fact: risks from cybersecurity threats have not previously materially affected us

fact: do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us

reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the materiality of cybersecurity risks on the company's business and financial condition. It is classified as Generic Boilerplate because the statements regarding materiality and the potential for future threats are standard legal disclaimers that do not contain specific domain terminology, firm-unique facts, or verifiable data.


content_category: Strategy Integration

category_confidence: high

specificity_confidence: high

reasoning: The paragraph primarily makes a negative assertion regarding the materiality of past cybersecurity incidents, which falls under Strategy Integration per Rule 5. It contains no specific domain terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.

provider: google

stage: benchmark


content_category: Risk Management Process

fact: threat modeling

fact: vulnerability testing

fact: information security maturity assessments

reasoning: The paragraph describes the company's cybersecurity risk management activities, including specific technical practices like threat modeling and vulnerability testing, which qualifies it as Risk Management Process and Domain-Adapted.


content_category: Third-Party Risk

fact: risk-based due diligence

fact: contractually require... maintain reasonable security controls

reasoning: The paragraph is centrally focused on the management of third-party cybersecurity risks, specifically detailing due diligence and contractual requirements. It reaches the Domain-Adapted level by referencing specific cybersecurity practices like 'risk-based due diligence' and 'reasonable security controls' in the context of vendor management.


content_category: Board Governance

reasoning: The paragraph describes the board's delegation of cybersecurity oversight to the audit committee, which is a classic Board Governance disclosure. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: Clarium Managed Services, LLC

fact: score of 4.8 on a scale of 0 to 5

type: quantified

reasoning: The paragraph is primarily about the risk management process, specifically the use of a third-party assessment to evaluate the company's security posture. It reaches the Quantified-Verifiable level because it cites a specific third-party firm (Clarium Managed Services, LLC) and a specific numerical assessment score.


reasoning: The paragraph describes the board's oversight structure and delegation of cybersecurity responsibilities to the Audit Committee, which is the primary definition of Board Governance. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: Risk Committee

reasoning: The paragraph primarily describes the Audit Committee's oversight role and its interaction with the Risk Committee, placing it squarely in Board Governance. It is classified as Firm-Specific because it identifies a specific internal body, the 'Risk Committee,' which distinguishes the company's governance structure.


fact: IT Committee

reasoning: The paragraph describes the activities of the IT Committee in assessing and improving security, which falls under Risk Management Process. It is classified as Firm-Specific because it identifies a specific internal body ('IT Committee') responsible for these activities, distinguishing it from generic board-level oversight.


content_category: Management Role

fact: Chief Information Security Officer (CISO)

fact: over 30 years of experience in cybersecurity

fact: United States Navy

fact: Amgen

fact: Warner Bros

fact: KPMG

fact: Forrester

reasoning: The paragraph is classified as Management Role because it focuses on the responsibilities and qualifications of the CISO. It reaches Quantified-Verifiable specificity due to the inclusion of specific, verifiable career history details (years of experience and named previous employers).


fact: regular scanning of both internal and externally facing systems

fact: annual third-party penetration testing

fact: security technologies intended to identify and assist in containing and remediating malware risks

fact: Active monitoring of logs and events for our network perimeter and internal systems

reasoning: The paragraph describes specific cybersecurity activities like penetration testing, malware remediation, and log monitoring, which classifies it as Risk Management Process and demonstrates domain expertise. The specificity is Domain-Adapted because it uses technical terminology (penetration testing, malware, network perimeter) that passes the ERM test.


fact: Vendor Management Policy

fact: enhanced risk assessments

fact: contractual controls

reasoning: The paragraph is centrally focused on the management of third-party cybersecurity risks, specifically detailing how the company oversees vendors. It reaches the Firm-Specific level by naming a specific internal policy ('Vendor Management Policy').


reasoning: The paragraph primarily describes the governance structure and reporting lines between the CEO, executive management, and the Board regarding cybersecurity oversight. It contains no specific cybersecurity domain terminology, firm-specific roles, or verifiable facts, relying instead on generic descriptions of oversight and incident response.


content_category: None/Other

reasoning: The paragraph is a cross-reference to another section of the report regarding insurance, which falls under the None/Other category as it does not provide substantive cybersecurity disclosure.


reasoning: The paragraph is centrally focused on the oversight and requirements imposed on third-party service providers, placing it squarely in the Third-Party Risk category. It lacks any specific domain terminology, firm-unique identifiers, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: Chief Security Officer

fact: more than 20 years

fact: global Chief Information Security Officer ("CISO") / CSO

reasoning: The paragraph focuses on the qualifications, experience, and organizational support structure of the Chief Security Officer, placing it squarely in Management Role. It reaches Quantified-Verifiable specificity because it cites a specific, verifiable duration of experience ('more than 20 years') and specific executive titles.


fact: penetration testing

fact: ISAT

reasoning: The paragraph describes the use of third-party consultants as part of the company's internal cybersecurity program, which falls under Risk Management Process. It is classified as Firm-Specific because it references a specific internal team, the 'ISAT'.


fact: insurance coverage for... business interruption, data recovery, hardware replacement, extortion

reasoning: The paragraph is classified as Strategy Integration because it describes the company's financial mitigation strategy (cyber insurance) for cybersecurity risks. It is Domain-Adapted because it lists specific insurance coverage areas (e.g., business interruption, data recovery, extortion) that demonstrate cybersecurity domain knowledge beyond generic risk management language.


fact: engage independent third-party specialists to review our cybersecurity environment

fact: formal reviews and assessments

reasoning: The paragraph describes the company's approach to risk management, specifically mentioning the use of third-party specialists for formal reviews and assessments, which qualifies as a domain-adapted description of cybersecurity activities.


fact: Chief Information Security Officer ("CISO")

fact: Chief Risk Officer ("CRO")

fact: over 18 years of experience in information technology leadership

fact: eight years of which is experience in leading information security oversight

reasoning: The paragraph focuses on the roles, responsibilities, and reporting lines of the CISO and CRO, placing it squarely in Management Role. It reaches Quantified-Verifiable specificity because it includes specific, verifiable tenure numbers (18 years and 8 years) for the CISO.


reasoning: The paragraph is a cross-reference to another section of the filing (Item 1.A) and contains no substantive cybersecurity disclosure, making it 'None/Other' and 'Generic Boilerplate'.


reasoning: The paragraph describes the governance structure and oversight responsibilities of the audit committee and the board, which is the primary focus of Board Governance. It contains no specific, domain-adapted, or verifiable facts, consisting entirely of generic governance language.


fact: CSO

reasoning: The paragraph focuses on the responsibilities and collaborative role of the CSO (Chief Security Officer) in implementing the cybersecurity program, which aligns with Management Role. It is classified as Firm-Specific because it explicitly names the 'CSO' role, which is a specific cybersecurity leadership title.


fact: Information Security Steering Committee ("ISSC")

fact: Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments

reasoning: The paragraph is classified as Management Role because it details the structure and composition of a management-level committee (the ISSC). It is Firm-Specific because it names this specific committee and lists the unique cross-functional departments involved in its composition.


reasoning: The paragraph is classified as Strategy Integration because it provides a negative assertion regarding the material impact of cybersecurity incidents on the company's financial condition and operations. It is classified as Generic Boilerplate because it contains no domain-specific terminology, firm-specific organizational details, or externally verifiable facts.


content_category: Incident Disclosure

fact: February 23, 2023

fact: DISH Network

fact: February 28, 2023

reasoning: The paragraph is classified as Incident Disclosure because it describes specific past cybersecurity events (the February 2023 network outage and data extraction). It reaches Quantified-Verifiable specificity due to the inclusion of specific, verifiable dates associated with these real-world incidents.


fact: Chief Executive Officer

fact: Senior Vice President, Finance and Chief Financial Officer

reasoning: The paragraph focuses on the specific management roles (CEO and SVP/CFO) responsible for cybersecurity oversight and strategy, fitting the Management Role category. It is classified as Firm-Specific because it identifies specific executive titles (CEO, SVP Finance/CFO) as the primary actors in the cybersecurity governance structure.


fact: threat intelligence service providers

fact: penetration testing firms

fact: managed cybersecurity service providers

reasoning: The paragraph describes the use of third-party service providers as part of the company's risk management process. It is classified as Domain-Adapted because it lists specific cybersecurity-related service categories (e.g., threat intelligence, penetration testing) that demonstrate domain expertise beyond generic risk management language.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity incidents on the company's operations, which falls under Strategy Integration. It contains no specific domain terminology, firm-unique details, or verifiable claims, resulting in Generic Boilerplate specificity.


fact: Head of IT

fact: over twenty years of experience

fact: Master of Science degree in Telecommunications and Computer Networks

fact: Project Management Professional

fact: Certified Scrum Master

fact: IT Infrastructure Library certified

reasoning: The paragraph is primarily focused on the qualifications, reporting lines, and responsibilities of the Head of IT, which falls under Management Role. It reaches Quantified-Verifiable specificity because it cites specific, verifiable credentials (degrees and certifications) and a specific duration of experience.


