact: Vice President (VP) of Platforms, Infrastructure and Cybersecurity

fact: over 20 years of related experience

reasoning: The paragraph describes the specific management roles and qualifications responsible for the cybersecurity program, placing it in the Management Role category. It is classified as Quantified-Verifiable because it cites a specific, verifiable duration of professional experience (over 20 years) for the named officers.


fact: Vice President of Information Technology, Security and Business Intelligence

fact: over 18 years

fact: Biogen

fact: AstraZeneca

fact: Iron Mountain

fact: Charles River Labs

fact: Sunovion Pharmaceuticals

fact: Agero

fact: DentaQuest

fact: master's degree in business administration from Boston University

fact: master's degree in electrical and computer engineering from Utah State University

fact: bachelor's degree in electronics engineering from Mumbai University

fact: over 10 years of experience

reasoning: The paragraph focuses on the specific management role responsible for cybersecurity, making it a Management Role category. It reaches Quantified-Verifiable specificity due to the inclusion of specific years of experience and named previous employers/universities.


reasoning: The paragraph focuses exclusively on the company's contractual requirements for third-party vendors, which is the core of Third-Party Risk. It contains no specific security frameworks, firm-unique details, or verifiable claims, resulting in a Generic Boilerplate classification.


fact: confidentiality, integrity, or availability

fact: CSO

reasoning: The paragraph describes the scope and objectives of the company's cybersecurity program, placing it in Risk Management Process. It is classified as Firm-Specific because it explicitly identifies the 'CSO' (Chief Security Officer) as a key component of the program structure.


reasoning: The paragraph is classified as Strategy Integration because it explicitly addresses the materiality of cybersecurity incidents on the company's business strategy and financial condition, including a forward-looking statement regarding potential future material effects. It is Generic Boilerplate because it contains no domain-specific terminology, firm-specific organizational details, or externally verifiable facts.


fact: System and Organization Controls (SOC) 2

reasoning: The paragraph is centrally focused on the management of third-party cybersecurity risks, including vendor onboarding and due diligence. It reaches the Domain-Adapted level by referencing specific cybersecurity standards like SOC 2 and ISO 27001, which demonstrate domain expertise beyond generic risk management language.


reasoning: The paragraph explicitly states a conclusion regarding the material impact of cybersecurity threats on the company's financial condition and business strategy, which aligns with the Strategy Integration category under Rule 5. It contains no specific domain terminology, firm-unique identifiers, or verifiable data points, resulting in Generic Boilerplate specificity.


fact: Chief Capability Officer (CCO)

fact: Chief Information Officer (CIO)

fact: Chief Information Security Officer (CISO)

reasoning: The paragraph is primarily about the Audit Committee's oversight structure and engagement with management, placing it in Board Governance. It reaches Firm-Specific level because it identifies specific executive roles (CCO, CIO, CISO) involved in the governance chain.


fact: data security addendum

fact: cybersecurity insurance

fact: incident reporting protocols

reasoning: The paragraph is centrally focused on the requirements imposed on third-party vendors, fitting the Third-Party Risk category. It is classified as Domain-Adapted because it uses specific cybersecurity terminology such as 'administrative, physical, and technical safeguards' and 'data security addendum' that demonstrates domain expertise.


fact: Chief Security and Trust Officer

fact: Executive Vice President, Operations

fact: over 25 years

reasoning: The paragraph focuses on the responsibilities and reporting lines of a specific management role (Chief Security and Trust Officer), making it a Management Role classification. It reaches Quantified-Verifiable specificity because it cites a specific duration of experience ('over 25 years') which is a verifiable claim.


reasoning: The paragraph is classified as Strategy Integration because it makes a negative assertion regarding the materiality of past cybersecurity incidents, which falls under the Strategy Integration materiality rule. It contains no domain-specific terminology, firm-specific facts, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: security due diligence process for each acquisition target

reasoning: The paragraph is primarily about managing security risks associated with acquisition targets, which falls under Third-Party Risk. It reaches the Domain-Adapted level by referencing specific cybersecurity practices like 'security due diligence' and 'independent testing of the target technology' rather than generic risk management language.


fact: Chief Security Officer ("CSO")

fact: reports to the CFO

fact: served in that role for Zebra since 2018

fact: over 14 years of global executive cybersecurity experience

reasoning: The paragraph focuses on the responsibilities, reporting lines, and qualifications of the Chief Security Officer, placing it squarely in Management Role. It reaches Quantified-Verifiable specificity due to the inclusion of specific tenure (since 2018) and years of experience (over 14 years).


fact: National Institute on Standards and Technology Cybersecurity Framework

fact: multi-factor authentication

fact: encryption

fact: malware defenses

fact: security operation center

reasoning: The paragraph describes the company's cybersecurity program, tools, and frameworks, which falls under Risk Management Process. It reaches Domain-Adapted specificity by referencing specific cybersecurity concepts like multi-factor authentication, intrusion prevention and detection systems, and the NIST Cybersecurity Framework.


