reasoning: The paragraph is classified as Strategy Integration because it explicitly addresses the materiality of cybersecurity incidents and risks on the company's business strategy and financial condition. It is Generic Boilerplate because negative assertions about the absence of material incidents are not externally verifiable, and the paragraph contains no other specific cybersecurity domain terms or firm-specific details.


content_category: Incident Disclosure

fact: fiscal year ended September 30, 2025

fact: physical security incident

fact: firemen's access conduit

category_confidence: high

specificity_confidence: high

reasoning: The paragraph is primarily an Incident Disclosure because it details a specific physical security breach that occurred during the fiscal year, including the method of entry and the outcome. It reaches Quantified-Verifiable specificity because it provides a specific fiscal year date for the incident.

provider: google

stage: benchmark


content_category: Board Governance

reasoning: The paragraph describes the board's oversight structure and frequency of review, which falls under Board Governance. It contains no domain-specific terminology, firm-specific committees, or verifiable facts, resulting in a Generic Boilerplate specificity level.


content_category: None/Other

reasoning: The paragraph provides a generic statement of cybersecurity objectives without describing specific processes, governance structures, or management roles, thus falling under None/Other and Generic Boilerplate.


fact: ransomware

fact: malicious software

reasoning: The paragraph is a standard risk factor disclaimer describing potential threats and consequences, which falls under None/Other as it does not describe the company's actual cybersecurity program or governance. It reaches Domain-Adapted specificity by referencing specific threat types like ransomware and malicious software.


fact: malware, viruses, worms and ransomware

fact: password spraying

fact: phishing

fact: denial-of-service attacks

fact: advanced persistent threat intrusions

reasoning: The paragraph describes the threat landscape and types of attacks the company faces, which is standard risk factor disclosure rather than a description of governance, management, or specific risk management processes. It reaches Domain-Adapted specificity by listing specific technical threat vectors like 'password spraying' and 'advanced persistent threat intrusions' that demonstrate cybersecurity expertise.


content_category: Risk Management Process

fact: monitor our environment for issues and alerts

fact: security tools

fact: suspicious behaviors

reasoning: The paragraph describes the operational activities of the cybersecurity program, specifically monitoring and incident response, placing it in Risk Management Process. It reaches Domain-Adapted specificity by referencing specific cybersecurity concepts like monitoring for alerts and suspicious behaviors, which pass the ERM test.


reasoning: The paragraph describes the integration of cybersecurity into the broader enterprise risk management framework, which is a core component of the risk management process. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


content_category: Strategy Integration

reasoning: The paragraph primarily makes a negative assertion regarding the materiality of past cybersecurity incidents, which is classified as Strategy Integration under Rule 5. It contains no domain-specific terminology, firm-unique details, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: Chief Technology Officer

reasoning: The paragraph primarily describes the board's oversight structure, the role of the audit committee, and reporting lines, which falls under Board Governance. It achieves Quantified-Verifiable specificity by referencing a specific event (hosting an expert at the board retreat) that occurred in a specific year (2023).


fact: Chief Information Officer

fact: Chief Information Security Officer

reasoning: The paragraph primarily describes the governance structure and reporting lines for cybersecurity oversight, making it Board Governance. It reaches Firm-Specific specificity because it identifies specific executive roles (Chief Information Officer and Chief Information Security Officer) involved in the reporting chain.


content_category: Management Role

fact: chief technology officer

fact: over a decade of industry experience

type: quantified

reasoning: The paragraph primarily describes the responsibilities, qualifications, and reporting lines of the Chief Technology Officer, placing it in Management Role. It reaches Quantified-Verifiable specificity because it cites a specific duration of experience ('over a decade'), which is a verifiable claim.


fact: scan and analyze for vulnerable software or misconfigurations

fact: cloud-based technology

reasoning: The paragraph is primarily about the company's internal risk management processes, specifically how they use security software and vendor assessments to manage risk. It reaches Domain-Adapted specificity by referencing specific cybersecurity practices like vulnerability scanning and misconfiguration analysis, which pass the ERM test.


reasoning: This paragraph is a cross-reference directing the reader to Item 1A for risk factors, which constitutes a non-substantive disclosure under the provided rules.


fact: IT and OT

fact: refinery processes

fact: petroleum movement monitoring

reasoning: The paragraph describes the company's reliance on IT and OT systems for operational processes, which falls under Risk Management Process as it defines the scope of the cybersecurity program's environment. It is classified as Domain-Adapted because it specifically references 'IT and OT' (Information Technology and Operational Technology) and industry-specific operational contexts like 'refinery processes' and 'petroleum movement monitoring,' which demonstrate domain expertise beyond generic risk management language.


reasoning: The paragraph is a generic disclaimer about the company's lack of resources and the difficulty of cybersecurity, rather than describing a specific program, governance structure, or strategy. It contains no domain-specific terminology, firm-specific details, or verifiable facts.


content_category: Third-Party Risk

fact: penetration testing

fact: threat monitoring

reasoning: The paragraph is centrally focused on the company's management of third-party vendors and their security requirements, which aligns with the Third-Party Risk category. It achieves Domain-Adapted specificity by citing specific cybersecurity practices like penetration testing and threat monitoring.


reasoning: This paragraph is a definition of a term ('systems') used within the filing, which does not describe governance, management, risk processes, or strategy, and thus falls under None/Other.