reasoning: This paragraph is a cross-reference directing the reader to another section of the filing for the actual cybersecurity risk assessment, which qualifies as None/Other under the provided rules.


reasoning: The paragraph describes the board's oversight structure and the Audit Committee's role, which falls under Board Governance. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: vulnerability scans

fact: penetration tests

reasoning: The paragraph primarily describes the company's cybersecurity program activities, such as risk assessment and monitoring, placing it in Risk Management Process. It reaches Domain-Adapted specificity by referencing specific cybersecurity practices like 'vulnerability scans' and 'penetration tests' that pass the ERM test.


fact: security and privacy addendums

reasoning: The paragraph is centrally focused on the risks posed by third-party suppliers and the company's management of those risks, fitting the Third-Party Risk category. It reaches Domain-Adapted specificity by referencing specific contractual mechanisms like 'security and privacy addendums,' which demonstrates cybersecurity domain knowledge beyond generic risk management language.


fact: DISH TV, SLING TV and Retail Wireless services

reasoning: The paragraph describes the operational status and restoration timeline of a specific cybersecurity incident, making it an Incident Disclosure. It reaches Quantified-Verifiable specificity because it provides a specific calendar date (March 31, 2023) regarding the restoration of systems.


fact: VRM

fact: third-party audit

fact: disaster recovery

fact: business continuity

fact: country risk

reasoning: The paragraph is centrally focused on the criteria used for vendor due diligence, placing it in Third-Party Risk. It achieves Domain-Adapted specificity by referencing specific risk assessment domains like third-party audits and country risk, which demonstrate professional risk management expertise.


reasoning: The paragraph focuses exclusively on the management of third-party service provider risks, fitting the Third-Party Risk category. It lacks specific cybersecurity domain terminology, firm-specific details, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: ransomware

fact: denial-of-service

reasoning: The paragraph is generic risk disclosure boilerplate that does not describe a specific governance, management, or risk management process. It reaches Domain-Adapted specificity by referencing specific cybersecurity threat types (ransomware, denial-of-service).


fact: Chief Information Security Officer

fact: 25 years of prior experience

fact: Certified Internal Controls Auditor (CICA)

fact: Payment Card Industry Professional (PCIP)

fact: Certified Information Systems Security Professional (CISSP)

fact: Certified Information Systems Auditor (CISA)

fact: Certified in Risk and Information Systems Control (CRISC)

reasoning: The paragraph focuses on the responsibilities and qualifications of the Chief Information Security Officer, placing it squarely in Management Role. It reaches Quantified-Verifiable specificity because it lists specific years of experience and multiple independently verifiable professional certifications held by the officer.


fact: Information Security Officer

fact: Chief Risk Officer

reasoning: The paragraph is primarily about the organizational structure and reporting lines of the cybersecurity function, specifically the Information Security Officer's role and reporting hierarchy, which falls under Management Role. It is classified as Firm-Specific because it identifies specific internal roles (Information Security Officer, Chief Risk Officer) and a named committee (Information Technology Steering Committee).


reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the materiality of cybersecurity incidents on the company's business strategy and financial condition. It contains no specific cybersecurity domain terms, firm-specific roles, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph describes the existence and general purpose of an incident response plan, which is a core component of the cybersecurity program (Risk Management Process). It contains no domain-specific terminology, firm-specific identifiers, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: CISO

fact: CDO

fact: more than 20 years of executive IT leadership experience

fact: joining MPC in 2021

fact: employed by GE... for over 20 years

fact: Senior Vice President and Chief Information Officer of Services for parent company GE in 2017

fact: Vice President and Chief Information Officer of GE Healthcare

fact: Bachelor's degree in Business Administration, Management and Information Systems

reasoning: The paragraph is classified as Management Role because it details the reporting structure between the CISO and CDO and provides the professional background of the CDO. It is Quantified-Verifiable due to the inclusion of specific years of experience, employment dates, and named executive titles.


reasoning: The paragraph provides a negative assertion regarding the materiality of cybersecurity risks and incidents, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific details, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: vulnerability assessments

fact: third-party and independent reviews

fact: Chief Information Security Officer

reasoning: The paragraph primarily describes the oversight structure and reporting lines between the Board, Audit Committee, and management, placing it in Board Governance. It reaches Firm-Specific level due to the explicit mention of the Chief Information Security Officer, a named leadership role.


fact: Management Enterprise Risk Committee

fact: Vendor Management Committee

fact: managed security service monitoring

fact: penetration testing

fact: vulnerability assessment

reasoning: The paragraph is primarily focused on the oversight and management of third-party vendors, making 'Third-Party Risk' the correct category. It reaches 'Firm-Specific' specificity because it names specific internal committees (Management Enterprise Risk Committee and Vendor Management Committee) responsible for this oversight.


reasoning: The paragraph describes the general components of a cybersecurity program (mechanisms, controls, policies) and management's role in overseeing it, which falls under Risk Management Process. It lacks any domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph focuses on the company's reliance on third-party vendors for IT and cybersecurity support, which falls under Third-Party Risk. It contains no specific domain terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: National Institute of Standards and Technology

type: framework

fact: Center for Internet Security Controls

reasoning: The paragraph describes the methodology and frameworks (NIST, CIS Controls) used in the company's cybersecurity program, which falls under Risk Management Process. It is Domain-Adapted because it references specific cybersecurity frameworks that demonstrate domain expertise beyond generic risk management language.


reasoning: The paragraph is a cross-reference to the Risk Factors section (Item 1A) and contains no substantive cybersecurity disclosure, thus falling under None/Other and Generic Boilerplate.


fact: cybersecurity audits

reasoning: The paragraph is centrally focused on the management of third-party cybersecurity risks, including diligence and contractual requirements, fitting the Third-Party Risk category. It reaches Domain-Adapted specificity by referencing 'cybersecurity audits' as a specific mechanism for vendor oversight, which passes the ERM test.


fact: CISO

fact: CIO

reasoning: The paragraph describes the board and committee oversight structure for cybersecurity, placing it squarely in Board Governance. It reaches Firm-Specific specificity because it identifies specific management roles (CISO, CIO, Security & Resiliency global practice leader) that report to the board.


fact: Third-Party Risk Management Program

fact: Vendor Management Policy

reasoning: The paragraph is centrally focused on the management of third-party vendor risks, making it a clear Third-Party Risk category. It reaches Firm-Specific specificity by naming the company's specific internal programs and policies (Third-Party Risk Management Program, Vendor Management Policy) and citing a specific regulatory framework (Interagency Guidance on Third-Party Relationships: Risk Management).


reasoning: This paragraph is a cross-reference to the Risk Factors section and does not contain any substantive cybersecurity disclosure.


fact: DISH TV and SLING TV services

reasoning: The paragraph describes the status and resolution of a specific cybersecurity incident, making it Incident Disclosure. It reaches Quantified-Verifiable specificity because it provides a specific calendar date (March 31, 2023) regarding the restoration of systems.


fact: in 2019 we were the subject of a successful phishing attempt

reasoning: The paragraph is primarily a materiality assessment regarding cybersecurity risks, which falls under Strategy Integration. It reaches the Quantified-Verifiable level because it cites a specific historical event ('in 2019') that is a verifiable claim.


fact: February 23, 2023

fact: February 28, 2023

fact: DISH Network IT systems

reasoning: The paragraph is classified as Incident Disclosure because it details specific past cybersecurity events, including dates and the nature of the impact. It reaches the Quantified-Verifiable level due to the inclusion of specific calendar dates associated with the reported incidents.


fact: Energy Transfer's Chief Information Officer

fact: Energy Transfer IT team

fact: USAC's IT department

fact: more than 35 years of experience

fact: over 50 years of combined experience

fact: 20 years dedicated to cybersecurity

fact: Global Industrial Cyber Security Professional (GICSP)

fact: Certified Information Systems Security Professional (CISSP)

fact: Certified Ethical Hacker (CEH)

fact: average of over 25 years of experience

fact: over 10 years of experience in IT security

reasoning: The paragraph is classified as Management Role because it focuses on the qualifications, experience, and credentials of the specific individuals and teams managing cybersecurity. It is Quantified-Verifiable due to the inclusion of specific professional certifications and quantified years of experience for the personnel involved.


fact: January 2021

fact: source code

fact: credentials

reasoning: The paragraph is classified as Incident Disclosure because it details a specific, historical cybersecurity event (the January 2021 incident). It reaches the Quantified-Verifiable level of specificity due to the inclusion of the specific date of the incident.


reasoning: The paragraph provides a negative assertion regarding the materiality of cybersecurity incidents, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph consists of generic risk management boilerplate and cross-references to other sections of the filing, containing no substantive cybersecurity program details or specific facts.


reasoning: The paragraph primarily serves as a cross-reference to the Risk Factors section (Item 1A) and contains no substantive details about governance, management, or specific risk management processes.


