fact: CPO

fact: CIO

fact: VP of Global IT Security

fact: Certified Information Systems Auditor

fact: Certified Information Systems Security Professional

fact: Fellow of Information Privacy

fact: Certified Information Privacy Professional

fact: Incident Response team

reasoning: The paragraph is primarily focused on the leadership roles, qualifications, and organizational structure of the management team responsible for cybersecurity, fitting the Management Role category. It reaches Firm-Specific specificity by naming specific executive roles (CISO, CPO, CIO, VP of Global IT Security) and a specific internal team (Incident Response team).


content_category: Board Governance

category_confidence: high

specificity_confidence: high

reasoning: The paragraph describes the governance structure for incident response, specifically the reporting lines between the Board of Managers and executive officers, which falls under Board Governance. It contains no domain-specific terminology, firm-unique identifiers, or verifiable claims, resulting in a Generic Boilerplate classification.

provider: google

stage: benchmark


fact: Paresh Patel

reasoning: The paragraph describes the Board's oversight mechanisms and identifies a specific board member with relevant expertise, placing it squarely in Board Governance. The mention of a named individual (Paresh Patel) elevates the specificity to Firm-Specific.


fact: CISO

fact: Cybersecurity Executive Committee

reasoning: The paragraph describes the governance structure and reporting lines between the CISO and the Audit Committee, placing it in Board Governance. It is Firm-Specific because it identifies the CISO role and a specific internal committee, the Cybersecurity Executive Committee.


content_category: Risk Management Process

fact: firewalls

fact: intrusion prevention

fact: endpoint detection and response systems

fact: vulnerability assessments

fact: cybersecurity threat intelligence

reasoning: The paragraph describes the company's technical security measures and processes, fitting the Risk Management Process category. It reaches Domain-Adapted specificity by referencing specific cybersecurity technologies and practices like EDR and threat intelligence that go beyond generic risk management language.


content_category: Incident Disclosure

fact: ransomware attack

fact: malware

fact: persistence mechanisms

fact: exchange on-premises accounts

fact: early 2019

reasoning: The paragraph is primarily an Incident Disclosure as it details a specific past ransomware event, its timeline, and the company's response. It reaches Domain-Adapted specificity by referencing specific cybersecurity concepts like 'persistence mechanisms' and 'exchange on-premises accounts'.


content_category: Third-Party Risk

fact: assess, typically prior to onboarding, the cybersecurity risks associated with the engagement of third-party vendors

fact: contractual protections related to, any actual or potential identified cybersecurity risks

fact: right to assess, monitor, audit and test such vendors' cybersecurity programs and practices

fact: digital controls

reasoning: The paragraph is centrally focused on the oversight and management of third-party vendor cybersecurity risks, fitting the Third-Party Risk category. It reaches the Domain-Adapted level by referencing specific cybersecurity practices like auditing and testing vendor programs and the use of digital controls, which go beyond generic enterprise risk management language.


fact: ransomware

fact: phishing

fact: forensic experts

fact: fourth quarter of fiscal year 2019

reasoning: The paragraph is classified as Incident Disclosure because it details a specific past ransomware event, its operational impact, and the subsequent remediation efforts. It reaches the Quantified-Verifiable level due to the specific historical dating of the incident (fourth quarter of fiscal year 2019) and the use of domain-specific terminology like ransomware and phishing.


content_category: Management Role

fact: Director of Information Security

fact: over 30 years

type: quantified

fact: Certified Information Systems Security Professional (CISSP)

fact: OD Technology Department

fact: Risk Committee

reasoning: The paragraph is primarily focused on the qualifications, role, and reporting lines of the Director of Information Security, placing it in Management Role. It reaches Quantified-Verifiable specificity because it cites the Director's specific years of experience and professional certification (CISSP), which are externally verifiable facts.


reasoning: The paragraph describes the company's reliance on the Investment Adviser's cybersecurity program and general risk management processes, which falls under Risk Management Process. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph focuses entirely on the company's oversight of third-party service providers, making it a clear Third-Party Risk disclosure. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph describes the reporting structure between the Audit Committee and the Board, which falls under Board Governance. It contains no domain-specific terminology, firm-unique identifiers, or verifiable claims, resulting in Generic Boilerplate specificity.


fact: Chief Information Security Officer ("CISO")

reasoning: The paragraph is primarily about the implementation of processes to assess, identify, and manage cybersecurity risks, which aligns with Risk Management Process. It is classified as Firm-Specific because it explicitly names the 'Chief Information Security Officer (CISO)' role, which is a specific leadership title.


fact: Executive Vice President and Chief Information Officer ("CIO")

reasoning: The paragraph primarily identifies the specific management roles (CISO and EVP/CIO) responsible for the cybersecurity program, which aligns with the Management Role category. The inclusion of these specific executive titles elevates the specificity to Firm-Specific.


fact: Vice President of IT & Digitization

reasoning: The paragraph describes the management structure and leadership responsible for the cybersecurity program, specifically identifying the Vice President of IT & Digitization, which constitutes a firm-specific role.


fact: National Institute of Standards and Technology

type: framework

fact: International Organization for Standardization

reasoning: The paragraph primarily focuses on the Board's oversight role regarding cybersecurity within the company's enterprise risk management program. It achieves Domain-Adapted specificity by explicitly referencing recognized cybersecurity frameworks (NIST and ISO), which demonstrates domain-specific knowledge.


content_category: None/Other

reasoning: The paragraph is a cross-reference to the Risk Factors section and contains no substantive cybersecurity disclosure, making it None/Other and Generic Boilerplate.


fact: Director of IT Security, Risk and Compliance

fact: 20 years of risk management experience

fact: threat assessments

fact: vulnerability management

fact: cybersecurity insurance

fact: end user awareness

reasoning: The paragraph focuses on the composition and qualifications of the management-level Information Security Committee (ISC), which falls under Management Role. It reaches Quantified-Verifiable specificity due to the inclusion of a specific job title and a quantified years-of-experience claim.


reasoning: The paragraph is purely a cross-reference to another section of the filing and contains no substantive cybersecurity disclosure.


content_category: Strategy Integration

reasoning: The paragraph provides a negative assertion regarding the materiality of cybersecurity risks on the company's business and financial condition, which falls under Strategy Integration per the materiality rule. It contains no specific cybersecurity practices, firm-unique identifiers, or verifiable claims, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph describes the Board's general oversight responsibilities and the relationship between the Board and management regarding risk, which falls under Board Governance. It contains no specific cybersecurity domain terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate classification.


reasoning: The paragraph describes the company's cybersecurity policies, standards, and monitoring processes, which is a core Risk Management Process disclosure. The specificity is Generic Boilerplate because the terms used (e.g., incident response, disaster recovery, access control) are explicitly listed in the instructions as failing the ERM test for domain expertise.


fact: Audit Committee

reasoning: The paragraph primarily describes the governance structure for cybersecurity, specifically detailing the Board's and Audit Committee's oversight roles. It is classified as Firm-Specific because it identifies the Audit Committee as the specific body responsible for information security oversight, which distinguishes the governance structure.


reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the lack of material adverse effect on the company's business strategy and financial condition. It contains no specific cybersecurity domain terminology, firm-specific organizational details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: Global Director of IT

reasoning: The paragraph describes the governance structure and reporting lines for cybersecurity, specifically detailing how information flows from the Global Director of IT to executive management and the audit committee, which falls under Board Governance. It is classified as Firm-Specific because it identifies a specific, non-generic role ('Global Director of IT') responsible for these briefings.


fact: Chief Technology Officer

fact: IT Director

reasoning: The paragraph focuses on the organizational structure and responsibilities of specific management roles (CTO and IT Director) regarding cybersecurity oversight. It is classified as Firm-Specific because it identifies specific management roles (CTO and IT Director) responsible for cybersecurity, which distinguishes the company's management structure.


reasoning: The paragraph describes the board's oversight structure and the delegation of cybersecurity risk management to the audit committee, which is a classic Board Governance disclosure. It contains no specific domain terminology, firm-unique identifiers, or verifiable facts, resulting in a Generic Boilerplate classification.


reasoning: The paragraph is classified as Strategy Integration because it explicitly addresses the materiality of cybersecurity risks on the company's business strategy and financial condition, including both a backward-looking negative assertion and a forward-looking statement. It is Generic Boilerplate because it contains no domain-specific terminology, firm-specific organizational details, or verifiable facts.


fact: early April 2023

reasoning: The paragraph describes a specific cybersecurity incident that occurred in April 2023, which directly answers the question of what happened, placing it in the Incident Disclosure category. The inclusion of the specific timeframe ('early April 2023') provides a verifiable anchor for the event, elevating the specificity to Quantified-Verifiable.