fact: denial of service attacks

fact: malicious software attacks

reasoning: The paragraph focuses primarily on the risks posed by third-party service providers and the company's lack of control over their security environments, making Third-Party Risk the most appropriate category. It reaches the Domain-Adapted level by referencing specific cybersecurity threat types like 'denial of service attacks' and 'malicious software attacks'.


fact: CISO

fact: over 20 years of information technology and cybersecurity experience

fact: security engineers

fact: detection specialists

reasoning: The paragraph is primarily about the management structure and leadership qualifications (CISO, team composition), making it Management Role. It reaches Quantified-Verifiable specificity because it cites a specific, verifiable duration of experience ('over 20 years').


fact: vendor due diligence process

fact: assess vendor control environments

reasoning: The paragraph is centrally focused on the company's vendor due diligence and third-party risk management processes. It reaches the Domain-Adapted level by referencing specific cybersecurity concepts like 'vendor control environments' and 'vendor due diligence' which demonstrate domain expertise beyond generic risk management language.


fact: National Institute of Standards and Technology Cybersecurity Framework

fact: Center for Internet Security – Top 18 Critical Security Controls – Control Level Framework

fact: phishing tests

fact: tabletop exercises

fact: cyber risk insurance policy

reasoning: The paragraph is primarily a description of the company's cybersecurity program activities, fitting the Risk Management Process category. It reaches Domain-Adapted specificity by referencing specific cybersecurity frameworks (NIST CSF, CIS Top 18) and technical practices like phishing tests and tabletop exercises.


reasoning: The paragraph is classified as Strategy Integration because it explicitly addresses the materiality of cybersecurity incidents on the company's business strategy and financial condition, including a forward-looking statement regarding potential material effects. It is Generic Boilerplate because it contains no domain-specific terminology, firm-specific organizational details, or externally verifiable facts.


reasoning: This paragraph is a cross-reference directing the reader to Item 1A for risk factor disclosures, which does not contain substantive cybersecurity program information and is classified as None/Other.


reasoning: The paragraph is a cross-reference to Item 1A (Risk Factors) and does not contain substantive cybersecurity disclosure or specific facts, making it None/Other and Generic Boilerplate.


fact: CDO

fact: collectively over 25 years of prior work experience

fact: Certified Information Security Manager

fact: Certified Information Systems Security Professional

fact: Information Systems Audit and Control Association

fact: International Information System Security Certification Consortium

reasoning: The paragraph is primarily about the roles, responsibilities, and qualifications of the CDO and CISO, fitting the Management Role category. It reaches Quantified-Verifiable specificity because it cites specific professional certifications (CISM, CISSP) and a quantified claim regarding years of experience.


reasoning: The paragraph primarily functions as a negative assertion regarding the materiality of past cybersecurity incidents, which is classified as Strategy Integration. The text is composed of generic boilerplate language regarding risk and potential impacts, containing no specific or verifiable facts.


reasoning: The paragraph is a generic disclaimer about the potential negative impacts of cybersecurity incidents and does not describe specific governance, management, or operational processes. It functions as a forward-looking risk disclosure rather than a substantive description of the cybersecurity program.


fact: Chief Information Officer ("CIO")

fact: CSO

fact: CFO

fact: appointed to the role in March 2022

fact: nearly 20 years of experience

reasoning: The paragraph focuses on the organizational structure and responsibilities of the CIO, placing it in Management Role. It reaches Quantified-Verifiable specificity because it includes a specific appointment date and a quantified number of years of experience.


fact: external risk management software program

fact: vendor security assessment process

reasoning: The paragraph is centrally focused on the management of third-party cybersecurity risks, fitting the Third-Party Risk category. It reaches Firm-Specific specificity because it identifies a specific cross-functional team structure ('Legal, Privacy and Information Security teams') involved in the assessment process.


fact: outside-in, hacker perspective

reasoning: The paragraph is primarily focused on the company's third-party risk management program, making 'Third-Party Risk' the correct category. It is classified as 'Firm-Specific' because it names the company's specific 'Third Party Risk Management (TPRM) program'.


fact: Director of IT Infrastructure and Security

fact: over 30 years of experience

fact: Defense Industrial Base

fact: Global Information Assurance Certification ("GIAC") Security Essentials

fact: GIAC Certified Enterprise Defender

fact: GIAC Certified Incident Handler Certification

fact: GIAC Certified Windows Security Administrator

fact: GIAC Critical Controls Certification

fact: Vice President of Information Technology

fact: over 19 years of experience

reasoning: The paragraph is primarily about the roles, responsibilities, and qualifications of the management team (Director and VP) overseeing cybersecurity, fitting the Management Role category. It reaches Quantified-Verifiable specificity because it lists specific years of experience and specific, verifiable professional certifications held by the named leadership roles.


fact: enterprise risk management ("ERM") process

fact: business continuity management

reasoning: The paragraph primarily describes how cybersecurity risks are integrated into the company's broader risk management framework, which falls under Risk Management Process. It reaches the Domain-Adapted level by referencing specific cybersecurity-related domains like 'business continuity management' and 'enterprise risk management' in a way that demonstrates domain knowledge beyond generic boilerplate.


