reasoning: Although Mr. Daly is mentioned, the paragraph primarily describes how the company’s cybersecurity function operates—team monitoring, testing, incident assessment, and escalation protocols—so it is best classified as Risk Management Process. The named cybersecurity certifications make the disclosure more company-specific than generic boilerplate, but it does not contain two clearly hard verifiable facts needed for Quantified-Verifiable.


content_category: Board Governance

category_confidence: medium

specificity_confidence: high

reasoning: The paragraph is chiefly about oversight by the Audit Committee of the Board, describing how the committee is informed about the cybersecurity program and risks. It contains no qualifying firm-specific facts because the Audit Committee, generic team references, and quarterly reporting cadence are excluded from specificity credit.

provider: openai

stage: benchmark


content_category: Third-Party Risk

category_confidence: high

reasoning: The paragraph focuses on oversight of vendor cybersecurity through assessments during onboarding and contract review, making third-party risk the central topic. It provides no named vendors, tools, firms, dates, frameworks, or other qualifying specific facts.


content_category: Management Role

reasoning: The paragraph is primarily about management-level cybersecurity governance through the executive forum and the interim CISO/CIO's involvement, rather than board oversight or detailed risk processes. It includes firm-specific roles and named governance bodies, which makes it Firm-Specific.


content_category: Risk Management Process

specificity_confidence: medium

reasoning: The paragraph is primarily about how the company integrates cybersecurity into its overall risk management process, with reporting to the board described as part of that process. Although board reporting is mentioned, the focus is not on board oversight structure itself or on the CIO's qualifications, but on the internal risk management mechanism.


reasoning: This paragraph is centered on the qualifications, background, and tenure of named cybersecurity management roles rather than the company’s cyber processes. It includes multiple verifiable role- and credential-specific facts about the CIO and CISO, making it more than firm-specific.


content_category: Strategy Integration

reasoning: The paragraph primarily provides a materiality conclusion that cybersecurity threats have not materially affected, and are not reasonably likely to materially affect, the company’s business strategy, results of operations, or financial condition. The references to escalation procedures, management, the Board, and a risk-factor cross-reference are secondary to that materiality-focused disclosure.


reasoning: The paragraph is a standalone materiality assessment stating that cybersecurity threats have not materially affected, and are not reasonably likely to materially affect, the company’s business, results, or financial condition. The cross-reference to Risk Factors does not change the main focus from materiality/impact assessment.


reasoning: The paragraph primarily provides a materiality-oriented discussion of cyber risk exposure and notes the existence of cybersecurity insurance, rather than describing governance, management roles, or specific risk processes. Its brief statement that no material incidents have occurred is ancillary and does not describe an actual incident.


reasoning: The paragraph primarily describes the company’s cybersecurity processes and incident response activities—monitoring systems and following a written incident response runbook—rather than focusing on the qualifications or reporting line of the CICSO. The mention of the CICSO is incidental to the broader discussion of how the cybersecurity function operates.


reasoning: The paragraph focuses on the potential business and financial impact of cybersecurity risk, states a materiality conclusion about past incidents, and mentions cyber liability insurance as part of risk mitigation. It does not describe governance roles, management qualifications, or a specific incident narrative.


reasoning: The paragraph describes the company's internal cybersecurity and resilience measures, such as backups, off-site storage, and disaster recovery capabilities, which makes it a risk management process disclosure. It does not identify any qualifying specific facts like named frameworks, roles, dates, firms, tools, or quantified details.


reasoning: The paragraph primarily describes the company’s internal cybersecurity risk management process—how risks are identified, assigned, and remediated—even though specific management roles are mentioned. The named IT/security roles and the Risk Subcommittee make the disclosure firm-specific rather than generic.


reasoning: The paragraph is centered on the CSO's responsibility, reporting lines, tenure, and experience, so it is principally about a management role rather than the broader cybersecurity process. It includes firm-specific details such as the CSO title and named committees, but does not clearly provide two hard verifiable facts of the type required for Quantified-Verifiable under the rubric.


content_category: None/Other

reasoning: This paragraph is only a cross-reference to the Risk Factors section and does not provide any substantive cybersecurity disclosure. It contains no discussion of governance, management, process, incidents, third-party risk, or strategy beyond directing the reader elsewhere.


reasoning: The paragraph focuses on the audit committee receiving cybersecurity-related reports, so board-level oversight is the main subject. It contains no qualifying specific facts because 'audit committee' is generic and the rest is standard oversight language.


reasoning: The paragraph primarily describes the company’s own cybersecurity preparedness and incident response processes, including simulation exercises and response procedures. Although it also mentions cyber insurance, that appears ancillary rather than the main focus.


reasoning: The paragraph is primarily about the company's internal cybersecurity risk evaluation, detection, and incident notification processes, not the qualifications of an individual manager. The mention of the CISO is incidental to describing how the risk management process operates.


content_category: Incident Disclosure

reasoning: This paragraph describes an actual cybersecurity incident’s effects, the types of data involved, and concrete response actions taken, which makes Incident Disclosure the best fit. It also includes two verifiable facts—a specific number of regulators and a specific time period for required notices—supporting Quantified-Verifiable specificity.


reasoning: The paragraph is primarily about the backgrounds and qualifications of members of management responsible for cybersecurity-related functions, rather than describing processes or board oversight. It includes firm-specific management facts, especially the CTO role, but does not contain two qualifying hard verifiable facts needed for Quantified-Verifiable.


reasoning: The paragraph primarily describes how the Audit Committee and Board oversee cybersecurity risk and receive briefings, making board oversight the main topic. Although it includes information about the Chief Information Officer, that management detail is secondary to the governance discussion.


reasoning: The paragraph is about the company’s internal cybersecurity risk management activities, including assessments, threat intelligence, vulnerability management, and incident response drills. It is not centered on board oversight, a management individual, or a specific incident.


reasoning: The paragraph describes the company's internal process for identifying, assessing, and evaluating cybersecurity-related risks as part of broader operational risk assessment. It does not focus on the board, a specific management role, third-party oversight, or any actual cyber incident.


reasoning: The paragraph is primarily about the Board and Audit Committee's oversight of cybersecurity risk, with management reporting mentioned only as part of that oversight structure. It contains no qualifying firm-specific facts under the rules because the Board, Audit Committee, periodic reporting, and COO are all excluded as generic governance or generic C-suite references.


reasoning: The paragraph focuses on the potential material effect of cybersecurity risks on the company’s business and financial condition and includes a cross-reference to Risk Factors, which fits Strategy Integration. It does not describe a specific incident, governance structure, management role, or concrete risk-management process details.


reasoning: This paragraph is primarily a SPAC/blank-check disclosure stating the company has no operations and no personnel or processes of its own for cybersecurity, with only incidental mention of board oversight and a cross-reference to risk factors. Under the instructions, such absence-of-program disclosures for shell companies are classified as None/Other.


reasoning: The paragraph primarily describes the company's cybersecurity compliance and control environment, including its Information Security Program and how it is designed to meet regulatory and industry requirements, which fits Risk Management Process. Its specificity comes from naming external regulatory frameworks and standards like GLBA, SOX, and FFIEC, but it does not provide firm-unique operational details that would make it Firm-Specific.


reasoning: The paragraph describes BlackRock's internal cybersecurity risk governance process through a management committee structure, rather than board oversight or an individual executive's qualifications. It includes firm-specific governance details, including the named TRCC/ERC committees and the CISO's participation.


reasoning: The paragraph is primarily about how the full Board receives cybersecurity-related updates, which makes board oversight the central topic. Although the CFO is the grammatical subject, the disclosure focuses on informing the Board rather than describing a management role’s qualifications or responsibilities in depth.


reasoning: The paragraph describes an internal cybersecurity response function—coordinating incident response activities and procedures—so it is about the company’s risk management process rather than a person or the board. It contains no qualifying specific facts such as named frameworks, dates, tools, firms, or cybersecurity-specific roles.


reasoning: The paragraph primarily describes the company's internal cybersecurity risk identification and assessment activities, including monitoring threats and conducting scans and tests. Although a management role is mentioned, the focus is on what the function does rather than the qualifications or reporting line of the individual.


reasoning: The paragraph centers on the management team’s experience, responsibilities, and qualifications for overseeing cybersecurity risk, which makes Management Role the best fit. It includes firm-specific facts such as a named IT leadership role and a quantified experience figure, but only one hard verifiable quantitative fact, so it does not reach Quantified-Verifiable.


reasoning: The paragraph is primarily about management personnel and their responsibilities, experience, and organizational roles in cybersecurity, rather than board oversight or the company's risk processes themselves. Although the CTO is noted as a board member, the main subject is the management function and leadership structure.