fact: Cybersecurity Incident Response Plan

fact: IRP

fact: containment, review, escalation, recovery from and remediation

fact: Incident Response Team ("IRT")

fact: DPT

reasoning: The paragraph describes the operational mechanics of the company's incident response program, making it a Risk Management Process disclosure. It reaches Firm-Specific specificity by naming internal entities like the 'DPT' and 'Incident Response Team (IRT)'.


reasoning: The paragraph is classified as Strategy Integration because it contains a negative assertion regarding the occurrence of material cybersecurity incidents. It lacks any specific, verifiable, or domain-unique details, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph describes the board's oversight structure and delegation to a committee, which is the definition of Board Governance. It contains no domain-specific terminology, firm-specific entities, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: Namecheap

fact: Godaddy

fact: Cloudflare

reasoning: The paragraph focuses on the company's reliance on third-party hosting providers as its primary cybersecurity risk vector. It reaches the Quantified-Verifiable level because it explicitly names specific third-party vendors (Namecheap, Godaddy, Cloudflare), which are externally verifiable entities.


reasoning: The paragraph consists entirely of generic disclaimers and forward-looking statements regarding potential risks and insurance limitations, which do not describe specific cybersecurity processes, governance, or management roles. It also includes a cross-reference to Item 1A, which is explicitly excluded from substantive classification.


reasoning: The paragraph describes the Board's oversight responsibilities for risk management, which is the core definition of Board Governance. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: threat intelligence

fact: security tools

reasoning: The paragraph describes the governance structure from the Board down to management, making Board Governance the primary category. It reaches Domain-Adapted specificity by referencing specific cybersecurity concepts like 'threat intelligence' and 'security tools' rather than just generic risk management language.


reasoning: The paragraph is centrally focused on the management of cybersecurity risks posed by third parties, fitting the Third-Party Risk category. It contains no specific domain terminology, firm-specific details, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: Audit Committee

fact: Chief Information Officer

fact: Chief Financial Officer

reasoning: The paragraph describes the governance structure and reporting lines between management and the Board/Audit Committee, placing it squarely in Board Governance. It is classified as Firm-Specific because it identifies specific roles (CIO, CFO) involved in the reporting process, which distinguishes the company's governance structure.


fact: Chief Information Officer (CIO)

fact: Chief Information Security Officer (CISO)

fact: Cyber Incident Response Teams

reasoning: The paragraph focuses on the organizational structure and responsibilities of specific management roles (CIO, CISO) and teams, fitting the Management Role category. It reaches Firm-Specific specificity because it identifies specific leadership roles (CIO, CISO) and a named internal team (Cyber Incident Response Teams).


fact: ransomware

fact: malware

fact: phishing

reasoning: The paragraph is classified as Strategy Integration because it makes a negative assertion regarding the materiality of past cybersecurity incidents. It is Domain-Adapted because it lists specific cybersecurity threat vectors like ransomware, malware, and phishing, which demonstrate domain expertise beyond generic risk management language.


reasoning: The paragraph describes the board's oversight structure and delegation of cybersecurity risk to the Audit Committee, which is the primary focus of Board Governance. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: attest reports covering cyber-related controls

fact: complementary user entity controls

reasoning: The paragraph is primarily focused on the risks posed by third-party providers and the specific measures taken to manage those risks, such as reviewing attest reports and implementing user entity controls. The specificity is Domain-Adapted because it references specific cybersecurity concepts like 'attest reports' and 'complementary user entity controls' which demonstrate domain expertise beyond generic risk management language.


reasoning: This paragraph is a cross-reference to the Risk Factors section and contains no substantive cybersecurity disclosure, thus falling under None/Other and Generic Boilerplate.


fact: Senior Director of Information Technology

fact: over 20 years of cybersecurity experience

fact: last 10 years in leadership positions

fact: Certified Information Systems Security Professional (CISSP)

fact: Certified Cloud Security Professional (CCSP)

fact: Certified Information Systems Security Architecture Professional (CISSP-ISSAP)

fact: Certified in the Governance of Enterprise IT (CGEIT)

fact: Certified Data Privacy Solutions Engineer (CDPSE)

fact: Certified Ethical Hacker (CEH)

reasoning: The paragraph is primarily about the roles and qualifications of the management team responsible for cybersecurity, fitting the Management Role category. It reaches the highest specificity level due to the inclusion of numerous verifiable certifications and quantified years of experience.


reasoning: The paragraph focuses on the company's collaboration with third-party vendors regarding cybersecurity, making Third-Party Risk the primary category. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: CISO

fact: Security Governance Committee

fact: over 20 years of cybersecurity and technology management experience

reasoning: The paragraph describes the composition and qualifications of management roles (CISO and committee members), fitting the Management Role category. It reaches Quantified-Verifiable specificity because it cites a specific, verifiable number of years of experience for the CISO.


fact: third-party security scoring system

reasoning: The paragraph is explicitly titled 'Managing Third Party Risk' and focuses on vendor oversight, making it a clear Third-Party Risk category. It reaches Domain-Adapted specificity by referencing a 'third-party security scoring system,' which is a specific cybersecurity tool/practice that passes the ERM test.


fact: Incident Response Plan

fact: Chief Operations Officer

reasoning: The paragraph describes the operational mechanics of the company's Incident Response Plan, which is a core component of their risk management process. It is classified as Firm-Specific because it identifies a specific management role (Chief Operations Officer) responsible for coordinating the plan.


fact: Chief Financial Officer ("CFO")

fact: Chief Technology Officer ("CTO")

fact: over 26 years of extensive information technology experience

fact: Director of Technology

fact: Information Technology Manager

fact: Technical Manager

fact: Systems Analyst

reasoning: The paragraph focuses on the management structure and the specific qualifications of the CTO, making it a Management Role classification. It reaches Quantified-Verifiable specificity because it cites a specific number of years of experience (26 years) for the CTO, which is a verifiable claim.