reasoning: The paragraph is a cross-reference to the Risk Factors section (Item 1A) and does not contain substantive cybersecurity disclosure, making it 'None/Other' and 'Generic Boilerplate'.


reasoning: The paragraph is a cross-reference to the Risk Factors section (Item 1A) and contains no substantive cybersecurity disclosure, making it None/Other.


reasoning: The paragraph describes the board's oversight structure and delegation of cybersecurity responsibilities to the Audit Committee, which is a classic Board Governance topic. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: penetration testing

reasoning: The paragraph primarily describes the company's approach to risk management, including the use of consultants and specific activities like penetration testing. It is classified as Domain-Adapted because it references 'penetration testing,' which demonstrates cybersecurity domain expertise beyond generic risk management language.


reasoning: The paragraph focuses on the Board's oversight role and reporting structure, which defines Board Governance. It contains no domain-specific terminology, firm-unique identifiers, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: vendor management program

fact: vendor oversight program

reasoning: The paragraph is centrally focused on the management of third-party cybersecurity risks, fitting the Third-Party Risk category. It is classified as Firm-Specific because it references the Trust's specific 'vendor management program' and 'vendor oversight program,' which are named internal programs distinguishing its approach.


fact: cyber insurance coverage

reasoning: The paragraph is classified as Strategy Integration because it explicitly addresses the materiality of cybersecurity risks on the company's business and financial condition. It is Domain-Adapted because it mentions 'cyber insurance coverage,' which is a specific cybersecurity-related financial mitigation strategy that passes the ERM test.


fact: Chief Financial Officer

reasoning: The paragraph describes the governance chain, specifically the reporting relationship between the CFO and the Audit Committee regarding cybersecurity oversight, which makes Board Governance the primary category. It is classified as Firm-Specific because it identifies the specific management role (Chief Financial Officer) responsible for cybersecurity, which distinguishes the company's governance structure.


fact: Head of Information Technology (“Head of IT”)

fact: over thirty years of experience

fact: threat intelligence

reasoning: The paragraph focuses on the responsibilities and qualifications of the Head of IT, placing it in Management Role. It reaches Quantified-Verifiable specificity because it includes a specific, verifiable claim regarding the individual's years of experience ('over thirty years').


reasoning: The paragraph is a generic introductory statement regarding the company's reliance on technology and the existence of security risks, containing no substantive details about cybersecurity governance, management, or specific operational processes.


reasoning: The paragraph describes the company's risk assessment methodology, which falls under Risk Management Process. It uses entirely generic language regarding risk identification and management, failing to mention specific tools, frameworks, or unique organizational details, resulting in a Generic Boilerplate specificity level.


fact: data privacy

fact: network security

reasoning: The paragraph focuses on the responsibilities and reporting lines of a specific management role (VP of IT), making it a Management Role classification. It reaches Firm-Specific specificity because it names a specific executive title (Vice President of Information Systems and Architecture) and includes domain-specific terminology like 'data privacy' and 'network security'.


reasoning: The paragraph focuses exclusively on the management of third-party vendor risks, placing it in the Third-Party Risk category. It lacks any specific domain terminology, firm-specific identifiers, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: Director of Global Information Systems

reasoning: The paragraph is primarily about the governance structure, specifically the oversight responsibilities of the Board and Audit Committee, placing it in Board Governance. It reaches Firm-Specific level due to the mention of the 'Director of Global Information Systems', a specific management role with security responsibilities.


reasoning: The paragraph focuses exclusively on the oversight of third-party cybersecurity risks, fitting the Third-Party Risk category. It lacks specific domain terminology, firm-unique details, or verifiable claims, resulting in a Generic Boilerplate classification.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity risks on the company's business and financial condition, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific facts, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: Chief Information Security Officer ("CISO")

reasoning: The paragraph is centrally focused on the management of third-party cybersecurity risks, fitting the 'Third-Party Risk' category. It reaches 'Firm-Specific' level by explicitly naming the 'Chief Information Security Officer' as the individual responsible for monitoring these risks.


reasoning: The paragraph focuses on the Audit Committee's oversight responsibilities and the reporting structure to the board, placing it squarely in Board Governance. It is classified as Firm-Specific because it identifies specific executive roles (Vice President, Information Security and Privacy; Senior Vice President, Chief Strategy and Digital Officer) involved in the reporting process.


fact: Audit Committee

fact: General Counsel

reasoning: The paragraph primarily describes the board's delegation of cybersecurity oversight to the Audit Committee, which is a Board Governance function. It is classified as Firm-Specific because it identifies the specific committee (Audit Committee) and the specific officer (General Counsel) responsible for these functions.


fact: February 2024

fact: Interim Chief Financial Officer

fact: Chief Legal Officer

reasoning: The paragraph is primarily about the Board's delegation of cybersecurity oversight to the Audit Committee, placing it squarely in Board Governance. It reaches Quantified-Verifiable specificity because it includes a specific date (February 2024) regarding the delegation of oversight.


reasoning: The paragraph is classified as Strategy Integration because it makes a negative assertion regarding the material impact of cybersecurity incidents on the company's business and financial condition. It contains no specific facts, domain terminology, or verifiable claims, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph describes the oversight role of the Audit Committee regarding cybersecurity and data privacy, which falls under Board Governance. It contains no domain-specific terminology, firm-specific entities, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity incidents on the company's business strategy and financial condition, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: Senior Vice President and Chief Information Officer ("CIO")

fact: over 25 years of IT Risk Management experience

fact: more than 30 years of collective information and product security experience

reasoning: The paragraph focuses on the organizational structure and leadership responsibilities for cybersecurity, specifically detailing the CIO's role and the team's composition, which aligns with Management Role. It reaches the Quantified-Verifiable level because it includes specific, verifiable claims regarding the years of experience for the CIO and the team.


reasoning: The paragraph consists of generic statements about commitment to security and board support without describing specific governance structures, management roles, or operational processes. It mentions the Audit Committee, which is a generic governance body present at every public company, and thus does not elevate the specificity.


fact: penetration testing

fact: CIS Critical Security Controls

fact: incident response plan

reasoning: The paragraph is primarily about the company's cybersecurity program activities, including third-party engagements, incident response planning, and testing, which falls under Risk Management Process. It reaches Domain-Adapted specificity by referencing specific cybersecurity practices like 'penetration testing' and the 'CIS Critical Security Controls' framework.


reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the lack of material impact of cybersecurity threats on the company's business strategy and financial condition. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: Chief Information Officer ("CIO")

fact: Chief Information Technology Architect & Chief Information Security Officer ("CISO")

reasoning: The paragraph is primarily about the Board committee's oversight structure and reporting lines, placing it in Board Governance. It reaches Firm-Specific specificity because it identifies the specific dual-role title held by the company's security leadership (CIO/CISO/Chief Information Technology Architect).


reasoning: The paragraph is classified as Strategy Integration because it makes a negative assertion regarding the materiality of cybersecurity incidents on the company's financial condition and operations. It contains no specific cybersecurity domain terminology, firm-specific organizational details, or externally verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: ransomware

fact: denial-of-service

fact: confidentiality, integrity, and availability

reasoning: The paragraph describes the company's general approach to cybersecurity risks and threats, placing it in Risk Management Process. It reaches Domain-Adapted specificity by referencing specific cybersecurity threat types (ransomware, denial-of-service) and the CIA triad (confidentiality, integrity, availability).


reasoning: The paragraph is a cross-reference to the Risk Factors section (Item 1A) and contains no substantive information about the company's cybersecurity program, governance, or management.


fact: December 2021

fact: March 2024

fact: end point protection software

fact: Canadian subsidiary

reasoning: The paragraph is primarily an Incident Disclosure because it details two specific, real-world cybersecurity events (December 2021 and March 2024). It reaches Quantified-Verifiable specificity because it provides specific dates for these incidents.


fact: Security Governance Council (the "SGC")

fact: CISO

reasoning: The paragraph focuses on the organizational structure and composition of the Security Governance Council (SGC), a management-level committee, and the role of the CISO in chairing it, which fits the Management Role category. It is classified as Firm-Specific because it names a specific internal committee (SGC) and a specific leadership role (CISO).


reasoning: The paragraph primarily describes the oversight responsibilities of the Audit Committee regarding cybersecurity and enterprise risk management, which falls under Board Governance. It contains no domain-specific terminology, firm-specific entities, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: phishing attacks

fact: malware infections

reasoning: The paragraph is primarily about the company's experience with and exposure to cybersecurity threats, which falls under Risk Management Process as it describes the threat landscape the program must address. It reaches Domain-Adapted specificity by explicitly naming specific cybersecurity threat types (phishing, malware) that pass the ERM test.