fact: third party security risk assessment

fact: due diligence review

reasoning: The paragraph is centrally focused on the company's processes for managing cybersecurity risks associated with third-party vendors, fitting the Third-Party Risk category. It reaches Domain-Adapted specificity by referencing specific cybersecurity practices like 'third party security risk assessment' and 'due diligence review' in a security context, which pass the ERM test.


fact: CISO

fact: Chief Legal Officer

fact: Chief Financial Officer

fact: Core Cybersecurity Management Team (the 'CCMT')

fact: CIRP

reasoning: The paragraph is classified as Management Role because it focuses on the organizational structure and responsibilities of the management team (the CCMT) regarding cybersecurity. It is Firm-Specific because it identifies specific internal roles (CISO, CLO, CFO) and a named internal committee (CCMT) and program (CIRP).


fact: Chief Information Officer

reasoning: The paragraph focuses on the responsibilities and oversight role of the management team, specifically the Chief Information Officer, fitting the Management Role category. It is classified as Firm-Specific because it identifies a specific leadership role (Chief Information Officer) responsible for cybersecurity, which distinguishes the company's management structure.


reasoning: The paragraph describes hypothetical risks and potential consequences of cybersecurity threats without detailing any specific governance, management, or risk management processes, making it generic boilerplate. It does not meet the criteria for Strategy Integration because it uses 'material' as an adjective to describe risks rather than making a formal assessment of the impact on business strategy or financial condition.


fact: Vice President of Cybersecurity

reasoning: The paragraph is primarily about the Board's oversight structure and reporting cadence, which falls under Board Governance. It is classified as Firm-Specific because it identifies a specific leadership role, 'Vice President of Cybersecurity,' which distinguishes the company's organizational structure.


fact: February 2023

reasoning: The paragraph describes a specific past cybersecurity incident, which directly answers the question of what happened in an incident. The inclusion of the specific date of the event makes it Quantified-Verifiable.


fact: Risk Committee

reasoning: The paragraph describes the oversight role of the Risk Committee in the governance chain, making it Board Governance. It is Firm-Specific because it names a specific internal committee and a specific internal program ('Incident Management and Information Security Plan').


fact: Chief Risk Officer

reasoning: The paragraph focuses on the role and responsibilities of a specific management position (Chief Risk Officer), placing it in Management Role. It is Firm-Specific because it identifies a specific executive role (Chief Risk Officer) within the company's management structure.


fact: Head of Global IT

fact: IT Security Team

fact: network, infrastructure security

fact: CompTIA

fact: PCI

fact: over 20 years of combined infrastructure architecture experience

reasoning: The paragraph is primarily about the management structure, specifically the Head of Global IT and the IT Security Team, their responsibilities, and their qualifications. It reaches Quantified-Verifiable specificity because it cites specific certifications (CompTIA), compliance standards (PCI, SOC1, SOC2), and a quantified duration of experience (over 20 years).


reasoning: The paragraph is a generic risk disclosure statement describing the potential consequences of a cybersecurity failure rather than detailing actual processes, governance, or management roles, despite the header.


fact: Chief Information Officer (CIO)

fact: more than 30 years of experience

fact: Master's in Cybersecurity

fact: Certified Information Systems Security Professional

fact: Certified Information Security Manager

fact: Microsoft Certified Cybersecurity Architect Expert

fact: Graduate Certificates in Enterprise Cybersecurity and Data Science

fact: Security+

fact: Certified Information Systems Auditor

reasoning: The paragraph is classified as Management Role because it focuses on the leadership structure, the CIO's background, and the team's qualifications. It reaches Quantified-Verifiable specificity because it lists specific, verifiable professional certifications held by the team and the CIO's years of experience.


fact: MOVEit

fact: 429,252 Umpqua Bank customers

fact: August 2023

reasoning: The paragraph describes a specific cybersecurity incident (the MOVEit vendor incident) and its impact, clearly falling under Incident Disclosure. It reaches Quantified-Verifiable specificity due to the inclusion of specific dates and the exact number of affected customers.


reasoning: The paragraph consists entirely of generic disclaimers regarding the effectiveness of policies and speculative statements about future risks, which does not constitute substantive cybersecurity disclosure. The negative assertion about not experiencing material incidents is not considered a verifiable fact under the provided rules.


reasoning: The paragraph is classified as Strategy Integration because its primary purpose is to provide a negative assertion regarding the material impact of cybersecurity threats on the bank's business and financial condition. It contains no specific, verifiable, or domain-unique facts, relying instead on standard regulatory disclosure language.


reasoning: This paragraph describes the professional background and responsibilities of a Human Resources executive, which is unrelated to cybersecurity governance, management, or risk processes.


reasoning: This paragraph is a biographical sketch of an executive and does not contain any information regarding cybersecurity governance, risk management, or strategy, thus falling under None/Other.


fact: CIO

reasoning: The paragraph primarily details the oversight structure of the Board of Directors and the Audit Committee, fitting the Board Governance category. It is classified as Firm-Specific because it identifies the CIO as a key leadership role responsible for cybersecurity.