reasoning: The paragraph consists of standard risk factor boilerplate regarding potential future threats and a negative assertion about past incidents, which does not constitute a substantive description of a cybersecurity program or governance structure. It concludes with a cross-reference to Item 1A, further indicating it is not a substantive disclosure.


fact: Progress software

fact: February 26, 2024

reasoning: The paragraph is classified as Incident Disclosure because it describes a specific cybersecurity incident (the Progress software breach) and the subsequent regulatory response. It reaches the Quantified-Verifiable level of specificity due to the inclusion of a specific calendar date (February 26, 2024) regarding the SEC request.


reasoning: The paragraph makes a negative assertion regarding the materiality of past cybersecurity incidents, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific facts, or externally verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph focuses exclusively on the company's oversight of third-party vendors, making it a clear Third-Party Risk disclosure. It lacks any domain-specific terminology, firm-specific details, or verifiable claims, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph describes external regulatory requirements rather than the company's internal cybersecurity program, governance, or strategy, and per instructions, None/Other paragraphs are classified as Generic Boilerplate.


reasoning: The paragraph is explicitly about managing third-party service provider risks, placing it in the Third-Party Risk category. It lacks specific cybersecurity domain terminology, firm-specific identifiers, or verifiable claims, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity risks on the company's business strategy and financial condition, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: Director of Information Technology

fact: more than 20 years' experience

fact: Certified Information Systems Security Professional (CISSP)

fact: University of California, Santa Barbara

reasoning: The paragraph focuses on the qualifications, experience, and responsibilities of a specific management role (Director of Information Technology), placing it in Management Role. It reaches Quantified-Verifiable specificity because it cites a specific certification (CISSP) and a specific number of years of experience (more than 20), both of which are independently verifiable.


fact: GISO

fact: cybersecurity maturity assessments

fact: Chief Information Security Officer

reasoning: The paragraph describes how the company's internal security organization (GISO) manages third-party engagements for assessments and protection, which is a core risk management activity. It is classified as Firm-Specific because it identifies the 'GISO' (Global Information Security Office) and the 'Chief Information Security Officer' as key actors.


reasoning: The paragraph consists of generic risk disclosures and a cross-reference to Item 1A, which does not constitute substantive cybersecurity program or governance disclosure. The negative assertion regarding past incidents is not considered a verifiable fact.


fact: SOC2 report evaluations

fact: security, availability of data, processing integrity, confidentiality and privacy controls

reasoning: The paragraph is primarily focused on the oversight and management of third-party vendors and service providers, fitting the Third-Party Risk category. It achieves Domain-Adapted specificity by referencing specific cybersecurity domain knowledge, namely the use of SOC 2 report evaluations and the specific Trust Services Criteria (security, availability, processing integrity, confidentiality, and privacy) used to assess vendors.


reasoning: The paragraph describes the board's oversight structure and delegation of cybersecurity risk to the Audit Committee, which is a classic Board Governance topic. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is a high-level, generic statement of commitment to security that does not describe specific governance, management, risk processes, or incidents, thus falling under None/Other.


fact: executive risk committee

fact: Chief Financial Officer

fact: Chief Legal Officer

fact: Senior Vice President, Engineering Operations

fact: monitoring, detecting, mitigating and preventing cybersecurity incidents

fact: testing cybersecurity processes

reasoning: The paragraph is primarily about the composition and responsibilities of the management-level 'executive risk committee' and the qualifications of the cybersecurity team, fitting the Management Role category. It reaches Firm-Specific specificity due to the naming of specific executive roles (CFO, CLO, SVP Engineering Operations) and the specific committee name.


reasoning: This paragraph is a generic introductory statement about the threat landscape and does not describe any specific governance, management, risk process, or incident, thus falling under None/Other.


fact: Brian Fellon

fact: Vice President, Chief Information Officer and Chief Information Security Officer

fact: September 2024

fact: 28 years of experience

fact: Puget Sound Energy

reasoning: The paragraph is primarily about the management structure and the specific leadership role of the CISO, making it Management Role. It reaches Quantified-Verifiable specificity because it includes verifiable facts such as the CISO's name, specific appointment date, years of experience, and previous employment details.


reasoning: The paragraph focuses on the company's process for evaluating third-party vendors, placing it squarely in Third-Party Risk. It reaches Domain-Adapted specificity by referencing specific security criteria (data security, availability, and confidentiality) that pass the ERM test.


fact: Information Security Program ("ISP")

fact: Information Technology Board Committee ("ITBC")

fact: IT Steering Committee ("ITSC")

reasoning: The paragraph is primarily about the oversight structure of the cybersecurity program, specifically naming the board-level and management-level committees responsible for governance. It is classified as Firm-Specific because it identifies specific, named committees (ITBC and ITSC) unique to the company's governance structure.


fact: March 2020

fact: ransomware attack

reasoning: The paragraph is primarily an Incident Disclosure because it details a specific past event (the March 2020 ransomware attack), its nature, and the company's assessment of its impact. It reaches the Quantified-Verifiable level of specificity because it cites a specific, verifiable date (March 2020) for the incident.


fact: artificial intelligence (AI)

fact: generative AI (GenAI)

fact: data leakage

fact: unauthorized access

reasoning: The paragraph describes the components of the company's cybersecurity program, making it a Risk Management Process disclosure. It reaches Domain-Adapted specificity by referencing specific security concepts like data leakage, unauthorized access, and the integration of AI/GenAI into the controls framework.