reasoning: The paragraph is primarily about which management officers are responsible for cybersecurity-related activities and how those responsibilities are allocated, rather than detailing the company’s cybersecurity processes themselves. It includes a firm-specific fact by naming the Cybersecurity Risk Management Committee.


reasoning: The paragraph focuses on the potential business, financial condition, and operational impacts of cybersecurity threats rather than describing board oversight, management roles, a concrete risk process, or an actual incident. Its statements are generalized and hypothetical, making Strategy Integration the closest fit.


reasoning: The paragraph is primarily about board-level oversight, with the Audit Committee described as responsible for information security oversight and reporting to the full board. Although it mentions the chief security officer, that role appears as part of the board reporting structure rather than as the main subject.


reasoning: The paragraph is primarily about the Board and Audit Committee's oversight of cybersecurity risk, with management responsibilities described in support of that governance structure. It contains no qualifying specific facts under the rubric because the Board and Audit Committee are generic governance bodies and the remaining details are standard oversight language.


reasoning: The paragraph primarily describes an actual cybersecurity incident, including when it occurred, the shutdown of systems, operational disruption, and response actions taken. Although it also mentions post-incident investments and the addition of a CISO, those points are secondary to the incident narrative.


reasoning: The paragraph is primarily about governance through a named committee that oversees technology and information security and reports to the board, making Board Governance the best fit. It includes firm-specific details such as a named committee and cybersecurity-related management roles, but no two hard verifiable facts needed for Quantified-Verifiable.


reasoning: The paragraph primarily describes the company’s internal cybersecurity risk management structure and how cyber risk is identified, governed, and escalated through ERM and IRM processes. Although board oversight is mentioned at the end, the main focus is the company’s risk management program rather than the board itself.


reasoning: This paragraph is a materiality statement about whether cybersecurity threats or prior incidents have affected or are reasonably likely to affect the company's business strategy, results of operations, or financial condition. It does not describe governance, management roles, or operational risk processes.


reasoning: The paragraph is centered on a materiality assessment and potential business/financial impact of cybersecurity threats, not on governance, management roles, or specific risk management processes. It contains only standard boilerplate language and no qualifying specific facts.


reasoning: This paragraph is a blank check company disclaimer stating it has no operations and no personnel or processes of its own for cybersecurity. Under the SPAC/shell-company rule, that absence of a program is classified as None/Other despite incidental mention of management reporting to the board.


reasoning: The paragraph is primarily about oversight by the CyTOC and the Board, including how they receive cybersecurity updates and participate in oversight activities. Although management roles are mentioned, they are discussed in service of Board-level oversight rather than as the main subject.


reasoning: The paragraph is primarily about the Board's oversight of cybersecurity risk, including delegation to a committee and briefings received by the Board. Although management participants are mentioned, the Board is the grammatical subject and central focus.


reasoning: The paragraph primarily describes the company's internal security governance structure for evaluating and addressing cyber risk, while mentioning Board oversight only incidentally. The only named roles/entities are the CFO and the Board, which are generic and do not qualify as specific facts.


reasoning: The paragraph focuses on the business impact and materiality of cybersecurity incidents, stating that no material losses have occurred and that future incidents could materially affect the company. It does not describe any specific incident event, timing, or response actions, so it fits Strategy Integration rather than Incident Disclosure.


reasoning: The paragraph is primarily about oversight by a board-approved committee structure and how cyber-related matters are governed and reported to the board, making Board Governance the best fit. It also includes firm-specific details through the named committee and cybersecurity-relevant management roles.


reasoning: The paragraph's main point is a materiality assessment that the company has not experienced cybersecurity threats or incidents that materially affected, or are reasonably likely to materially affect, its business, results, or financial condition. It does not describe a specific incident or discuss concrete internal risk management processes.


reasoning: The paragraph's main topic is oversight of third-party service providers, suppliers, and vendors, including assessing their cybersecurity practices and imposing contractual security requirements. It does not provide any company-unique names, dates, frameworks, or other qualifying specific facts.


reasoning: The paragraph is primarily about oversight and governance through board-approved committees and their monitoring of cybersecurity and technology risk, making Board Governance the best fit. It includes firm-specific committee names and cybersecurity-related management titles, but lacks two or more hard verifiable facts such as dates, dollar amounts, or named external firms/tools.


reasoning: The paragraph is primarily about the company’s cybersecurity risk assessment and management processes and who implements them, rather than focusing mainly on the individual’s biography. It includes firm-specific detail through a cybersecurity-specific role and a quantified experience statement, but not enough hard verifiable facts to clearly reach Quantified-Verifiable.


reasoning: Although the paragraph names the CISO, its main focus is the operation of AGM's cybersecurity program and incident response processes rather than the executive's qualifications or background. The disclosure includes firm-specific organizational details such as the CISO role and the AGM Technology and ERM teams.


reasoning: The paragraph is primarily about the company’s reliance on and selection of third-party service providers and consultants in connection with cybersecurity risk management, making vendor-related oversight the central topic. Although it ends with a materiality statement, that appears secondary to the discussion of third parties.


reasoning: The paragraph's substantive point is a materiality statement that no cybersecurity threat or incident has materially affected the company, followed by cross-references to risk factors. Under the tiebreakers, standalone materiality conclusions and related boilerplate belong in Strategy Integration, not Incident Disclosure.


reasoning: This paragraph does not describe a cybersecurity governance structure, management role, process, third-party oversight program, incident, or strategy integration; it is a general statement of cybersecurity vulnerability and lack of capability. It is therefore best treated as non-substantive risk language rather than a disclosure of an actual cybersecurity program or event.


reasoning: The paragraph primarily describes the company's internal cybersecurity and resilience processes, including incident response, continuity planning, testing, and reporting. Although it mentions reporting to the audit committee, the main focus is on the company's operational risk management program rather than board oversight.


reasoning: The paragraph’s main point is a materiality assessment stating that cybersecurity risks have not materially affected the company and are not reasonably likely to do so long term. The cross-reference to risk factors does not change the classification because it is appended to a standalone materiality conclusion rather than describing governance, processes, or a specific incident.


reasoning: The paragraph primarily describes the company's internal protocol for reporting material cybersecurity incidents, which is an internal process. Although it mentions the Board being informed, board oversight is secondary rather than the main subject.


reasoning: The paragraph describes a real cybersecurity-related event, including when it occurred, what happened, and the company’s response and restoration actions, which makes Incident Disclosure the best fit. It includes multiple hard verifiable facts, including a specific date, a named firm, and quantified restoration timelines.


reasoning: The paragraph describes the company's own cybersecurity and product security capability and what it is intended to protect, which fits internal risk management/process disclosure. It does not focus on board oversight, management roles, third-party oversight, or any specific incident.


reasoning: The paragraph is centrally about cybersecurity risks arising from third parties such as vendors and service providers, which fits Third-Party Risk. It contains no named firms, frameworks, roles, dates, systems, or other qualifying specific facts, so it is generic boilerplate.


reasoning: The paragraph is most centrally about the CISO and the information security function’s leadership and qualifications, even though it also mentions board committee oversight. It includes multiple company-specific, verifiable details, including the CISO role, a named certification, quantified experience, and named committees.


reasoning: The paragraph primarily narrates a real cybersecurity incident, including discovery timing, operational effects, data exfiltration, notification, containment, restoration, and remediation actions. Although it mentions costs and insurance, those points are secondary to the incident description itself.


reasoning: The paragraph's main point is a materiality assessment stating that no cybersecurity incidents or threats have materially affected, or are reasonably likely to materially affect, the company. It does not describe any actual incident, governance structure, or risk management process, and the vendor reference is incidental.


reasoning: The paragraph’s main point is a materiality assessment stating that cybersecurity threats and prior incidents have not materially affected the company, plus a cross-reference to risk factors. It does not describe governance, management roles, or a specific incident narrative.


reasoning: The paragraph is primarily about how the board and its committees oversee cybersecurity risk, making Board Governance the best fit. It includes firm-specific governance details such as named committees and cybersecurity-specific management roles, but lacks two or more hard verifiable facts needed for Quantified-Verifiable.


reasoning: The paragraph describes the company's internal incident escalation and response process, including how incidents are routed to management and committees. Although committees are mentioned, the focus is on operational procedures rather than board oversight or a specific management person's role.


reasoning: The paragraph’s most substantive disclosure is that the company evaluates third-party service providers for security measures and breach reporting obligations, which makes vendor oversight the central topic. The board oversight sentence is present, but it is generic and secondary.


