reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the materiality of past cybersecurity incidents on the company's business strategy and financial condition. It is Generic Boilerplate because it contains no domain-specific terminology, firm-specific facts, or verifiable claims.


content_category: None/Other

category_confidence: high

specificity_confidence: high

reasoning: The paragraph describes the company's status as a blank check company with no operations or internal cybersecurity program, which constitutes a disclaimer rather than a substantive disclosure of governance, management, or risk management processes.

provider: google

stage: benchmark


content_category: Risk Management Process

fact: phishing attempt

fact: phishing security test

reasoning: The paragraph describes specific cybersecurity risk management activities, specifically employee training and phishing simulations. It is classified as Domain-Adapted because it references specific cybersecurity practices like phishing tests that go beyond generic enterprise risk management language.


fact: cyber risk advisory

reasoning: The paragraph is classified as Risk Management Process because it describes the company's reliance on third-party consultants and technology as a component of its internal risk management strategy. It reaches Domain-Adapted specificity by referencing 'cyber risk advisory,' a specific cybersecurity service area that passes the ERM test.


content_category: Management Role

fact: Steering Committee

fact: cyber incident response plan

fact: third-party assessments

reasoning: The paragraph describes the responsibilities and oversight activities of a management-level 'Steering Committee,' which falls under Management Role. It reaches Firm-Specific specificity because it identifies a named management committee ('Steering Committee') and includes domain-specific terminology like 'cyber incident response plan' and 'prevention, detection, mitigation, and remediation'.


content_category: Third-Party Risk

fact: third-party risk management program

fact: vendor due diligence questionnaires

fact: vendor incident response procedures

reasoning: The paragraph is centrally focused on the company's third-party risk management program, including vendor assessments and due diligence. It reaches the Domain-Adapted level by referencing specific cybersecurity-related vendor management practices like 'vendor due diligence questionnaires' and 'vendor incident response procedures,' which demonstrate domain expertise beyond generic risk management language.


content_category: Board Governance

reasoning: The paragraph is primarily focused on the reporting structure and oversight cadence (Board/Audit Committee notification and briefing), which falls under Board Governance. It contains no domain-specific terminology, firm-specific entities, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: CTO

fact: CISO

reasoning: The paragraph focuses on the qualifications and roles of management personnel (CTO, CISO, and internal working group), fitting the Management Role category. It is classified as Firm-Specific because it explicitly names the CTO and CISO roles, which are specific management positions.


fact: CCDC

reasoning: The paragraph focuses on the company's vendor management program and oversight of third-party risks, placing it squarely in the Third-Party Risk category. It is classified as Firm-Specific because it references the 'CCDC' (a named internal committee), which distinguishes the company's governance structure.


reasoning: The paragraph describes a company with no internal cybersecurity operations (a common disclosure for SPACs or shell companies), which does not constitute a substantive cybersecurity program, governance structure, or risk management process. As it lacks any specific cybersecurity measures or domain-specific terminology, it is classified as None/Other and Generic Boilerplate.


fact: integrated into our overall enterprise risk management program

fact: assessments designed to help identify material cybersecurity risks

fact: security controls

fact: response to cybersecurity incidents

reasoning: The paragraph describes the components and integration of the company's cybersecurity program, placing it squarely in Risk Management Process. It reaches Domain-Adapted specificity by referencing specific cybersecurity concepts like 'security controls' and 'response to cybersecurity incidents' rather than just generic risk management language.


reasoning: This paragraph is a generic statement about data collection that does not describe governance, management, risk processes, or specific incidents, and thus falls under None/Other. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


content_category: Strategy Integration

reasoning: The paragraph is classified as Strategy Integration because it makes a negative assertion about the company's history of material cybersecurity incidents, which is a standard materiality assessment. It is Generic Boilerplate because it contains no domain-specific terminology, firm-specific organizational details, or verifiable facts.


fact: CROs

reasoning: The paragraph is centrally focused on the management of cybersecurity risks posed by third parties, fitting the Third-Party Risk category. It is classified as Firm-Specific because it explicitly identifies 'CROs' (Contract Research Organizations) as a specific category of third-party risk, which is a unique detail relevant to the company's specific business context.


content_category: Incident Disclosure

fact: December 2022

fact: containment protocols

fact: forensics experts

reasoning: The paragraph describes a specific cybersecurity incident that occurred in December 2022, including the company's response and impact assessment, which directly answers the question of what happened in an incident. The inclusion of the specific date (December 2022) makes it Quantified-Verifiable.


fact: Cybersecurity Program Manager

fact: vendor management policy

reasoning: The paragraph is centrally focused on the company's approach to managing cybersecurity risks associated with third-party vendors. It is classified as Firm-Specific because it identifies a specific internal role, the 'Cybersecurity Program Manager,' and a specific internal policy, the 'vendor management policy.'


fact: ransomware

fact: denial-of service

reasoning: The paragraph is primarily a forward-looking disclaimer about the general importance of cybersecurity and the potential impact of threats, which falls under None/Other as it does not describe a specific governance structure, management role, or risk management process. It reaches Domain-Adapted specificity by explicitly naming specific cybersecurity threat types (ransomware, denial-of-service).


fact: Audit Committee of the Board of Directors

reasoning: The paragraph describes the board's oversight structure, specifically delegating cybersecurity risk oversight to the Audit Committee, which falls under Board Governance. It is classified as Firm-Specific because it identifies the specific committee (Audit Committee) tasked with this oversight, which distinguishes the governance structure.


reasoning: The paragraph is a standard, hypothetical risk factor disclaimer describing potential consequences of cybersecurity incidents without detailing any specific governance, management, or operational processes. As it contains no substantive cybersecurity program details or verifiable facts, it is classified as None/Other and Generic Boilerplate.


reasoning: The paragraph describes the responsibilities of the management team regarding cybersecurity oversight and framework maintenance, fitting the Management Role category. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: This paragraph serves solely as a cross-reference to the Risk Factors section (Item 1A) and contains no substantive cybersecurity disclosure.


reasoning: The paragraph is explicitly focused on the company's approach to managing third-party service provider risks, fitting the Third-Party Risk category. It lacks specific domain terminology, firm-unique details, or verifiable claims, relying instead on generic descriptions of vendor oversight processes.


reasoning: The paragraph focuses on the assessment of third-party vendors, which falls under Third-Party Risk. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: 26 BTC

type: quantified

fact: US Federal law enforcement

reasoning: The paragraph describes a specific cybersecurity incident (a business email compromise leading to theft of funds), making it Incident Disclosure. It is Quantified-Verifiable because it includes specific amounts of stolen assets (26 BTC, $560,000) and references engagement with a specific external entity (US Federal law enforcement).


fact: IASME Cyber Essentials framework

type: framework

fact: UK government Cyber Security NCSC

fact: NIST framework

reasoning: The paragraph describes the company's risk management methodology and the specific cybersecurity frameworks (IASME, ISO 27001, NIST) it utilizes, which qualifies as Risk Management Process. The specificity is Domain-Adapted because it references specific cybersecurity frameworks that demonstrate domain expertise beyond generic risk management language.


reasoning: This paragraph serves solely as a cross-reference to the Risk Factors section (Item 1A) and contains no substantive information regarding the company's cybersecurity program, governance, or management.


reasoning: The paragraph is a generic introductory statement regarding the importance of cybersecurity and potential risks, containing no substantive information about the company's specific governance, management, or operational processes.


reasoning: The paragraph is classified as Strategy Integration because it explicitly states that cybersecurity incidents have not materially impacted the company's business strategy or financial condition. It is Domain-Adapted because it references specific cybersecurity concepts like 'ransomware' that pass the ERM test.


fact: email spoofing effort

reasoning: The paragraph describes a specific cybersecurity incident (email spoofing) that occurred in May 2014, making it an Incident Disclosure. It reaches the Quantified-Verifiable level because it includes a specific date (May 2014) associated with a real event.


fact: Chief Information Security Officer

reasoning: The paragraph is primarily about the governance structure, specifically identifying the oversight role of the Audit Committee and the management role of the CISO. It is classified as Firm-Specific because it explicitly names the 'Chief Information Security Officer' role, which distinguishes the management structure.


fact: insider threat controls

fact: data loss

reasoning: The paragraph describes specific cybersecurity program activities (insider threat controls, data loss prevention), placing it in Risk Management Process. It reaches Domain-Adapted specificity by referencing specific cybersecurity concepts like 'insider threat controls' and 'data loss' that go beyond generic enterprise risk management language.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity incidents on the company's business strategy and financial condition, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph primarily describes the governance structure, specifically the oversight role of the Audit Committee and the reporting lines to the Board, which falls under Board Governance. It reaches Firm-Specific specificity because it identifies a specific leadership role ('vice president of information technology services') responsible for the program.