reasoning: The paragraph focuses on the use of cybersecurity insurance as a financial risk management tool, which falls under Strategy Integration. It contains no specific technical domain terms, firm-specific organizational details, or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: Security Incident Response Plan (SIRP)

fact: encryption protocols

fact: multi-factor authentication

fact: data loss prevention controls

reasoning: The paragraph describes the company's cybersecurity program activities, specifically incident response and data protection measures, placing it in Risk Management Process. It reaches Firm-Specific specificity by naming a specific internal program, the 'Security Incident Response Plan (SIRP)', and includes domain-specific terminology like 'data loss prevention controls' and 'multi-factor authentication'.


fact: Audit Committee of the Board

fact: Director of Information Technology

reasoning: The paragraph describes the governance structure for cybersecurity oversight, specifically the interaction between the Board's Audit Committee and the Manager's Director of Information Technology. It is classified as Firm-Specific because it identifies a specific management role (Director of Information Technology) involved in the oversight chain.


reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the lack of material impact from cybersecurity threats on the company's business and financial condition. It is considered Generic Boilerplate because it contains no domain-specific terminology, firm-specific organizational details, or externally verifiable facts.


fact: CISO

reasoning: The paragraph describes the governance chain and reporting structure for cybersecurity risks, which falls under Board Governance. It is classified as Firm-Specific because it explicitly names the CISO role as part of the reporting structure.


reasoning: This paragraph is a standard cross-reference directing the reader to Item 1A for risk factor disclosures, which is classified as None/Other per the provided rules.


reasoning: The paragraph describes the company's general approach to identifying and managing cybersecurity risks, which falls under Risk Management Process. It contains no specific domain terminology, firm-unique details, or verifiable claims, making it generic boilerplate.


fact: wire fraud scheme

fact: multi-factor authentication (MFA)

reasoning: The paragraph is classified as Incident Disclosure because it details a specific historical cybersecurity event (a 2019 wire fraud incident) and the company's subsequent response. It reaches Quantified-Verifiable specificity by citing the specific year of the incident and referencing the implementation of multi-factor authentication (MFA) as a direct remediation measure.


fact: Critical Threat Committee

reasoning: The paragraph describes the governance structure and reporting lines between a management-level committee and the Board regarding incident materiality and disclosure, which falls under Board Governance. It is classified as Firm-Specific because it names a specific internal entity, the 'Critical Threat Committee', which distinguishes the company's governance structure.


reasoning: The paragraph is classified as Strategy Integration because it makes a negative assertion regarding the material impact of cybersecurity incidents on the company's business and financial condition. It contains no specific domain terminology, firm-specific details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: program maturity assessments

fact: information technology risk assessments

fact: third-party security risks assessments

reasoning: The paragraph primarily describes the components of the company's cybersecurity risk management program (assessments), fitting the Risk Management Process category. It reaches Domain-Adapted specificity by referencing specific cybersecurity assessment types (program maturity, IT risk, third-party security) that go beyond generic risk management language.


fact: identity management and access control

fact: system and network security and monitoring

reasoning: The paragraph describes specific cybersecurity program activities (Risk Management Process). It reaches Domain-Adapted specificity by referencing technical concepts like 'identity management,' 'access control,' and 'encryption of data in transit and at rest,' which pass the ERM test.


reasoning: The paragraph consists entirely of forward-looking disclaimers regarding the effectiveness of the cybersecurity program and a cross-reference to the Risk Factors section, which does not constitute substantive cybersecurity disclosure.


reasoning: The paragraph describes the board's oversight structure (Audit Committee receiving reports), which falls under Board Governance. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in Generic Boilerplate specificity.


fact: third-party risk management (TPRM) program

reasoning: The paragraph is centrally focused on the company's third-party risk management program, fitting the Third-Party Risk category. It is classified as Domain-Adapted because it uses the specific industry term 'TPRM' (Third-Party Risk Management), which demonstrates cybersecurity domain knowledge beyond generic risk management language.


fact: IT consultant

reasoning: The paragraph is primarily about the company's oversight and engagement of an IT consultant for cybersecurity tasks, which falls under Third-Party Risk. It lacks specific domain terminology (e.g., specific security frameworks or tools), firm-specific identifiers (e.g., named committees or specific team names), or verifiable claims, resulting in a Generic Boilerplate specificity level.


fact: application vulnerability assessments

fact: public internet presence monitoring

fact: controls evidence reviews

fact: security capabilities and maturity assessments

fact: NIST

type: framework

fact: ISO

fact: HIPAA

fact: Payment Card Industry standards

reasoning: The paragraph is centrally focused on the oversight and contractual requirements imposed on third-party suppliers, placing it squarely in Third-Party Risk. It achieves Domain-Adapted specificity by referencing specific cybersecurity assessment activities like 'application vulnerability assessments' and 'public internet presence monitoring' that go beyond generic risk management language.


fact: $1.0 million

fact: December 30, 2023

fact: fourth quarter of 2024

fact: $0.6 million

reasoning: The paragraph describes the impact, remediation, and financial consequences of a specific cybersecurity incident, making it an Incident Disclosure. It reaches the Quantified-Verifiable level due to the inclusion of specific dollar amounts and precise dates related to the incident's financial impact and remediation timeline.