reasoning: The paragraph describes the oversight responsibilities of the Board of Directors and the Audit Committee, which falls squarely under Board Governance. It contains no domain-specific terminology, firm-unique identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: HITRUST

fact: threat modeling

fact: network firewalls

fact: access controls

fact: vulnerability scanners

fact: intrusion prevention and detection systems

fact: identity and access management systems

fact: cybersecurity threat intelligence

fact: phishing email simulations

fact: tabletop exercises

fact: NIST

reasoning: The paragraph is a comprehensive description of the company's cybersecurity program activities, tools, and frameworks, which falls squarely under Risk Management Process. It achieves Domain-Adapted specificity by referencing specific cybersecurity frameworks (HITRUST, SOC2, NIST) and technical security practices (penetration testing, threat modeling, EDR, etc.) that demonstrate domain expertise.


fact: Topper Group

reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the materiality of cybersecurity risks and incidents on the company's operations. It is Firm-Specific because it references the 'Topper Group', which distinguishes this entity from others.


fact: Director of IT

reasoning: The paragraph primarily describes the Board's oversight structure and reporting cadence, placing it in Board Governance. It is classified as Firm-Specific because it identifies a specific role, 'Director of IT', responsible for cybersecurity oversight and reporting.


reasoning: This paragraph is a cross-reference directing the reader to the 'Risk Factors' section and contains no substantive cybersecurity disclosure.


reasoning: The paragraph consists entirely of high-level, aspirational statements regarding the importance of information security and its general integration into business operations, lacking any substantive description of specific processes, governance, or management roles.


reasoning: The paragraph is classified as Strategy Integration because it makes a negative assertion regarding the material impact of cybersecurity incidents on the company's financial position and operations. It is Generic Boilerplate because it lacks specific domain terminology, firm-specific details, or verifiable claims.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity risks on the company's business strategy and financial condition, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is primarily a negative assertion regarding the materiality of past cybersecurity incidents and a forward-looking disclaimer about potential future impacts, which falls under Strategy Integration per Rule 5. It contains no specific cybersecurity domain terms, firm-specific details, or verifiable facts, resulting in Generic Boilerplate specificity.


fact: SVP of IT Security

reasoning: The paragraph primarily describes the Board's oversight structure and reporting cadence, placing it in Board Governance. It is classified as Firm-Specific because it identifies a specific leadership role, the 'SVP of IT Security', which distinguishes the company's governance structure.


reasoning: The paragraph is a generic concluding statement about the goals of risk management without describing any specific processes, roles, or governance structures, thus falling into None/Other and Generic Boilerplate.


reasoning: The paragraph describes the composition of incident response teams by listing various departments and generic executive roles, which falls under Management Role (team composition). It contains no domain-specific terminology, firm-unique identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: Breach Response Team

reasoning: The paragraph describes the activities of the cybersecurity program (tabletop exercises, incident response simulation), which falls under Risk Management Process. It is classified as Firm-Specific because it names a specific internal entity, the 'Breach Response Team', which distinguishes it from generic descriptions.


reasoning: The paragraph focuses on management's responsibilities and general qualifications, placing it in the Management Role category. It contains no specific domain terminology, firm-unique identifiers, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: penetration tests

fact: incident response plans

reasoning: The paragraph describes specific cybersecurity activities (penetration testing, incident response planning) which constitutes a Risk Management Process description, despite the grammatical framing around management's involvement. The inclusion of domain-specific terminology like 'penetration tests' elevates the specificity to Domain-Adapted.


fact: ransomware

fact: denial-of-service

fact: nation state actors

fact: defense industrial base

fact: critical infrastructure sectors

reasoning: The paragraph describes the general threat landscape and risk environment rather than specific governance, management, or operational processes, placing it in None/Other. It is classified as Domain-Adapted because it utilizes specific cybersecurity threat terminology (e.g., ransomware, denial-of-service, nation state actors) that demonstrates domain expertise.


fact: Chief Information Consultant

reasoning: The paragraph describes the governance structure and reporting lines for cybersecurity risk, specifically the CFO's reporting to the Audit Committee, which aligns with Board Governance. It is classified as Firm-Specific because it identifies a unique organizational role, the 'Chief Information Consultant', which distinguishes this company's management structure.


fact: ISO 27001 certification

reasoning: The paragraph describes the company's cybersecurity program activities, such as testing, training, and third-party assessments, placing it in Risk Management Process. It reaches Quantified-Verifiable specificity because it explicitly claims to maintain an 'ISO 27001 certification,' which is an externally verifiable fact.


reasoning: This paragraph is a cross-reference to another section of the filing and does not contain substantive cybersecurity disclosure.


fact: Chief Operating Officer

reasoning: The paragraph primarily describes the oversight structure, specifically the Audit Committee's role in receiving reports and overseeing cybersecurity, which falls under Board Governance. It reaches Firm-Specific specificity because it identifies specific management roles (Chief Operating Officer, Senior Director of Information Technology) involved in the governance chain.


reasoning: The paragraph is a cross-reference to Item 1A and contains only hypothetical risk language, which does not constitute substantive cybersecurity disclosure.


reasoning: The paragraph focuses exclusively on the company's oversight of third-party suppliers, placing it squarely in Third-Party Risk. It lacks any specific domain terminology, firm-unique identifiers, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: security questionnaires

reasoning: The paragraph is centrally focused on the management of third-party cybersecurity risks, specifically detailing the vendor assessment process. It reaches the Domain-Adapted level by referencing specific cybersecurity practices like 'security questionnaires' and 'contractual obligations related to cybersecurity' rather than just generic risk management language.


fact: CTO

fact: IT Manager

reasoning: The paragraph focuses on the responsibilities and composition of the management team regarding cybersecurity, making it a Management Role classification. It is classified as Firm-Specific because it explicitly names the 'CTO' and 'IT Manager' as the key personnel responsible for these functions.


reasoning: This paragraph is a cross-reference to another section of the filing (Item 1A) and contains no substantive cybersecurity disclosure, making it None/Other and Generic Boilerplate.


reasoning: The paragraph focuses on the qualifications and training of the management team responsible for cybersecurity, placing it in the Management Role category. It lacks specific details such as named roles, specific certifications, or unique organizational structures, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph primarily provides a negative assertion regarding the materiality of cybersecurity threats on the company's business strategy and financial condition, which falls under Strategy Integration per Rule 5. It contains no specific cybersecurity domain terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph describes the use of third-party service providers to support security operations, which is a component of the company's risk management process. The language used is generic and does not contain specific cybersecurity domain terminology or firm-specific details, resulting in a Generic Boilerplate classification.


fact: Chief Financial Officer

fact: cybersecurity incident response team

reasoning: The paragraph is primarily about the organizational structure and composition of the incident response team, specifically identifying the inclusion of the CFO, which falls under Management Role. It is classified as Firm-Specific because it names a specific internal team and a specific executive role (CFO) involved in that team.


fact: NIST Framework

reasoning: The paragraph describes the company's cybersecurity program activities, such as risk assessment and incident response, placing it in Risk Management Process. It reaches Domain-Adapted specificity by explicitly referencing the NIST Framework, which demonstrates cybersecurity domain knowledge beyond generic risk management language.


fact: over four years

fact: more than 25 years of experience

fact: more than ten years with the Company

reasoning: The paragraph primarily describes the governance structure, specifically the Audit Committee's oversight role, making Board Governance the best fit. It reaches Quantified-Verifiable specificity because it includes specific, verifiable tenure and experience metrics for the Senior Vice President – Technology Solutions.


fact: Our Town

reasoning: The paragraph is centrally focused on the cybersecurity risks associated with third-party entities, specifically the hotel manager and franchisors. The identification of the specific hotel manager, 'Our Town,' provides a firm-specific detail.


reasoning: This paragraph is a legal disclaimer defining terms used in the filing and does not contain any substantive information regarding the company's cybersecurity program, governance, or risk management.


fact: Global Director of IT

fact: over 30 years of experience in various information technology roles

fact: over 20 years of experience as an IT Director

fact: over 10 years of experience in risk management

reasoning: The paragraph focuses on the responsibilities and qualifications of specific management roles (Global Director of IT, CEO, CFO), making it a Management Role classification. It reaches Quantified-Verifiable specificity because it provides specific, verifiable years of experience for the named roles.


reasoning: The paragraph describes the board's oversight structure and delegation to the audit committee, which is the primary focus of Board Governance. It contains no domain-specific terminology, firm-specific entities, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph provides a negative assertion regarding the materiality of cybersecurity incidents on the company's business strategy and financial condition, which falls under Strategy Integration per Rule 5. It contains no specific cybersecurity domain terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: Vice President and Chief Information Officer

fact: Director of Information Security

fact: 27 years of technology leadership experience

fact: Doctor of Business Administration

fact: 27 years of experience in infrastructure and security operations

fact: Information Security Committee

fact: Executive Information Security Oversight Committee

reasoning: The paragraph is classified as Management Role because it focuses on the organizational structure, specific leadership roles, committee memberships, and the qualifications of the individuals responsible for cybersecurity. It reaches Quantified-Verifiable specificity due to the inclusion of specific years of experience for the named officers.