reasoning: The paragraph serves primarily as a cross-reference to the Risk Factors section and provides only generic statements about IT dependency, containing no substantive cybersecurity program or governance details.


fact: forensic investigation

fact: automated off-boarding and access-revocation processes

fact: 24/7 SIEM/SOC monitoring

fact: 24/7 security operations

fact: identity and domain anomalies

fact: DNS

reasoning: The paragraph describes remediation actions taken in response to a specific incident, making it Incident Disclosure. It reaches Firm-Specific specificity because it claims '24/7' security operations, which is a specific organizational claim, alongside several domain-adapted terms like SIEM/SOC and DNS.


reasoning: The paragraph primarily discusses regulatory requirements and points to other sections of the filing, which constitutes a cross-reference and general regulatory context rather than substantive cybersecurity disclosure.


fact: Head of Resources Management

fact: CCO

fact: more than 30 years of overall experience

fact: more than 20 years directly assessing and managing our cyber information technology and human resources systems

fact: more than 15 years managing information technology systems and databases

fact: 15-plus years supporting our Adviser's and Administrator's resource management department

reasoning: The paragraph focuses on identifying specific management roles (Head of Resources Management, CCO) and their qualifications, placing it in Management Role. It reaches Quantified-Verifiable specificity due to the inclusion of specific, verifiable tenure numbers (e.g., 'more than 20 years', '15-plus years') associated with these roles.


fact: managed service providers

fact: system scans

fact: threat intelligence analysis

reasoning: The paragraph primarily describes the operational components of the cybersecurity program, including training and the use of third-party services for specific security activities like scanning and threat intelligence. It is classified as Risk Management Process because these activities are central to the program's operation, and it reaches Domain-Adapted specificity by referencing specific cybersecurity practices like threat intelligence analysis and system scanning.


reasoning: The paragraph describes generic, non-specific intentions to meet and assess status without detailing any actual governance structure, management roles, or specific risk management activities. It lacks any domain-specific terminology, firm-specific identifiers, or verifiable facts.


fact: Information Technology Committee

fact: Chief Information Security Officer

fact: penetration test

reasoning: The paragraph is primarily about the Board's oversight structure and the reporting lines of the CISO to the Information Technology Committee, placing it in Board Governance. It is Firm-Specific because it names a specific committee (Information Technology Committee) and a specific role (Chief Information Security Officer) that are not generic board-level entities.


reasoning: This paragraph provides a standard definition of a cybersecurity threat and does not describe any substantive cybersecurity governance, management, or risk management activities.


fact: penetration testing

fact: vulnerability scanning

reasoning: The paragraph describes the company's cybersecurity program activities, specifically training, penetration testing, and vulnerability scanning, which falls under Risk Management Process. It reaches Domain-Adapted specificity by referencing specific cybersecurity practices like penetration testing and vulnerability scanning, which pass the ERM test.


fact: malware

fact: viruses

fact: ransomware

fact: phishing

reasoning: The paragraph describes the company's ongoing efforts to monitor and mitigate cybersecurity risks, which falls under Risk Management Process. It reaches Domain-Adapted specificity by referencing specific threat vectors like malware, ransomware, and phishing, which demonstrate cybersecurity domain knowledge beyond generic risk management language.


fact: email spoofing

reasoning: The paragraph describes a specific cybersecurity incident (email spoofing), including dates, financial impact, and response actions, making it a clear Incident Disclosure. It reaches Quantified-Verifiable specificity due to the inclusion of specific dates and the exact dollar amount lost.


fact: Executive Vice President of Technology

fact: over 16 years of experience

reasoning: The paragraph primarily describes the management structure and responsibilities for cybersecurity, fitting the Management Role category. It reaches Quantified-Verifiable specificity because it cites a specific number of years of experience (16 years) for the Executive Vice President of Technology.


fact: Cybersecurity Committee

fact: ten years of cybersecurity experience

fact: thirty-five years of experience in various technology domains

fact: IT Infrastructure

fact: Cloud

fact: Application Development

reasoning: The paragraph focuses on the organizational structure and responsibilities of management and the Cybersecurity Committee, placing it in Management Role. It reaches Quantified-Verifiable specificity due to the inclusion of specific years of experience (ten and thirty-five) attributed to the senior IT executive.


reasoning: The paragraph provides a negative assertion regarding the materiality of cybersecurity incidents for the fiscal year, which is classified as Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-unique identifiers, or externally verifiable facts, resulting in Generic Boilerplate specificity.


fact: August 2021

fact: January 2023

reasoning: The paragraph is classified as Incident Disclosure because it explicitly describes the nature and impact of two specific, real-world cybersecurity incidents. It reaches the Quantified-Verifiable level of specificity because it cites specific dates (August 2021 and January 2023) associated with these incidents.


reasoning: The paragraph describes the company's reliance on IT systems and data processing but does not detail any specific cybersecurity governance, management, risk processes, or strategy. It is a generic statement of operational reliance that does not meet the threshold for any substantive cybersecurity disclosure category.


reasoning: The paragraph describes the organizational structure and reporting lines for cybersecurity management, placing it in Management Role. It lacks specific cybersecurity domain terminology, unique firm-specific titles (MIS supervisor is a generic IT role), or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: ransomware attack against us in May 2020

fact: cybercriminal removed a copy of a subset of data from our self-hosted environment

reasoning: The paragraph is classified as Incident Disclosure because it describes a specific, real-world cybersecurity event (the May 2020 ransomware attack) and its ongoing consequences. It reaches the Quantified-Verifiable level of specificity because it cites a specific date (May 2020) associated with a verifiable historical event.


reasoning: The paragraph is classified as Strategy Integration because it provides a negative assertion regarding the materiality of cybersecurity risks on the company's financial and operational performance. It is Generic Boilerplate as it lacks any specific domain terminology, firm-unique details, or verifiable facts.


fact: management committee on cybersecurity

fact: prevention, detection, mitigation, and remediation

reasoning: The paragraph focuses on the specific management roles (Senior Director and Head of Information Technology) and the internal committee structure (management committee on cybersecurity) responsible for oversight, fitting the Management Role category. It reaches Firm-Specific specificity due to the inclusion of these specific, non-generic titles and committee names.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity risks on the company's business strategy and financial condition, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific facts, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: Head of Information Technology for Latin America

fact: 25 years of experience

reasoning: The paragraph focuses on the qualifications and responsibilities of a specific management role, placing it in Management Role. It reaches Quantified-Verifiable specificity because it cites a specific number of years of experience (25), which is a verifiable claim.


fact: cyber risk insurance

reasoning: The paragraph discusses cybersecurity insurance, which falls under Strategy Integration as it relates to financial risk mitigation. It is classified as Domain-Adapted because 'cyber risk insurance' is a specific domain term that passes the ERM test, distinguishing it from generic risk management language.


reasoning: This paragraph is a cross-reference to other sections of the filing and contains no substantive cybersecurity disclosure.


reasoning: The paragraph describes the scope and intent of the company's risk management program, fitting the Risk Management Process category. It lacks specific tools, frameworks, or unique organizational details, resulting in a Generic Boilerplate specificity level.


fact: Technology Committee of our Board

fact: Information Security Policy

reasoning: The paragraph focuses on the Board of Directors and the Technology Committee's role in overseeing the information security program, which falls under Board Governance. It is classified as Firm-Specific because it names a specific board-level committee (Technology Committee) responsible for policy approval.


fact: vulnerability management

reasoning: The paragraph is primarily about the governance structure (reporting lines to the Audit Committee), which defaults to Board Governance. It reaches Domain-Adapted specificity because it explicitly mentions 'vulnerability management,' a specific cybersecurity practice that passes the ERM test.


reasoning: The paragraph provides a negative assertion regarding the materiality of past incidents and a forward-looking statement regarding future material impact, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in Generic Boilerplate specificity.


fact: Chief Operating Officer

fact: Chief Compliance Officer

reasoning: The paragraph is categorized as Management Role because it explicitly details the responsibilities and expertise of specific management positions regarding cybersecurity. It is classified as Firm-Specific because it identifies the Chief Operating Officer and Chief Compliance Officer as the key management roles responsible for these risks.


fact: October 28, 2023

fact: mid-December 2023

fact: $1.5 million

reasoning: The paragraph is primarily an Incident Disclosure because it details a specific past cybersecurity event, its timeline, and its operational and financial impact. It reaches Quantified-Verifiable specificity due to the inclusion of specific dates and a precise dollar amount of expenses incurred.


fact: $1.5 million of expenses

reasoning: The paragraph is primarily an Incident Disclosure because it details a specific past cybersecurity event, its timeline, and its financial impact. It reaches the Quantified-Verifiable level of specificity due to the inclusion of specific dates and a precise dollar amount of expenses incurred.


reasoning: The paragraph consists entirely of generic risk disclosure boilerplate and definitions of cybersecurity threats, lacking any substantive description of governance, management, or operational processes. Per the instructions, None/Other paragraphs are classified as Generic Boilerplate.