fact: Cybersecurity Leadership Team

reasoning: The paragraph is primarily about the Board's oversight structure and delegation to the Audit Committee, placing it in Board Governance. It is classified as Firm-Specific because it references a specific internal entity, the 'Cybersecurity Leadership Team', which distinguishes the company's governance structure.


reasoning: The paragraph is classified as Strategy Integration because it provides a formal materiality assessment regarding cybersecurity risks and their impact on the business. It is Domain-Adapted because it utilizes the 'confidentiality, integrity, or availability' (CIA) triad to define cybersecurity threats, which demonstrates specific domain knowledge beyond generic risk management language.


reasoning: The paragraph discusses general information technology investments for business operations and growth, lacking any specific cybersecurity content or terminology.


reasoning: The paragraph focuses entirely on the Board's oversight role and governance structure regarding cybersecurity, fitting the Board Governance category. It contains no domain-specific terminology, firm-specific identifiers, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: Form 8-K filed on July 14, 2023

fact: zero-day vulnerability

fact: MOVEit

fact: First National 1870

fact: Guardian Mortgage

reasoning: The paragraph describes a specific cybersecurity incident involving a third-party vendor, which qualifies as Incident Disclosure. It is classified as Quantified-Verifiable because it includes specific, externally verifiable dates and named internal divisions.


fact: Chief Financial Officer

reasoning: The paragraph primarily describes the oversight structure of the Board and Audit Committee regarding cybersecurity, placing it in Board Governance. It is classified as Firm-Specific because it identifies the Chief Financial Officer as the specific management role responsible for the cybersecurity program.


fact: more than 20 years of experience

reasoning: The paragraph primarily describes the specific leadership role and qualifications of the President and CEO in managing cybersecurity, which falls under Management Role. It reaches Quantified-Verifiable specificity because the claim of 'more than 20 years of experience' provides a specific, verifiable threshold.


reasoning: The paragraph describes the components of the company's cybersecurity program, such as risk assessments, training, and incident response planning, which falls under Risk Management Process. The language used is generic and lacks specific domain terminology, firm-unique identifiers, or verifiable claims, resulting in a Generic Boilerplate classification.


reasoning: The paragraph describes the company's efforts to integrate cybersecurity into its broader risk management framework, which is a core Risk Management Process activity. It reaches Domain-Adapted specificity by referencing the 'confidentiality, integrity, and availability' (CIA triad) security concepts.


reasoning: The paragraph primarily describes the board's oversight structure and the reporting lines between management and the board, fitting the Board Governance category. It reaches Firm-Specific specificity because it identifies a specific leadership role (Vice President of Information Technology) involved in the reporting process.


reasoning: The paragraph makes a negative assertion regarding the material impact of cybersecurity risks on the company's financial condition, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific facts, or verifiable claims, resulting in Generic Boilerplate specificity.


fact: extended detection and response

fact: vulnerability scanning

fact: phishing simulations

fact: penetration tests

reasoning: The paragraph describes the components of the company's cybersecurity program, which falls under Risk Management Process. It is classified as Domain-Adapted because it lists specific cybersecurity practices and tools like 'extended detection and response' and 'phishing simulations' that demonstrate domain expertise.


fact: VP of IT

fact: Chief Information Security Officer

fact: cyber emergency response team

fact: NVP of Finance

fact: Cybersecurity Response Committee

fact: over 24 years

fact: over 50 years of collective experience

reasoning: The paragraph focuses on the qualifications, experience, and committee membership of specific management roles (VP of IT, NVP of Finance), making it a Management Role classification. It reaches Quantified-Verifiable specificity due to the inclusion of specific years of experience (24 years, 50 years) which are verifiable claims.


fact: Chief Information Security Officer ("CISO")

fact: Chief Risk Officer ("CRO")

fact: Chief Technology Officer ("CTO")

fact: Chief Legal Officer ("CLO")

reasoning: The paragraph focuses on the organizational structure and reporting lines of cybersecurity leadership (CISO reporting to CRO), which falls under Management Role. It is classified as Firm-Specific because it explicitly names specific executive roles (CISO, CRO, CTO, CLO) involved in the cybersecurity governance structure.


fact: security threat intelligence system

fact: vulnerability management tools

fact: patch management

fact: Security Operations Center

fact: event correlation

reasoning: The paragraph details specific operational components of the cybersecurity program, such as threat intelligence, patch management, and a Security Operations Center, which directly answers what the program does (Risk Management Process) and demonstrates domain-specific knowledge.


fact: CISO

fact: Chief Information Officer

reasoning: The paragraph focuses on the Board's oversight structure and the delegation of cybersecurity risk oversight to the Audit Committee, placing it squarely in Board Governance. It reaches Firm-Specific level because it explicitly identifies the specific management roles (CISO and Chief Information Officer) responsible for reporting to the Board and Audit Committee.


fact: cybersecurity audits

reasoning: The paragraph is primarily focused on the management of third-party cybersecurity risks, including supply chain and vendor access, which fits the Third-Party Risk category. It reaches the Domain-Adapted level because it mentions conducting 'cybersecurity audits' on third parties, which demonstrates specific domain knowledge beyond generic risk management language.


fact: Blend's internal audit team

reasoning: The paragraph is primarily focused on the management of third-party service providers, including contractual obligations and re-evaluation processes, making Third-Party Risk the most appropriate category. It is classified as Firm-Specific because it explicitly names 'Blend's internal audit team' as part of the escalation process.


fact: Security Committee

fact: Chief Security Officer (CSO)

fact: Cyber Risk Advisory Committee

reasoning: The paragraph primarily describes the governance structure for cybersecurity oversight, detailing the roles of the board, specific committees, and the CSO. It is classified as Firm-Specific because it names specific internal committees (Security Committee, Cyber Risk Advisory Committee) and a specific executive role (Chief Security Officer).