reasoning: This paragraph is not a substantive disclosure about the company's cybersecurity governance, management, processes, incidents, or strategy; it is a quotation and summary of SEC rulemaking requirements. Because it contains no company-specific cybersecurity facts, it is best categorized as None/Other.


reasoning: The paragraph is primarily about the company’s internal cybersecurity risk identification and testing activities, so it fits Risk Management Process. Although it mentions third-party vendors and a committee, those are supporting elements rather than the central topic.


reasoning: The paragraph is primarily about oversight by the Board and Audit Committee, which makes Board Governance the best fit. It contains only generic governance language and a generic reporting cadence, with no qualifying firm-specific facts.


reasoning: Although the paragraph includes management and board reporting, its main substance is the company’s cybersecurity program and risk management system—how it is managed, evaluated, and used to assess incidents and third-party risks. The named cybersecurity roles and internal team make the disclosure firm-specific.


reasoning: The paragraph primarily describes the company's internal processes for assessing, identifying, and managing cybersecurity risks, with third-party risk mentioned only as one component of that broader program. It contains no qualifying specific facts such as named roles, frameworks, dates, committees, tools, firms, or quantified details.


reasoning: The paragraph primarily describes the company's internal cybersecurity program, controls, assessments, and threat-identification activities, so it is best categorized as Risk Management Process. Although management roles are named, they are presented mainly as part of how the program operates rather than as standalone biographical or reporting-line disclosures.


reasoning: The paragraph is primarily about the company’s internal risk oversight process through a management-led Risk Committee that reviews risk assessments, including cybersecurity, and reports on mitigation processes. It is not board oversight, and it is not focused on an individual executive’s qualifications or reporting line.


reasoning: The paragraph is primarily about the Board of Directors and Audit Committee overseeing cybersecurity risk, so Board Governance is the best fit. It does not include qualifying firm-specific facts under the stated rules because the Board, Audit Committee, CFO, and periodic update language are generic, and the IT title given is not clearly a cybersecurity-specific role.


reasoning: The paragraph is primarily about committee and board oversight of cybersecurity, including reporting from the CTO to the committee and the committee's reporting to the full Board. Although a management role is mentioned, the main subject is governance oversight rather than the CTO's qualifications or responsibilities as a person.


reasoning: The paragraph is primarily about the company's internal cybersecurity risk assessment and management activities carried out by the CSIRT, rather than board oversight or the qualifications of an individual leader. Although the Director of IT is mentioned, the focus is on how the team executes cybersecurity processes such as incident response, compliance, training, and risk management.


reasoning: This paragraph is a generic description of common cybersecurity threats and includes a section-heading-style reference to business impact, but it does not provide a substantive company-specific materiality assessment, incident narrative, governance detail, or risk management process.


reasoning: The paragraph is centered on who leads cybersecurity and the leaders’ experience and qualifications, making Management Role the best fit. It includes multiple verifiable details about named roles, years of experience, and specific credentials, supporting a Quantified-Verifiable rating.


reasoning: The paragraph describes the company's internal cybersecurity assessment and testing practices, making it primarily about its risk management process. Its only qualifying specific details are the named frameworks NIST CSF and PCI DSS, with no firm-unique roles, dates, numbers, or named vendors.


reasoning: The paragraph describes the company's internal cybersecurity monitoring activities—prevention, detection, mitigation, remediation, and receiving notifications—as part of its risk management process. References to service providers are only a component of that process, not the central topic.


reasoning: The paragraph is primarily about the identified management leader of cybersecurity and that person’s qualifications, experience, and responsibilities, so Management Role is the best fit. It includes firm-specific facts about the named role, a quantified experience level, and a named certification.


reasoning: The paragraph mainly describes the company's internal handling of cybersecurity incidents and coordination of cybersecurity initiatives, which fits risk management processes. Although it mentions Audit Committee oversight, the substantive focus is on how cybersecurity is managed operationally rather than on board governance itself.


reasoning: The paragraph focuses on the Sponsor's internal cybersecurity program and how it identifies, assesses, and mitigates cyber threats, which fits Risk Management Process. Its main firm-specific detail is the named internal plan, while the rest is otherwise general process language.


reasoning: The paragraph is mainly about which management group is responsible for assessing and managing cybersecurity risk, with board oversight mentioned secondarily. It does not describe concrete risk management processes or provide any qualifying firm-specific cybersecurity facts under the stated rules.


reasoning: The paragraph is centered on named individuals responsible for cybersecurity oversight and their backgrounds, especially Katherine Dowling and Hong Kim, so Management Role is the best fit. It includes firm-specific facts such as a named cybersecurity-relevant role, a specific date, and a specifically identified team, but does not reach two clear hard verifiable facts under the Quantified-Verifiable rule.


reasoning: The paragraph primarily describes Ameren's internal process for identifying, assessing, mitigating, and monitoring cybersecurity risk through its enterprise risk management program. Although board oversight is mentioned, the main focus is the company's risk management framework and the steering committee's role in that process.


reasoning: The paragraph is primarily about the Board's oversight of cybersecurity, including how the Board is briefed and involved in exercises and reviews. It does not include qualifying specific facts such as named committees, named roles from the allowed list, dates, firms, tools, or other firm-unique details.


reasoning: The paragraph describes the company's internal cybersecurity risk management activities—using an external cybersecurity assessment firm to test systems, monitor threats, and advise on enhancements. It is not about oversight of vendors/suppliers, so Third-Party Risk does not apply.


reasoning: The paragraph is centrally about how the company evaluates and imposes security and data-handling requirements on vendors, making third-party oversight the main subject. It contains no named roles, committees, frameworks, dates, firms, tools, or other qualifying specific facts.


reasoning: The paragraph primarily describes a real cybersecurity incident, including unauthorized activity, containment actions, systems being taken offline, temporary operational disruption, and resulting business impacts. It contains a specific time reference to the fourth quarter of fiscal 2025, which makes it firm-specific.


reasoning: The paragraph is primarily about which members of management lead cybersecurity-related efforts and their relevant experience, which fits Management Role better than a pure process description. It includes a firm-specific management team composition, but no hard verifiable facts such as dates, amounts, named firms, or named tools.


reasoning: The paragraph is primarily about the Board's and Audit Committee's oversight responsibilities for cybersecurity risk, making board oversight the central topic. It contains only generic governance language and no qualifying specific facts under the provided rules.


reasoning: The paragraph discusses potential business, reputational, legal, and financial impacts of a possible future cybersecurity event rather than governance, management roles, or risk management processes. It does not describe an actual incident and contains only generic risk and materiality-style language plus a risk-factor cross-reference.


reasoning: The paragraph describes the company's internal cybersecurity risk management activities, including risk assessments, monitoring, training, incident response planning, and related processes. Although third-party risk is mentioned, it is only one component of the broader internal program rather than the central topic.


reasoning: The paragraph focuses on cybersecurity insurance as a financial risk management and resource-planning measure, which fits Strategy Integration rather than operational risk processes. It contains no firm-unique names, dates, amounts, or other qualifying specific facts.


reasoning: This paragraph is about the VP of IT’s qualifications, background, and credentials rather than the company’s cybersecurity processes, so Management Role is the best fit. It includes multiple concrete, company-specific details about experience, prior scope of responsibility, and certifications.


reasoning: The paragraph primarily describes Fortress's own cybersecurity risk management activities, including third-party assessments, penetration testing, remediation review, and vendor assessment as part of its internal process. Although vendors are mentioned, vendor oversight is only one component of the broader internal cybersecurity program rather than the central topic.


reasoning: The paragraph is primarily a materiality assessment stating that cybersecurity threats and incidents have not materially affected the company’s business strategy, results of operations, or financial condition. The risk factor cross-reference is secondary and does not change the main focus from strategy/materiality.


reasoning: The paragraph focuses on the company’s internal incident response and escalation processes, including how cybersecurity incidents are managed and reported. Although it mentions a response team and the Audit Committee, the main subject is the process itself rather than board oversight or a specific management role.


reasoning: The paragraph primarily describes the company's cybersecurity risk management activities, including incident response planning, monitoring, and risk identification, even though it also mentions board oversight and management roles. It is firm-specific because it includes company-unique governance and role details, but it does not contain two hard verifiable facts of the type needed for Quantified-Verifiable.


reasoning: The paragraph primarily describes the company's internal cybersecurity risk management, certification, incident response procedures, and escalation workflow, so it is best classified as Risk Management Process. It includes firm-specific facts such as the CTO role, ISO 27001:2013 certification, and named internal teams, but lacks two hard verifiable facts needed for Quantified-Verifiable.