reasoning: The paragraph consists of generic boilerplate statements regarding the importance of information security and the existence of unspecified policies and procedures, providing no substantive details about governance, management, or specific risk management activities.


reasoning: The paragraph is primarily about the board's oversight structure, specifically detailing the roles of the Audit Committee and the Cybersecurity Sub-Committee. It is classified as Firm-Specific because it names a specific internal governance body, the 'Cybersecurity Sub-Committee of the Board of Directors', which distinguishes this company's governance structure.


fact: CISO

reasoning: The paragraph describes the board's oversight structure and information flow, placing it squarely in Board Governance. It is classified as Firm-Specific because it identifies the CISO as a specific role briefing the board, which distinguishes the governance structure.


fact: ransomware

fact: malware

fact: phishing

reasoning: The paragraph is classified as Strategy Integration because it leads with a negative assertion regarding material cybersecurity incidents, which is a standard materiality assessment. It is Domain-Adapted because it lists specific threat vectors like ransomware, malware, and phishing, which demonstrate cybersecurity domain knowledge beyond generic risk management language.


fact: July 2018

reasoning: The paragraph describes a specific historical cybersecurity event (a ransomware incident in July 2018), making it an Incident Disclosure. It reaches the Quantified-Verifiable level because it includes a specific date (July 2018) associated with the event.


fact: CRO, Chief Information Officer ("CIO") and CISO

fact: over 15 years experience

fact: RGA's Executive Committee

fact: more than 30 years of experience

fact: Global Chief Risk Officer

fact: Enterprise Risk Management program

fact: risk quantification

reasoning: The paragraph is primarily about the roles, responsibilities, and qualifications of specific management personnel (CRO, CIO, CISO), fitting the Management Role category. It reaches Quantified-Verifiable specificity because it includes specific, verifiable tenure claims (e.g., 'more than 30 years of experience') and named executive roles.


reasoning: The paragraph focuses on the oversight and management of third-party service providers, making Third-Party Risk the primary category. It lacks specific domain terminology, firm-unique identifiers, or verifiable claims, relying instead on generic descriptions of organizational departments and risk management functions.


fact: IT vendor risk management policy

fact: third-party risk management program

fact: pre-onboarding security assessments

fact: third-party security controls

reasoning: The paragraph focuses exclusively on the management of third-party and vendor risks, fitting the Third-Party Risk category. It is classified as Domain-Adapted because it uses specific cybersecurity terminology like 'pre-onboarding security assessments' and 'third-party security controls' rather than just generic risk management language.


reasoning: The paragraph focuses on the oversight and assessment of third-party service providers, placing it squarely in Third-Party Risk. It lacks specific details, domain-specific terminology, or verifiable claims, relying on generic descriptions of risk management activities.


reasoning: The paragraph is a standard risk factor disclaimer describing potential operational impacts of IT failure and includes a negative assertion about material incidents, which does not constitute substantive cybersecurity disclosure or strategy integration under the provided rules.


fact: Cyber ERM (Enterprise Risk Management) Committee

reasoning: The paragraph describes the structure and responsibilities of a specific management-level committee (the Cyber ERM Committee), which falls under Management Role. It is classified as Firm-Specific because it names a unique internal committee, distinguishing it from generic governance descriptions.


fact: Retrieval-Masters Credit Bureau, Inc. d/b/a/ American Medical Collections Agency (AMCA)

reasoning: The paragraph describes a specific historical cybersecurity incident involving a third party, making it an Incident Disclosure. It reaches Quantified-Verifiable specificity because it includes a precise date and the name of the external entity involved.


fact: threat intelligence services

fact: Third-Party Risk Management program

reasoning: The paragraph is primarily focused on the company's approach to managing cybersecurity risks associated with third parties, making 'Third-Party Risk' the most appropriate category. The specificity is 'Firm-Specific' because it references a named internal program, 'Third-Party Risk Management program', which distinguishes it from generic boilerplate.


reasoning: The paragraph is primarily focused on the management of third-party cybersecurity risks, specifically detailing the processes used to oversee external vendors. It reaches the Domain-Adapted level by referencing 'System Organization and Control Reports (SOC Reports)', which is a specific cybersecurity domain term that passes the ERM test.


reasoning: The paragraph consists of generic statements about maintaining security programs and cross-references to the Risk Factors section, containing no substantive cybersecurity process details or specific facts.


fact: Vice President of Internal Audit

fact: General Counsel

reasoning: The paragraph describes how cybersecurity risks are integrated into the company's broader enterprise risk management (ERM) process, making it a Risk Management Process disclosure. It is classified as Firm-Specific because it identifies specific leadership roles (Vice President of Internal Audit, General Counsel) involved in the process.