fact: IT team

fact: cross-functional team

reasoning: The paragraph describes the operational steps taken during an incident response, which falls under Risk Management Process. It is classified as Firm-Specific because it identifies the specific internal groups ('IT team' and 'cross-functional team') responsible for these activities.


fact: VP of IT

reasoning: The paragraph primarily describes the governance structure for cybersecurity oversight, specifically the delegation of duties from the Board to the Audit Committee and the reporting lines of the VP of IT. It is classified as Firm-Specific because it identifies a specific management role (VP of IT) involved in the governance chain.


fact: phishing simulations

fact: vulnerabilities

fact: targeted attack simulations

reasoning: The paragraph describes the activities and components of the cybersecurity program (vulnerability testing, phishing simulations, attack simulations), which falls under Risk Management Process. It reaches Domain-Adapted specificity by referencing specific cybersecurity practices like phishing simulations and targeted attack simulations that pass the ERM test.


fact: steering committee on information security

fact: over 20 years of experience

fact: CIO Executive Education Certificate from Stanford University

reasoning: The paragraph is classified as Management Role because it focuses on the responsibilities and qualifications of the CISO and the internal steering committee. It reaches Quantified-Verifiable specificity due to the inclusion of specific years of experience and a named educational certification.


fact: Chief Information Security Officer ("CISO")

reasoning: The paragraph focuses on the responsibilities and organizational role of the CISO, making it a Management Role classification. It is Firm-Specific because it explicitly names the 'Chief Information Security Officer' role, which qualifies as a security-specific leadership title.


reasoning: The paragraph provides a negative assertion regarding the material impact of cybersecurity incidents on the company's business strategy and financial condition, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific details, or externally verifiable facts, resulting in a Generic Boilerplate specificity level.


reasoning: The paragraph is classified as Strategy Integration because it makes a negative assertion regarding the materiality of past cybersecurity incidents, which is a standard assessment of business impact. It is Generic Boilerplate because negative assertions about the absence of material incidents are not externally verifiable, and the rest of the text is standard risk disclosure language.


fact: Ann Bordelon, Chair of the Audit Committee

fact: Paulette Dodson

fact: Noah Glass

reasoning: The paragraph focuses on the Board and Audit Committee's role in cybersecurity oversight, which is the definition of Board Governance. It reaches Firm-Specific specificity because it names specific board members who possess cybersecurity experience.


fact: Cybersecurity Manager

fact: security engineers

reasoning: The paragraph is primarily focused on the company's oversight of third-party service providers, making 'Third-Party Risk' the correct category. It reaches 'Firm-Specific' specificity because it identifies specific internal roles ('Cybersecurity Manager' and 'security engineers') responsible for these tasks.


reasoning: The paragraph provides a generic statement about senior leadership oversight and directs the reader to the Risk Factors section, which constitutes a cross-reference rather than substantive cybersecurity disclosure.


reasoning: The paragraph is primarily a negative assertion regarding the materiality of past incidents, which falls under Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph provides a negative assertion regarding the materiality of cybersecurity incidents, which is classified as Strategy Integration per Rule 5. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in Generic Boilerplate specificity.


fact: Enterprise Risk Committee ("ERC")

fact: Operational Risk Committee ("ORC")

fact: 17-year period

fact: Certified Information Systems Security Professional (CISSP)

reasoning: The paragraph is primarily focused on the organizational structure and leadership roles (CISO, ERC, ORC) responsible for cybersecurity, fitting the Management Role category. It reaches Quantified-Verifiable specificity because it includes verifiable facts such as the CISO's specific certification (CISSP) and the duration of their prior experience (17 years).


fact: January 2023

reasoning: The paragraph describes a specific cybersecurity incident involving the company's advisor, making it an Incident Disclosure. It is classified as Quantified-Verifiable because it includes a specific date (January 2023) associated with the event.


reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the materiality of past cybersecurity incidents on the company's business strategy and financial condition. It is Generic Boilerplate because it contains no domain-specific terminology, firm-specific organizational details, or externally verifiable facts.


reasoning: The paragraph is classified as Strategy Integration because it explicitly states a conclusion regarding the lack of material impact on the company's business strategy and financial condition. It is Generic Boilerplate because it contains no domain-specific terminology, firm-specific identifiers, or verifiable facts.


fact: vulnerability management policy

fact: encryption of data

reasoning: The paragraph describes the company's cybersecurity program activities, fitting the Risk Management Process category. It reaches Domain-Adapted specificity by referencing specific cybersecurity practices like vulnerability management and data encryption, which pass the ERM test.


reasoning: The paragraph consists entirely of standard forward-looking risk disclaimers and a cross-reference to Item 1A, which does not constitute substantive cybersecurity disclosure.


fact: data encryption

fact: breach notification

reasoning: The paragraph describes the company's process for monitoring regulatory compliance, which is a component of the risk management process. It reaches Domain-Adapted specificity by referencing specific cybersecurity concepts like data encryption and breach notification.


fact: Cybersecurity team

reasoning: The paragraph focuses on the organizational structure of management committees (ERC, ORC) and the specific reporting lines of the CISO, which falls under Management Role. It is classified as Firm-Specific because it names specific internal committees and the CISO role.