reasoning: The paragraph’s main point is a materiality assessment stating that cybersecurity threats have not materially affected, and are not reasonably likely to materially affect, the company’s business strategy, financial condition, or results of operations. The cross-reference to Risk Factors is secondary and does not change the primary category.


reasoning: The paragraph is primarily about board-level oversight and director preparedness, with the board and its committee as the grammatical subject. It includes a firm-specific named board committee, which makes it more than generic boilerplate.


reasoning: The paragraph is primarily about who is responsible for day-to-day cybersecurity oversight and highlights the role and qualifications of the individuals leading that function, which fits Management Role best. It mentions cyber program activities, but the main point is the personnel responsible rather than the process itself.


reasoning: The paragraph primarily describes the company's internal cybersecurity processes and controls, including training, incident response, vulnerability scanning, monitoring, patching, and access management. It is not centered on board oversight, a named executive's qualifications, or a specific cyber incident.


reasoning: The paragraph primarily describes the company's internal cybersecurity activities and escalation processes carried out by the information security team, which makes it a risk management process disclosure rather than a management-role paragraph about a specific person's qualifications or reporting line. References to insurance and board escalation are secondary to the description of day-to-day monitoring, assessment, mitigation, and response processes.


reasoning: This paragraph is primarily about management responsibility and the qualifications of specific cybersecurity leaders, especially the CIO and CISO, rather than the company’s broader cyber processes. It includes multiple firm-specific and verifiable details, including named roles, quantified experience, certifications, and a named steering committee.


reasoning: The paragraph describes the company’s internal post-incident review and program improvement process, including reassessing the cybersecurity program and incident response plan. Although the Audit Committee is mentioned, it is not the main subject and the disclosure is primarily about internal risk management activities.


reasoning: The paragraph mainly describes the potential business, financial, and reputational impacts of cybersecurity threats rather than detailing AFG's internal cybersecurity processes or governance. It is high-level risk/impact disclosure with no firm-specific operational detail.


reasoning: The paragraph primarily narrates two actual cybersecurity incidents, including when they occurred, operational impact, response actions, restoration timing, and aftermath. Because it includes multiple specific dates and quantified duration details tied to real events, it is best classified as Incident Disclosure with Quantified-Verifiable specificity.


reasoning: The paragraph is primarily about how the full Board and a board committee oversee cybersecurity through reporting and oversight structures. Although management roles are mentioned, they are described mainly as reporting into the Board and committee governance process.


reasoning: The paragraph's main substantive point is a materiality assessment that cybersecurity risks and past threats have not materially affected the company’s business strategy, results of operations, or financial condition. The brief mention of prior malware/virus attacks is non-specific and serves as context to that conclusion rather than describing an actual incident.


reasoning: The paragraph primarily describes the company's overall cybersecurity risk management approach, including compliance with regulatory requirements and use of established cybersecurity standards. Although the Board of Directors is mentioned, the main focus is the company's internal cybersecurity program rather than board oversight itself.


reasoning: The paragraph primarily provides a materiality assessment that prior cybersecurity threats and incidents have not materially affected, and are not reasonably likely to materially affect, the company’s business strategy, results of operations, or financial condition. It does not describe a specific incident or substantive governance/process details, so Strategy Integration is the best fit.


reasoning: The paragraph describes the company’s internal cybersecurity controls and risk mitigation activities, such as policies, monitoring, audits, and training, which makes Risk Management Process the best fit. It does not include qualifying firm-specific facts like named frameworks, specific roles, dates, tools, or named vendors, so it is Generic Boilerplate.


reasoning: The paragraph’s main substantive point is a materiality assessment that cybersecurity risks have not materially affected the company’s business strategy, results of operations, or financial condition. Its brief mention of past threats and breaches is generic and not a description of any actual incident, while the rest is a risk-factor cross-reference.


reasoning: The paragraph mainly describes the company’s internal cybersecurity practices and controls, including software protections, policies, and review procedures, so it is best categorized as Risk Management Process. Although the board and Audit Committee are mentioned, they are not the central subject of the disclosure.


reasoning: The paragraph describes the company's internal cybersecurity activities such as threat assessment, monitoring, protective measures, incident response planning, and employee training. Although third-party experts are mentioned, vendor oversight is not the central topic, so the primary category is Risk Management Process.


reasoning: The paragraph describes the company's internal cybersecurity-related awareness and education practices for personnel and customers, which fits its own risk management processes. It does not identify any named roles, frameworks, dates, tools, firms, or other qualifying specific facts.


reasoning: The paragraph is centered on the company's CIO/CISO as a management role, describing his qualifications and responsibilities for cybersecurity oversight. Although it includes a quantified experience statement, it does not contain two hard verifiable facts needed for Quantified-Verifiable specificity.


reasoning: The paragraph is primarily about identified management officials and committees responsible for cybersecurity, including their reporting structure and qualifications. Although the Audit Committee is mentioned at the end, board oversight is not the main subject of the paragraph.


reasoning: The paragraph primarily describes the company's own cybersecurity and IT risk management activities, including monitoring, risk assessments, mitigation, and related processes. Although third-party service provider risk is mentioned, it appears as one component of the broader internal risk management program rather than the central topic.


reasoning: The paragraph is primarily about the Board’s and audit committee’s oversight of cybersecurity risk, with management and the Principal Accounting Officer described in support of that governance structure. Because it includes multiple verifiable facts—specific fiscal years and a 100% independence statement—it rises above firm-specific disclosure.


reasoning: The paragraph’s primary focus is the Board’s oversight structure, stating that the Board and Audit Committee oversee cybersecurity risk, with management roles described in support of that governance framework. It is Firm-Specific because it identifies cybersecurity-related management titles (CTO and VPCS), which are specific facts under the rubric.


reasoning: The paragraph’s main substance is a materiality statement that no cybersecurity threat or incident has materially affected, or is reasonably likely to materially affect, the company, which falls under Strategy Integration. The remaining statements about investing in cybersecurity and a cross-reference to risk factors are generic and do not describe a specific incident, governance body, management role, or concrete process details.


reasoning: The paragraph describes the company's internal cybersecurity risk management activities, including risk assessments and security controls, rather than board oversight, management qualifications, third-party oversight, or a specific incident. It contains only generic process language and no qualifying specific facts such as named roles, frameworks, dates, tools, or firms.


reasoning: The paragraph primarily describes the company's internal cybersecurity governance and response processes, including incident escalation and the responsibilities of an internal advisory body. Although the Board of Directors is mentioned as a recipient of incident reports, the focus is on the company's operational risk management structure rather than board oversight itself.


reasoning: The paragraph is primarily about board-level oversight, with the Audit Committee described as overseeing management's cybersecurity risk identification and mitigation processes. Although it mentions the CISO, that reference is secondary to the committee's governance role.


reasoning: Although the paragraph briefly notes Board oversight, its main focus is the company’s own cybersecurity risk management processes, integration into risk management, and use of recognized frameworks. The only concrete details are references to NIST and ISO frameworks, which support a Sector-Adapted specificity level rather than a firm-specific one.


reasoning: The paragraph is primarily about Board-level oversight, with the Board and Audit Committee described as overseeing cybersecurity and receiving reports. It includes firm-specific details such as the CISO role and director completion of a named cyber-risk oversight program, but it does not clearly contain two qualifying hard verifiable facts needed for Quantified-Verifiable.


reasoning: This paragraph discusses erroneous invoice payments and a material weakness in internal control over financial reporting, not cybersecurity risk, governance, processes, or incidents. Because it is non-cybersecurity content, the appropriate category is None/Other.


reasoning: This paragraph describes the company's business and development stage, not cybersecurity governance, management, risk processes, incidents, third-party risk, or strategy. It contains no substantive cybersecurity disclosure.


reasoning: The paragraph primarily describes a real cybersecurity incident, including discovery timing, operational effects, data exfiltration, and response actions, which makes Incident Disclosure the best fit. It includes one qualifying specific fact—a specific date reference—so it is Firm-Specific rather than Generic Boilerplate or Quantified-Verifiable.


reasoning: The paragraph describes the company's internal cybersecurity risk management approach, specifically the frameworks it uses to design and assess its program. It does not focus on board oversight, management personnel, vendors, or any actual incident.


reasoning: The paragraph focuses on the company’s internal cybersecurity risk management processes, controls, monitoring, training, and resilience measures, making Risk Management Process the best fit. Its only qualifying specific details are named security frameworks/standards, without firm-unique roles, dates, tools, or quantified facts.