reasoning: The paragraph describes the board's oversight structure and the flow of information regarding cybersecurity, fitting the Board Governance category. It contains no specific, verifiable, or firm-unique details, resulting in a Generic Boilerplate specificity level.


fact: Software Approval Board

fact: cross-functional members from Quality, Internal Audit, Information Security, Business Systems, and R&D

reasoning: The paragraph is primarily focused on the oversight and management of third-party software risks, making Third-Party Risk the most appropriate category. It reaches Firm-Specific specificity by naming a unique internal committee (Software Approval Board) and detailing its specific cross-functional composition.


fact: Chief Information Officer

reasoning: The paragraph primarily describes the Board's oversight responsibilities and the flow of information from management to the Board, fitting the Board Governance category. It is classified as Firm-Specific because it identifies the specific role (Chief Information Officer) responsible for reporting to the Board.


fact: June 2019

fact: over 20 years of experience

fact: real-time dashboards

fact: attack vectors

fact: vulnerabilities

reasoning: The paragraph is primarily focused on the qualifications, background, and role of the Director of Information Technology, placing it in Management Role. It reaches Level 4 specificity due to the inclusion of verifiable facts, such as the specific start date of the role and the quantified years of experience.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity risks on the company's business and financial condition, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific organizational details, or externally verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: For more than 5 years, we have not identified any known cybersecurity threats... that have materially impacted us

reasoning: The paragraph is classified as Strategy Integration because it provides a negative assertion regarding the material impact of cybersecurity incidents on the company's business and financial condition. It reaches the Quantified-Verifiable level of specificity due to the inclusion of the specific timeframe 'more than 5 years' regarding the absence of material incidents.


fact: Vendor due diligence

fact: risk-based approach

reasoning: The paragraph is primarily focused on the oversight and management of third-party cybersecurity risks, making 'Third-Party Risk' the correct category. It reaches 'Domain-Adapted' specificity by referencing specific cybersecurity practices like 'vendor due diligence' and a 'risk-based approach' to monitoring, which demonstrate domain knowledge beyond generic risk management language.


reasoning: The paragraph primarily describes the Audit Committee's oversight role and reporting structure, which falls under Board Governance. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph describes the oversight role of the Audit Committee regarding cybersecurity, which falls under Board Governance. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is a cross-reference to another section of the filing and mentions general regulatory oversight, which does not constitute a substantive cybersecurity disclosure.


fact: National Institute of Standards and Technology ("NIST") Cybersecurity Framework

fact: Federal Financial Institutions Examination Council ("FFIEC") Information Technology Examination Handbooks

fact: FFIEC Cybersecurity Assessment Tool

fact: Information Security Officer

fact: Information Technology Officer

reasoning: The paragraph describes the objectives and frameworks of the cybersecurity program, placing it in Risk Management Process. It reaches Firm-Specific specificity because it identifies specific internal roles (Information Security Officer, Information Technology Officer) and specific regulatory frameworks (NIST, FFIEC) used by the company.


fact: Chief Business Officer

reasoning: The paragraph describes the board's oversight structure and the reporting lines for cybersecurity information, which falls under Board Governance. It is classified as Firm-Specific because it identifies a specific management role (Chief Business Officer) responsible for reporting to the board, which distinguishes this governance structure.


fact: February 2023 cyberattack

reasoning: The paragraph is classified as Strategy Integration because it focuses on the materiality of past incidents and the potential for future material impact on financial results. It reaches the Quantified-Verifiable level of specificity because it explicitly references a specific past event ('February 2023 cyberattack') which is a verifiable fact.


reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the materiality of cybersecurity risks on the company's business strategy and financial condition. It is Generic Boilerplate because it lacks any specific domain terminology, firm-specific details, or verifiable facts.


fact: National Security Administration ("NSA")'s Cybersecurity Collaboration Center

fact: U.S. Cybersecurity and Infrastructure Security Agency's Critical Partnership

fact: Federal Bureau of Investigation ("FBI") InfraGard

fact: U.S. Coast Guard Area Maritime Security Committees and Cybersecurity Subcommittees

fact: Cyber-Hawaii

fact: Maritime Transportation System Information Sharing and Analysis Center ("MTS-ISAC")

reasoning: The paragraph details the specific external organizations and partnerships the company engages with for threat intelligence and information sharing, which is a component of their risk management process. Listing these specific entities distinguishes the company's cybersecurity posture, making it firm-specific.


fact: Security & Technology Committee

reasoning: The paragraph describes the board's oversight mechanism and information flow regarding cybersecurity incidents, placing it in Board Governance. It is classified as Firm-Specific because it names a specific board-level committee ('Security & Technology Committee') rather than a generic one.


fact: Information Security Steering Committee (ISSC)

fact: Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments

reasoning: The paragraph describes the structure and composition of a management-level committee (ISSC), which falls under Management Role. It is classified as Firm-Specific because it identifies a named internal committee and details the specific cross-functional departments involved in its composition.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity incidents on the company's business and financial condition, which falls under Strategy Integration per Rule 5. It contains no specific cybersecurity domain terms, firm-specific facts, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: Franklin Templeton

reasoning: The paragraph is primarily focused on the management of third-party cybersecurity risks, specifically detailing vendor compliance requirements. It is classified as Firm-Specific because it explicitly names 'Franklin Templeton' as the entity enforcing these vendor requirements, which distinguishes this disclosure from generic boilerplate.


fact: cybersecurity containment and remediation efforts

reasoning: The paragraph describes the use of third-party providers as a component of the company's internal incident response capabilities (containment and remediation), which falls under Risk Management Process rather than Third-Party Risk (which focuses on vendor oversight). The mention of 'containment and remediation' demonstrates domain-specific knowledge of incident response activities, elevating it to Domain-Adapted.


fact: vulnerability assessments

fact: January 2024

reasoning: The paragraph focuses on the board's oversight structure, including the audit committee's role and information flow, placing it firmly in Board Governance. It reaches Quantified-Verifiable specificity due to the mention of a specific date (January 2024) regarding a board training session.


fact: network security

fact: data encryption

fact: large language models

fact: artificial intelligence systems

reasoning: The paragraph is primarily about board oversight (Audit Committee and Board receiving reports), making Board Governance the primary category. It reaches Domain-Adapted specificity by referencing specific cybersecurity concepts like 'network security', 'data encryption', and 'large language models' that pass the ERM test.


fact: February 2023 ransomware attack

fact: ransomware

fact: credit monitoring

reasoning: The paragraph describes the impact and remediation of a specific, named cybersecurity incident (the February 2023 ransomware attack), which qualifies as Incident Disclosure and provides verifiable temporal context.


fact: CISO

reasoning: The paragraph describes the board's oversight structure and information flow regarding cybersecurity, placing it in Board Governance. It is classified as Firm-Specific because it explicitly identifies the CISO as the reporting officer, which is a specific management role.


reasoning: The paragraph describes the qualifications and experience of management personnel, which falls under Management Role. It does not contain domain-specific cybersecurity terminology, firm-specific cybersecurity leadership roles (as these are general corporate officer titles), or verifiable quantified claims, resulting in a Generic Boilerplate classification.


reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the material impact of cybersecurity risks on the company's business strategy and financial condition. It is Generic Boilerplate because it contains no domain-specific terminology, firm-specific organizational details, or externally verifiable facts.


fact: penetration testing firms

fact: forensic investigators

fact: vendor management standard

reasoning: The paragraph is primarily focused on the management of third-party cybersecurity risks, including the use of specific types of providers and vendor management processes. It reaches the Domain-Adapted level by referencing specific cybersecurity practices like penetration testing and forensic investigations, which demonstrate domain expertise beyond generic risk management language.


fact: Executive Director of IT

reasoning: The paragraph describes the Board and Audit Committee's oversight structure and reporting lines, which is the primary focus of Board Governance. It reaches Firm-Specific specificity by naming a specific management role ('Executive Director of IT') and includes domain-adapted terminology like 'vulnerability assessments'.


reasoning: The paragraph is classified as Strategy Integration because it provides a negative assertion regarding the material impact of cybersecurity threats on the company's business. It is Generic Boilerplate as it contains no specific domain terminology, firm-unique details, or verifiable facts.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity risks on the company's business and financial condition, which falls under Strategy Integration per the materiality rule. It contains no specific cybersecurity domain terms, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: March 2023

fact: $2.7 million

fact: independent forensic investigation

reasoning: The paragraph describes a specific cybersecurity incident, including its timeline, response, and financial impact, which directly constitutes Incident Disclosure. It is classified as Quantified-Verifiable due to the inclusion of a specific date and a precise dollar amount of loss.


fact: Marco Technologies

fact: Red Canary

fact: High Point Networks

fact: 24/7 monitoring

fact: end points

reasoning: The paragraph is primarily about the cybersecurity program's operational activities (vendor management, monitoring, backups), which falls under Risk Management Process. It reaches Quantified-Verifiable specificity because it names specific third-party vendors (Marco Technologies, Red Canary, High Point Networks) and provides a specific, verifiable metric for recovery time (Return to Operations objectives of less than 24 hours).