fact: three lines of defense

fact: Chief Technology Officer

fact: Technology Leadership Centre

fact: Chief Risk Officer

fact: Risk Committee of the board of directors

reasoning: The paragraph describes the company's governance structure for cybersecurity, specifically outlining the 'three lines of defense' model and the roles/committees involved, which aligns with Board Governance. It reaches Firm-Specific specificity by naming specific internal roles (Chief Technology Officer, Chief Risk Officer) and a specific internal team (Technology Leadership Centre).


reasoning: This paragraph is purely introductory boilerplate that states the importance of cybersecurity without describing any specific governance, management, or operational processes.


fact: offered identity protection services, including credit monitoring

fact: two years

reasoning: The paragraph describes the remediation steps taken in response to a cybersecurity incident (identity protection services), which classifies it as Incident Disclosure. It reaches the Quantified-Verifiable level because it specifies a concrete duration ('two years') for the services provided.


fact: Risk Committee of the Board

fact: Global Security Organization

fact: ERM Steering Committee

fact: CSO

fact: Disclosure Committee

reasoning: The paragraph primarily describes the governance structure and reporting lines for cybersecurity, placing it in Board Governance. It reaches Firm-Specific specificity because it names specific internal entities like the 'Global Security Organization', 'ERM Steering Committee', and 'Disclosure Committee', as well as the 'CSO' role.


reasoning: The paragraph describes the Board's direct oversight role and the lack of committee delegation, which is a core Board Governance topic. It contains no domain-specific terminology, firm-unique identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is classified as Strategy Integration because it makes a negative assertion regarding the materiality of past cybersecurity incidents, which falls under the SI materiality rule. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: Federal Financial Institutions Examination Council (FFIEC)

fact: National Institute of Standards and Technology (NIST)

reasoning: The paragraph primarily describes the frameworks (FFIEC and NIST) used to design the company's cybersecurity program, which falls under Risk Management Process. It reaches Domain-Adapted specificity by referencing specific cybersecurity frameworks and the CIA triad (confidentiality, integrity, and availability), which demonstrates domain expertise beyond generic risk management language.


fact: internal control reports

fact: incident response plans

reasoning: The paragraph is explicitly focused on the management of third-party cybersecurity risks, making it a clear Third-Party Risk category. It reaches Domain-Adapted specificity by referencing specific cybersecurity-relevant mechanisms like 'internal control reports' and 'incident response plans' rather than just generic risk management language.


fact: February 16, 2022

fact: cybersecurity intrusion

reasoning: The paragraph is classified as Incident Disclosure because it describes a specific, real-world cybersecurity event (the February 16, 2022 intrusion) and the company's response to it. It reaches the Quantified-Verifiable level of specificity because it cites a specific calendar date for the incident.


fact: cybersecurity incident response plan

fact: ransomware

fact: generative AI

reasoning: The paragraph is primarily a forward-looking risk disclaimer and a cross-reference to Item 1A, which falls under None/Other. It achieves Domain-Adapted specificity by referencing specific cybersecurity concepts like 'cybersecurity incident response plan', 'ransomware', and 'generative AI'.


reasoning: The paragraph focuses exclusively on the company's approach to managing third-party cybersecurity risks, fitting the Third-Party Risk category. It lacks specific domain terminology, firm-unique identifiers, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: October 11, 2023

fact: disruption of our business operations for approximately three days

fact: fulfill our backlog of orders caused by the operational disruption within one week

reasoning: The paragraph is classified as Incident Disclosure because it details a specific cybersecurity event, including the date of occurrence, the duration of the operational disruption, and the recovery timeline. The specificity is Quantified-Verifiable due to the inclusion of these precise dates and timeframes.


reasoning: The paragraph primarily functions as a negative assertion regarding the material impact of cybersecurity risks on the company's business strategy and financial condition, which falls under Strategy Integration. It contains no specific cybersecurity domain terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: requires its critical vendors to implement, cybersecurity and data protection measures

fact: inform MetLife, Inc., of any actual or reasonably suspected data security incident

reasoning: The paragraph is primarily about the contractual cybersecurity requirements imposed on the Custodian and its vendors, making it a Third-Party Risk disclosure. It is Firm-Specific because it explicitly names MetLife, Inc. as the entity to be notified in the event of an incident.


fact: Chief Information Officer

reasoning: The paragraph focuses on the reporting lines and responsibilities of the CSO and their interaction with the CIO and senior management, which is a Management Role. It is classified as Firm-Specific because it identifies specific leadership roles (CSO, Chief Information Officer) involved in the cybersecurity governance structure.


fact: Operational Risk Committees

fact: Enterprise Risk Management Committee

fact: Head of Technology & Operations

fact: Chief Risk Officer

fact: Information Security and Data Management Committee

fact: Chief Technology Officer

fact: second LOD

reasoning: The paragraph is primarily focused on the organizational structure of management, detailing the specific committees and executive roles responsible for cybersecurity oversight. It is classified as Firm-Specific because it names specific internal committees and executive titles.


fact: security questionnaires

fact: vendor security programs

reasoning: The paragraph is primarily focused on the company's vendor management process for cybersecurity, making it a Third-Party Risk disclosure. It reaches the Domain-Adapted level by referencing specific cybersecurity practices like 'security questionnaires' and 'vendor security programs' which demonstrate domain expertise beyond generic risk management language.