reasoning: The paragraph describes the company's process for assessing and supporting cybersecurity at its Affiliates and during pre-investment diligence, which fits internal risk management activities more than vendor oversight. It does not include qualifying specific facts such as named frameworks, roles, dates, tools, firms, or quantified details.


reasoning: The paragraph focuses on cybersecurity strategy, priorities, objectives, and resource allocation, which fits Strategy Integration. Although it also mentions personnel capabilities, it does not identify any specific management role or describe concrete governance or process details.


reasoning: The paragraph is centered on management’s responsibility for monitoring cybersecurity matters and reporting them upward, rather than on the board’s oversight itself. The named Information Technology Steering Committee is a firm-specific governance detail, which makes the disclosure Firm-Specific.


reasoning: The paragraph is primarily about identified management officials and their responsibility and experience in overseeing cybersecurity risk, which makes Management Role the best fit. Although it also includes a materiality statement, that is secondary to the discussion of the CISO and senior IT leadership.


reasoning: The paragraph focuses on the company's internal cybersecurity activities—preventing, detecting, mitigating, and remediating risks and incidents—rather than on a specific management person's qualifications or the board's oversight. It contains no qualifying specific facts such as named roles, frameworks, dates, firms, tools, or quantified details.


reasoning: The paragraph is centered on the CISO’s leadership role, reporting line, and background, which makes Management Role the best fit. Although it also describes the CGC and some process elements, those support the discussion of management structure rather than serving as the main subject.


reasoning: The paragraph is primarily about the company’s internal cybersecurity risk management approach—its policies, standards, processes, and the Security Steering Group that helps oversee them. Although board oversight is mentioned, the main focus is the company’s operational process for assessing and managing cybersecurity risk.


reasoning: The paragraph is chiefly about how cybersecurity matters are governed and communicated to the Board, including Board reporting, incident communications, and Board education. Although it mentions the information security program, the core focus is the governance structure linking management and the Board.


reasoning: The paragraph primarily provides a materiality assessment stating that cybersecurity threats have not materially affected the company, along with a cross-reference to risk factors. It does not describe an actual incident or the company's cybersecurity processes.


reasoning: The paragraph describes the company's internal cybersecurity risk management measures and controls, such as incident response, vulnerability management, monitoring, and training. It does not focus on board oversight, management qualifications, third-party oversight, or any specific incident.


reasoning: The paragraph is primarily about oversight by the CyTOC and the Board, including how cybersecurity information is escalated to them, so Board Governance is the best fit. It includes firm-specific facts through a named non-generic committee and a cybersecurity-specific management role, but lacks two or more hard verifiable facts needed for Quantified-Verifiable.


reasoning: The paragraph describes the company's escalation and incident response process—how management reports a material cybersecurity incident or investigation—rather than focusing on board oversight as the main subject. It contains only generic references to management, the Audit Committee, the Board, and an incident response plan, with no qualifying specific facts.


reasoning: The paragraph describes the company's internal cybersecurity training and awareness activities, such as onboarding training and phishing exercises, which makes it primarily about its risk management process. References to management and the Board are incidental oversight mentions rather than the main subject.


reasoning: The paragraph provides a standalone materiality statement that no cybersecurity incidents have materially affected the company, and then cross-references risk factors. It does not describe any actual incident or substantive cyber risk management process.


reasoning: Although the paragraph opens with board oversight, most of the disclosure describes the company’s internal cybersecurity program, incident response structure, and response procedures. The named CISO, IS Program, and Incident Response Team make this firm-specific rather than generic boilerplate.


reasoning: The paragraph primarily describes the company’s internal cybersecurity risk management function—who participates and how they monitor prevention, detection, mitigation, and remediation—rather than focusing on a specific executive’s role or qualifications alone. It includes firm-specific details about the participating teams and their experience, but lacks two hard verifiable facts needed for Quantified-Verifiable.


reasoning: The paragraph describes an internal cybersecurity control activity—auditing aspects of the information security program for alignment with regulatory expectations—so it is best categorized as Risk Management Process. It contains no qualifying specific facts such as named frameworks, roles, firms, dates, or quantified details.


reasoning: The paragraph is primarily about how the board and its committees oversee cybersecurity risk, making Board Governance the best fit. It includes firm-specific governance details such as a named cybersecurity-specific role, a named non-generic committee, and a specific date for the delegation of oversight authority.


reasoning: The paragraph is centrally about the company’s oversight of third-party service providers, so Third-Party Risk is the best fit. Although it describes a vendor risk process, it contains no qualifying specific facts such as named firms, dates, tools, or other firm-unique verifiable details.


reasoning: The paragraph’s main focus is a materiality assessment of past and potential cybersecurity incidents, along with a brief statement about cybersecurity insurance coverage. It does not describe a specific incident or the company’s cyber risk management processes, and the risk-factor cross-reference is ancillary.


reasoning: The paragraph focuses on the company's internal cybersecurity preparedness activities, including incident-response testing, training, exercises, and phishing simulations, which makes it a risk management process disclosure. It is firm-specific because it identifies a named internal program and team, beyond merely describing generic practices.


reasoning: This paragraph is only a cross-reference to Risk Factors and does not provide any substantive cybersecurity governance, management, process, incident, or strategy disclosure. It contains no qualifying specific facts and is therefore generic boilerplate.


reasoning: The paragraph describes the company’s internal cybersecurity risk management activities and controls, including assessments, monitoring, training, incident response, and vendor risk as one component of the broader program. It does not provide qualifying firm-specific facts such as named roles, named committees, dates, frameworks, tools, or other verifiable details.


reasoning: The paragraph's main substantive point is a materiality conclusion that cybersecurity risks and past threats or breaches have not materially affected the company’s business strategy, results of operations, or financial condition. The references to threats, malware, and risk factors are generic and do not provide an actual incident narrative.


reasoning: This paragraph focuses on the qualifications, experience, and prior positions of named cybersecurity executives rather than on the company's cyber processes or board oversight. It is therefore best classified as Management Role.


reasoning: Although the paragraph begins with board oversight, most of the substantive detail concerns management responsibility: the IT Director leads the cybersecurity program and reports through the CFO. The named governance bodies are generic, and no qualifying firm-specific facts from the allowed list remain after filtering.


reasoning: The paragraph is centered on the cybersecurity leaders themselves—the CISO and the Senior Vice President, Global Security of Inmarsat—and their experience and backgrounds, which makes Management Role the best fit. It includes firm-specific role and experience details, but not two qualifying hard verifiable facts needed for Quantified-Verifiable.


reasoning: The paragraph is centered on the CSO's role and qualifications to oversee cybersecurity risk, making Management Role the best fit. It includes firm-specific governance facts such as a cybersecurity-specific officer title and a named committee, but no two hard verifiable facts needed for Quantified-Verifiable.


reasoning: The paragraph is framed around management's responsibility for cybersecurity implementation and reporting, making management the primary subject rather than the board. It does not identify any specific cybersecurity role, committee, framework, date, or other qualifying firm-specific fact.


reasoning: The paragraph is primarily about how the company structures and operates its cybersecurity function—through outsourced providers and internal reporting for prevention, detection, mitigation, and remediation—rather than board oversight or a specific executive’s qualifications. Although third-party providers are central to the process, the disclosure describes the company’s own cybersecurity operating model rather than oversight of vendor cyber risk.


reasoning: The paragraph is primarily about board-level oversight, with the audit committee receiving cybersecurity reports and presentations, so Board Governance is the best fit. It includes a firm-specific cybersecurity role fact (CSO/CISO), but otherwise much of the language is governance boilerplate.


reasoning: The paragraph is primarily about oversight by the Audit Committee and Board of Directors, including how they are briefed on cybersecurity risks and incidents. Although it also mentions the CIO's reporting and experience, those details are secondary to the board-level governance focus.


reasoning: This paragraph is primarily about the CTO as a person—his oversight responsibility, experience, and qualifications—rather than the company’s broader cybersecurity processes. It includes firm-specific details such as a cybersecurity-specific executive role, a named Risk Committee, and a quantified experience statement.


reasoning: The paragraph is primarily about who in management is responsible for cybersecurity risk, especially the Chief Information Security Officer and senior leadership structure. Although it mentions a steering group and its activities, the central focus is management ownership and the CISO's role and qualifications.


reasoning: The paragraph describes the company’s internal incident response planning, testing, and response procedures, making it primarily about cybersecurity risk management processes. References to the Board and management are incidental to the process description rather than a discussion of governance oversight or management roles.


reasoning: The paragraph primarily describes the firm's internal cybersecurity risk assessment and risk assurance processes, including how enterprise risk management handles cybersecurity threats. Although management roles are mentioned, the focus is on what the risk management function does rather than on the qualifications or status of those individuals.