fact: CTO

fact: Vaidyanathan Raghavan

fact: Vice President of Information Technology and Security

fact: Brendan Hamilton

fact: Certified Information Systems Security Professional

reasoning: The paragraph is classified as Management Role because it focuses on the specific individuals, titles, and qualifications of the management team responsible for cybersecurity. It reaches Quantified-Verifiable specificity because it cites a specific professional certification (CISSP) held by a named officer, which is an externally verifiable fact.


reasoning: The paragraph focuses on the Board's oversight responsibilities and expertise regarding the cybersecurity program, which is the primary definition of Board Governance. It contains no specific cybersecurity practices, named committees, or verifiable metrics, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity incidents, which is classified as Strategy Integration under Rule 5. It contains no domain-specific terminology, firm-unique facts, or externally verifiable claims, resulting in Generic Boilerplate specificity.


fact: National Institute of Standards and Technology

fact: International Organization for Standardization

fact: confidentiality, security and availability

reasoning: The paragraph is primarily focused on the Board's oversight role regarding cybersecurity and its integration into the broader ERM program. It reaches Domain-Adapted specificity by referencing recognized cybersecurity frameworks (NIST, ISO) and the CIA triad (confidentiality, security, availability).


fact: denial of service attacks

reasoning: The paragraph is a general disclaimer about reliance on technology and the existence of threats, rather than describing the company's specific governance, management, or risk management processes. It is classified as None/Other because it lacks substantive disclosure about the company's actual cybersecurity program, though it reaches Domain-Adapted specificity due to the mention of 'denial of service attacks'.


reasoning: The paragraph describes the governance structure for risk oversight, specifically the flow of information from the executive leadership team to the board, which falls under Board Governance. It contains no domain-specific terminology, firm-specific entities, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the material impact of cybersecurity incidents on the company's business strategy and financial condition. It contains no specific facts, domain terminology, or verifiable claims, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph describes the responsibilities of specific management roles, placing it in Management Role. It lacks domain-specific terminology, firm-unique identifiers (as the titles provided are generic), or verifiable claims, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph describes the governance chain (executive team reporting to the Board/Audit Committee), which defaults to Board Governance. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes the board's oversight structure and delegation of cybersecurity responsibilities to the Audit Committee, which is the definition of Board Governance. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph describes the Board's oversight structure and the Audit Committee's role in cybersecurity risk management, which falls under Board Governance. It contains no domain-specific terminology, firm-unique identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is primarily focused on the Board's oversight role and the integration of cybersecurity into the broader enterprise risk management framework, which aligns with Board Governance. It contains no specific facts, domain-specific terminology that passes the ERM test, or verifiable claims, resulting in a Generic Boilerplate classification.


reasoning: The paragraph focuses exclusively on the company's approach to managing third-party service provider risks, fitting the Third-Party Risk category. It lacks specific domain terminology, firm-unique identifiers, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: National Institute of Standards and Technology Cybersecurity Framework (NIST CSF)

fact: HIPAA

fact: Service Organization Control Type 2 (SOC 2 Type II)

fact: Sarbanes-Oxley IT General Controls (SOX ITGC)

reasoning: The paragraph describes the company's cybersecurity risk management program and the frameworks used to guide it, placing it squarely in Risk Management Process. It reaches Domain-Adapted specificity by explicitly referencing specific cybersecurity frameworks (NIST CSF, SOC 2 Type II, etc.) which demonstrates domain knowledge beyond generic risk management language.


reasoning: The paragraph is a cross-reference to the Risk Factors section (Item 1A) and contains no substantive cybersecurity disclosure, making it None/Other and Generic Boilerplate.


reasoning: This paragraph is a generic introductory statement expressing the company's commitment to cybersecurity without describing any specific governance, management, or risk management processes. It contains no domain-specific terminology, firm-specific details, or verifiable facts.


reasoning: The paragraph describes the board's oversight structure and the role of the Audit Committee in cybersecurity, which is a classic Board Governance topic. It contains no specific cybersecurity domain terminology or firm-specific details, relying entirely on generic governance language.


fact: Chief Information Security Officer ("CISO")

fact: information security risk committee

reasoning: The paragraph is classified as Management Role because it focuses on the organizational structure of the cybersecurity program, specifically the establishment of an information security risk committee and the role of the CISO. It is Firm-Specific because it identifies a named management-level committee and a specific executive role.


fact: CISO

fact: ISO

reasoning: The paragraph primarily describes the governance structure for cybersecurity oversight, specifically the Board and Audit Committee's role, which falls under Board Governance. It reaches Firm-Specific specificity because it identifies specific management roles (CISO, Senior Vice President, General Counsel & Compliance Officer, ISO) involved in the incident reporting chain.


fact: IT Security Steering Committee

fact: VP of Software Engineering

fact: Director of Information Systems and Security

fact: IT Security Team

fact: over 40 years of experience

reasoning: The paragraph focuses on the composition and leadership of the IT Security Steering Committee and the IT Security Team, making it a Management Role classification. It reaches Quantified-Verifiable specificity because it cites a specific, verifiable aggregate number of years of experience (over 40 years) for the team members.


fact: Enterprise Risk Management Committee ("ERMC")

fact: TISC meetings

fact: Director of Enterprise Risk Management

fact: Chief Risk Officer

reasoning: The paragraph describes the governance structure and reporting lines of the Enterprise Risk Management Committee, which falls under Board Governance as it details the oversight chain. It is classified as Firm-Specific because it names specific internal committees (ERMC, TISC) and leadership roles (Director of Enterprise Risk Management, Chief Risk Officer).


fact: Ontrack software solution

reasoning: The paragraph describes the company's risk management activities and specifically names the 'Ontrack' software solution used for tracking risks and incidents, which qualifies as a firm-specific fact.


fact: Mr. Lee

reasoning: The paragraph describes the governance structure for reporting cybersecurity incidents to the Board and Audit Committee, placing it in Board Governance. It is classified as Firm-Specific because it identifies a specific individual ('Mr. Lee') responsible for these updates.


reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the materiality of cybersecurity threats on the company's business strategy and financial condition. It is Generic Boilerplate because it contains no domain-specific terminology, firm-specific organizational details, or externally verifiable facts.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity threats on the company's business and financial condition, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific facts, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: Company's CCO

fact: real time threat detection

fact: mitigation

reasoning: The paragraph primarily focuses on the management's responsibility for cybersecurity oversight, including the specific role of the CCO, which aligns with the Management Role category. The specificity is Firm-Specific because it identifies a specific officer role (CCO) involved in the oversight process.


reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the materiality of cybersecurity risks on the company's business strategy and financial condition. It is classified as Generic Boilerplate because it contains no domain-specific terminology, firm-specific roles or programs, or externally verifiable facts.


fact: information security

fact: prevention, detection, mitigation, and remediation

fact: Adviser

reasoning: The paragraph focuses on the responsibilities, qualifications, and reporting lines of management, specifically the CCO, fitting the Management Role category. It reaches Firm-Specific level by identifying the CCO role and the specific organizational structure involving the Adviser.


fact: Senior Director, Information Technology

fact: Incident Response Team

fact: Senior Vice President, Finance

fact: General Counsel

fact: over twenty years of experience

reasoning: The paragraph focuses on the organizational structure and specific roles responsible for cybersecurity, fitting the Management Role category. It reaches Quantified-Verifiable specificity because it cites a specific, verifiable duration of experience ('over twenty years') for a named role.


reasoning: The paragraph primarily describes the company's risk management process (evaluating, re-designing, and implementing safeguards). It lacks specific domain terminology, firm-specific details, or verifiable facts, relying instead on generic descriptions of risk management activities.


reasoning: The paragraph describes the professional background of an individual (Mr. Tao) in general business and marketing, which does not constitute a cybersecurity-specific disclosure regarding governance, management, or risk processes.


fact: National Institute of Standards and Technology Cybersecurity Framework (NIST CSF)

fact: Identify, Protect, Detect, Respond, and Recover

reasoning: The paragraph describes the company's cybersecurity program and its reliance on the NIST CSF framework, which is a core risk management process disclosure. It achieves Domain-Adapted specificity by explicitly referencing the NIST CSF and its specific functional pillars.


reasoning: The paragraph is a standard risk factor disclosure describing potential negative outcomes of cybersecurity incidents, which constitutes speculative boilerplate rather than a substantive description of governance, management, or process.


reasoning: The paragraph consists entirely of generic risk disclosures regarding the company's early-stage status and lack of resources, which does not constitute a substantive cybersecurity program description or governance disclosure. The negative assertion regarding past incidents is not externally verifiable and does not elevate the specificity.