fact: Audit and Compliance Committee

fact: Director - Information Systems

reasoning: The paragraph primarily describes the board's oversight structure and the committees involved, placing it in Board Governance. It is classified as Firm-Specific because it names a specific committee ('Audit and Compliance Committee') and a specific management role ('Director - Information Systems') that distinguishes the company's governance structure.


reasoning: The paragraph is a standard forward-looking disclaimer regarding potential future risks and cross-references Item 1A, which does not constitute a substantive cybersecurity disclosure under the provided rules. It contains no domain-specific terminology, firm-specific facts, or verifiable claims.


fact: Chief Information Security Officer

fact: Cybersecurity Risk Management Team

reasoning: The paragraph focuses on the organizational structure and specific roles responsible for cybersecurity, making it a Management Role classification. It reaches Firm-Specific specificity by naming the company's specific internal departments and teams (Trust, Security and Reliability department; Cybersecurity Risk Management Team).


reasoning: The paragraph is primarily focused on the responsibilities and role of the Senior Vice President of Information Technology, making it a Management Role classification. It is classified as Firm-Specific because it explicitly names a specific executive role (SVP of IT) which distinguishes the management structure.


fact: managed services agreement

fact: incident response

fact: cybersecurity assessment

fact: firewall maintenance

reasoning: The paragraph is primarily focused on the company's strategy for managing third-party cybersecurity risks, including assessment and monitoring of vendors. It reaches the Domain-Adapted level by referencing specific cybersecurity activities like firewall maintenance and incident response managed services.


fact: CISO

fact: CSBDO

fact: over thirty years of experience

reasoning: The paragraph primarily describes the components and operations of the cybersecurity program, such as incident response and third-party risk management, fitting the Risk Management Process category. It reaches the Quantified-Verifiable level of specificity by citing the CISO's specific years of professional experience.


fact: vendor management process

fact: security assessments

reasoning: The paragraph is centrally focused on the oversight and management of third-party service providers, placing it squarely in Third-Party Risk. It achieves Domain-Adapted specificity by referencing specific cybersecurity-related vendor management activities like 'security assessments' and 'periodic reassessments' rather than just generic risk management language.


reasoning: The paragraph is a cross-reference to Item 1A (Risk Factors) and does not contain substantive cybersecurity disclosure, making it 'None/Other' and 'Generic Boilerplate'.


fact: cybersecurity subcommittee

fact: board enterprise risk committee

fact: more than 20 years of experience

fact: Certified Information Security Manager (CISM)

fact: Senior Vice President – Enterprise Risk Officer

reasoning: The paragraph is primarily focused on the CISO's role, qualifications, and reporting structure, which defines the management organization. It achieves Quantified-Verifiable specificity through the inclusion of specific years of experience and a named professional certification.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity incidents on the company's business strategy and financial condition, which falls under Strategy Integration per Rule 5. It contains no specific cybersecurity domain terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: audit and risk committee

fact: Chief Information Officer

fact: ISMS

fact: information security governance framework

reasoning: The paragraph focuses on the board's oversight structure and reporting lines, placing it squarely in Board Governance. It reaches Firm-Specific specificity because it names a specific committee ('audit and risk committee') and specific leadership roles ('Chief Information Officer', 'Executive Director of Information Security') involved in the governance chain.


fact: forensic reviews

fact: independent security assessments

reasoning: The paragraph describes the company's use of external resources for security activities, which falls under Risk Management Process. It reaches Domain-Adapted specificity by referencing specific cybersecurity activities like forensic reviews and independent security assessments.


reasoning: The paragraph is classified as Strategy Integration because it provides a negative assertion regarding the material impact of cybersecurity incidents on the company's business and financial condition. It contains no specific facts, domain terminology, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: audit rights

reasoning: The paragraph is centrally focused on the management of third-party cybersecurity risks, specifically vendor assessment and audit processes. It reaches Firm-Specific specificity by naming a specific internal team, 'Information Technology Automated Solutions (ITAS)', responsible for these audits.


reasoning: The paragraph consists entirely of a forward-looking disclaimer regarding potential risks and a cross-reference to the Risk Factors section, which falls under the None/Other category.


fact: contract research organizations

fact: contract manufacturing organizations

reasoning: The paragraph is centrally focused on the management of third-party cybersecurity risks, including vendor due diligence and contractual obligations. While it mentions specific types of vendors (CROs/CMOs), these are standard industry terms for this company's sector rather than unique cybersecurity program identifiers, resulting in a Generic Boilerplate specificity classification.


reasoning: The paragraph is a generic mission statement regarding data protection and does not describe specific governance, management, or risk processes. It is classified as Domain-Adapted because it explicitly references the 'confidentiality, integrity, and availability' (CIA) triad, which is a foundational cybersecurity domain concept.


reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the materiality of past cybersecurity incidents on the company's business and financial condition. It is Generic Boilerplate because it contains no domain-specific terminology, firm-specific organizational details, or verifiable facts.