fact: CISO

fact: joined Workday in 2010

fact: served as our CISO since April 2018

fact: more than 15 years of experience

reasoning: The paragraph is primarily about the CISO's role, responsibilities, and qualifications, fitting the Management Role category. It reaches the Quantified-Verifiable level because it includes specific, verifiable dates (joined 2010, CISO since 2018) and a quantified duration of experience (more than 15 years).


fact: ISIRP

fact: System and Organization Control reports

fact: risk based re-assessment of high inherent-risk third-party providers

reasoning: The paragraph is primarily focused on the management of third-party cybersecurity risks, including due diligence, contractual requirements, and ongoing monitoring. It reaches the Domain-Adapted level by referencing specific cybersecurity-relevant assessment mechanisms like 'System and Organization Control reports' and 'risk based re-assessment' of high-risk providers.


fact: penetration testing

fact: managed detection and response services

fact: intrusion prevention and detection applications

reasoning: The paragraph is primarily about the company's internal cybersecurity program activities (testing, monitoring, vendor oversight), making it Risk Management Process. It reaches Domain-Adapted specificity by referencing specific cybersecurity practices and tools like penetration testing, managed detection and response, and intrusion prevention applications.


reasoning: The paragraph describes the board's oversight structure and delegation of cybersecurity risk to the Audit Committee, which is the primary focus of Board Governance. It contains no domain-specific terminology, firm-specific entities, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is classified as Strategy Integration because it makes a negative assertion regarding the materiality of past cybersecurity incidents on the company's business and financial condition. It is considered Generic Boilerplate because it contains no domain-specific terminology, firm-specific organizational details, or externally verifiable facts.


fact: December 13, 2023

fact: November 20, 2023

fact: malware

fact: exfiltrated

reasoning: The paragraph describes the timeline, nature, and scope of a specific cybersecurity incident, clearly falling under Incident Disclosure. It reaches Quantified-Verifiable specificity due to the inclusion of specific calendar dates regarding the investigation and unauthorized activity.


reasoning: The paragraph primarily describes the governance structure and reporting lines between the Audit Committee and the Board of Directors, which falls under Board Governance. It contains no specific, verifiable, or domain-unique facts, resulting in a Generic Boilerplate classification.


fact: Chief Technology Officer ("CTO")

fact: Chief Information Security Officer ("CISO")

fact: vulnerability assessments

fact: third-party and independent reviews

reasoning: The paragraph primarily describes the board's oversight structure and the flow of information from management to the Audit Committee, placing it in Board Governance. It reaches Firm-Specific specificity because it explicitly names the CISO and CTO as the individuals reporting to the committee.


reasoning: The paragraph is primarily composed of standard risk factor boilerplate regarding potential future threats and a negative assertion about past incidents, which does not constitute a substantive cybersecurity disclosure. It lacks specific details about governance, management, or operational processes.


reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the materiality of cybersecurity risks on the company's business strategy and financial condition. It is Generic Boilerplate because it contains no domain-specific terminology, firm-unique facts, or verifiable claims.


reasoning: The paragraph is classified as Strategy Integration because it makes a negative assertion regarding the material impact of cybersecurity risks on the company's business strategy and financial condition. It is Generic Boilerplate because it contains no domain-specific terminology, firm-specific organizational details, or externally verifiable facts.


reasoning: The paragraph describes the timeline, nature, and scope of a specific cybersecurity incident, clearly falling under Incident Disclosure. It reaches Quantified-Verifiable specificity due to the inclusion of specific, verifiable dates regarding the investigation and the unauthorized activity.


fact: unauthorized changes to our domain, DNS, and email configurations

fact: administrative credentials retained by a former employee

reasoning: The paragraph describes a specific cybersecurity incident (unauthorized configuration changes in May 2025), making it an Incident Disclosure. It reaches Quantified-Verifiable specificity because it provides a specific date (May 2025) for a real event.


reasoning: The paragraph is centrally focused on the oversight and contractual requirements of third-party service providers, placing it squarely in Third-Party Risk. It lacks specific domain terminology, firm-specific details, or verifiable claims, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is centrally focused on the oversight of third-party vendors, placing it in the Third-Party Risk category. It achieves Domain-Adapted specificity by explicitly mentioning 'System and Organization Controls reports,' which is a specific cybersecurity audit standard.


reasoning: The paragraph primarily describes the governance structure for cybersecurity oversight, specifically identifying the Board's role and the existence of a dedicated 'Risk Committee of the Board of Directors,' which qualifies as a firm-specific fact.


reasoning: The paragraph focuses on the company's approach to managing third-party vendor risks, making 'Third-Party Risk' the primary category. It contains no specific domain terminology, firm-specific details, or verifiable facts, resulting in a 'Generic Boilerplate' specificity level.


fact: Chief Information Officer (CIO)

fact: more than 20 years of experience

fact: operational technology

reasoning: The paragraph focuses on the responsibilities and qualifications of the Chief Information Officer, making Management Role the primary category. It reaches Quantified-Verifiable specificity due to the specific, verifiable claim regarding the CIO's years of experience.


fact: Third Party Program

reasoning: The paragraph is explicitly about third-party risk management, making it a clear fit for the Third-Party Risk category. It is classified as Firm-Specific because it names a specific internal program ('Third Party Program') rather than just discussing the concept of third-party risk in the abstract.


reasoning: The paragraph describes the delegation of cybersecurity oversight from the Board to the Audit Committee, which is a classic Board Governance topic. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is a negative assertion regarding the occurrence of material cybersecurity incidents, which falls under Strategy Integration per the materiality rule. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is classified as Strategy Integration because it makes a negative assertion regarding the materiality of past cybersecurity incidents. It is Generic Boilerplate because negative assertions about the absence of material incidents are not externally verifiable, and the remainder of the text consists of standard risk disclaimers and cross-references.


reasoning: This paragraph is a generic introductory statement regarding the importance of cybersecurity and does not contain substantive details about governance, management, or specific risk processes.


fact: National Institute of Standards and Technology Cybersecurity Framework (NIST CSF)

reasoning: The paragraph describes the framework used to guide the company's cybersecurity program, which is a core component of the Risk Management Process. It reaches Domain-Adapted specificity by explicitly referencing the NIST CSF, which demonstrates cybersecurity domain knowledge beyond generic risk management language.


fact: vulnerability scanning

fact: PCI DSS

fact: network assessments

fact: penetration testing

reasoning: The paragraph describes specific cybersecurity activities (vulnerability scanning, penetration testing) that constitute the company's risk management process. It is classified as Domain-Adapted because it references specific security practices and standards (PCI DSS) that demonstrate cybersecurity expertise beyond generic risk management language.


fact: CISO

fact: Executive Steering Committee

fact: Executive Vice President, Engineering

fact: Senior Director, IT

reasoning: The paragraph is primarily about the organizational structure and roles responsible for cybersecurity, specifically detailing the CISO's coordination with the Executive Steering Committee and its members. It reaches Firm-Specific specificity because it names specific leadership roles (CISO, Executive Vice President, Engineering, Senior Director, IT) and a specific internal committee (Executive Steering Committee).


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity risks on the company's business strategy and financial condition, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: Audit and Risk Committee

reasoning: The paragraph primarily describes the board's oversight structure and the reporting relationship between the CISO and the Audit and Risk Committee, which falls under Board Governance. It is classified as Firm-Specific because it identifies the specific committee responsible for oversight ('Audit and Risk Committee') and the specific role ('CISO') reporting to it.


fact: layered security model

reasoning: The paragraph describes the company's approach to cybersecurity risk management, specifically mentioning a 'layered security model' and the 'confidentiality, integrity, and availability' triad, which are domain-specific concepts that pass the ERM test.


fact: vulnerability assessments

fact: threat environment

reasoning: The paragraph primarily describes the board's oversight structure and reporting lines, placing it in Board Governance. It reaches Domain-Adapted specificity by referencing specific cybersecurity concepts like 'vulnerability assessments' and 'threat environment' which pass the ERM test.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity incidents on the company's business and financial condition, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific facts, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: over 30 years of industry experience

fact: Zero Trust Architecture

fact: VisaNet

fact: President of Technology

reasoning: The paragraph focuses on the qualifications, tenure, and responsibilities of specific management roles (CISO and President of Technology), making it a Management Role classification. It reaches Quantified-Verifiable specificity due to the inclusion of specific tenure durations (e.g., 'over 30 years') and named proprietary systems/architectures.


fact: service organization controls reports

fact: Risk Management, Legal and/or Information Security Departments

reasoning: The paragraph is centrally focused on the management of third-party cybersecurity risks, specifically detailing the oversight program and the departments involved in vendor review. It reaches the Firm-Specific level by naming the specific internal departments (Risk Management, Legal, and Information Security) involved in the review process.