fact: fourth quarter of fiscal 2025

fact: unauthorized activity on certain of our information technology systems

fact: proactively taking certain systems offline

reasoning: The paragraph describes a specific cybersecurity incident, its timeline, and its operational impact, placing it squarely in Incident Disclosure. It reaches Domain-Adapted specificity by referencing specific technical containment measures like taking systems offline, though it lacks the verifiable external claims required for Quantified-Verifiable.


reasoning: This paragraph is a cross-reference to another section of the filing (Item 1A) and contains no substantive cybersecurity disclosure, falling under the None/Other category.


fact: Chief Technology Officer

reasoning: The paragraph describes the board's oversight structure and information flow regarding cybersecurity, which is the definition of Board Governance. It reaches Firm-Specific level by identifying the Chief Technology Officer as the specific executive responsible for briefing the board.


reasoning: The paragraph is centrally focused on the oversight of third-party service providers, making it Third-Party Risk. It lacks specific domain terminology (e.g., SOC 2, encryption standards), firm-specific details, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures

fact: promptly report any suspected breach of its security measures

reasoning: The paragraph is primarily focused on the company's requirements for third-party service providers, making it a Third-Party Risk disclosure. It is classified as Firm-Specific because it details specific contractual requirements (certification of security measures and breach reporting obligations) that distinguish the company's vendor management approach from generic boilerplate.


reasoning: The paragraph is classified as Strategy Integration because it makes a negative assertion regarding the materiality of cybersecurity incidents on the company's business and operations. It is classified as Generic Boilerplate because it contains no domain-specific terminology, firm-specific identifiers, or externally verifiable facts.


fact: vendor due diligence evaluation

fact: contracts with third parties to incorporate industry and regulatory standard clauses

fact: maintain adequate levels of cybersecurity insurance coverage

reasoning: The paragraph is primarily focused on the management of third-party vendor risks, including due diligence and contractual requirements. It reaches the Domain-Adapted level by referencing specific cybersecurity-related vendor management practices like due diligence evaluations and specific contractual clauses regarding incident reporting and insurance, which go beyond generic risk management language.


fact: Senior Director - Information Security

fact: over 15 years' experience

fact: CISO Academy Workshop

fact: Information Systems Auditor certification

fact: BA in math and computer science from Ohio Wesleyan University

reasoning: The paragraph focuses exclusively on the qualifications, background, and credentials of a specific management role, placing it in Management Role. It reaches Quantified-Verifiable specificity due to the inclusion of specific years of experience, named certifications, and educational background.


reasoning: The paragraph provides a standard negative assertion regarding the material impact of cybersecurity risks on the company's business strategy and financial condition, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: third-party information risk management program

fact: periodic security risk assessment

reasoning: The paragraph is centrally focused on the management of third-party cybersecurity risks, specifically detailing the company's program for assessing and mitigating risks from vendors. It reaches the Domain-Adapted level by referencing specific cybersecurity practices like 'periodic security risk assessment' and 'security and privacy provisions' in contracts, which demonstrate domain knowledge beyond generic risk management.


fact: vulnerability management

fact: incident response

reasoning: The paragraph is classified as Management Role because it focuses on the specific responsibilities and involvement of the Principal Accounting Officer in cybersecurity oversight and incident response. It is Domain-Adapted because it utilizes specific cybersecurity terminology like 'vulnerability management' and 'incident response' that demonstrate domain expertise beyond generic risk management language.


reasoning: The paragraph describes the Board's oversight role and reporting cadence, which is a core Board Governance topic. It lacks any specific, verifiable, or domain-unique terminology, resulting in a Generic Boilerplate classification.


fact: Vice President of Information Systems

fact: Audit Committee

reasoning: The paragraph is primarily about the governance structure, detailing the reporting lines between the Vice President of Information Systems, the CFO, and the Audit Committee's oversight role. It is classified as Firm-Specific because it identifies specific management roles (Vice President of Information Systems) and committees (Audit Committee) involved in the governance chain.


reasoning: The paragraph describes the company as a blank check company with no operations or internal cybersecurity capabilities, which falls under the None/Other category for no-operations entities.


fact: asset identification

fact: asset classification

reasoning: The paragraph describes components of the company's cybersecurity program, placing it in Risk Management Process. It reaches Domain-Adapted specificity by referencing specific cybersecurity practices like asset identification and classification, which pass the ERM test.


fact: June 2024

fact: CDK

reasoning: The paragraph is primarily an Incident Disclosure because it describes a specific, real-world cybersecurity event (the June 2024 CDK incident) and its impact on the company. It reaches Quantified-Verifiable specificity because it names a specific third-party firm (CDK) and a specific date (June 2024) associated with that incident.


reasoning: The paragraph provides a negative assertion regarding the materiality of past cybersecurity incidents, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: contract research organizations

fact: contract manufacturers

fact: cybersecurity risk assessments

fact: vendor management process

reasoning: The paragraph is centrally focused on the management of cybersecurity risks associated with third-party service providers, fitting the Third-Party Risk category. It reaches Domain-Adapted specificity by referencing specific cybersecurity-relevant vendor management practices like 'cybersecurity risk assessments' and 'vendor management process' in the context of third-party oversight.


fact: IT Risk and Compliance Team

fact: VP Security

reasoning: The paragraph is classified as Management Role because it focuses on the organizational structure, specific team responsibilities, and reporting lines (the IT Risk and Compliance Team reporting to the VP Security). It is Firm-Specific because it identifies a specific internal team and a specific executive role (VP Security) that distinguishes the company's management structure.


reasoning: The paragraph focuses on the company's oversight of third-party cybersecurity risks, making Third-Party Risk the primary category. It contains no domain-specific terminology, firm-specific identifiers, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: testing and advisory services

reasoning: The paragraph describes the use of third-party consultants as a component of the internal cybersecurity program's risk management activities, making it a Risk Management Process paragraph rather than Third-Party Risk (which requires vendor oversight as the central topic). It reaches Domain-Adapted specificity by referencing specific cybersecurity activities like 'testing and advisory services' which demonstrate domain knowledge beyond generic risk management.


reasoning: This paragraph is a cross-reference to the Risk Factors section and contains no substantive cybersecurity disclosure, making it 'None/Other' and 'Generic Boilerplate'.


fact: January 18, 2023

fact: ransomware attack

fact: fewer than 300 restaurants

reasoning: The paragraph is classified as Incident Disclosure because it describes a specific, real-world cybersecurity event (the January 2023 ransomware attack) and its impacts. It reaches Quantified-Verifiable specificity due to the inclusion of a specific date and a quantified impact metric (fewer than 300 restaurants).


reasoning: This paragraph is a fragment of a risk factor title or header describing potential negative outcomes of cybersecurity incidents, which does not constitute substantive cybersecurity disclosure.


reasoning: The paragraph provides a formal materiality assessment regarding cybersecurity threats, which is the primary indicator for Strategy Integration. It contains no specific cybersecurity program details, domain terminology, or verifiable facts, resulting in Generic Boilerplate specificity.


fact: Director of Information Security and Privacy

fact: CISSP (Certified Information Systems Security Professional)

fact: CCSP (Certified Cloud Security Professional)

fact: penetration testing

fact: email phishing test campaigns

fact: email security monitoring

fact: vulnerability scanning

fact: intrusion detection

fact: information security management system

reasoning: The paragraph is primarily about the management structure and qualifications of the security leadership, making it Management Role. It reaches Quantified-Verifiable specificity because it explicitly names the Director's specific professional certifications (CISSP, CCSP), which are independently verifiable.


reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the materiality of cybersecurity risks on the company's business strategy and financial condition. It contains no specific cybersecurity domain terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is classified as Strategy Integration because it makes a negative assertion regarding the occurrence of material cybersecurity incidents, which is a standard materiality assessment. It is classified as Generic Boilerplate because it contains no domain-specific terminology, firm-specific details, or externally verifiable facts.


fact: third quarter of fiscal year 2023

fact: zero-day vulnerability

fact: third-party vendor's file transfer application

reasoning: The paragraph is primarily an Incident Disclosure because it details a specific material cybersecurity incident from fiscal year 2023. It reaches Domain-Adapted specificity by referencing technical concepts like 'zero-day vulnerability' and 'file transfer application' in the context of the incident.


fact: GDPR

reasoning: The paragraph describes the company's cybersecurity program, frameworks, and risk management activities, placing it in Risk Management Process. It reaches Domain-Adapted specificity by citing specific cybersecurity frameworks (ISO 27001, NIST 800-53, GDPR) which demonstrate domain expertise beyond generic risk management language.


reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the material impact of cybersecurity incidents on the company's business strategy and financial condition. It is Generic Boilerplate because it lacks any specific cybersecurity domain terminology, firm-specific organizational details, or verifiable claims.