fact: February 2022

fact: targeted cyber-attack

fact: cybersecurity incident response plan

fact: Chief Information Security Officer (CISO)

fact: CSRM program

reasoning: The paragraph is primarily an Incident Disclosure because it details a specific past cyber-attack, its operational impact, and the company's response. It is classified as Firm-Specific because it names a specific internal program (CSRM) and the addition of a CISO role, which are distinguishing organizational facts.


reasoning: The paragraph describes the board's oversight role and reporting cadence, which is standard governance disclosure. It contains no domain-specific terminology, firm-unique identifiers, or verifiable claims, resulting in a Generic Boilerplate classification.


fact: Chief Operating Officer

reasoning: The paragraph identifies a specific management role (Chief Operating Officer) responsible for cybersecurity oversight, which falls under Management Role. The specificity is Firm-Specific because it names a specific executive title (COO) as the oversight authority.


fact: ransomware

fact: exfiltrated personal information

reasoning: The paragraph describes the nature and response to an actual cybersecurity incident (ransomware and data exfiltration), placing it squarely in Incident Disclosure. It is classified as Domain-Adapted because it uses specific cybersecurity terminology ('ransomware', 'exfiltrated') that goes beyond generic risk management language.


reasoning: The paragraph is a cross-reference to Item 1A and contains no substantive cybersecurity disclosure, thus falling under None/Other and Generic Boilerplate.


fact: security questionnaires

fact: vulnerability scans

reasoning: The paragraph is primarily focused on the company's approach to managing cybersecurity risks posed by third-party service providers, fitting the Third-Party Risk category. It reaches Domain-Adapted specificity by referencing specific cybersecurity practices like 'security questionnaires' and 'vulnerability scans' in the context of vendor oversight.


reasoning: The paragraph consists of generic statements about investing in cybersecurity and internal controls without describing specific processes or governance, and it concludes with a cross-reference to Item 1A, which is explicitly excluded from substantive classification.


reasoning: The paragraph is a standard negative assertion regarding the materiality of past cybersecurity incidents, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: Board's Cybersecurity Special Committee

reasoning: The paragraph primarily describes the company's incident response methodology, which falls under Risk Management Process. It is classified as Firm-Specific because it names a specific internal governance body, the 'Board's Cybersecurity Special Committee,' which distinguishes it from generic oversight descriptions.


fact: self-attestation questionnaires

fact: Service Organization Controls (SOC) reports

fact: Vendor Management team

reasoning: The paragraph is centrally focused on the oversight and management of third-party service providers, fitting the Third-Party Risk category. It reaches Firm-Specific specificity because it identifies a specific internal entity, the 'Vendor Management team,' responsible for these processes.


reasoning: The paragraph is classified as Strategy Integration because it explicitly provides a negative assertion regarding the material impact of cybersecurity incidents on the company's business strategy and financial condition. It is classified as Generic Boilerplate because negative assertions about the absence of material incidents are not externally verifiable, and the text contains no other specific domain terminology or firm-unique facts.


fact: CIO has more than 30 years of experience

fact: CISO has more than 20 years of cybersecurity experience

fact: Certified Information Systems Auditor

fact: Certified Information Security Manager

fact: Certified Information Systems Security Professional

fact: Aegon N.V.

fact: Citigroup, Inc.

fact: JP Morgan Chase & Company

fact: Brighthouse Financial

fact: GE Healthcare

fact: Allstate Insurance Company

reasoning: The paragraph focuses on the qualifications, career history, and credentials of the company's leadership (CIO and CISO), placing it in Management Role. It reaches Quantified-Verifiable specificity due to the inclusion of specific years of experience, named past employers, and verifiable professional certifications.


reasoning: The paragraph serves as an introduction to the company's risk management principles, placing it in the Risk Management Process category. It is classified as Domain-Adapted because it references the 'confidentiality, integrity, and availability' (CIA) triad, which is a foundational cybersecurity domain concept.


fact: internal controls and financial condition of a third-party vendor

reasoning: The paragraph is centrally focused on the company's procedures for evaluating and managing third-party vendor risks, fitting the Third-Party Risk category. It reaches Domain-Adapted specificity by referencing specific cybersecurity-relevant evaluation criteria like 'internal controls' and 'network' access in the context of vendor risk management.


fact: incident response plan

fact: prioritization guidelines

fact: data collection and evidence handling

reasoning: The paragraph describes the components and operational methodology of the company's incident response program, which falls under Risk Management Process. It reaches Domain-Adapted specificity by referencing specific cybersecurity operational concepts like 'data collection and evidence handling' and 'prioritization guidelines' within an incident response context.


fact: IS Steering Committee

fact: Chief Information Officer

reasoning: The paragraph is primarily focused on the company's vendor management program and the risks associated with third-party service providers, making Third-Party Risk the most appropriate category. It reaches Firm-Specific specificity because it names a specific internal body, the 'IS Steering Committee', and a specific leadership role, the 'Chief Information Officer', involved in that oversight.