fact: CISSP

fact: CCNP

fact: CISA

fact: CySA+

reasoning: The paragraph focuses on the qualifications and experience of the management team responsible for cybersecurity, placing it in Management Role. It reaches Domain-Adapted specificity by citing specific cybersecurity certifications (CISSP, CCNP, CISA, CySA+), which demonstrate domain expertise beyond generic management descriptions.


fact: Audit & Finance Committee

fact: CISO

fact: CIO

reasoning: The paragraph is primarily about the board's oversight structure and reporting lines, placing it in Board Governance. It reaches Firm-Specific specificity because it names the specific board committee (Audit & Finance Committee) and the specific management roles (CISO and CIO) responsible for reporting.


reasoning: The paragraph consists entirely of a standard disclaimer regarding the inability to guarantee security and a cross-reference to the Risk Factors section, which does not constitute substantive cybersecurity disclosure.


reasoning: The paragraph is classified as Strategy Integration because it explicitly states that cybersecurity threats have not materially affected the company's business strategy, results of operations, or financial condition. It contains no domain-specific terminology, firm-specific details, or verifiable facts, resulting in a specificity level of Generic Boilerplate.


reasoning: The paragraph describes the company's general cybersecurity program activities, such as risk assessment and training, fitting the Risk Management Process category. It lacks specific domain terminology, firm-unique details, or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: encryption

fact: data loss prevention technology

fact: authentication technology

fact: entitlement management

fact: access control

fact: anti-virus and anti-malware software

fact: National Institute of Standards and Technology Cybersecurity Framework

reasoning: The paragraph describes the specific tools and technologies used in the company's cybersecurity program, which falls under Risk Management Process. It reaches Domain-Adapted specificity by referencing specific cybersecurity technologies (e.g., data loss prevention, entitlement management) and a recognized framework (NIST CSF).


fact: vulnerability scans related to vendors

reasoning: The paragraph is centrally focused on the company's vendor management program and how it handles third-party cybersecurity risks, making it a clear Third-Party Risk category. It reaches Domain-Adapted specificity by referencing specific cybersecurity activities like 'vulnerability scans' in the context of vendor oversight, which demonstrates domain knowledge beyond generic risk management language.


fact: Vice President of IT

fact: Randy Jepsen

fact: Russell Devendorf

fact: over 25 years of experience in the IT industry

fact: 19 years at Smith Douglas and The SMART Builder Solutions

fact: almost 50 years managing and otherwise engaged with IT and internal audit functions

reasoning: The paragraph focuses on the roles, responsibilities, and qualifications of specific management personnel (VP of IT and CFO) regarding cybersecurity oversight, placing it squarely in Management Role. It reaches Quantified-Verifiable specificity due to the inclusion of specific years of experience and employment dates for the named executives.


fact: Security Operations Center ("SOC")

reasoning: The paragraph describes the company's cybersecurity program activities, such as incident response and vulnerability management, placing it in Risk Management Process. It reaches Domain-Adapted specificity by referencing the ISO 27001:2022 standard and the operation of a Security Operations Center (SOC), which are specific cybersecurity domain concepts.


fact: Senior Vice President of Engineering

fact: Chief Information Security Officer

fact: Chief Privacy Officer

fact: Privacy and Security Council

reasoning: The paragraph details the organizational structure and specific management roles responsible for cybersecurity, including reporting lines and a named internal committee, which aligns with the Management Role category. The inclusion of specific executive titles and a named council elevates the specificity to Firm-Specific.


fact: CIO has over two decades of experience

fact: CEO, CFO, and GC each have over 15 years of experience

reasoning: The paragraph focuses on the qualifications and experience of management personnel, specifically the CIO and other executives, which falls under Management Role. It reaches the Quantified-Verifiable level because it provides specific, verifiable duration metrics (over two decades, over 15 years) regarding the experience of named executive roles.


fact: technology committee

reasoning: The paragraph describes the governance structure for cybersecurity oversight, specifically identifying the board's committees, which defaults to Board Governance. It is classified as Firm-Specific because it names a 'technology committee' of the board, which is a distinguishing organizational feature.


reasoning: The paragraph describes the company's process for evaluating third-party vendors, which is the central topic of Third-Party Risk. It lacks specific cybersecurity domain terminology or firm-specific details, resulting in a Generic Boilerplate classification.


reasoning: The paragraph focuses on the reporting structure and frequency of updates provided to the board of directors, which is a core Board Governance topic. It contains no specific cybersecurity domain terminology, firm-unique identifiers, or verifiable claims, resulting in a Generic Boilerplate classification.


fact: October 2023

fact: two-factor verification

fact: Security Operations

fact: detection tools

reasoning: The paragraph is primarily an Incident Disclosure because it details a specific, real-world cybersecurity event that occurred in October 2023 and the subsequent remediation actions. The specificity is Quantified-Verifiable due to the inclusion of the specific date of the incident.


reasoning: The paragraph describes the company's internal cybersecurity program, including incident response and third-party assessment processes, which falls under Risk Management Process. It reaches Domain-Adapted specificity by referencing the CIA triad (confidentiality, integrity, and availability), which is a core cybersecurity domain concept.


fact: patching and vulnerability management

fact: cybersecurity tabletop exercise

fact: cybersecurity threat assessment

fact: information technology security infrastructure

reasoning: The paragraph describes the frequency and scope of cybersecurity reporting to the Board of Directors, placing it squarely in Board Governance. It reaches Domain-Adapted specificity by referencing specific cybersecurity practices like vulnerability management and tabletop exercises, which pass the ERM test.