reasoning: The paragraph describes the reporting relationship between management and the board's audit committee, which is a core component of cybersecurity governance. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: Chief Information Officer (CIO)

fact: led the Century Communities IT efforts since 2016

fact: more than 20 years of experience as an IT leader

fact: reports to our Corporate General Counsel

reasoning: The paragraph focuses on the qualifications, reporting lines, and history of the Chief Information Officer, placing it squarely in Management Role. It reaches Quantified-Verifiable specificity because it includes a specific tenure duration ('since 2016') and a verifiable quantified experience claim ('more than 20 years').


reasoning: The paragraph is centrally focused on the company's requirements for third-party service providers, placing it squarely in the Third-Party Risk category. The language used is high-level and generic, lacking specific frameworks, tools, or verifiable metrics, which results in a Generic Boilerplate specificity level.


fact: patches

fact: vulnerability scanning

fact: intrusion detection tools

reasoning: The paragraph describes specific operational activities of the cybersecurity program, such as patching and vulnerability scanning, which classifies it as Risk Management Process. It reaches Domain-Adapted specificity by referencing technical cybersecurity practices like intrusion detection and vulnerability scanning that go beyond generic enterprise risk management language.


fact: Chief Technology Officer (the "CTO")

fact: Chief Information Security Officer (the "CISO")

reasoning: The paragraph describes the board's oversight structure and reporting lines, which falls under Board Governance. It is classified as Firm-Specific because it explicitly names the specific executive roles (CTO and CISO) responsible for reporting to the board.


reasoning: The paragraph describes the reporting lines and escalation procedures for cybersecurity issues, which constitutes board governance oversight. It contains no specific domain terminology, unique firm identifiers, or verifiable facts, resulting in a generic boilerplate classification.


fact: cybersecurity certifications

fact: third-party audit results

fact: technical and organizational controls

reasoning: The paragraph is centrally focused on the company's process for evaluating cybersecurity risks posed by third-party suppliers, placing it squarely in the Third-Party Risk category. It achieves Domain-Adapted specificity by referencing specific cybersecurity artifacts such as certifications, audit results, and technical and organizational controls, which demonstrate domain knowledge beyond generic risk management language.


reasoning: The paragraph consists entirely of generic boilerplate statements regarding the importance of data security and the existence of a program, without providing any substantive details on governance, management, or specific risk management activities.


fact: cybersecurity risk assessment

reasoning: The paragraph is centrally focused on the company's third-party risk management program, specifically vendor assessment procedures and contractual requirements. It reaches the Firm-Specific level because it identifies the specific internal teams ('information security and enterprise risk management teams') responsible for conducting these assessments.


reasoning: The paragraph is classified as Incident Disclosure because it describes a specific, real-world cybersecurity event. It reaches the Quantified-Verifiable level of specificity due to the inclusion of the exact date the incident was detected.


fact: Vice President and Chief Information Security Officer (CISO)

reasoning: The paragraph describes the board's oversight structure and delegation of cybersecurity responsibilities to the Audit Committee, placing it squarely in Board Governance. It reaches Firm-Specific specificity because it identifies a specific executive role (Vice President and Chief Information Security Officer) involved in the reporting structure.


reasoning: The paragraph is entirely focused on the company's processes for managing cybersecurity risks associated with third-party service providers, placing it squarely in the Third-Party Risk category. It uses standard audit and risk management terminology that does not demonstrate specific cybersecurity domain expertise, nor does it contain firm-specific or verifiable facts.


fact: CIO/CDO

fact: control maturity assessments

fact: prevention, detection, mitigation, and remediation

reasoning: The paragraph is primarily about the board and committee oversight structure, placing it in Board Governance. It reaches Firm-Specific level due to the mention of the specific C-level role 'CIO/CDO' and includes domain-adapted terminology like 'control maturity assessments'.


fact: Chief Operating Officer

reasoning: The paragraph is primarily about the governance structure and the reporting relationship between the Chief Operating Officer and the Audit Committee, which falls under Board Governance. It is classified as Firm-Specific because it identifies the specific management role (Chief Operating Officer) responsible for reporting to the Board, distinguishing it from generic 'management' references.


fact: September 14, 2023

fact: social engineering attack

fact: loyalty program database

fact: IRP

reasoning: The paragraph describes a specific, real-world cybersecurity incident, making it Incident Disclosure. It reaches Quantified-Verifiable specificity because it includes a precise date (September 14, 2023) regarding the event.


reasoning: The paragraph is classified as Strategy Integration because it explicitly addresses the potential for cybersecurity risks to materially affect the company's business strategy and financial condition, aligning with the SEC's forward-looking materiality disclosure requirements. It contains no specific cybersecurity practices, firm-unique identifiers, or verifiable claims, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is a forward-looking disclaimer regarding the effectiveness of security measures rather than a description of governance, management, or specific risk management processes. It contains no substantive cybersecurity details, domain terminology, or verifiable facts.


fact: NIST CSF

fact: CISO

fact: endpoint detection

fact: security incident response and event management

fact: privileged access management

reasoning: The paragraph is primarily about the cybersecurity program's activities and framework adoption, making it Risk Management Process. It reaches Firm-Specific specificity because it identifies the CISO as the responsible party for the program.


fact: security and privacy addenda

reasoning: The paragraph is primarily focused on the risks posed by third-party suppliers and the contractual measures taken to mitigate them, placing it squarely in Third-Party Risk. It reaches Domain-Adapted specificity by referencing specific contractual mechanisms like 'security and privacy addenda,' which demonstrates domain knowledge beyond generic risk management language.


reasoning: The paragraph describes the reporting chain for cybersecurity risks from an employee to the CEO and the Board, which is a governance structure description. It contains no specific domain terminology, unique organizational details, or verifiable facts, making it generic boilerplate.


fact: due diligence on the cybersecurity practices and controls

fact: contractual provisions requiring the providers to maintain appropriate cybersecurity measures

reasoning: The paragraph is centrally focused on the management of third-party cybersecurity risks, including due diligence and contractual requirements. It reaches the Domain-Adapted level because it describes specific cybersecurity-related vendor management practices (due diligence on controls, contractual security requirements) that go beyond generic enterprise risk management language.


reasoning: The paragraph is a cross-reference to Item 1A and does not contain substantive cybersecurity disclosures or specific program details.


fact: NEE Management

fact: NEER

reasoning: The paragraph primarily describes the board's oversight role regarding the provision of cybersecurity services, fitting the Board Governance category. It is classified as Firm-Specific because it names specific corporate entities (NEE Management and NEER) responsible for providing these services, which distinguishes this arrangement from generic disclosures.


fact: National Institute of Standards and Technology (NIST) governance requirements and cybersecurity framework

reasoning: The paragraph primarily describes the board's oversight role via the audit committee, placing it in Board Governance. It reaches Domain-Adapted specificity by referencing the NIST cybersecurity framework, which demonstrates domain-specific knowledge beyond generic risk management language.


fact: IT Security team

reasoning: The paragraph focuses on the company's oversight of third-party vendors, making 'Third-Party Risk' the primary category. It is classified as 'Firm-Specific' because it identifies a specific internal entity, the 'IT Security team', responsible for monitoring vendor compliance.


fact: The Business Continuity Institute (BCI)

fact: Disaster Recovery Institute International (DRII)

fact: threat-agnostic plans

fact: business impact analyses

reasoning: The paragraph describes the company's business resilience and continuity program, which falls under Risk Management Process. It reaches Quantified-Verifiable specificity because it explicitly names specific external organizations (BCI, DRII) and a specific ISO standard (ISO 22301) that the company uses, which are verifiable claims.


reasoning: The paragraph is classified as Strategy Integration because it explicitly includes the forward-looking materiality assessment required by SEC Item 106(b)(2). It contains no domain-specific terminology, firm-unique facts, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: Kroll

fact: November 2022

fact: September 2023

fact: penetration tests

fact: network architecture

fact: tabletop exercises

fact: Century Communities Information Security Team

fact: Information Security Incident Response Policy

reasoning: The paragraph describes the company's engagement with a third party (Kroll) to assess and improve its security program, which falls under Risk Management Process. It reaches Quantified-Verifiable specificity because it names a specific third-party firm (Kroll) and provides specific dates for engagements (November 2022, September 2023).