reasoning: The paragraph primarily describes the company's internal cybersecurity risk mitigation process—evaluating and updating safeguards after risk assessments. The brief note that IT leadership reports to the CEO does not make management roles the main subject, and neither item is sufficiently specific to elevate the disclosure beyond boilerplate.


reasoning: The paragraph mainly describes management-level cybersecurity governance centered on the Chief Information Security Officer, related management committees, and reporting/escalation within management. Although the board is mentioned, it is not the main focus or grammatical subject of most of the paragraph.


reasoning: The paragraph describes the company's internal cybersecurity practices and controls, such as authentication, monitoring, encryption, scanning, and training, so it fits Risk Management Process. It contains no qualifying specific facts such as named frameworks, roles, committees, dates, firms, tools, or quantified details.


reasoning: The paragraph is primarily about the Board's oversight role and its delegation of cybersecurity oversight responsibilities, making Board Governance the best fit. It contains no qualifying specific facts because the CEO and CFO are generic C-suite roles and the rest is standard oversight language.


reasoning: The paragraph is primarily about how the board, through the Audit Committee, oversees cybersecurity risk and receives updates, so Board Governance is the best fit. It includes firm-specific cybersecurity management roles, but no two hard verifiable facts such as dates, dollar amounts, or named third-party firms.


reasoning: The paragraph is chiefly about how the company’s cybersecurity program and risk management processes are carried out internally, with management roles and cross-functional participation described as part of that process. Although it names specific roles and team composition, it includes only one hard quantified fact, so it is Firm-Specific rather than Quantified-Verifiable.


reasoning: This paragraph is only a cross-reference to the risk factors section and does not provide any substantive cybersecurity governance, management, process, incident, or strategy disclosure. It contains no qualifying specific facts.


reasoning: The paragraph’s substantive point is a materiality assessment—that the company has not experienced a cybersecurity incident deemed material—followed by a risk-factor cross-reference. It does not describe governance, management roles, or internal cybersecurity processes.


reasoning: The paragraph is primarily about the CISO and IT Security Team leadership structure, reporting line, and qualifications, so it fits Management Role rather than describing cybersecurity processes. It includes firm-specific details such as cybersecurity-specific roles and quantified experience, but lacks two clearly hard verifiable facts of the type needed for Quantified-Verifiable.


reasoning: The paragraph is primarily about the Board of Directors' oversight of cybersecurity and the reporting it receives, making Board Governance the best fit. While it includes management details, those details mainly support how the board is informed rather than focusing on the management role itself.


reasoning: The paragraph centers on cybersecurity risks related to third-party vendors and service providers, making vendor oversight the main topic. It contains no named vendors, standards, roles, dates, or other firm-specific details.


reasoning: This paragraph is centered on the CISO’s role, reporting line, responsibilities, and qualifications, so Management Role is the best fit. It includes firm-specific, verifiable details about the CISO’s tenure and named certifications, which elevates it beyond boilerplate.


reasoning: The paragraph primarily describes the company's internal cybersecurity risk assessment and management activities, including budgeting, incident preparation, and review of security assessments. Although the Board and executives are mentioned, the focus is on the process and program function rather than board oversight or a specific management person's qualifications.


reasoning: This paragraph primarily describes an actual cybersecurity incident, including when it was discovered, what data was affected, and the response actions taken. Although it ends with a materiality statement, the main focus is the incident narrative itself.


reasoning: This paragraph is primarily a SPAC/no-operations disclosure stating the absence of business operations and the absence of a cybersecurity program or formal processes. Under the guidance, SPACs explicitly stating they have no operations or no formal cybersecurity program are classified as None/Other, despite incidental mention of board oversight and no incidents.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes and how they are integrated into enterprise risk management, rather than focusing on board oversight, management qualifications, third-party oversight, or a specific incident. It contains only general process descriptions without qualifying firm-specific facts or named frameworks.


reasoning: This paragraph states that, as a SPAC with no business operations, the company does not have a cybersecurity program or formal cyber risk processes. Under the instruction for SPACs/shell companies disclosing the absence of operations or a program, this is classified as None/Other rather than a substantive cybersecurity disclosure.


reasoning: The paragraph is centered on the Vice President of Information Technology's responsibility for cyber monitoring, incident awareness, and reporting to management, making it primarily about a management role rather than board oversight or a broader risk process. It includes a cybersecurity-relevant named role, which makes the disclosure firm-specific.


reasoning: The paragraph describes the company's own cybersecurity risk management activities—using outside experts to evaluate and test its systems—rather than making vendor oversight the central topic. It contains only generic references to external consultants and common security practices, with no qualifying specific facts.


reasoning: The paragraph primarily describes the company's internal cybersecurity risk management processes and controls, with third-party oversight mentioned only as one component of that broader process. It contains no qualifying specific facts such as named roles, committees, frameworks, dates, firms, tools, or quantified details.


reasoning: The paragraph is primarily about the company's internal cybersecurity oversight process operated by a management committee, not board-level oversight or the qualifications of an individual executive. It describes how management reviews threats/incidents and approves strategy within the company's cybersecurity program.


reasoning: The paragraph is centrally about how the company oversees cybersecurity risk from third-party service providers, including onboarding diligence, audit report review, and contract terms. It does not include any qualifying specific facts such as named firms, dates, tools, committees, or recognized frameworks.


reasoning: The paragraph is primarily about the Board of Directors' oversight of cybersecurity risk, with the board as the grammatical subject. It contains only generic governance references such as the Board, executive officers, and the Audit Committee, with no qualifying specific facts.


reasoning: The paragraph’s most specific substantive detail is the identified CTO role and its reporting line on cybersecurity matters, which makes management responsibility the central focus. Although the board is mentioned, it is the recipient of the CTO’s reports rather than the primary subject of the paragraph.


reasoning: The paragraph describes the company's internal cybersecurity awareness and training process for personnel, which is part of its own risk management program. The mention of an information technology partner is incidental and unnamed, so the central topic is not third-party oversight.


reasoning: The paragraph primarily describes the VP of Information Technology's responsibilities, reporting lines, and qualifications, so Management Role is the best fit. Although the Board is mentioned, it is secondary to the description of this management role and its experience.


reasoning: The paragraph primarily describes an actual cybersecurity-related event, including when it occurred, what systems were disrupted, restoration milestones, and operational effects, so it is best categorized as Incident Disclosure. It contains multiple independently verifiable facts, including several specific dates and a named third party, which makes it Quantified-Verifiable.


reasoning: The paragraph describes the company's internal cybersecurity practices—training, layered defenses, monitoring, and testing of defenses—so it is about risk management processes rather than governance, management roles, or a specific incident. It contains no qualifying firm-specific facts or named standards, only common security practices stated generically.


reasoning: The paragraph is primarily about how significant cybersecurity matters are escalated to the Compliance Committee and the full Board for oversight and guidance, making board-level governance the main topic. Although the CISO is mentioned, the emphasis is on reporting upward to governance bodies rather than on the individual's qualifications or background.


reasoning: The paragraph focuses on management reporting lines and the background of a specific technology executive, making Management Role the best fit. It includes firm-specific facts such as a cybersecurity-specific role and a specific employment date, but not two hard verifiable facts that would support Quantified-Verifiable.


reasoning: The paragraph is primarily about the qualifications and experience of individuals responsible for cybersecurity-related oversight, especially the senior IT consultant and the senior vice president, rather than detailing the company’s cybersecurity processes. It includes one company-specific factual detail about experience length, which supports Firm-Specific but not Quantified-Verifiable specificity.


reasoning: This paragraph primarily states the absence of a cybersecurity program or formal processes and gives a no-material-impact statement, which for a SPAC/shell-company-type disclosure is classified as None/Other. The brief mention of board oversight is incidental and does not describe a substantive cybersecurity governance or risk management program.


reasoning: This paragraph primarily describes a real cybersecurity incident, including what happened, when it was identified, the financial amount involved, and the recovery outcome. Although it mentions follow-up control enhancements, the main focus is the incident narrative and response.


reasoning: The paragraph is primarily about who is responsible for cybersecurity and the qualifications and reporting structure of those management roles and teams, rather than the company’s cyber processes themselves. It includes multiple concrete, verifiable details about experience, certifications, and team composition.


reasoning: Although it identifies a specific management role, the paragraph is primarily about how the company's cybersecurity function operates, including supervision, threat analysis, monitoring, and reporting. It contains firm-specific facts such as the named IT leadership role and the stated experience level, but not two hard verifiable facts sufficient for Quantified-Verifiable.