fact: Pension Benefit Information, LLC

fact: Progress Software Corporation's MOVEit Transfer software

fact: approximately 850,000 of Jackson's customers

reasoning: The paragraph describes a specific cybersecurity incident involving a third-party vendor, including the scope of impacted customers and the software involved, which qualifies as Incident Disclosure. The inclusion of specific numbers (850,000 customers) and named entities makes it Quantified-Verifiable.


fact: late May 2023

fact: ransomware attack

reasoning: The paragraph describes a specific past cybersecurity event (a ransomware attack), which falls squarely under Incident Disclosure. It is classified as Domain-Adapted because it references a specific threat type ('ransomware') that passes the ERM test, though it lacks firm-specific identifiers or independently verifiable claims (like a named forensic firm or specific dollar impact).


fact: Chief Information Security Officer

reasoning: The paragraph focuses on the responsibilities and organizational role of the Chief Information Security Officer and management in overseeing the cybersecurity program. The specificity is Firm-Specific because it identifies the CISO role, which is a specific leadership title.


fact: Chief Information Officer

fact: Internal Audit Group

reasoning: The paragraph primarily describes the governance structure and reporting lines between management and the Audit Committee, placing it in Board Governance. It reaches Firm-Specific specificity because it identifies specific internal roles (CIO, CISO) and a specific internal team (Internal Audit Group) involved in the oversight process.


reasoning: The paragraph focuses on the responsibilities and qualifications of a management role (the Director), which falls under Management Role. It lacks specific domain terminology or verifiable facts, resulting in a Generic Boilerplate specificity level.


fact: threat intelligence

reasoning: The paragraph primarily describes the cross-functional management team structure (legal, finance, internal audit) responsible for cybersecurity oversight, fitting the Management Role category. It reaches Domain-Adapted specificity by referencing specific cybersecurity concepts like 'threat intelligence' and 'security tools' that pass the ERM test.


reasoning: The paragraph describes the governance reporting structure between management and the audit committee, which is a classic Board Governance topic. It contains no specific, verifiable, or domain-unique terminology that elevates it beyond generic boilerplate.


reasoning: The paragraph describes the company's approach to mitigating internal threats and managing cybersecurity risks, placing it in the Risk Management Process category. It reaches Domain-Adapted specificity by referencing the 'security, confidentiality, and/or integrity' of records, which constitutes the core CIA triad concept in cybersecurity.


reasoning: The paragraph consists entirely of generic boilerplate disclaimers regarding cybersecurity risk and a general commitment to improvement, containing no substantive details about governance, management, or specific processes.


fact: ITD

fact: Director of ITD

fact: over 7 years of experience

reasoning: The paragraph describes the governance and oversight structure, tracing responsibility from the Board down to the management team, which aligns with Board Governance. It reaches Quantified-Verifiable specificity due to the inclusion of the Director of ITD's specific years of experience.


reasoning: The paragraph describes the company's general approach to cybersecurity risk management, including policies, monitoring, and incident response, which falls under Risk Management Process. The language used is high-level and generic, lacking specific tools, frameworks, or unique organizational details, thus qualifying as Generic Boilerplate.


fact: CISO

fact: CIO

fact: CCO

fact: Morgan Stanley's Cybersecurity Program

reasoning: The paragraph describes the Board's oversight structure and the flow of information from management to the Board, fitting the Board Governance category. It reaches Firm-Specific level by naming specific leadership roles (CISO, CIO, CCO) and the specific program name.


fact: Vice President of IT

fact: Information Security Manager

fact: United States Computer Emergency Readiness Team

reasoning: The paragraph primarily details the management reporting structure and specific roles responsible for cybersecurity, which aligns with the Management Role category. It is classified as Firm-Specific because it identifies specific job titles (Vice President of IT, Information Security Manager) that distinguish the company's management hierarchy.


fact: Morgan Stanley's Non-Financial Risk Committee

fact: Firm Risk Committee

fact: BOTC

fact: Head of Operational Risk

reasoning: The paragraph describes the governance and reporting structure for cybersecurity risks, including specific management-level committees and reporting lines to the Board, which falls under Board Governance. It is classified as Firm-Specific because it names specific internal committees (e.g., Non-Financial Risk Committee, BOTC) and specific leadership roles (CIO, Head of Operational Risk).


fact: CSO

fact: Executive Vice President and Chief Operations Officer

fact: over 20 years of security experience

fact: Certified Information Systems Security Professional

fact: Certified Information Security Manager

fact: architecture

fact: operations

reasoning: The paragraph describes the governance chain from the Board and Audit Committee down to the management level, which defines the oversight structure. It reaches Quantified-Verifiable specificity due to the mention of specific professional certifications (CISSP, CISM) and the CSO's years of experience.


fact: over 25 years of work experience

reasoning: The paragraph focuses on the roles and qualifications of management personnel responsible for cybersecurity, placing it in Management Role. It reaches Quantified-Verifiable specificity because it cites a specific, verifiable number of years of experience for a key employee.


fact: Employee Self Service portal

reasoning: The paragraph primarily describes the company's cybersecurity governance structure, including the roles of the Board and Audit Committee, which falls under Board Governance. The specificity level is Quantified-Verifiable because it contains a specific, verifiable fact regarding the development of an internal system ('Employee Self Service portal') in a specific year ('2022').


fact: Chief Information Security Officer ("CISO")

fact: EXCO

fact: Senior Leadership Team ("SLT")

reasoning: The paragraph describes the governance structure and reporting lines between the CISO and the Board/leadership teams, making it primarily about Board Governance. It reaches Firm-Specific level by naming specific internal leadership groups like the EXCO and SLT.