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity risks on the company's business and financial condition, which falls under Strategy Integration per Rule 5. It contains no specific cybersecurity domain terms, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: malware

fact: ransomware

fact: computer viruses

reasoning: The paragraph is classified as Strategy Integration because it explicitly states that no cybersecurity risks or incidents have materially affected the company's business strategy or financial condition, which is a core materiality assessment. It is Domain-Adapted because it references specific threat types like malware, ransomware, and computer viruses, which pass the ERM test for domain expertise.


fact: Fiscal 2024

fact: $2.7 million of loss

reasoning: The paragraph describes a specific cybersecurity incident, the company's response, and the financial impact, which is the definition of Incident Disclosure. The inclusion of a specific dollar amount ($2.7 million) and a specific fiscal year makes it Quantified-Verifiable.


fact: phishing sites

reasoning: The paragraph is classified as Incident Disclosure because it describes specific past cybersecurity events (phishing attacks targeting the online banking platform). It reaches Domain-Adapted specificity by referencing 'phishing sites,' which is a specific cybersecurity threat type.


reasoning: The paragraph describes the board's oversight structure and delegation of cybersecurity risk to the Audit Committee, which is a classic Board Governance topic. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph describes the company's general approach to identifying and managing cybersecurity risks, which falls under Risk Management Process. It contains only high-level, generic language regarding risk management and industry standards, failing to meet the threshold for domain-adapted or firm-specific terminology.


fact: VP of Information Technology

reasoning: The paragraph focuses on identifying the specific management team members responsible for cybersecurity oversight, which aligns with the Management Role category. It is classified as Firm-Specific because it lists a specific leadership title ('VP of Information Technology') involved in the cybersecurity governance structure.


fact: CISO reports to our Chief Financial Officer

fact: over 20 years of information security experience

fact: over four years as a director in the information security management practice of a big four accounting firm

fact: B.S. in Network Security

fact: Information Security Steering Committee ("ISSC")

fact: annual cybersecurity risk assessments

fact: internal and third-party information security audits

reasoning: The paragraph is primarily about the CISO's role, reporting lines, qualifications, and the management-level committee (ISSC) they lead, fitting the Management Role category. It reaches Quantified-Verifiable specificity due to the inclusion of specific, verifiable career duration metrics (e.g., 'over 20 years', 'over four years').


fact: Chief Information Security Officer

fact: three times per year

reasoning: The paragraph primarily describes the board's oversight structure and reporting lines, placing it in Board Governance. It reaches Quantified-Verifiable specificity because it cites a specific, verifiable certification held by a board member (NACD's CERT Certificate in Cybersecurity Oversight) and a specific reporting cadence (three times per year).


fact: security questionnaires

fact: statements of work

fact: information security addenda

fact: audits and compliance reviews

fact: network infrastructure

reasoning: The paragraph is centrally focused on the management of third-party cybersecurity risks, fitting the Third-Party Risk category. It reaches Domain-Adapted specificity by referencing specific cybersecurity assessment mechanisms like security questionnaires, information security addenda, and compliance reviews, which demonstrate domain knowledge beyond generic risk management language.


reasoning: The paragraph describes the educational process and expertise of the Audit Committee regarding cybersecurity oversight, which falls under Board Governance. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is primarily focused on the requirements and oversight imposed on third-party service providers, placing it squarely in Third-Party Risk. It contains no specific domain terminology, firm-unique identifiers, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: ISO

reasoning: The paragraph describes the reporting relationship between the Information Security Officer and the Board, which is a core governance function. It is classified as Firm-Specific because it identifies a specific role (ISO) and a specific regulatory framework (Interagency Guidelines for Safeguarding Customer Information).


reasoning: The paragraph is primarily focused on the risks posed by third-party service providers and the company's general approach to managing those risks, fitting the Third-Party Risk category. It lacks specific domain terminology, firm-unique details, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition

reasoning: The paragraph is classified as Strategy Integration because it explicitly addresses the materiality of cybersecurity risks on the company's business strategy and financial condition, meeting the criteria for a negative assertion assessment. It is Firm-Specific because it contains a company-specific declaration regarding the current impact of cybersecurity threats on its operations.


reasoning: The paragraph is explicitly focused on the company's oversight of third-party vendors and service providers, placing it squarely in the Third-Party Risk category. It contains no specific domain terminology, firm-unique details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: Chief Risk Officer

reasoning: The paragraph describes how the cybersecurity program is integrated into the broader enterprise risk management framework, which is a core component of the risk management process. It is classified as Firm-Specific because it identifies a specific management role (Chief Risk Officer) responsible for this oversight.


fact: vendor risk management platform

fact: System and Organization Controls ("SOC") 1 or SOC 2 report

reasoning: The paragraph is centrally focused on the management of third-party vendor risks, specifically detailing the requirements imposed on vendors (SOC 1/2 reports). It reaches the Domain-Adapted level by referencing specific cybersecurity compliance standards (SOC 1/2) and vendor risk management platforms, which demonstrates domain-specific knowledge beyond generic risk management language.


fact: SOC2 T2

fact: penetration testing

fact: ISO 27001 certification

reasoning: The paragraph is centrally focused on the company's third-party risk management program, including vendor assessment and contractual requirements. It reaches Domain-Adapted specificity by referencing specific cybersecurity artifacts like SOC2 T2, penetration testing, and ISO 27001 certification.


fact: IT Security Director

fact: Chief Information Officer

fact: threat intelligence

reasoning: The paragraph focuses on the reporting lines and responsibilities of the IT Security Director, placing it squarely in Management Role. It reaches Firm-Specific specificity because it identifies specific leadership roles (IT Security Director, Chief Information Officer) that are not generic board or executive roles.


fact: chief information officer ("CIO")

fact: director of information technology ("IT")

fact: Contran

fact: ISA

fact: security engineering

fact: cyber threat detection and response

reasoning: The paragraph primarily details the leadership structure, reporting lines, and qualifications of the individuals managing cybersecurity programs across the company and its subsidiaries, fitting the Management Role category. It reaches Firm-Specific level by identifying specific roles (CIO, Director of IT) and external entities/agreements (Contran, ISA).


fact: Chief Information Officer ("CIO")

fact: 25 years of experience

fact: multidisciplinary incident response team

reasoning: The paragraph is primarily about the Board's oversight structure (Board Governance), as it details the reporting lines and oversight responsibilities of the Board and Audit Committee. The specificity is Quantified-Verifiable because it includes a specific, verifiable claim regarding the CIO's years of experience.


reasoning: The paragraph is a cross-reference to another section of the filing and contains no substantive cybersecurity disclosure, thus falling under None/Other and Generic Boilerplate.


reasoning: This paragraph is a cross-reference to another section of the filing and contains no substantive cybersecurity disclosure, thus falling under None/Other and Generic Boilerplate.


fact: managed cybersecurity service providers

reasoning: The paragraph describes the use of third parties as part of the company's internal risk management program, making it a Risk Management Process disclosure. It reaches Domain-Adapted specificity by referencing specific cybersecurity practices like penetration testing and managed security services.


fact: CIO has primary responsibility for the development, operation, and maintenance of the Company's information security program

fact: 19 years of experience in technology risk management

fact: 11 of which have been with the Company

fact: SANS Global Information Security Leader

fact: Certified Information Systems Auditor

reasoning: The paragraph focuses on the CIO's responsibilities and qualifications, placing it squarely in Management Role. It reaches Quantified-Verifiable specificity due to the inclusion of specific years of experience and named professional certifications.


reasoning: The paragraph is a cross-reference to Item 1A (Risk Factors) and does not contain substantive cybersecurity disclosure, making it None/Other.


reasoning: The paragraph focuses on the use of third-party service providers for cybersecurity risk management, which falls under Third-Party Risk. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph describes the board's oversight structure and delegation of cybersecurity responsibilities to the Audit Committee, which is a classic Board Governance disclosure. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: CDO

fact: interim CISO

fact: over 20 years of both leading and transforming technology

fact: master's degree in business administration and management from Ecole Sup rieure de Commerce de Chamb ry

fact: nearly 20 years of experience developing and leading security and risk programs

fact: threat management

fact: bachelor's degree in management information systems and marketing from Miami University

reasoning: The paragraph is classified as Management Role because it details the specific responsibilities, reporting lines, and professional qualifications of the CDO and interim CISO. It is Quantified-Verifiable because it includes specific, checkable claims regarding years of experience and educational degrees.


reasoning: This paragraph is a cross-reference to another section of the filing (Item 1A) and contains no substantive cybersecurity disclosure.


fact: December 15, 2020

fact: ransomware incident

reasoning: The paragraph is classified as Incident Disclosure because it describes a specific past cybersecurity event (the 2020 ransomware incident) and its impact. It reaches Quantified-Verifiable specificity due to the inclusion of a specific date (December 15, 2020) associated with that incident.


fact: National Institute of Standards and Technology Cybersecurity Framework

fact: multi-layered defenses

fact: patching of vulnerabilities

reasoning: The paragraph primarily describes the cybersecurity program's methodology, framework adoption (NIST CSF), and operational activities, fitting the Risk Management Process category. It reaches Domain-Adapted specificity by referencing specific cybersecurity concepts like 'multi-layered defenses' and 'patching of vulnerabilities' that pass the ERM test.


fact: CISO

fact: CIO

fact: over 20 years

fact: undergraduate degree in Information Systems from Xavier University

fact: MBA from Michigan State

fact: over 25 Information Technology and Cybersecurity certifications

fact: Certified Information Systems Security Professional

fact: Certified Cloud Security Professional

fact: Certified Information Security Manager

reasoning: The paragraph focuses on the CISO's reporting lines, responsibilities, and qualifications, making it a clear Management Role classification. It reaches the highest specificity level because it contains multiple verifiable claims, such as specific degrees, years of experience, and professional certifications.