fact: reviewing the cybersecurity practices of such provider

fact: conducting security assessments

fact: conducting on-site inspections

reasoning: The paragraph is centrally focused on how the company manages cybersecurity risks related to third-party vendors, fitting the Third-Party Risk category. It reaches Domain-Adapted specificity by referencing specific cybersecurity-related vendor oversight activities like security assessments and on-site inspections, which demonstrate domain knowledge beyond generic risk management.


reasoning: The paragraph describes the existence of a cybersecurity program and general review processes, which falls under Risk Management Process. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: CISSP

fact: CISM

fact: CISA

fact: industry-recognized certifications, such as CISSP, CISM, and CISA

reasoning: The paragraph focuses on the management team's responsibilities and qualifications, placing it in Management Role. It reaches Domain-Adapted specificity by citing specific cybersecurity certifications (CISSP, CISM, CISA) which demonstrate domain expertise beyond generic management descriptions.


reasoning: The paragraph is explicitly focused on the company's third-party risk management program, making it a clear fit for the Third-Party Risk category. It contains no domain-specific terminology, firm-specific identifiers, or verifiable claims, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the materiality of cybersecurity threats on the company's business strategy and financial condition. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph describes the governance reporting structure for risk findings to a specific board-level committee, placing it in Board Governance. It is classified as Firm-Specific because it names a specific internal committee ('Enterprise Risk and Compliance Committee') rather than a generic one like the Audit Committee.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity incidents on the company's business, which falls under Strategy Integration per the materiality rule. It contains no specific cybersecurity domain terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph focuses on the company's reliance on third parties and how they manage those risks, making Third-Party Risk the primary category. It contains no domain-specific terminology, firm-specific roles, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph consists entirely of high-level, introductory boilerplate statements regarding the company's commitment to cybersecurity and general goals, lacking any substantive details about governance, management, specific processes, or unique organizational facts.


reasoning: The paragraph describes the board's oversight role and the division of responsibility between the board and executive officers, which is a classic Board Governance disclosure. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph describes the use of a third party for risk assessment, which falls under Risk Management Process. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is a generic introductory statement regarding the company's commitment to cybersecurity and lacks any substantive details about governance, management, processes, or specific incidents.


reasoning: The paragraph is primarily focused on the risks associated with third-party service providers, making it a clear Third-Party Risk disclosure. It contains no domain-specific terminology, firm-specific identifiers, or verifiable claims, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph describes the board and audit committee's oversight role, which falls under Board Governance. It contains no specific domain terminology, firm-specific details, or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity risks on the company's business strategy and financial condition, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific organizational details, or externally verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: Chief Risk Officer as the Chief Privacy Officer

fact: Chief Information Security Officer

fact: Board's Risk Oversight Committee

fact: Information Security Program

fact: Security Incident Response Policy and Plan

fact: over 13 years previously serving as the Company's Chief Financial Officer

fact: over 20 years of work experience in cybersecurity

reasoning: The paragraph focuses on defining management roles, reporting lines, and the specific qualifications of the officers involved, making it a Management Role classification. It reaches Quantified-Verifiable specificity due to the inclusion of specific years of experience for the officers.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity incidents on the company's business and financial condition, which is classified as Strategy Integration under Rule 5. It contains no specific, verifiable, or domain-unique information, resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes the Board's oversight responsibilities and the delegation of authority for cybersecurity policies, which is a core Board Governance topic. It contains no specific, verifiable, or domain-unique terminology, qualifying it as generic boilerplate.


fact: Technology Committee

reasoning: The paragraph describes the board's oversight structure and delegation of cybersecurity responsibilities to a specific committee, which is the core definition of Board Governance. The mention of the 'Technology Committee' constitutes a firm-specific fact, elevating the specificity level.


fact: proactive detection tools

reasoning: The paragraph describes the company's use of external experts and technology to manage cybersecurity risks, which falls under Risk Management Process. It reaches Domain-Adapted specificity by referencing 'proactive detection tools,' a term that demonstrates cybersecurity domain knowledge beyond generic risk management language.


fact: CISO

fact: FedEx Executive Committee

fact: DTRC

fact: CyTOC

fact: threat intelligence briefings

reasoning: The paragraph is classified as Management Role because it focuses on the CISO's reporting structure and the specific management-level committees (DTRC, CyTOC) involved in incident communication. It is Firm-Specific due to the inclusion of these named internal committees and the specific reporting line of the CISO.


fact: reviewing and updating all third-party service contracts upon renewal for potential amendments related to security, confidentiality, and recourse

reasoning: The paragraph is centrally focused on the management of third-party cybersecurity risks, specifically detailing the company's process for updating vendor contracts. It is classified as Firm-Specific because it describes a specific, active organizational initiative (reviewing and updating all third-party contracts upon renewal) rather than just generic policy language.


reasoning: The paragraph is classified as Strategy Integration because it makes a negative assertion regarding the materiality of cybersecurity incidents on the firm's financial condition and operations for the reporting period. It is considered Generic Boilerplate because the negative assertion regarding material incidents is a standard disclosure that does not constitute an externally verifiable fact.


fact: Technology Steering Committee

reasoning: The paragraph primarily describes the oversight structure involving the board and committees, placing it in Board Governance. It reaches Firm-Specific specificity because it names a specific internal body, the 'Technology Steering Committee', which distinguishes it from generic governance descriptions.


reasoning: The paragraph primarily describes the organizational structure and responsibilities of management regarding cybersecurity, fitting the Management Role category. It reaches Firm-Specific specificity because it identifies a specific leadership role, the 'Senior Director of Information Technology', which is a security-qualifying title.


reasoning: The paragraph is a cross-reference to another section of the filing and contains no substantive cybersecurity disclosure.


fact: key risk indicators

fact: Chief Information Officer

reasoning: The paragraph describes the Board's oversight structure and the flow of information from management to the Board, which is the definition of Board Governance. It reaches Firm-Specific level by identifying the Chief Information Officer as the specific executive briefing the Board.


reasoning: The paragraph focuses on the responsibilities and background of the CISO, which is a management-level role. It is classified as Firm-Specific because it identifies a specific leadership role (CISO) responsible for the cybersecurity strategy.


fact: IT Steering Committee

fact: continuous cyber monitoring

fact: vulnerabilities

fact: trend analysis on attack vectors

fact: residual risk

reasoning: The paragraph is primarily about the activities and structure of the cybersecurity program (Risk Management Process), specifically detailing how risks are identified and monitored. It reaches Firm-Specific specificity because it names the 'IT Steering Committee' as the oversight body, and includes domain-specific terminology like 'attack vectors' and 'residual risk'.


fact: Deputy Chief Executive Officer and Chief Financial Officer

fact: more than seven years

reasoning: The paragraph primarily details the management structure and the specific qualifications of the executive responsible for cybersecurity, fitting the Management Role category. The inclusion of a specific duration of experience ('more than seven years') provides a verifiable lower bound, elevating the specificity to Quantified-Verifiable.


fact: December 18, 2023

reasoning: The paragraph describes regulatory requirements and cross-references other sections of the filing rather than detailing the company's internal cybersecurity program, governance, or strategy, making it 'None/Other'. It reaches Quantified-Verifiable specificity due to the inclusion of the specific effective date of the SEC rules.


reasoning: The paragraph lists oversight responsibilities, which is characteristic of Board Governance descriptions, but contains no specific facts, domain terminology, or firm-unique details, resulting in a Generic Boilerplate classification.


reasoning: The paragraph is primarily a cross-reference to Item 1A, but it concludes with a negative assertion regarding material cybersecurity incidents, which falls under Strategy Integration per Rule 5. Because the negative assertion is not externally verifiable and no other specific facts are present, the specificity is Generic Boilerplate.


fact: cybersecurity governance committee

fact: Chief Financial Officer

fact: Chief Legal Officer

fact: Head of Internal Audit

reasoning: The paragraph is classified as Management Role because it focuses on the organizational structure, leadership roles (CIO), and the composition and responsibilities of the management-level cybersecurity governance committee. It is Firm-Specific because it identifies specific executive roles and a named internal committee.


fact: confidentiality, integrity, or availability

fact: ransomware

fact: insider risk

reasoning: The paragraph is a standard risk factor disclosure describing reliance on IT and potential threats, which does not describe a specific governance structure, management role, or risk management process, thus falling under None/Other. It reaches Domain-Adapted specificity by referencing the CIA triad (confidentiality, integrity, availability) and specific threat types like ransomware.


reasoning: This paragraph is a standard legal disclaimer regarding forward-looking statements and does not contain any substantive cybersecurity disclosure.