reasoning: The paragraph describes the Board's oversight structure and the delegation of cybersecurity risk oversight to the Audit Committee, which is a classic Board Governance topic. It contains no specific, domain-adapted, or verifiable facts, relying entirely on generic boilerplate language.


fact: Chief Compliance Officer

reasoning: The paragraph focuses on the oversight of third-party cybersecurity risks, making 'Third-Party Risk' the primary category. It is classified as 'Firm-Specific' because it identifies a specific internal role, the 'Chief Compliance Officer', involved in this oversight.


reasoning: The paragraph provides a standard negative assertion regarding the material impact of cybersecurity incidents on the company's business and financial condition, which is classified as Strategy Integration. It contains no specific, domain-adapted, or verifiable facts, resulting in a Generic Boilerplate classification.


reasoning: The paragraph describes ongoing efforts to develop cybersecurity processes and response plans, which falls under Risk Management Process. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: posture and intelligence reviews

reasoning: The paragraph is centrally focused on the oversight and assessment of third-party vendors, placing it in the Third-Party Risk category. It achieves Domain-Adapted specificity by referencing specific cybersecurity practices such as 'open-source intelligence risk assessments' and 'posture and intelligence reviews,' which demonstrate domain expertise beyond generic risk management language.


fact: cyber liability insurance policy

reasoning: The paragraph is classified as Strategy Integration because it explicitly addresses the materiality of cybersecurity incidents on the company's operations and financial standing. It is Domain-Adapted because it references a 'cyber liability insurance policy,' which is a specific cybersecurity-related financial instrument, rather than generic risk management language.


reasoning: The paragraph provides a negative assertion regarding the materiality of cybersecurity incidents on the company's business strategy and financial condition, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: threat intelligence

reasoning: The paragraph describes the management team's oversight responsibilities and supervisory activities, fitting the Management Role category. It reaches Domain-Adapted specificity by referencing 'threat intelligence,' which is a specific cybersecurity domain concept.


fact: CISO

fact: more than 20 years of experience

fact: RACC

fact: CRO

fact: application and product security

fact: cyber defense

reasoning: The paragraph is primarily focused on the management structure, specifically the CISO's role, qualifications, and reporting lines to the RACC (Risk and Compliance Committee). It reaches the highest specificity level because it includes a verifiable claim regarding the CISO's years of experience ('more than 20 years').


fact: Cyber Risk Committee

fact: CIO

fact: more than twenty years of experience

fact: since 2007

fact: virtual Chief Information Security Officer

reasoning: The paragraph primarily describes the management structure, specifically the Cyber Risk Committee and the role and qualifications of the CIO. It reaches Quantified-Verifiable specificity due to the inclusion of verifiable claims regarding the CIO's tenure and years of experience.


reasoning: The paragraph provides a generic statement about reliance on technology and third parties without describing specific risk management processes, governance structures, or actual incidents, making it boilerplate disclosure.


reasoning: The paragraph describes the existence of risk management processes and reliance on third-party systems, which falls under Risk Management Process. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is primarily about the Board's oversight structure and responsibilities, fitting the Board Governance category. It reaches Firm-Specific specificity because it explicitly mentions the CISO, a named security-specific leadership role.


fact: Chief Financial Officer is the primary person in our company responsible for overseeing the cybersecurity risk management program

fact: second half of 2021

reasoning: The paragraph is primarily about the management structure and the specific individual (CFO) responsible for cybersecurity oversight, fitting the Management Role category. It reaches Firm-Specific specificity because it identifies a specific executive role (CFO) as the primary owner of the program and provides a specific start date for that oversight.


reasoning: The paragraph describes the Board's oversight role and the involvement of the Audit Committee, which falls under Board Governance. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: Chief Information Security Officer ("CISO")

fact: Chief Information Officer ("CIO")

fact: Technology and Operations Committee

fact: Management Committee

reasoning: The paragraph focuses on the organizational structure of the cybersecurity function, specifically detailing reporting lines for the CISO and the membership/responsibilities of the Technology and Operations Committee. It is classified as Firm-Specific because it names specific internal committees and executive roles.


reasoning: This paragraph consists entirely of generic risk disclaimers regarding the potential costs and consequences of cybersecurity incidents, without describing any specific governance, management, or operational processes. It does not meet the threshold for any substantive category.


reasoning: The paragraph is primarily focused on the company's reliance on and management of third-party service providers, making Third-Party Risk the most appropriate category. It contains no domain-specific terminology, firm-specific identifiers, or verifiable claims, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is a cross-reference to the Risk Factors section and contains generic, speculative language about potential business impacts, which does not constitute substantive cybersecurity disclosure.


fact: Chief Information Security Officer (CISO)

reasoning: The paragraph focuses on the organizational structure and leadership of the security team, specifically the CISO role, which falls under Management Role. It is classified as Firm-Specific because it identifies a specific leadership role (CISO) that distinguishes the company's management structure.


reasoning: The paragraph is primarily focused on the management of cybersecurity threats related to third-party service providers, placing it in the Third-Party Risk category. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: engaged a third-party technology firm to conduct an annual cyber risk assessment

fact: engaged an independent cyber security firm to conduct a more comprehensive assessment

reasoning: The paragraph describes the company's specific activities regarding risk assessment and system upgrades, which falls under Risk Management Process. It is classified as Firm-Specific because it details specific engagements with third-party firms for assessments in 2024 and 2025, which distinguishes these actions from generic boilerplate.


reasoning: The paragraph is a generic introductory statement about the company's business and commitment to security, containing no substantive cybersecurity disclosure or specific facts.


reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the materiality of cybersecurity risks on the company's business strategy and financial condition. It is Generic Boilerplate because it lacks specific details about the insurance policy, specific risk assessments, or verifiable metrics.


fact: externally managed company

fact: Bimini

reasoning: The paragraph describes the company's reliance on its external manager's cybersecurity processes, which falls under Risk Management Process as it explains how the company handles risk assessment and management. It is classified as Firm-Specific because it identifies the specific external manager ('Bimini') and the company's unique 'externally managed' structure.


fact: Chief Technology Officer

fact: Executive Vice President – Operations

reasoning: The paragraph describes the organizational reporting lines and qualifications of the management team responsible for cybersecurity, which is the definition of Management Role. It is classified as Firm-Specific because it identifies specific executive roles (CTO and EVP – Operations) involved in the cybersecurity governance structure.


reasoning: This paragraph is a cross-reference directing the reader to Item 1A for risk factor disclosures, which falls under the 'None/Other' category and contains no substantive cybersecurity information.


fact: Risk Management Committee of the Board of Directors

fact: IT Risk Assessment

fact: Cybersecurity Risk Assessment

fact: Annual IT Program Status Report

fact: Vendor Management Risk Assessment

fact: Quarterly Internal Vulnerability Reports

fact: residual risk

reasoning: The paragraph is primarily about the oversight responsibilities of the Board's Risk Management Committee, which defines it as Board Governance. It reaches Firm-Specific level by identifying the specific committee and the unique set of internal reports and assessments that the board reviews.


reasoning: The paragraph is primarily about the board's oversight structure and reporting lines, which falls under Board Governance. It is classified as Firm-Specific because it identifies a specific governance body, the 'Advisory Committee of the Board of Managers,' which distinguishes the company's oversight structure.


reasoning: The paragraph describes the existence of incident response plans and periodic testing, which falls under Risk Management Process. It contains no domain-specific terminology (e.g., specific frameworks or tools), firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: Vendor Management program

reasoning: The paragraph is centrally focused on the management of third-party risks, specifically describing a vendor management program. It reaches the Domain-Adapted level because it references a specific cybersecurity-relevant process ('Vendor Management program') that goes beyond generic risk management language.


reasoning: This paragraph is a cross-reference directing the reader to another section of the filing for risk disclosures, which falls under the None/Other category and constitutes generic boilerplate.


fact: In 2021, the Bank was the target of a ransomware attack

fact: ransomware attack

reasoning: The paragraph is primarily an Incident Disclosure because it details a specific past ransomware attack and the resulting litigation. It reaches the Quantified-Verifiable level because it cites a specific year (2021) for a real-world event.


reasoning: This paragraph is a standard risk disclaimer describing hypothetical consequences of cybersecurity incidents rather than providing substantive details about the company's program or governance, thus falling under None/Other. It contains no firm-specific or verifiable information, resulting in Generic Boilerplate specificity.


reasoning: This paragraph is a generic risk disclosure statement regarding reliance on IT systems, which does not describe a specific cybersecurity program, governance structure, or incident, and thus falls under None/Other.


fact: do not carry a separate cybersecurity commercial insurance policy

reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the materiality of cybersecurity incidents on the company's business and financial condition. It is Firm-Specific because it discloses a unique operational detail: the absence of a standalone cybersecurity insurance policy.