fact: vulnerability scanning

fact: Penetration testing

fact: Threat intelligence monitoring

fact: threat intelligence feeds

reasoning: The paragraph is primarily about the activities and methodologies of the cybersecurity program, fitting the Risk Management Process category. It reaches Domain-Adapted specificity by referencing specific cybersecurity practices like vulnerability scanning, penetration testing, and threat intelligence feeds, which pass the ERM test.


fact: external and internal penetration testing

fact: service organization controls ("SOC") reports

fact: vulnerability and penetration testing

fact: incident response processes

fact: access reviews and controls

fact: encryption standards

fact: disaster recovery

reasoning: The paragraph is primarily focused on the oversight and assessment of third-party service providers, making Third-Party Risk the most appropriate category. It reaches Domain-Adapted specificity by referencing specific cybersecurity concepts like SOC reports, penetration testing, and encryption standards.


fact: malware

fact: computer virus attacks

reasoning: The paragraph is classified as Strategy Integration because it explicitly states that cybersecurity risks have not materially affected the company's business strategy, results of operations, or financial condition. It is Domain-Adapted because it references specific threat types like 'malware' and 'computer virus attacks' which demonstrate cybersecurity domain knowledge.


fact: Chief Information Officer

fact: Senior Vice President Internal Audit

reasoning: The paragraph is primarily about the Board's oversight structure and reporting lines for cybersecurity, placing it in Board Governance. It reaches Firm-Specific specificity because it identifies specific executive roles (Chief Information Officer, Senior Vice President Internal Audit) involved in the reporting process.


fact: Change Healthcare

fact: UnitedHealth Group

fact: Exogen device

reasoning: The paragraph is classified as Incident Disclosure because it describes a specific, real-world cybersecurity incident involving a third-party vendor (Change Healthcare) and its operational impact on the company. It reaches the Quantified-Verifiable level of specificity due to the inclusion of specific dates (March 7 and March 18, 2024) and named entities.


fact: Vice President of IT

fact: denial-of-service attacks

fact: phishing

fact: ransomware

fact: social engineering

fact: vendor software supply chain compromises

reasoning: The paragraph is primarily focused on defining the management responsibility for the information security program (specifically the Vice President of IT), which aligns with the Management Role category. It reaches Firm-Specific specificity due to the inclusion of the 'Vice President of IT' title, and Domain-Adapted specificity due to the listing of specific cyber threat vectors like ransomware and social engineering.


fact: data exfiltration

reasoning: The paragraph describes the company's criteria for assessing the materiality of cybersecurity incidents, which falls under Strategy Integration. It reaches Domain-Adapted specificity by referencing 'data exfiltration,' a specific cybersecurity concept that passes the ERM test.


fact: CDIO

fact: security council

fact: Legal and Regulatory, Corporate Security, Network Engineering, Internal Audit, Finance & Accounting and Risk and IT Infrastructure

fact: April 2024

reasoning: The paragraph primarily describes the management-level organizational structure, specifically the CDIO-led security council and cross-functional teams responsible for oversight and materiality determinations. It reaches Level 4 specificity due to the mention of a specific, verifiable incident date (April 2024).


fact: Risk and Governance Committee

fact: Head of Information Technology

fact: Certified Information Systems Security Professional

reasoning: The paragraph is primarily about the board's delegation of oversight to a specific committee, making it Board Governance. It reaches Firm-Specific level because it names a specific committee (Risk and Governance Committee) and a specific role (Head of Information Technology) with a professional certification.


reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the materiality of cybersecurity risks on the company's business strategy and financial condition, satisfying the SI materiality rule. It is Generic Boilerplate because it contains no domain-specific terminology, firm-specific organizational details, or externally verifiable facts.


reasoning: The paragraph is entirely focused on the company's oversight of third-party vendors, including contractual requirements and onboarding procedures, making Third-Party Risk the clear category. It lacks specific domain terminology, firm-unique identifiers, or verifiable facts, resulting in a Generic Boilerplate classification.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity risks on the company's business and financial condition, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity risks on the company's business strategy and financial condition, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific facts, or verifiable claims, resulting in a Generic Boilerplate specificity level.


reasoning: This paragraph is a biographical summary of an executive's career history and contains no information related to cybersecurity governance, management, or operations.


fact: Incident Response Team

reasoning: The paragraph describes the operational activities and escalation procedures of the company's cybersecurity program, placing it in Risk Management Process. It is classified as Firm-Specific because it identifies a named internal entity, the 'Incident Response Team,' which distinguishes the company's organizational structure.


reasoning: The paragraph focuses exclusively on the oversight of third-party service providers, fitting the Third-Party Risk category. It lacks specific domain terminology, firm-unique details, or verifiable claims, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is a cross-reference to another section of the filing and contains no substantive cybersecurity disclosure, thus falling under None/Other and Generic Boilerplate.


fact: Audit Committee

fact: data security posture

fact: incident response plan

reasoning: The paragraph is primarily about the Audit Committee's oversight responsibilities and frequency of engagement, which falls under Board Governance. It reaches Domain-Adapted specificity by referencing specific cybersecurity concepts like 'data security posture' and 'incident response plan' in the context of the committee's review.


reasoning: The paragraph describes the reporting structure and frequency of cybersecurity updates to the Board and Audit Committee, which is a core Board Governance topic. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: ERMC

fact: Vice President of Information Technology

fact: over 20 years of experience

reasoning: The paragraph focuses on the organizational structure and specific management roles (VP of IT, ERMC) responsible for cybersecurity, fitting the Management Role category. It achieves Quantified-Verifiable specificity due to the inclusion of a specific, verifiable claim regarding an employee's years of experience.


fact: Risk Management Committee

fact: EVP ERM

reasoning: The paragraph primarily describes the governance structure and reporting lines between the Board's Risk Management Committee and management, placing it in Board Governance. It is classified as Firm-Specific because it identifies a specific committee (Risk Management Committee) and a specific management role (EVP ERM) involved in the oversight process.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity risks on the company's business strategy and financial condition, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific organizational details, or externally verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is centrally focused on the oversight and due diligence of third-party service providers, which defines the Third-Party Risk category. It lacks specific domain terminology, firm-specific details, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: CISO

fact: Audit, Risk and Finance Committee

fact: Information Security group

fact: Information Security Program

reasoning: The paragraph describes the governance chain and reporting structure between management and the board committee, which falls under Board Governance. It is classified as Firm-Specific because it names the specific board committee ('Audit, Risk and Finance Committee') and the CISO role.


reasoning: The paragraph is primarily a materiality assessment regarding cybersecurity threats, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity incidents on the company's business, which falls under Strategy Integration per the materiality rule. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is centrally focused on the oversight of third-party service providers, fitting the Third-Party Risk category. It lacks specific domain terminology, firm-unique identifiers, or verifiable claims, relying instead on generic descriptions of risk assessment processes.


reasoning: The paragraph is centrally focused on the oversight and management of third-party service providers, clearly falling under Third-Party Risk. It lacks specific domain terminology, named programs, or verifiable facts, resulting in a Generic Boilerplate classification.


reasoning: The paragraph provides a negative assertion regarding the materiality of cybersecurity incidents, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific identifiers, or externally verifiable facts, resulting in Generic Boilerplate specificity.


fact: Chief Information Officer

fact: vCISO

reasoning: The paragraph primarily describes the board's oversight structure and delegation of cybersecurity responsibilities to the Audit Committee, fitting the Board Governance category. It reaches Firm-Specific specificity by naming specific roles (Chief Information Officer, vCISO) involved in the reporting structure.


reasoning: The paragraph primarily provides a negative assertion regarding the material impact of cybersecurity risks on the company's business and financial condition, which classifies it as Strategy Integration. It contains no specific, verifiable, or domain-unique facts, resulting in a Generic Boilerplate specificity level.


fact: Audit and Finance Committee

fact: Chief Information Security Officer

fact: Chief Technology and Digital Officer

reasoning: The paragraph primarily describes the board's oversight structure and the reporting lines to the Audit and Finance Committee, placing it in Board Governance. It is classified as Firm-Specific because it identifies specific named roles (CISO, Chief Technology and Digital Officer) and a specific committee (Audit and Finance Committee) involved in the governance process.


fact: ORIX USA

fact: ORIX USA's cybersecurity program

reasoning: The paragraph describes how the company relies on the cybersecurity program of its external manager (ORIX USA) to manage its risks, which is a description of their risk management process. It is classified as Firm-Specific because it identifies the specific entity (ORIX USA) and its specific program that the company relies upon.