reasoning: This paragraph is a SPAC/no-operations disclosure stating the absence of a cybersecurity program or formal processes, which is classified as None/Other under the SPAC-specific rule. The brief mention of board oversight and no incidents is incidental and does not convert it into a substantive governance or incident disclosure.


reasoning: The paragraph is centered on the CISO and CIO and their role in communicating cybersecurity matters upward, making management roles the main subject. Although board oversight is referenced, the disclosure primarily describes what these officers do rather than the board’s oversight process itself.


reasoning: The paragraph is principally about how the board and its Audit Committee are kept informed about cybersecurity matters and incidents, making board oversight the central topic. Although management is mentioned as providing the updates, the substance focuses on governance and escalation to board-level bodies.


reasoning: The paragraph describes the company's internal cybersecurity-related training process and system usage, which fits Risk Management Process. It does not identify any qualifying specific facts such as a named framework, named product, specific date, or cybersecurity-specific role.


reasoning: The paragraph describes the company's internal cybersecurity assessment and validation activities, including use of independent testing and consulting, which fits risk management processes. Although third-party experts are mentioned, vendor oversight is not the central topic and no incident, board, or named management role is discussed.


reasoning: The paragraph describes the company's general cybersecurity measures for protecting systems and data, which fits internal risk management processes. It contains only broad, reusable statements with no named roles, frameworks, dates, tools, or other qualifying specific facts.


reasoning: The paragraph describes the company's internal cybersecurity functions and incident response processes, centered on how cyber risk is managed rather than on board oversight, a specific executive's qualifications, or a real incident. It contains only generic process language with no qualifying specific facts.


reasoning: The paragraph is centrally about how the company oversees and restricts third-party service providers' access to its networks and data, which makes Third-Party Risk the best fit. It includes a firm-specific cybersecurity/IT role, but otherwise mainly describes general vendor-control practices.


reasoning: The paragraph centers on the CTO as a management role, emphasizing that person's responsibility, experience, and reporting relationship rather than the board's oversight or the company's broader risk processes. It includes firm-specific facts such as the cybersecurity-specific CTO title and the stated experience level.


reasoning: The paragraph is primarily about the identified management leader of cybersecurity, including his qualifications, reporting line, and leadership responsibilities. Although it mentions a management committee, the main focus remains the management role rather than the company’s broader risk management process.


reasoning: The paragraph focuses on the qualifications and experience of identified management personnel, especially the CTO and VPCS, rather than describing cybersecurity processes. It includes multiple verifiable facts such as specific roles, years of experience, and named certifications.


reasoning: This paragraph primarily describes the specific management roles and named personnel/participants involved in the company's cybersecurity governance structure, rather than board oversight or operational risk processes. It contains several firm-specific facts, including named roles and a named committee, but not two hard verifiable facts needed for Quantified-Verifiable.


reasoning: The paragraph describes the company's internal cybersecurity controls and monitoring practices, with the third-party SOC mentioned as one component of that overall process rather than as a standalone vendor-risk oversight discussion. It contains no qualifying firm-specific facts such as named products, firms, dates, roles, or recognized frameworks.


reasoning: The paragraph describes the company’s internal approach for overseeing cybersecurity threats and escalating reportable incidents, which is primarily about process rather than board oversight or a specific management role. The references to management and the board are generic and do not include qualifying firm-specific details.


reasoning: The paragraph’s main point is a materiality conclusion about cybersecurity incidents and their potential impact, which fits Strategy Integration under the tiebreakers. It does not describe an actual incident or the company’s cybersecurity processes; it also includes a cross-reference to risk factors.


reasoning: The paragraph is centrally about processes applied to vendors and other third parties, so the most applicable category is Third-Party Risk. It contains no qualifying specific facts such as named roles, committees, frameworks, dates, firms, tools, or quantified details.


reasoning: The paragraph primarily discusses the company's cybersecurity controls and ongoing exposure to cyber threats, framing the topic around its internal security posture rather than board oversight, management roles, or a specific incident. Although it notes no significant compromise or material financial losses to date, the paragraph does not center on a disclosed event or a standalone materiality assessment.


reasoning: This paragraph is primarily about identified management roles and their qualifications/responsibilities, not board oversight or broader process details. It includes firm-specific management titles and a quantified experience statement, but not two qualifying hard verifiable facts needed for Quantified-Verifiable.


reasoning: The paragraph primarily describes the company’s intended cybersecurity processes and governance for assessing, identifying, managing, and responding to cyber risks. Although it mentions subcontractor incident reporting and supply-chain exposure, third-party oversight is only one component of the broader internal risk management discussion.


reasoning: The paragraph describes the company's own cybersecurity controls and operational practices, including monitoring, patching, backup, and recovery measures, which makes it a risk management process disclosure. References to avoiding third-party dependence are incidental rather than the central topic.


reasoning: The paragraph is primarily about how cybersecurity oversight is allocated between the board and a subsidiary-level committee, making board oversight the main topic. It includes a firm-specific governance fact through the named Information Security Committee.


reasoning: This paragraph is only a cross-reference to the Risk Factors section and does not provide any substantive cybersecurity disclosure about governance, management, processes, incidents, or strategy. It therefore fits None/Other.


reasoning: The paragraph focuses on the company's internal cybersecurity policies, procedures, reporting structure, and business-unit-level risk management activities. Although it mentions third-party vendors, vendor risk is only one component of the broader internal cybersecurity process, so Risk Management Process is the best fit.


reasoning: The paragraph describes the company's internal incident response processes and procedures for handling cybersecurity events, making it a risk management process disclosure. It contains only generic descriptions of an incident response plan and no qualifying specific facts such as named roles, frameworks, dates, tools, or firms.


reasoning: The paragraph is primarily about how the company’s cybersecurity risk assessment and management processes are implemented and maintained, with the executive role mentioned in support of that function. Although it includes role and experience details, the main subject is the company’s internal cybersecurity process rather than board oversight, third-party risk, or an actual incident.


reasoning: The paragraph focuses on the company's internal cybersecurity program and how it manages cyber risk through policies, controls, monitoring, and risk assessments, which fits Risk Management Process. Its only qualifying specific detail is the named NIST Cybersecurity Framework, with no firm-unique or independently verifiable facts beyond that framework reference.


reasoning: The paragraph is primarily about the Board’s oversight of cybersecurity and its delegation to a board committee, making Board Governance the best fit. It contains only generic governance language involving the Board, Audit Committee, CFO, and quarterly reporting, none of which qualify as specific facts under the rubric.


reasoning: The paragraph is primarily about the company’s internal cybersecurity-related governance process for managing engineering risk, not board oversight or the qualifications of a specific executive. It includes firm-specific named committees and a cybersecurity-specific role, which makes it Firm-Specific.


reasoning: The paragraph is centered on the Chief Technology Officer's role, reporting line, experience, and responsibilities, so it is primarily about management's cybersecurity role rather than the broader process itself. It includes firm-specific facts such as the CTO title and a quantified experience statement, but not two clear hard verifiable facts needed for Quantified-Verifiable.


reasoning: The paragraph primarily describes the company's internal cybersecurity risk identification, assessment, monitoring, and escalation processes, with third-party risk mentioned as one component of that broader process. The brief reference to escalation to a board member does not make board oversight the main subject.


reasoning: The paragraph is centered on a management role—the Vice President of Technology—and its responsibility to brief the board on cybersecurity matters. Although board oversight is referenced, the board is not the grammatical subject and the paragraph is not primarily about the board’s governance structure.


reasoning: The paragraph is about oversight by the Audit Committee, making board-level governance the main topic. It contains only generic committee oversight language and no qualifying specific facts under the provided rules.


reasoning: The paragraph primarily describes the company's own cybersecurity risk management activities, including independent assessments, plan reviews, defensive controls, and cloud supplier assessments. Although third-party cloud suppliers are mentioned, vendor oversight is only one component of the broader internal cybersecurity process.


reasoning: The paragraph is primarily about board-level oversight, with the Audit Committee and full Board as the subjects responsible for reviewing and overseeing cybersecurity risk. The mention of the CISO adds a firm-specific role detail, but the main focus remains governance by the board.


reasoning: The paragraph primarily describes an actual cybersecurity event, including when it was identified, the nature of the attack, operational disruption, and response actions, which makes Incident Disclosure the best fit. It includes one qualifying hard fact—a specific date—so it is Firm-Specific rather than Generic Boilerplate or Quantified-Verifiable.


reasoning: The paragraph is centered on the CISO's reporting responsibilities and escalation path, making management's role the primary topic. Although board oversight is mentioned, the board is the recipient of updates rather than the grammatical subject.