fact: Chief Technology and Digital Officer

fact: Senior Vice President, Technology

fact: over 10 and 25 years, respectively, of networking and information technology management or executive experience

fact: Cybersecurity Committee

reasoning: The paragraph is primarily about management roles, specifically the leadership of the Chief Technology and Digital Officer and the SVP of Technology, and the structure of the Cybersecurity Committee. It reaches the Quantified-Verifiable level because it provides specific years of experience for the named officers.


reasoning: The paragraph is entirely focused on the company's procedures for managing third-party vendor risks, such as due diligence and contractual requirements. It lacks specific domain terminology, firm-unique details, or verifiable claims, making it Generic Boilerplate.


fact: Enterprise Risk Management Committee

fact: Chief Risk Officer

fact: Information Systems Audit

fact: penetration test

reasoning: The paragraph is primarily about the activities of the cybersecurity program (audits, penetration testing, risk assessments), which falls under Risk Management Process. It reaches Firm-Specific level because it names a specific management committee (Enterprise Risk Management Committee) and specific executive roles (CIO, CRO) involved in the oversight of these processes.


fact: February 16, 2022

fact: February 2022 cybersecurity intrusion

reasoning: The paragraph is classified as Incident Disclosure because it describes a specific, real-world cybersecurity event that occurred on February 16, 2022. The specificity is Quantified-Verifiable due to the inclusion of this specific date.


reasoning: The paragraph describes the board's oversight structure and reporting lines, which falls under Board Governance. It contains no domain-specific terminology, firm-specific entities, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: penetration testing

fact: vendor management group

reasoning: The paragraph is primarily focused on the oversight and assessment of third-party service providers, making Third-Party Risk the correct category. It reaches Firm-Specific specificity because it identifies a specific internal entity, the 'vendor management group,' which distinguishes the company's organizational structure.


fact: Vice President and Chief Information Officer

fact: Chief Information Security Officer

fact: Cybersecurity Executive Committee

fact: 27 years of cybersecurity experience

fact: 17 of which are in the oil and gas industry

fact: one of less than 400 CISOs globally that has graduated from the FBI's CISO Academy

reasoning: The paragraph is primarily about the management structure, reporting lines, and qualifications of the cybersecurity leadership team, fitting the Management Role category. It reaches Quantified-Verifiable specificity due to the inclusion of specific years of experience and the verifiable claim regarding the CISO's graduation from the FBI's CISO Academy.


fact: February 13, 2023

fact: secure file transfer software platform

reasoning: The paragraph is classified as Incident Disclosure because it details a specific, real-world security breach event. It reaches the Quantified-Verifiable level of specificity due to the inclusion of the specific disclosure date (February 13, 2023).


fact: CISO

fact: certificate in Cybersecurity Oversight from the Carnegie Mellon University Software Engineering Institute

fact: cyber threat detection and response

fact: security engineering

reasoning: The paragraph focuses on the management structure, specifically the CISO's role and qualifications, making it a Management Role category. It reaches Quantified-Verifiable specificity because it cites a specific, verifiable certification held by the CISO.


fact: malware

fact: computer virus attacks

reasoning: The paragraph is classified as Strategy Integration because it explicitly states that cybersecurity risks have not materially affected the company's business strategy or financial condition. It is Domain-Adapted because it references specific threat types like 'malware' and 'computer virus attacks', which demonstrate cybersecurity domain knowledge beyond generic risk language.


fact: Audit and Risk Committee

reasoning: The paragraph describes the governance structure and reporting lines between management (CISO) and the Board/Committee, making it Board Governance. It is Firm-Specific because it identifies the specific committee ('Audit and Risk Committee') and the specific role ('CISO') involved in the oversight process.


fact: ISO 27001 compliance certification

reasoning: The paragraph describes the integration of cybersecurity policies and tools following a merger, which is a risk management activity. It reaches the Domain-Adapted level by referencing the ISO 27001 framework, which demonstrates cybersecurity domain expertise.


reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the materiality of cybersecurity risks on the company's business and financial condition. It is classified as Generic Boilerplate because it contains no domain-specific terminology, firm-specific details, or verifiable facts.


fact: ransomware attacks

fact: phishing attacks

fact: insider threats

fact: third-party attacks

reasoning: The paragraph is primarily about the company's risk management process, specifically identifying the types of threats they monitor and their disaster recovery process. It reaches the Domain-Adapted level by explicitly naming specific cybersecurity threat vectors (ransomware, phishing, insider threats) that demonstrate domain expertise beyond generic risk language.


reasoning: This paragraph is a cross-reference to another section of the filing (Item 1A) and contains no substantive cybersecurity disclosure, thus falling under None/Other and Generic Boilerplate.


reasoning: The paragraph consists entirely of generic, forward-looking statements about the company's exposure to cyber risks and the importance of security, without describing any specific governance, management, or risk management processes.


reasoning: The paragraph focuses exclusively on the oversight of third-party vendors and their systems, making Third-Party Risk the primary category. It lacks any specific domain terminology, firm-unique details, or verifiable claims, resulting in a Generic Boilerplate specificity level.