fact: August 2020

fact: incident response

reasoning: The paragraph is classified as Incident Disclosure because it describes a specific historical cybersecurity event (a ransomware incident in August 2020). It reaches the Quantified-Verifiable level of specificity due to the inclusion of a specific date (August 2020) associated with the incident.


reasoning: The paragraph is a cross-reference to the Risk Factors section (Item 1A) and contains no substantive cybersecurity disclosure, program details, or governance information.


reasoning: The paragraph provides a standard materiality assessment regarding cybersecurity threats, which falls under Strategy Integration per Rule 5. It contains no specific facts, domain terminology, or verifiable claims, resulting in Generic Boilerplate specificity.


fact: cybersecurity incident response plan

fact: incident response policy

fact: data protection and cybersecurity training

reasoning: The paragraph describes specific components of the company's cybersecurity program, such as incident response plans and training, which falls under Risk Management Process. It is classified as Domain-Adapted because it references specific cybersecurity practices (incident response plans, data protection training) that go beyond generic risk management language.


reasoning: The paragraph is classified as Strategy Integration because it provides a backward-looking materiality assessment regarding the impact of cybersecurity threats on the company's business and financial condition. It contains no domain-specific terminology, firm-unique facts, or verifiable claims, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph consists entirely of generic risk disclaimers and a cross-reference to Item 1A, which does not constitute substantive cybersecurity disclosure under the provided rules.


reasoning: The paragraph describes the governance structure and reporting lines between management and the board (Audit Committee) regarding cybersecurity oversight. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: System and Organizational Control ("SOC") type reports

reasoning: The paragraph describes the company's cybersecurity program activities, such as threat identification and vendor assessment, placing it in Risk Management Process. It reaches Domain-Adapted specificity by referencing 'SOC type reports,' which demonstrates cybersecurity domain knowledge beyond generic risk management language.


fact: penetration testing

fact: vulnerabilities

fact: cybersecurity insurance

reasoning: The paragraph primarily describes the company's risk management activities, including penetration testing and vulnerability remediation, which falls under Risk Management Process. It reaches Domain-Adapted specificity by referencing specific cybersecurity practices like penetration testing and vulnerability remediation, which demonstrate domain expertise beyond generic risk management language.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity threats on the company's business and financial condition, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: Director of Internal Audit

fact: Director of Information Technology

reasoning: The paragraph is primarily about the governance structure and the flow of information between management and the Board regarding cybersecurity oversight, which falls under Board Governance. It is classified as Firm-Specific because it identifies specific management roles (Director of Internal Audit, Director of Information Technology) involved in this governance process.


fact: third-party risk management process

fact: initial assessment

fact: contracting process to mitigate cybersecurity risks

reasoning: The paragraph is centrally focused on the management of third-party cybersecurity risks, fitting the Third-Party Risk category. It reaches Domain-Adapted specificity by describing specific procedural components like an 'initial assessment' and a 'contracting process' to mitigate risks, which demonstrates an understanding of cybersecurity vendor management beyond generic oversight language.


reasoning: The paragraph provides a negative assertion regarding the materiality of cybersecurity incidents, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific facts, or externally verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: Chief Financial Officer

reasoning: The paragraph describes the governance structure for cybersecurity oversight, specifically the role of the Audit Committee and the reporting line from the CFO, which falls under Board Governance. It is classified as Firm-Specific because it identifies a specific management role (Chief Financial Officer) involved in the governance chain.


reasoning: The paragraph describes the company's risk assessment methodology, which falls under Risk Management Process. It contains no domain-specific terminology, firm-unique identifiers, or verifiable claims, resulting in a Generic Boilerplate classification.


fact: scanning our environment for vulnerabilities

reasoning: The paragraph describes the activities and operational components of the company's cybersecurity program, placing it in Risk Management Process. It reaches Domain-Adapted specificity by referencing specific cybersecurity practices like vulnerability scanning and penetration testing, which demonstrate domain expertise beyond generic risk management language.


fact: Chief Information Security Officer ("CISO")

fact: Chief Information Officer ("CIO")

fact: Chief Legal Officer

fact: over 30 years of experience

fact: Certified Information System Security Professional ("CISSP")

fact: Certified Information Privacy Professional ("CIPP")

fact: CIO Program Certificate from the College of Information and Cyberspace, National Defense University

reasoning: The paragraph focuses on the organizational structure and qualifications of the cybersecurity management team, specifically the CISO's reporting lines and credentials. It reaches the Quantified-Verifiable level because it cites specific, verifiable professional certifications (CISSP, CIPP) and a specific number of years of experience.


fact: Audit Review Committee

reasoning: The paragraph primarily describes the Board's oversight structure and the delegation of cybersecurity responsibilities to a specific committee, fitting the Board Governance category. It is classified as Firm-Specific because it names the 'Audit Review Committee,' which is a specific entity within the company's governance structure.


fact: February and April 2025

fact: Microsoft

fact: Azure environment

fact: nation-state threat actor

fact: enhanced rotation of credentials

fact: strengthened security monitoring

reasoning: The paragraph is primarily an Incident Disclosure because it details specific unauthorized activity events in February and April 2025, including the actor and the company's response. It reaches Quantified-Verifiable specificity due to the inclusion of specific dates and named third-party platforms (Microsoft Azure).


fact: December 18, 2023

reasoning: The paragraph is classified as None/Other because it primarily discusses regulatory requirements and provides a cross-reference rather than describing the company's internal cybersecurity program or governance. It reaches Quantified-Verifiable specificity due to the inclusion of the specific effective date of the SEC rules.


fact: phishing simulations

fact: malware detection

reasoning: The paragraph describes specific activities within the company's cybersecurity program, such as phishing simulations and malware detection training, which qualifies as Risk Management Process and demonstrates domain-specific knowledge.


fact: CISO

fact: Security Steering Committee

fact: CSIRT

fact: PSIRT

fact: incident handling lifecycle

fact: key risk indicators

reasoning: The paragraph is primarily focused on the management structure and roles (CISO, Security Steering Committee) responsible for oversight, which aligns with Management Role. It reaches Firm-Specific specificity due to the mention of named internal entities like the Security Steering Committee, CSIRT, and PSIRT.


reasoning: The paragraph is classified as Strategy Integration because it explicitly addresses the materiality of cybersecurity risks and incidents on the company's business and financial condition, satisfying the SI materiality rule. It is Generic Boilerplate because it contains no domain-specific terminology, firm-specific organizational details, or externally verifiable facts.


fact: due diligence on our third-party service providers

fact: contractual commitments from them to implement specific cybersecurity measures

reasoning: The paragraph is explicitly about managing third-party cybersecurity risks. It reaches Domain-Adapted specificity because it describes specific cybersecurity-related activities (due diligence, contractual commitments for security measures) that go beyond generic risk management language.


fact: phishing attack

reasoning: The paragraph describes a specific cybersecurity incident, including the date, amount, and remediation, which clearly falls under Incident Disclosure. It is classified as Quantified-Verifiable because it contains specific, verifiable dates and a precise dollar amount.


fact: IT Lead

fact: 5 years of experience

fact: 15 years of expertise

reasoning: The paragraph focuses on the organizational structure and qualifications of the management responsible for cybersecurity, specifically the IT Lead. It reaches the Quantified-Verifiable level because it provides specific, checkable numbers regarding the years of experience for both the internal IT Lead and the external agency.


fact: hosted architecture

fact: vendor management process

reasoning: The paragraph focuses primarily on the risks associated with third-party service providers and the company's vendor management process, making it a clear Third-Party Risk disclosure. It reaches Domain-Adapted specificity by referencing specific architectural concepts like 'hosted architecture' and specific risk management terminology like 'vendor management process' that go beyond generic boilerplate.


reasoning: The paragraph describes the company as a SPAC with no operations and explicitly states it has no cybersecurity program, making it a 'None/Other' disclosure as it lacks substantive cybersecurity content. No specific facts were identified that would elevate the specificity level.


fact: Fortra, LLC

fact: GoAnywhere managed file transfer as a service system (MFTaaS)

fact: zero-day vulnerability

fact: Health Insurance Portability and Accountability Act

fact: fiscal 2023

reasoning: The paragraph describes a specific cybersecurity incident involving a third-party vendor (Fortra, LLC) and the impact on the company's data, which falls squarely under Incident Disclosure. It reaches the Quantified-Verifiable level because it names specific entities (Fortra, LLC) and systems (GoAnywhere MFTaaS) involved in a real-world event.


reasoning: The paragraph serves as an introductory header and a generic statement of intent regarding cybersecurity, lacking any substantive details about governance, management, or specific risk management processes.


reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the lack of material impact of cybersecurity incidents on the company's business strategy and financial condition. It contains no specific cybersecurity domain terms, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is a standard disclaimer regarding the unpredictability of future incidents and directs the reader to the Risk Factors section, which falls under None/Other. It contains no specific cybersecurity processes, firm-unique details, or verifiable facts, resulting in Generic Boilerplate specificity.