fact: advanced persistent threats

fact: September 2022

fact: Rockstar Games

fact: Grand Theft Auto

fact: 2K Games

reasoning: The paragraph is primarily an Incident Disclosure because it details specific, real-world cybersecurity incidents (the September 2022 intrusions at Rockstar Games and 2K Games). It reaches Quantified-Verifiable specificity because it cites specific dates and named internal business units/products involved in the incidents.


fact: Chief Technology Officer

fact: Chief Operating Officer

fact: over 10 years of experience overseeing cybersecurity functions

fact: over 5 years of experience overseeing cybersecurity and IT functions

reasoning: The paragraph is primarily about the governance structure, specifically the delegation of oversight from the Board to the Audit Committee, which defines it as Board Governance. It reaches Quantified-Verifiable specificity because it includes specific, verifiable tenure claims regarding the experience of the CTO and COO.


fact: Vice President, IT Security and Compliance

fact: IT Security Director

fact: threat intelligence

reasoning: The paragraph is primarily focused on defining the roles, reporting lines, and responsibilities of specific management positions (VP, IT Security and Compliance; IT Security Director), making it a Management Role classification. It reaches Firm-Specific specificity because it identifies specific leadership titles (VP, IT Security and Compliance; IT Security Director) that distinguish the company's management structure.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity risks on the company's business and financial condition, which falls under Strategy Integration per Rule 5. It contains no specific cybersecurity facts, domain terminology, or firm-specific details, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is a negative assertion regarding the absence of material cybersecurity incidents, which falls under Strategy Integration per the materiality rule. It contains no domain-specific terminology, firm-specific organizational details, or externally verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: third-party risk management program

fact: vendor risk assessments

reasoning: The paragraph is centrally focused on the company's third-party risk management program and the specific activities involved in assessing vendor security. It is classified as Domain-Adapted because it uses specific cybersecurity terminology like 'vendor risk assessments' and 'third-party risk management program' which demonstrate domain expertise beyond generic enterprise risk management language.


fact: Task Force

reasoning: The paragraph describes the governance structure and reporting lines between an internal 'Task Force' and the Audit Committee, placing it squarely in Board Governance. It is Firm-Specific because it identifies a specific internal body ('Task Force') responsible for these governance activities.


reasoning: The paragraph describes the governance structure for cybersecurity oversight, involving the Board and Audit Committee, which falls under Board Governance. It contains no specific domain terminology, firm-unique details, or verifiable facts, resulting in Generic Boilerplate specificity.


fact: CTO

reasoning: The paragraph primarily describes the governance structure and reporting lines between the CTO and the Board of Directors, making it Board Governance. It is classified as Firm-Specific because it identifies a specific executive role (CTO) responsible for reporting to the Board.


reasoning: The paragraph describes the oversight responsibilities of the Audit Committee regarding cybersecurity, which is a core Board Governance topic. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, relying entirely on generic governance language.


fact: Firewalls

fact: intrusion detection/prevention systems (IDS/IPS)

fact: data loss prevention (DLP)

fact: Mobile Device Management

fact: principle of least privilege

fact: Encryption

fact: at rest and in transit

fact: phishing

reasoning: The paragraph describes the specific technical controls and security measures implemented within the company's cybersecurity program, placing it in Risk Management Process. It reaches Domain-Adapted specificity by referencing specific cybersecurity tools and architectural concepts like IDS/IPS, DLP, MDM, and the principle of least privilege, which demonstrate domain expertise.


fact: FactSet Audit Committee

fact: ELT

reasoning: The paragraph primarily describes the governance structure and reporting lines for cybersecurity oversight, specifically mentioning the FactSet Audit Committee and the ELT. It is classified as Firm-Specific because it names the specific internal committee and management team responsible for receiving security review reports.


reasoning: The paragraph is a high-level, generic risk disclosure that does not describe specific governance, management roles, or operational processes, making it boilerplate.


fact: advanced persistent threats

reasoning: The paragraph is classified as Strategy Integration because it explicitly assesses the materiality of past incidents (stating no material incidents occurred in the two-year period) and discusses the potential material adverse effects on business operations. It reaches Domain-Adapted specificity by referencing 'advanced persistent threats,' which demonstrates cybersecurity domain knowledge beyond generic risk management language.


fact: Change Healthcare, a subsidiary of UnitedHealth Group

fact: EXOGEN device

reasoning: The paragraph is primarily an Incident Disclosure because it details a specific third-party cybersecurity incident (Change Healthcare) and its operational impact on the company. It reaches Quantified-Verifiable specificity because it names specific external entities (Change Healthcare, UnitedHealth Group) and a specific product line (EXOGEN) affected by the event.


reasoning: The paragraph outlines the company's policy for disclosing material cybersecurity incidents, which falls under Incident Disclosure. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: CISO

fact: Audit Committee

fact: threat landscape

fact: client security audits

reasoning: The paragraph is primarily about the board's delegation of cybersecurity oversight to the Audit Committee and the reporting structure between the CISO and the Board/Committee, which falls under Board Governance. It is classified as Firm-Specific because it identifies the specific role (CISO) and committee (Audit Committee) responsible for this oversight, and includes domain-specific terminology like 'threat landscape' and 'client security audits'.


fact: cybersecurity incident related to employee interactions with suspicious websites

reasoning: The paragraph describes a specific cybersecurity incident (employee interaction with suspicious websites) and its containment, which falls under Incident Disclosure. It is classified as Domain-Adapted because it describes a specific threat vector (suspicious websites) rather than generic risk language.


reasoning: The paragraph is a standard forward-looking disclaimer regarding potential cybersecurity risks and impacts, which does not describe specific governance, management, or operational processes. It concludes with a cross-reference to the Risk Factors section, confirming its status as boilerplate disclosure.


reasoning: The paragraph is a cross-reference to Item 1A (Risk Factors) and contains no substantive cybersecurity program, governance, or management information, making it 'None/Other' and 'Generic Boilerplate'.


reasoning: The paragraph outlines the responsibilities of a specific management role, placing it in the Management Role category. It does not contain verifiable facts, domain-specific terminology that passes the ERM test, or firm-specific titles (as 'Director, IT' is explicitly excluded by the rules), resulting in Generic Boilerplate specificity.


fact: Director of IT Security and Compliance

fact: IT Steering Committee

fact: vulnerability assessments

fact: continuous monitoring

reasoning: The paragraph is primarily about the activities and processes used to manage cybersecurity risk (RMP), such as assessments and monitoring. It reaches Firm-Specific specificity because it names specific roles (Director of IT Security and Compliance) and a specific internal committee (IT Steering Committee).


fact: least-privilege

fact: phishing awareness exercises

fact: security-by-design

reasoning: The paragraph describes specific cybersecurity program activities like framework adoption (ISO 27001), access control principles (least-privilege), and training methodologies (phishing exercises, security-by-design), which classifies it as Risk Management Process. It reaches Domain-Adapted specificity by using these specific cybersecurity concepts that pass the ERM test.


fact: independent third party auditors to validate our risk management program

fact: monitor and test our safeguards

reasoning: The paragraph is primarily focused on the oversight and requirements imposed on third-party service providers, making it a Third-Party Risk disclosure. It reaches the Domain-Adapted level because it references specific cybersecurity activities like 'monitor and test our safeguards' and 'validate our risk management program' which demonstrate domain knowledge beyond generic risk management.


fact: Marriott brand standards

reasoning: The paragraph is primarily about the cybersecurity responsibilities of third-party franchisees and licensees, making it a clear Third-Party Risk disclosure. It is classified as Firm-Specific because it identifies 'Marriott brand standards' as the specific mechanism used to enforce security requirements on these external parties.


reasoning: The paragraph is primarily a negative assertion regarding the absence of material cybersecurity incidents to date, which falls under Strategy Integration per the materiality rule. It contains no specific cybersecurity measures, roles, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: defense in depth

fact: zero trust

fact: phishing email simulations

reasoning: The paragraph describes the company's cybersecurity program activities, such as risk assessment and specific security controls, placing it firmly in Risk Management Process. It reaches Domain-Adapted specificity by referencing specific cybersecurity concepts like 'defense in depth', 'zero trust', and 'phishing email simulations' that pass the ERM test.


reasoning: The paragraph describes the responsibilities and qualifications of a specific management role, which falls under Management Role. It does not contain verifiable claims, firm-specific titles (as the title lacks a security qualifier), or domain-specific terminology that would elevate the specificity level.


reasoning: The paragraph describes the use of external service providers to evaluate and enhance security policies, which is a standard component of a risk management program. It contains no specific domain terminology, firm-unique details, or verifiable claims, resulting in a Generic Boilerplate classification.


reasoning: The paragraph is a cross-reference to another section of the filing and contains no substantive cybersecurity disclosure, making it None/Other and Generic Boilerplate.


fact: CISO

fact: CIO

fact: Technology & Operations Committee

fact: program maturity

reasoning: The paragraph focuses on the governance structure and reporting lines between management and the board, specifically the Audit Committee and the Technology & Operations Committee. It is classified as Firm-Specific because it identifies specific leadership roles (CISO, CIO) and a named board committee (Technology & Operations Committee) that distinguish the company's governance structure.