reasoning: The paragraph is classified as Strategy Integration because it includes a negative assertion regarding the materiality of past cybersecurity incidents. It is Generic Boilerplate because it lacks specific domain terminology, firm-unique details, or externally verifiable facts.


fact: incident detection

fact: containment

fact: remediation

reasoning: The paragraph describes the company's incident response capabilities, which falls under Risk Management Process. It is classified as Domain-Adapted because it uses specific cybersecurity terminology like 'incident detection,' 'containment,' and 'remediation' that go beyond generic risk management language.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity threats on the company's financial position and operations, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific details, or verifiable claims, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph describes the company's approach to security awareness training and the integration of cybersecurity into its enterprise risk management framework, which are core activities of a risk management process. The content is written in high-level, generic language that does not include specific domain terminology, firm-unique identifiers, or verifiable claims.


fact: Chief Financial Officer

fact: Head of IT

reasoning: The paragraph describes the specific responsibilities and roles of management (CFO and Head of IT) regarding cybersecurity, fitting the Management Role category. It is classified as Firm-Specific because it identifies specific management roles (CFO and Head of IT) responsible for cybersecurity oversight.


fact: identifying, protecting from, detecting, responding to, and recovering from

fact: incident response test exercise

reasoning: The paragraph describes the operational activities of the company's incident response program, such as escalation procedures and testing, which falls under Risk Management Process. It is classified as Domain-Adapted because it incorporates specific cybersecurity framework language (NIST CSF core functions) and describes technical activities like incident response testing.


reasoning: The paragraph primarily describes the board's oversight structure and the frequency of reporting regarding cybersecurity, which falls under Board Governance. It contains no domain-specific terminology, firm-specific entities, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: Chief Information Security Officer

fact: Chief Technology Officer

fact: Chief Operations Officer

fact: over 25 years' experience

reasoning: The paragraph focuses on the roles, responsibilities, and qualifications of specific management positions (CISO, CTO, COO), placing it in Management Role. It reaches Quantified-Verifiable specificity because it cites a specific, verifiable duration of experience ('over 25 years').


fact: CIO

reasoning: The paragraph focuses on the organizational structure and responsibilities of the management team (CIO, CEO, CFO, GC) in implementing the cybersecurity program, making it a Management Role classification. It is Firm-Specific because it explicitly identifies the CIO as the lead role, which is a specific cybersecurity-related title.


fact: assess, test, or otherwise assist with aspects of our cybersecurity controls

reasoning: The paragraph describes the use of third parties as part of the company's internal cybersecurity program (specifically for assessment and testing), which falls under Risk Management Process. It is classified as Domain-Adapted because it references specific cybersecurity activities like 'assess' and 'test' in the context of controls, which demonstrates domain knowledge beyond generic risk management.


reasoning: The paragraph focuses on the company's reliance on a third-party accounting firm for financial record-keeping and cybersecurity, making Third-Party Risk the primary category. It contains no specific domain terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: This paragraph is a cross-reference to another section of the filing, which is explicitly classified as None/Other and Generic Boilerplate per the provided rules.


fact: National Institute of Standards and Technology Cybersecurity Framework (NIST CSF)

reasoning: The paragraph describes the methodology used to design and assess the cybersecurity program, which falls under Risk Management Process. It is classified as Domain-Adapted because it explicitly references the NIST CSF framework, which demonstrates domain-specific knowledge beyond generic risk management language.


fact: Chief Information Security Officer ("CISO")

fact: served in the role since 2015

fact: application security

fact: intrusion detection

fact: penetration testing

fact: complex threat modeling

fact: unconventional cyber-attack vectors

fact: RCOC

reasoning: The paragraph focuses on the leadership structure, qualifications, and reporting lines of the cybersecurity team, making it a Management Role classification. It reaches Quantified-Verifiable specificity because it includes a specific start date for the CISO's tenure (2015), which is a verifiable fact.


fact: hardening our environment

fact: vulnerability to attack

reasoning: The paragraph describes the company's ongoing cybersecurity activities (audits, hardening, training), which falls under Risk Management Process. It reaches Domain-Adapted specificity by using cybersecurity-specific terminology like 'hardening our environment' and 'vulnerability to attack' rather than generic risk management language.


reasoning: The paragraph describes the company's general approach to updating systems and processes in response to evolving threats, which falls under Risk Management Process. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity threats and incidents on the company's business and financial condition, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: Prudential's CISO

fact: Operational Risk Management

reasoning: The paragraph describes the Board's oversight responsibilities and reporting structure, which is the primary focus of Board Governance. It achieves Firm-Specific status by identifying specific roles (CISO, CIO) and a specific internal department (Operational Risk Management) involved in the reporting process.


reasoning: The paragraph describes the objectives and scope of the company's information security program, which falls under Risk Management Process. It achieves Domain-Adapted specificity by referencing the CIA triad (confidentiality, integrity, and availability), a foundational concept in the cybersecurity domain.


reasoning: The paragraph describes components of the company's cybersecurity program, placing it in Risk Management Process. It contains only generic terminology (risk assessments, critical systems) that fails the ERM test for domain expertise, resulting in a Generic Boilerplate specificity level.


fact: threat intelligence

fact: tactics, techniques, and procedures

fact: phishing exercises

fact: monitoring and detection

fact: cybersecurity incident response plan ("CIRP")

reasoning: The paragraph describes the company's cybersecurity program activities, such as threat intelligence, phishing exercises, and monitoring, which falls under Risk Management Process. It reaches Firm-Specific specificity because it names a specific internal program, the 'Cybersecurity Incident Response Plan (CIRP)', which distinguishes it from generic descriptions.


reasoning: The paragraph is classified as Strategy Integration because it provides a negative assertion regarding the materiality of cybersecurity threats on the company's business strategy and financial condition. It is classified as Generic Boilerplate because it contains no domain-specific terminology, firm-specific organizational details, or externally verifiable facts.


reasoning: The paragraph describes employee training, which is a standard component of a cybersecurity program (Risk Management Process). It contains no specific tools, frameworks, or unique identifiers, resulting in a Generic Boilerplate specificity level.


fact: did not experience any cybersecurity incident during 2024

reasoning: The paragraph is classified as Strategy Integration because it makes a negative assertion regarding the occurrence of material cybersecurity incidents, which is a standard materiality assessment. It is classified as Quantified-Verifiable because it includes a specific reporting year (2024) tied to the incident claim, which meets the threshold for a verifiable fact in this context.


fact: firewalls

fact: intrusion detection and prevention systems

fact: vulnerability and patch management processes

fact: phishing tests

reasoning: The paragraph describes the company's cybersecurity program activities, such as vulnerability management and specific technical controls, placing it in Risk Management Process. It reaches Domain-Adapted specificity by referencing specific cybersecurity tools and practices like firewalls, intrusion detection/prevention systems, and phishing tests, which pass the ERM test.


fact: InfoSec Director

fact: eRISC committee

reasoning: The paragraph describes the reporting structure and governance chain for cybersecurity, placing it in Board Governance. It is Firm-Specific because it names a specific internal committee ('eRISC committee') and a security-specific leadership role ('InfoSec Director').


reasoning: The paragraph is a generic introductory statement defining cybersecurity threats by referencing Regulation S-K and listing common, high-level risk categories without describing any specific program, governance structure, or management role. It functions as a preamble rather than a substantive disclosure of cybersecurity operations or strategy.


reasoning: The paragraph is explicitly about third-party risk management, making it the central topic. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is primarily focused on the company's reliance on third-party service providers and the existence of a risk management program to address those specific risks. It contains no specific domain terminology, firm-unique details, or verifiable facts, making it generic boilerplate.


fact: virtual Chief Information Security Officer ("vCISO")

reasoning: The paragraph is primarily focused on the management and reporting of third-party risk, making 'Third-Party Risk' the most appropriate category. It reaches 'Firm-Specific' specificity because it identifies a specific, non-generic role ('virtual Chief Information Security Officer') responsible for this function.


reasoning: The paragraph describes the oversight structure where the Audit Committee oversees the CEO's cybersecurity responsibilities, which constitutes a governance-chain description. It contains no specific domain terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate classification.


fact: cybersecurity insurance

reasoning: The paragraph is classified as Strategy Integration because it discusses the company's use of cybersecurity insurance as a financial risk transfer mechanism. It is Domain-Adapted because 'cybersecurity insurance' is a specific domain term that goes beyond generic risk management language.


reasoning: The paragraph describes the company's use of third-party consultants to support its internal risk management activities, which falls under Risk Management Process. It lacks specific domain terminology or firm-unique details, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is a general statement of commitment to security and a cross-reference to the Risk Factors section, containing no substantive description of governance, management, or specific risk management processes. It functions as introductory boilerplate rather than a disclosure of cybersecurity operations.