fact: managed service provider

fact: CIO firms

reasoning: The paragraph is primarily focused on the oversight and management of third-party service providers, fitting the Third-Party Risk category. It reaches Domain-Adapted specificity by referencing specific cybersecurity operational concepts like 'managed service provider' and 'CIO firms' in the context of security oversight, which demonstrates domain knowledge beyond generic risk management.


fact: 24x7 Security Operations Center (SOC)

fact: Security Information and Event Management (SIEM) systems

reasoning: The paragraph describes specific cybersecurity program components (SOC and SIEM), which are operational activities, placing it in Risk Management Process. It is Domain-Adapted because it uses specific cybersecurity terminology (SOC, SIEM) that passes the ERM test.


reasoning: The paragraph is a standard negative assertion regarding the material impact of cybersecurity risks on the company's business and financial condition, which falls under Strategy Integration per the materiality rule. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph focuses on the management of third-party cybersecurity risks, making it a clear Third-Party Risk category. It reaches Domain-Adapted specificity by referencing 'third-party risk monitoring security rating services,' which demonstrates cybersecurity domain knowledge beyond generic risk management language.


fact: point-of-sale software

fact: data warehouse

reasoning: The paragraph describes the information systems that constitute the company's operational environment, which is a foundational element of their risk management process. It reaches Domain-Adapted specificity by referencing specific technical categories like 'customer relationship management solutions', 'point-of-sale software', and 'data warehouse' rather than generic business terms.


fact: after-action evaluation

fact: penetration testing

fact: forensic analysis

fact: NIST framework

fact: Global Corporate Continuity Program

reasoning: The paragraph primarily describes the company's internal risk management processes, including incident response (after-action evaluation) and third-party assessment methodologies. It reaches Firm-Specific specificity because it names a specific internal program, the 'Global Corporate Continuity Program'.


fact: personally identifiable information

fact: trade secrets

reasoning: The paragraph is centrally focused on the company's third-party vendor management program and oversight of vendor-related risks. It reaches the Domain-Adapted level by referencing specific data types (personally identifiable information, trade secrets) that require cybersecurity domain knowledge to manage, rather than generic risk management language.


fact: Vice President of Information Technology

fact: phishing and penetration tests

reasoning: The paragraph is primarily about the cybersecurity program's activities, specifically the execution of phishing and penetration tests and the subsequent remediation process. It reaches the Quantified-Verifiable level due to the inclusion of specific calendar years (2023, 2024) tied to the execution and completion of these security activities.


fact: privileged access policies

fact: multi-factor authentication

reasoning: The paragraph is primarily about the implementation of specific security measures (privileged access policies, multi-factor authentication) following an incident, which falls under Risk Management Process. It reaches Domain-Adapted specificity because it references specific cybersecurity practices that pass the ERM test.


reasoning: The company is a SPAC with no operations and explicitly states it has not adopted a cybersecurity program, which qualifies as None/Other under the provided rules.


reasoning: The paragraph is centrally focused on the management of third-party cybersecurity risks. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: $14.3 million

reasoning: The paragraph describes a specific cybersecurity incident, including the date of occurrence and the financial impact, which directly classifies it as Incident Disclosure. The inclusion of a specific date and a precise dollar amount makes it Quantified-Verifiable.


fact: Information Technology Committee

reasoning: The paragraph focuses on the Board's oversight role and the flow of information regarding cybersecurity, which is the primary definition of Board Governance. It is classified as Firm-Specific because it names a specific internal body, the 'Information Technology Committee', which distinguishes it from generic board oversight descriptions.


fact: DSCP

fact: Form 8-K filed on February 29, 2024

fact: MOVEit Cybersecurity Incident

fact: PBI

fact: approximately 2.5 million to 2.7 million of our policyholders' or other customers' personal information

reasoning: The paragraph is primarily an Incident Disclosure because it details the specific MOVEit incident, its scope, and the company's response. It reaches Quantified-Verifiable specificity due to the inclusion of specific incident names, dates, and the quantified number of affected individuals.


reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the materiality of cybersecurity risks on the company's business strategy and financial condition. It contains no specific cybersecurity domain terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph provides a generic overview of cybersecurity threats and reliance on information systems without detailing specific governance, management, or risk management processes. It constitutes standard risk disclosure boilerplate.


fact: Information Security Officer

fact: Chief Information Officer

reasoning: The paragraph focuses on the responsibilities of specific management roles (Information Security Officer and Chief Information Officer), placing it in Management Role. It is classified as Firm-Specific because it identifies specific leadership titles involved in the cybersecurity program.


reasoning: The paragraph is centrally focused on the oversight and management of third-party service providers, fitting the Third-Party Risk category. It reaches Firm-Specific specificity because it identifies a specific management role (Chief Information Officer) responsible for the monitoring process.


reasoning: The paragraph focuses on the oversight and management of cybersecurity risks related to third-party vendors and customers, which is the central theme of Third-Party Risk. The language used is generic and does not contain specific technical terminology or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: This paragraph describes hypothetical cybersecurity threats and potential business impacts, which constitutes standard risk factor disclosure rather than a description of governance, management, or specific risk management processes. It contains no specific, verifiable, or domain-unique cybersecurity details.


reasoning: The paragraph describes the company as a special purpose acquisition company (SPAC) with no operations and explicitly states it has no cybersecurity program, which falls under the None/Other category as it lacks substantive cybersecurity disclosure.


fact: SOC reports

fact: complementary controls

reasoning: The paragraph is primarily focused on the oversight and management of third-party service providers, fitting the Third-Party Risk category. It reaches Domain-Adapted specificity by referencing specific cybersecurity concepts like 'SOC reports' and 'complementary controls,' which demonstrate domain expertise beyond generic risk management language.


fact: fiscal year ending on December 31, 2024

reasoning: The paragraph primarily discusses the Board of Directors' role in establishing cybersecurity policies and oversight, placing it in Board Governance. It reaches Quantified-Verifiable specificity because it cites a specific, verifiable fiscal year-end date (December 31, 2024) in the context of SEC transition guidance.


reasoning: The paragraph states that the company is a blank check company with no operations, which is a standard disclaimer for SPACs and does not describe a cybersecurity program or governance structure. As it contains no substantive cybersecurity disclosure, it is classified as None/Other and Generic Boilerplate.


fact: Chief Financial Officer ("CFO")

fact: CCO

fact: three years

fact: more than 30 years

fact: April 2025

fact: more than 35 years

reasoning: The paragraph focuses on the roles and responsibilities of specific management personnel (CFO and CCO) in overseeing cybersecurity, fitting the Management Role category. It reaches the Quantified-Verifiable level because it includes specific, verifiable tenure durations and start dates for these officers.


fact: CSIRPs

fact: detection, analysis, containment, eradication, recovery, post-incident review

reasoning: The paragraph describes the company's incident response procedures, which falls under Risk Management Process. It is classified as Firm-Specific because it identifies the company's specific program, 'CSIRPs'.


reasoning: The paragraph describes the oversight role of the Audit Committee regarding cybersecurity, which falls under Board Governance. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph describes the Board's general oversight responsibility for cybersecurity risks, which falls squarely under Board Governance. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: CIO

fact: management committee on cybersecurity

reasoning: The paragraph describes the governance structure for cybersecurity oversight, specifically detailing the reporting lines and briefing frequency to the Board and Audit Committee. It is classified as Firm-Specific because it identifies specific roles (Senior Director, Information Protection & Compliance; CIO) and a named internal committee (management committee on cybersecurity).


reasoning: The paragraph provides a standard materiality assessment regarding cybersecurity risks, which falls under Strategy Integration. It contains no specific facts, domain terminology, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph focuses exclusively on the oversight and monitoring of third-party providers, making Third-Party Risk the primary category. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity risks on the company's business and financial condition, which is classified as Strategy Integration. It contains no specific cybersecurity program details, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: third-party security expert consultant

fact: risk assessment process

fact: security controls

reasoning: The paragraph describes the activities of a third-party consultant within the company's cybersecurity program, which falls under Risk Management Process. It is classified as Domain-Adapted because it uses specific cybersecurity terminology like 'security controls' and 'coordination of responses to cybersecurity incidents' that demonstrate domain expertise beyond generic risk management language.


fact: Chief Information Officer ("CIO")

fact: Chief Information Security Officer ("CISO")

fact: over 20 years of experience

reasoning: The paragraph describes the governance structure for cybersecurity, specifically the delegation of oversight from the Board to the Audit Committee and the reporting lines of the CISO and CIO, making Board Governance the primary category. The specificity is Quantified-Verifiable due to the inclusion of specific, checkable claims regarding the years of experience of the named officers.