fact: 2025 Cybersecurity Incident

fact: forensic investigation

fact: threat actor

reasoning: The paragraph is classified as Incident Disclosure because it describes the timeline and nature of a specific, real-world cybersecurity event. It reaches the Quantified-Verifiable level of specificity due to the inclusion of specific dates (August 5-8, 2025) related to the incident.


reasoning: The paragraph describes the board's oversight structure and reporting cadence, which is the primary focus of Board Governance. It contains no specific cybersecurity tools, firm-unique identifiers, or verifiable facts, making it Generic Boilerplate.


fact: November 2023

fact: cyber response protocol

reasoning: The paragraph is primarily an Incident Disclosure because it details a specific past cybersecurity event (November 2023), the response, and the remediation, despite also containing a materiality assessment. It reaches Quantified-Verifiable specificity due to the inclusion of a specific date (November 2023) associated with the incident.


fact: intelligence sharing about emerging threats

fact: Arizona Cyber Threat Response Alliance ("ACTRA")

fact: The Internet and Television Association ("NCTA")

reasoning: The paragraph describes the company's participation in threat intelligence sharing programs, which is a core component of their risk management process. It reaches the Quantified-Verifiable level because it names specific external organizations (ACTRA and NCTA) with which the company collaborates, which are verifiable facts.


reasoning: The paragraph describes the responsibilities of executive management regarding cybersecurity oversight, which falls under Management Role. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is centrally focused on the management of third-party cybersecurity risks, specifically vendor assessments and monitoring. It lacks specific domain terminology, firm-unique details, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: contractually obligated to notify us if they experience certain incidents

reasoning: The paragraph is centrally focused on the management of third-party cybersecurity risks, specifically regarding due diligence and contractual obligations. It does not contain domain-specific terminology (e.g., SOC 2, encryption requirements), firm-specific entities, or verifiable claims, resulting in a Generic Boilerplate specificity level.


reasoning: This paragraph is an introductory or summary statement that does not describe any specific cybersecurity governance, management, or risk processes, making it 'None/Other' and lacking any specific facts.


fact: October 2023

fact: two-step verification

fact: Security Operations

reasoning: The paragraph is classified as Incident Disclosure because it details a specific, real-world cybersecurity event (the October 2023 incident) and the subsequent remediation steps. It reaches the Quantified-Verifiable level of specificity due to the inclusion of the specific date of the incident.


fact: unauthorized access of an employee's email account

reasoning: The paragraph describes a specific cybersecurity incident (unauthorized email access and fund diversion) that occurred in 2024, making it an Incident Disclosure. It reaches Quantified-Verifiable specificity because it cites a specific year (2024) associated with the event.


fact: scanning our internal network and infrastructure

fact: vulnerability testing

reasoning: The paragraph describes the company's cybersecurity program activities, such as vulnerability testing and network scanning, which falls under Risk Management Process. It is classified as Domain-Adapted because it references specific cybersecurity practices like network scanning and vulnerability testing that go beyond generic risk management language.


fact: Vice President, Finance and Controller

reasoning: The paragraph describes the oversight structure and reporting lines to the Audit Committee, which falls under Board Governance. It is classified as Firm-Specific because it identifies specific executive roles (Senior Vice President and General Counsel, Vice President, Finance and Controller) involved in the governance process.


reasoning: The paragraph consists entirely of generic, high-level statements about the importance of cybersecurity and commitment to security without describing any specific governance, management, risk processes, or incidents. It functions as an introductory disclaimer rather than a substantive disclosure.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity incidents on the company's business strategy and financial condition, which falls under Strategy Integration per Rule 5. It contains no specific cybersecurity domain terminology, firm-specific organizational details, or externally verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph consists entirely of forward-looking risk disclaimers and a negative assertion regarding past incidents, which does not constitute substantive cybersecurity disclosure under the provided rules.


reasoning: The paragraph focuses exclusively on the Board of Directors' oversight structure and reporting lines, placing it squarely in Board Governance. It contains no specific cybersecurity domain terminology, firm-unique identifiers, or verifiable claims, resulting in a Generic Boilerplate classification.


reasoning: The paragraph focuses on the company's process for evaluating third-party cybersecurity, which falls under Third-Party Risk. It contains no domain-specific terminology, firm-specific details, or verifiable claims, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph describes the company's cybersecurity program activities, placing it in Risk Management Process. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: governance, risk and compliance reviews

reasoning: The paragraph describes the company's approach to identifying and assessing cybersecurity risks, which falls under Risk Management Process. It reaches Domain-Adapted specificity by referencing specific cybersecurity-relevant practices like 'governance, risk and compliance reviews' and 'independent third-party assessments and testing,' which pass the ERM test.


fact: connected vehicles

reasoning: The paragraph describes the company's cybersecurity risk management program, including its integration with ERM and general operational approach, making it a Risk Management Process disclosure. It reaches Domain-Adapted specificity by referencing 'connected vehicles' as a specific asset class requiring protection, which demonstrates domain-specific context beyond generic enterprise risk management language.


fact: fiscal years ended April 30, 2025 and 2024

fact: phishing

fact: vulnerabilities

reasoning: The paragraph is classified as Strategy Integration because it provides a negative assertion regarding the material impact of cybersecurity incidents on the company's financial condition. The specificity is Domain-Adapted because it includes cybersecurity-specific terminology like 'phishing' and 'vulnerabilities' that pass the ERM test, though it lacks firm-specific or externally verifiable claims.


reasoning: The paragraph provides a negative assertion regarding the materiality of cybersecurity incidents, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific organizational details, or externally verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: Operations Officer (COO)

fact: over 15 years of experience in cybersecurity

reasoning: The paragraph focuses on the responsibilities and qualifications of a specific management role (the COO), making it Management Role. It reaches Quantified-Verifiable specificity because it cites a specific, verifiable number of years of experience (over 15 years).


reasoning: The paragraph is a negative assertion regarding material impact and a cross-reference to Item 1A, which falls under None/Other per the rules (cross-references are N/O, and negative assertions about material impact are only Strategy Integration if they are a formal assessment, but this is a fragment of a larger sentence and functions primarily as a disclaimer/reference).


fact: do not believe that any prior cybersecurity-related threats or incidents have materially affected our company

reasoning: The paragraph is primarily a negative assertion regarding the materiality of past incidents, which falls under Strategy Integration per Rule 5. While it mentions third-party requirements, the core purpose is the materiality assessment; the specificity remains Generic Boilerplate because the materiality statement is a standard legal disclaimer and the third-party language is generic.


reasoning: The paragraph provides a negative assertion regarding the material impact of past cybersecurity incidents and a forward-looking statement regarding potential future material impact, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: Director of Information Technology (DIT)

fact: over 20 years of experience

reasoning: The paragraph focuses on the organizational structure and responsibilities of the Director of Information Technology, placing it in Management Role. It reaches Quantified-Verifiable specificity because it cites a specific number of years of experience for the DIT, which is a verifiable claim.


reasoning: The paragraph describes the governance structure and reporting lines between management and the board, making it Board Governance. It is classified as Firm-Specific because it identifies a specific leadership role ('Senior Director, Global Information Security') that distinguishes the company's organizational structure.


reasoning: The paragraph is explicitly about third-party risk management, making it the central topic. It contains no domain-specific terminology (beyond generic 'cybersecurity standards'), no firm-specific details, and no verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: ransomware virus

fact: encrypted several machines

reasoning: The paragraph describes a specific past cybersecurity event (a ransomware incident), making it an Incident Disclosure. It reaches Quantified-Verifiable specificity because it provides a specific count of incidents ('one cybersecurity incident in the last decade'), which is a verifiable claim.


reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the materiality of cybersecurity risks on the company's business and financial condition. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is a cross-reference to Item 1A and does not contain substantive cybersecurity disclosure, falling under the None/Other category.


reasoning: The paragraph provides a negative assertion regarding the materiality of past cybersecurity incidents, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is a cross-reference to the Risk Factors section and contains no substantive cybersecurity disclosure, making it None/Other and Generic Boilerplate.


fact: subservice organizations

fact: service availability risks

reasoning: The paragraph is primarily about the company's oversight of third-party vendors and their cybersecurity risks, fitting the Third-Party Risk category. It reaches Domain-Adapted specificity by using cybersecurity-specific terminology like 'subservice organizations' and 'service availability risks' rather than generic risk management language.


reasoning: The paragraph primarily discusses the company's approach to managing third-party service provider risks, which constitutes the majority of the text. The content lacks specific domain terminology, firm-unique identifiers, or verifiable claims, resulting in a generic classification.


fact: To date we have not identified any prior cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

reasoning: The paragraph is primarily a negative assertion regarding the materiality of past cybersecurity incidents, which falls under Strategy Integration per Rule 5. It is classified as Firm-Specific because it includes a specific, company-level assessment of materiality regarding its own operations and financial condition, distinguishing it from generic boilerplate.