fact: October 3, 2024

reasoning: The paragraph is classified as Incident Disclosure because it explicitly describes a specific, real-world cybersecurity event (the October 3, 2024 incident). It is Quantified-Verifiable because it provides the specific date of that incident, which is an externally verifiable fact.


fact: As of March 31, 2025

reasoning: The paragraph is classified as Strategy Integration because it makes a negative assertion regarding the material impact of cybersecurity incidents on the company's operations. It is classified as Quantified-Verifiable because it includes a specific date (March 31, 2025) anchoring the company's claim about incident history.


reasoning: The paragraph is a standard risk factor disclosure describing potential threats and consequences rather than detailing specific governance, management, or operational processes. It uses generic terminology like 'internal controls' and 'disaster recovery' which do not demonstrate specific domain expertise or firm-unique details.


fact: Cybersecurity Steering Committee

fact: CISO

reasoning: The paragraph primarily describes the governance structure, detailing the flow of information from the Cybersecurity Steering Committee and CISO to the Board, as well as the Board's oversight and expertise. It is classified as Firm-Specific because it identifies specific internal governance bodies like the Cybersecurity Steering Committee and the CISO role.


reasoning: The paragraph describes the board committee's oversight role and information flow regarding cybersecurity risks and incidents, which falls under Board Governance. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: audit committee

reasoning: The paragraph focuses on the oversight responsibilities of the Board of Directors and the Audit Committee, placing it squarely in Board Governance. It is classified as Firm-Specific because it identifies the specific committee (Audit Committee) tasked with cybersecurity oversight, which distinguishes the governance structure.


fact: tabletop exercises

reasoning: The paragraph is classified as Strategy Integration because it makes a formal negative assertion regarding the materiality of cybersecurity risks and incidents on the company's business. It is Domain-Adapted because it references 'tabletop exercises,' which is a specific cybersecurity practice that passes the ERM test.


reasoning: The paragraph is primarily a negative assertion regarding the occurrence of material cybersecurity incidents in the fiscal year, which falls under Strategy Integration per the materiality rule. It contains no domain-specific terminology, firm-specific organizational details, or externally verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph describes the company's general approach to cybersecurity risk management, fitting the Risk Management Process category. It lacks any domain-specific terminology (e.g., specific tools, frameworks, or architectural concepts), firm-specific details, or verifiable claims, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the lack of material impact of cybersecurity incidents on the company's financial condition. It is Generic Boilerplate because negative assertions about the absence of incidents are not externally verifiable, and the text contains no domain-specific terminology or firm-unique facts.


fact: incident response plan

reasoning: The paragraph describes the operational activities of the cybersecurity program, specifically incident response and employee training, which falls under Risk Management Process. It reaches Domain-Adapted specificity by referencing specific cybersecurity program components like an 'incident response plan' and 'information security and privacy training' rather than just generic risk management language.


reasoning: The paragraph is centrally focused on the oversight of third-party cybersecurity risks, fitting the Third-Party Risk category. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph describes general business reliance on technology and software rather than specific cybersecurity governance, management, or risk processes. It contains no domain-specific terminology, firm-specific details, or verifiable facts.


reasoning: The paragraph is classified as Board Governance because it explicitly discusses the Board's oversight responsibilities and the qualifications of its members regarding cybersecurity. It is classified as Generic Boilerplate because it lacks specific domain terminology, firm-specific details, or verifiable facts.


fact: penetration testing

fact: offensive testing

fact: maturity assessments

fact: cyber phishing tests

reasoning: The paragraph outlines the specific components and activities of the company's cybersecurity program, which falls under Risk Management Process. It achieves Domain-Adapted specificity by referencing technical cybersecurity practices such as penetration testing, offensive testing, and phishing tests.


reasoning: The paragraph focuses on contractual requirements imposed on third-party vendors, which is the central topic of Third-Party Risk. It uses generic language regarding security measures and breach reporting without referencing specific frameworks, tools, or unique organizational details, resulting in a Generic Boilerplate classification.


reasoning: The paragraph describes a specific cybersecurity incident, including the date of detection and remediation, which qualifies as Incident Disclosure. The inclusion of the specific date (July 10, 2024) makes it Quantified-Verifiable.


reasoning: The paragraph is centrally focused on the management of third-party cybersecurity risks, fitting the Third-Party Risk category. It lacks specific details, domain-specific terminology, or verifiable facts, resulting in a Generic Boilerplate classification.


reasoning: The paragraph primarily describes the Board's oversight role and information flow regarding cybersecurity, which falls under Board Governance. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is a generic risk disclosure statement regarding potential cybersecurity threats, which does not describe specific governance, management, or operational processes.


fact: National Institute of Standards and Technology ("NIST")

fact: International Organization for Standardization ("ISO")

reasoning: The paragraph describes the frameworks and methodologies used in the company's cybersecurity program, which falls under Risk Management Process. It reaches Domain-Adapted specificity by referencing specific cybersecurity frameworks (NIST, ISO) and the CIA triad (confidentiality, integrity, and availability), which demonstrate domain expertise beyond generic risk management language.


reasoning: The paragraph describes the integration of the cybersecurity program into the broader enterprise risk management framework, which is a core component of the risk management process. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is primarily focused on the risks associated with third-party service providers and the company's limited ability to control their cybersecurity practices, making it a clear Third-Party Risk disclosure. It contains no specific facts, domain-specific terminology, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: vCIO services

fact: service level agreement

fact: MSP's Service Delivery Team

reasoning: The paragraph describes the specific services provided by a third-party vendor (vCIO/MSP), making it a Third-Party Risk disclosure. It reaches Firm-Specific specificity by naming the 'MSP's Service Delivery Team' and referencing specific service delivery components.


reasoning: The paragraph is a cross-reference to another section of the filing and contains no substantive cybersecurity disclosure.


fact: offsite backup storage

reasoning: The paragraph outlines the components of the company's cybersecurity program, which falls under Risk Management Process. It achieves Domain-Adapted specificity by identifying a specific security practice, 'offsite backup storage,' which demonstrates domain knowledge beyond generic risk management language.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity incidents on the business, which is classified as Strategy Integration per Rule 5. It contains no specific cybersecurity facts, domain terminology, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph is a standard disclaimer regarding the severity of cybersecurity threats and a cross-reference to the Risk Factors section, containing no substantive cybersecurity program details.


fact: Vice President of IT and Digital

reasoning: The paragraph focuses on the roles and responsibilities of specific management positions (Vice President of IT and Digital and CISO) in maintaining cybersecurity knowledge, which falls under Management Role. It is classified as Firm-Specific because it explicitly names these specific leadership titles.


reasoning: The paragraph describes the company's cybersecurity risk management processes, fitting the Risk Management Process category. It reaches Domain-Adapted specificity by referencing the 'confidentiality, integrity and availability' (CIA) triad, which is a core cybersecurity domain concept.


reasoning: The paragraph consists entirely of generic disclaimers regarding the limitations of security measures and cross-references to risk factors, containing no substantive cybersecurity program details or specific facts.


reasoning: The paragraph consists entirely of generic risk factor boilerplate regarding potential future cybersecurity threats and their hypothetical consequences, which does not constitute substantive cybersecurity disclosure.


fact: cyber insurance policy

reasoning: The paragraph is classified as Strategy Integration because it explicitly addresses the materiality of cybersecurity risks on the company's business strategy and financial condition, including a mention of cyber insurance. It is Domain-Adapted because it uses specific cybersecurity terminology like 'detect, triage and eradicate' and 'cyber insurance policy' which demonstrates domain knowledge beyond generic risk management.


fact: assess risks from cybersecurity threats

fact: monitor our information systems for potential vulnerabilities

fact: security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents

reasoning: The paragraph is primarily focused on describing the company's cybersecurity program activities (risk assessment, monitoring, incident response), which falls under Risk Management Process. It reaches Domain-Adapted specificity by referencing specific cybersecurity activities like vulnerability monitoring and incident lifecycle management (identify, escalate, investigate, resolve, recover), which demonstrate domain expertise beyond generic risk management language.


reasoning: The paragraph primarily functions as a negative assertion regarding the materiality of cybersecurity risks, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific organizational details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph describes the general threat landscape and potential consequences of cyberattacks in a generic manner, without detailing the company's specific cybersecurity program, governance, or strategy.


fact: annual assessments of the SOC reports

fact: implementing complementary controls

reasoning: The paragraph is primarily focused on the management of third-party cybersecurity risks, making 'Third-Party Risk' the correct category. It reaches 'Domain-Adapted' specificity by referencing specific cybersecurity practices like 'SOC reports' and 'complementary controls,' which demonstrate domain expertise beyond generic risk management language.


fact: vendor qualification and management program

fact: protected health information

reasoning: The paragraph is primarily focused on the company's oversight and management of third-party service providers, making it a clear Third-Party Risk disclosure. It reaches Domain-Adapted specificity by referencing specific cybersecurity concepts like 'confidentiality, integrity, or availability' (the CIA triad) and 'protected health information' (PHI), which demonstrate domain expertise beyond generic risk management language.


fact: 21 CFR 11 (Part 11) compliant

fact: antivirus and antimalware software

reasoning: The paragraph is primarily about the company's reliance on CROs (Contract Research Organizations) for cybersecurity and data management, making it a Third-Party Risk disclosure. It reaches Domain-Adapted specificity by referencing specific regulatory compliance (21 CFR Part 11) and technical security controls (antivirus/antimalware).


reasoning: The paragraph consists entirely of generic, high-level statements about the importance of cybersecurity without describing any specific governance, management, risk processes, or strategy, thus falling under None/Other and Generic Boilerplate.


fact: continuous system monitoring

fact: threat detection

fact: cybersecurity assessments

reasoning: The paragraph primarily describes the operational components of the company's cybersecurity program, specifically how it utilizes third-party providers for core security functions like monitoring and assessment, which aligns with Risk Management Process. It reaches Domain-Adapted specificity by referencing specific cybersecurity practices such as continuous system monitoring and threat detection.


fact: chief information security officer

reasoning: The paragraph describes the governance reporting structure between the CISO and the Audit Committee, which falls under Board Governance. It is classified as Firm-Specific because it identifies the CISO as the specific officer responsible for reporting to the board.


fact: third-party sub-contractor to manage all Information Technology (IT) issues

reasoning: The paragraph describes the company's reliance on a third-party sub-contractor for IT and cybersecurity management, which is a specific organizational arrangement (Firm-Specific). While it touches on third-party usage, it is primarily describing the company's internal risk management process (outsourcing the function) rather than a vendor oversight program.


reasoning: This paragraph serves solely as a cross-reference to Item 1A for risk factor disclosures, which is classified as None/Other per the provided rules.


fact: SaaS platforms

fact: cloud-based infrastructure

fact: encryption and authentication technology

fact: threat intelligence service providers

fact: penetration testing firms

fact: Response, eradication and recovery

reasoning: The paragraph is primarily focused on the company's reliance on third-party service providers for both general business and cybersecurity functions. It reaches Domain-Adapted specificity by referencing specific technical concepts such as SaaS, cloud infrastructure, threat intelligence, and penetration testing.


fact: firewalls

fact: intrusion prevention and detection systems

fact: anti-malware functionality

reasoning: The paragraph describes the company's internal cybersecurity program, specifically technical tools and the use of third-party assessors, which falls under Risk Management Process. It reaches Domain-Adapted specificity by listing specific cybersecurity technologies like firewalls and intrusion prevention systems.


reasoning: The paragraph is centrally focused on the company's reliance on third-party providers for monitoring, risk assessment, and supplier oversight, which defines the Third-Party Risk category. It lacks specific, verifiable, or highly technical domain-specific details, resulting in a Generic Boilerplate specificity level.


reasoning: This paragraph is a cross-reference to the Risk Factors section, which is explicitly classified as 'None/Other' under the provided rules. It contains no substantive cybersecurity information or specific facts.


fact: SVP, Engineering

fact: VP, Technology & CISO

reasoning: The paragraph is classified as Management Role because it explicitly identifies the specific management positions responsible for cybersecurity oversight. It is Firm-Specific because it names specific VP-level roles with security-related responsibilities.


reasoning: This paragraph is a cross-reference directing the reader to Item 1A for risk factor disclosures, which is explicitly classified as None/Other and constitutes generic boilerplate.


reasoning: The paragraph explicitly states a conclusion regarding the materiality of cybersecurity risks on the company's business and financial condition, which is the primary indicator for Strategy Integration. It contains no specific, verifiable, or firm-unique details, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is primarily focused on the company's requirements for third-party service providers, which defines the Third-Party Risk category. It contains no specific domain terminology, firm-specific identifiers, or verifiable claims, resulting in a Generic Boilerplate specificity level.


category_confidence: medium

reasoning: The paragraph provides a high-level, generic summary of the company's cybersecurity approach, mentioning assessments and certifications without providing specific details, thus falling under Risk Management Process but remaining at the Generic Boilerplate level.


reasoning: This paragraph is a cross-reference directing the reader to Item 1A for risk factor disclosures, which is explicitly classified as None/Other per the provided rules.


reasoning: The paragraph describes the board's oversight structure and information flow regarding cybersecurity, which falls under Board Governance. It lacks specific cybersecurity domain terminology, firm-specific cybersecurity committees or roles, and verifiable claims, resulting in a Generic Boilerplate classification.


reasoning: The paragraph is primarily focused on the company's engagement with third-party service providers and the requirements imposed upon them, which aligns with the Third-Party Risk category. It lacks specific domain terminology, firm-unique details, or verifiable facts, resulting in a Generic Boilerplate classification.


reasoning: The paragraph describes the components and activities of the company's cybersecurity program, which is the definition of Risk Management Process. The content is entirely generic, using high-level descriptions of standard cybersecurity functions without providing specific domain terminology, firm-unique details, or verifiable facts.


fact: Chief Information Officer

fact: Information Security Officer

fact: combined over 35 years of IT management experience

reasoning: The paragraph primarily focuses on the responsibilities and qualifications of the Chief Information Officer and Information Security Officer, fitting the Management Role category. It reaches Quantified-Verifiable specificity due to the explicit claim regarding the combined years of experience of the named officers.


fact: Master's degree in Cybersecurity

fact: forensic analysis

fact: regulatory compliance

reasoning: The paragraph focuses on the qualifications, background, and composition of the cybersecurity leadership team, which falls under Management Role. It reaches Quantified-Verifiable specificity due to the specific claim of 'over 23 years of combined Cybersecurity experience'.


reasoning: The paragraph describes the operational impact and recovery from a specific cybersecurity incident, which is the definition of Incident Disclosure. It contains no specific cybersecurity program details, domain-specific terminology, or verifiable metrics, resulting in a Generic Boilerplate specificity level.


fact: GC Advisors

reasoning: The paragraph describes the Board's oversight structure and reporting lines, placing it in Board Governance. It reaches Firm-Specific level by naming 'GC Advisors' as the specific entity whose cybersecurity program is being reported on.


fact: ransomware attack

reasoning: The paragraph describes a specific cybersecurity incident (a ransomware attack) and provides exact dates for the event and remediation, making it an Incident Disclosure at the Quantified-Verifiable level.


fact: Chief Technology Officer

fact: over 15 years of experience

fact: software development and security architecture

reasoning: The paragraph focuses on the responsibilities and qualifications of the Chief Technology Officer, placing it squarely in Management Role. It reaches Quantified-Verifiable specificity because it cites a specific, verifiable duration of experience ('over 15 years').


reasoning: The paragraph is classified as Strategy Integration because it makes a negative assertion regarding the materiality of cybersecurity incidents for the fiscal year. It is considered Generic Boilerplate because negative assertions about material incidents and cross-references to risk factors are standard, non-specific disclosures.


fact: service provider oversight committee

reasoning: The paragraph is centrally focused on the management and oversight of third-party service providers, fitting the Third-Party Risk category. It is classified as Firm-Specific because it identifies a specific internal body, the 'service provider oversight committee,' which distinguishes the company's governance structure.


fact: IT Committee

fact: Senior Vice President of Information Technology

fact: Executive Vice President and Chief Accounting Officer

fact: Co-Chief Operating Officer

reasoning: The paragraph is primarily about the management-level IT Committee and the specific executives (SVP of IT, CAO, COO) responsible for cybersecurity oversight and reporting to the Board, fitting the Management Role category. It reaches Firm-Specific specificity due to the naming of these specific executive roles and the internal IT Committee.


fact: security incident management

fact: cyberattacks

fact: information security threats

fact: Deutsche Bank Group

fact: DWS

reasoning: The paragraph describes the operational scope and process of incident management, which falls under Risk Management Process. It is classified as Domain-Adapted because it uses specific cybersecurity terminology like 'security incident management', 'cyberattacks', and 'information security threats' that demonstrate domain expertise beyond generic risk management language.


reasoning: The paragraph provides a negative assertion regarding the materiality of cybersecurity incidents, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is a generic disclaimer about the possibility of future incidents and a cross-reference to the Risk Factors section, containing no substantive cybersecurity program details or specific disclosures.


reasoning: The paragraph is classified as Strategy Integration because it makes a negative assertion regarding the materiality of past cybersecurity incidents on the company's business and financial condition. It contains no specific cybersecurity domain terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the material impact of cybersecurity threats on the company's business strategy and financial condition. It is Generic Boilerplate because it contains no domain-specific terminology, firm-specific organizational details, or externally verifiable facts.


reasoning: This paragraph is a cross-reference directing the reader to another section of the filing for information regarding material impacts, which falls under the None/Other category. It contains no substantive cybersecurity information or specific facts.


fact: not insured for damages that could result from such an incident

reasoning: The paragraph is classified as Strategy Integration because it explicitly addresses the financial risk management strategy regarding cybersecurity insurance coverage. It is Firm-Specific because the disclosure regarding the lack of cyber insurance is a unique, verifiable fact about the company's specific risk posture.


fact: penetration tests

fact: risk register

fact: cloud environments

reasoning: The paragraph describes the company's cybersecurity program activities, such as risk assessment methodologies, penetration testing, and risk registers, which falls under Risk Management Process. It reaches Domain-Adapted specificity by referencing specific cybersecurity practices like penetration testing and the use of a risk register, which demonstrate domain expertise beyond generic risk management language.


fact: enterprise risk management assessment program

fact: cybersecurity-specific risk identification program

reasoning: The paragraph is primarily focused on the management of third-party cybersecurity risks, including supply chain and vendor access. It reaches the Domain-Adapted level by referencing specific cybersecurity-related risk programs and audit practices that go beyond generic enterprise risk management language.


reasoning: The paragraph describes the board's oversight role regarding cybersecurity risks, which falls under Board Governance. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: subsequent to June 30, 2024

reasoning: The paragraph primarily establishes the governance structure by defining the Board's oversight responsibility, which takes precedence over the management role description. It reaches Quantified-Verifiable specificity because it includes a specific, verifiable date reference ('subsequent to June 30, 2024').


reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the materiality of cybersecurity incidents on the company's business strategy and financial condition. It is Generic Boilerplate because it contains no domain-specific terminology, firm-specific organizational details, or externally verifiable facts.


fact: active interactions with children's hospitals while assisting with insurance prior approvals

reasoning: The paragraph is classified as Strategy Integration because it explicitly addresses the materiality of cybersecurity risks, both backward-looking (no material impact) and forward-looking (potential material impact). It is Firm-Specific because it identifies a unique business context—interactions with children's hospitals for insurance prior approvals—that distinguishes this company's risk profile.


fact: CISO

fact: Risk and Compliance Committee

fact: Chief Legal Officer

reasoning: The paragraph describes the governance structure and reporting lines between the CISO, the Risk and Compliance Committee, and the Board, making it primarily Board Governance. It is classified as Firm-Specific because it names specific roles (CISO, Chief Legal Officer) and a specific committee (Risk and Compliance Committee) that distinguish the company's governance structure.


fact: CGNC

reasoning: The paragraph focuses on the responsibilities of senior management and business unit leaders, placing it in Management Role. It is classified as Firm-Specific because it names the 'CGNC' (Corporate Governance and Nominating Committee), which is a specific entity within the company's governance structure.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity threats on the company's business strategy and financial condition, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is classified as Strategy Integration because it explicitly states that cybersecurity threats have not materially affected the company's business or financial condition. It contains no specific cybersecurity domain terms, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph focuses on the board's role in evaluating investments and overseeing compliance, which falls under Board Governance. It contains no domain-specific terminology, firm-specific entities, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph describes the board's oversight structure and delegation of cybersecurity responsibilities to the Audit Committee, which is a classic Board Governance topic. It contains no domain-specific terminology, firm-unique identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: October 15, 2025

fact: Federal Bureau of Investigation (FBI)

fact: encryption and monitoring software

reasoning: The paragraph describes a specific cybersecurity incident, including the date of discovery and the response actions taken, which classifies it as Incident Disclosure. It reaches Quantified-Verifiable specificity due to the inclusion of a specific date (October 15, 2025) and the naming of an external entity (FBI) involved in the response.


reasoning: The paragraph provides a negative assertion regarding the materiality of cybersecurity incidents on the company's business strategy and financial condition, which falls under Strategy Integration per Rule 5. It contains no specific cybersecurity domain terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: Cybersecurity Governance Board

reasoning: The paragraph is primarily a materiality assessment regarding cybersecurity risks, which falls under Strategy Integration. It is classified as Firm-Specific because it names a specific internal body, the 'Cybersecurity Governance Board', which distinguishes it from generic board oversight descriptions.


reasoning: The paragraph is classified as Strategy Integration because it makes a negative assertion regarding the materiality of past cybersecurity incidents, which is a backward-looking assessment of business impact. It contains no specific cybersecurity domain terminology, firm-specific organizational details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is classified as Strategy Integration because it explicitly states that cybersecurity risks have not had a material impact on the company's business strategy or financial results, which is a backward-looking materiality assessment. It contains no specific cybersecurity domain terms, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: Audit Committee

fact: Board of Directors

reasoning: The paragraph describes the governance chain for cybersecurity oversight, specifically the reporting lines from management to the Audit Committee and the Board, which places it in Board Governance. The specificity is Generic Boilerplate because 'Audit Committee', 'Board of Directors', 'CEO', and 'CFO' are standard governance roles present at every public company and do not constitute firm-specific or domain-adapted facts.


reasoning: The paragraph is classified as Strategy Integration because it makes a negative assertion regarding the materiality of past cybersecurity incidents. It is Generic Boilerplate because it contains no domain-specific terminology, firm-specific details, or verifiable facts.


reasoning: The paragraph is a negative assertion regarding the absence of material cybersecurity incidents, which falls under Strategy Integration per the materiality rule. It contains no domain-specific terminology, firm-specific facts, or externally verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: ransomware

fact: malware

fact: June 2018

fact: $10 million

reasoning: The paragraph is primarily an incident disclosure, as it details a specific historical security event (the June 2018 incident) and its financial impact. It reaches the Quantified-Verifiable level because it cites a specific dollar amount ($10 million) and a specific date (June 2018) associated with that incident.


fact: incident response program

fact: single cybersecurity event in June of 2023

fact: unauthorized third party gained access to the email accounts of two of our employees

fact: notified the affected customers of the incident in early September 2023

fact: incurred expenses of approximately $25,000

reasoning: The paragraph is primarily an Incident Disclosure because it details a specific cybersecurity event, including the timeline, nature of the breach, and financial impact. It reaches Quantified-Verifiable specificity due to the inclusion of specific dates (June 2023, September 2023) and a specific dollar amount ($25,000) related to the incident.


reasoning: The paragraph is classified as Strategy Integration because it explicitly addresses the materiality of cybersecurity risks on the company's business strategy and financial condition, as required by SEC Item 106(b)(2). It contains no specific cybersecurity facts, domain terminology, or verifiable claims, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph describes the company's lack of a cybersecurity program due to its early-stage status, which constitutes a disclosure of the absence of cybersecurity measures rather than a description of governance, management, or risk processes. Because it describes the lack of a program rather than detailing specific cybersecurity activities or structures, it is classified as None/Other.


reasoning: The paragraph is primarily a Strategy Integration disclosure because it explicitly states a conclusion regarding the materiality of past and future cybersecurity incidents on the company's business. It contains no specific cybersecurity domain terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: exfiltrated images of video meetings and computer screens

fact: threat actors unlawfully accessed certain computer systems

reasoning: The paragraph describes a specific cybersecurity incident (unauthorized access and data exfiltration), making it Incident Disclosure. It reaches Domain-Adapted specificity by using technical terminology like 'exfiltrated' and 'threat actors' in the context of a specific breach event.


fact: annual assessments of the SOC reports

fact: implementing complementary controls

reasoning: The paragraph is primarily focused on the management of third-party cybersecurity risks, including specific processes like SOC report reviews and complementary controls, which elevates it to Domain-Adapted specificity.


fact: cyber crisis response plan

fact: threat intelligence feeds

fact: vulnerability management

reasoning: The paragraph describes the company's cybersecurity program activities, specifically incident response and vulnerability management, placing it in Risk Management Process. It reaches Domain-Adapted specificity by referencing specific cybersecurity concepts like 'threat intelligence feeds' and 'vulnerability management' that pass the ERM test.


fact: SMIS and Cybersecurity Committee

fact: cyber incident response plan

reasoning: The paragraph primarily describes the governance structure and reporting lines between the Board, the Audit Committee, and the Cybersecurity Committee, making it Board Governance. It is Firm-Specific because it names a specific internal committee ('SMIS and Cybersecurity Committee') that distinguishes the company's governance structure.


reasoning: The paragraph is classified as Management Role because it primarily defines the responsibilities and reporting lines of the Chief Executive Officer regarding cybersecurity. It is classified as Generic Boilerplate because it relies on standard corporate titles and generic risk management terminology without referencing specific internal programs, named committees, or verifiable metrics.


reasoning: The paragraph is a standard materiality assessment statement regarding the impact of cybersecurity threats on the company's business and financial condition, which falls under Strategy Integration. It contains no domain-specific terminology, firm-specific organizational details, or externally verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is classified as Strategy Integration because it explicitly states that cybersecurity risks have not materially affected the company's business strategy, results of operations, or financial condition. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.