reasoning: The paragraph describes an internal cybersecurity activity—conducting risk assessments to identify threats to systems, data, products, services, and IT infrastructure—so it fits Risk Management Process. It contains no named frameworks, roles, dates, tools, firms, or other firm-specific facts.


reasoning: The paragraph is a standalone materiality conclusion stating that the company is not aware of reportable cybersecurity incidents that materially affected or are reasonably likely to materially affect the business, results, or financial condition. The Risk Factors cross-reference is ancillary and does not change the main focus from materiality assessment.


reasoning: The paragraph is about the company's internal cybersecurity risk management processes and who oversees them, rather than board oversight or the qualifications of a named individual. It includes a firm-specific team composition spanning Information Technology, Information Security, Product Security, Compliance, and Legal.


reasoning: The paragraph's main point is a materiality/impact statement about cybersecurity risk on the company's business strategy, results of operations, and financial condition, along with a risk factor cross-reference. It does not describe a specific incident or substantive risk management process.


reasoning: The paragraph focuses on the potential business and financial impact of cybersecurity threats, including possible material adverse effects and impacts from service providers, rather than describing governance, management roles, or a concrete risk management process. It contains only generalized risk and materiality language with no qualifying specific facts.


reasoning: The paragraph is centered on the CIO as the designated executive responsible for the incident response plan and cybersecurity/data privacy program, including the CIO’s experience and responsibilities. Although it describes cybersecurity processes, those processes are presented mainly through the CIO’s role rather than as a standalone enterprise process description.


reasoning: The paragraph describes the company's internal approach to integrating cybersecurity into enterprise risk management, which is a risk management process. It contains no qualifying specific facts such as named roles, committees, dates, frameworks, tools, firms, or quantified details.


reasoning: The paragraph describes a real cybersecurity-related event—an email spoofing attempt—including what happened and the outcome, so it is best classified as Incident Disclosure. Its only qualifying specific fact is the month/year date, which makes it Firm-Specific but not Quantified-Verifiable.


reasoning: The paragraph’s main point is a materiality-oriented statement that the company has not experienced any material cybersecurity events and that future threats could adversely affect the business. It does not describe governance, management roles, or a concrete incident narrative, so Strategy Integration is the best fit.


reasoning: The paragraph is primarily about board-level oversight, with the committee responsible for overseeing the cybersecurity risk management program and receiving reports on cybersecurity matters. Although it mentions a management role, that role is described in service of the committee's oversight function.


reasoning: The paragraph's main point is the lack of significant impact to date and the possibility of future material effects on business strategy, results of operations, and financial condition. The brief mention of past threats is incidental and does not provide an actual incident narrative.


reasoning: This paragraph mainly states the company is an early-stage entity with limited cybersecurity resources and no encountered incidents, rather than describing a substantive cybersecurity governance or risk management program. Under the SPAC/early-stage rule, the absence of a meaningful program is classified as None/Other.


reasoning: The paragraph primarily describes how the audit committee and Board receive cybersecurity-related briefings and updates, making board-level oversight the central topic. It does not include any qualifying specific facts such as named cyber roles, non-generic committees, dates, frameworks, or quantified details.


reasoning: The paragraph is primarily about the company’s internal security governance structure for evaluating and addressing cyber risk, which makes it a risk management process disclosure. The references to the CFO and Board are incidental and generic rather than the main focus of the paragraph.


reasoning: Although the paragraph mentions a board-level committee, most of the substantive detail centers on the Chief Security Officer and the Information Security team’s qualifications and certifications. That makes management roles and credentials the primary focus rather than board oversight.


reasoning: Although the paragraph mentions the CISO, its main focus is the company's incident response structure, team composition, and testing of the incident response plan, which makes it a risk management process disclosure. It includes firm-specific details such as the CISO role, named IRT/IRP, and specific departmental composition.


reasoning: This paragraph is a standalone materiality conclusion stating that cybersecurity threats have not materially affected and are not reasonably likely to materially affect the company’s business strategy, results of operations, or financial condition. It does not describe governance, management roles, or any specific risk management process.


reasoning: The paragraph is primarily about how the Board's risk committee oversees cybersecurity through reports and escalation processes, making board-level oversight the main topic. It mentions management roles, but mainly in service of describing the committee's oversight structure.


reasoning: The paragraph is primarily about named management cybersecurity leaders, their responsibilities, and especially their qualifications and experience, so Management Role is the best fit. It includes multiple firm-specific, externally checkable details such as named roles, years of experience, degree, and certifications.


reasoning: The paragraph is primarily a materiality assessment stating that cybersecurity threats and prior incidents have not materially affected, and are not reasonably likely to materially affect, the company’s business strategy, results of operations, or financial condition. The rest is cautionary language and a risk factor cross-reference, not incident details or process/governance disclosure.


reasoning: The paragraph is primarily about the company's internal cybersecurity operations and incident response processes—monitoring, threat assessment, classification, escalation, and outside assistance—rather than the qualifications of a specific executive or board oversight. It includes firm-specific organizational facts such as a dedicated Information Security Division and a CISO.


reasoning: The paragraph is primarily about the company's internal cybersecurity risk identification and management program, including its enterprise-wide information security program and related controls. Although a CISO is named, the focus is on what the program does rather than on the individual's qualifications or reporting line.


reasoning: The paragraph focuses on a specific management role—its identification, experience, and reporting line—rather than on the company’s broader cyber processes. It includes firm-specific facts through the named CIO role and a quantified experience statement, but not enough hard verifiable facts to reach Quantified-Verifiable.


reasoning: The paragraph is primarily about Board-level oversight: the Board delegates cybersecurity oversight to the Audit Committee, which receives incident reports and reports back to the full Board. The only qualifying firm-specific fact is the involvement of the CIO, while the rest is largely generic governance description centered on the Board and Audit Committee.


reasoning: The paragraph describes the company's own cybersecurity risk management activities and monitoring processes, with third-party partners presented as components of that internal program rather than as the subject of vendor oversight. It contains no qualifying specific facts such as named firms, tools, dates, roles, committees, or quantified details.


reasoning: The paragraph is primarily about Exelon's own cybersecurity activities and controls—threat intelligence, monitoring, protective measures, training, and insurance—so it fits Risk Management Process rather than Management Role. Although a CISO is mentioned, the focus is on what the cybersecurity program does, not on the individual's qualifications or reporting line.


reasoning: The paragraph primarily describes CTBI's internal incident response and escalation process, including classification and threat-level assessment, rather than focusing on board oversight or the qualifications of any one manager. It includes a firm-specific escalation group composition, which makes it more specific than generic boilerplate.


reasoning: The paragraph primarily describes the company's internal cybersecurity risk management activities, including assessments, audits, testing, incident response preparedness, and training. Mentions of third parties and board participation are ancillary rather than the central topic.


reasoning: The paragraph describes a real cybersecurity incident, including what happened, the vendor and system involved, the affected data, and response actions taken. It includes multiple externally verifiable facts such as a specific time period, a named vendor, and a named product/system.


reasoning: The paragraph’s substantive point is a materiality assessment stating that cybersecurity incidents have not materially affected the company’s business, results, or financial condition. The rest is a cross-reference to risk factors, with no description of governance, management roles, or specific risk management processes.


reasoning: The paragraph primarily describes the company's cybersecurity program and its cross-functional processes for identifying, mitigating, and escalating cybersecurity threats and incidents. Although it mentions board-level oversight, the main focus is the company's internal risk management approach rather than board governance itself.


reasoning: The paragraph is primarily about the qualifications of the company's risk-management leadership and supporting personnel rather than describing cyber processes or board oversight. It provides company-specific credential details, which makes it more than boilerplate, but it does not include two clear hard verifiable facts of the type needed for Quantified-Verifiable.


reasoning: The paragraph is centered on management’s materiality assessment, stating that cybersecurity threats are not reasonably likely to materially affect the company and that no material incidents occurred, rather than describing governance structures or a specific incident. The references to fiscal 2025 and fiscal 2026 provide two verifiable time-bound facts.


reasoning: The paragraph is primarily about the CISO's qualifications, responsibilities, and reporting line, making management's role the central topic. Although the Board and Audit Committee are mentioned, they appear only as part of the CISO/CDO reporting chain rather than as the main subject.


reasoning: The paragraph focuses on the business and financial impact of cybersecurity risks and the Bank's investment in its cybersecurity program, rather than describing governance, management roles, or operational risk processes. It contains only generic materiality and investment language with no qualifying specific facts.


reasoning: The paragraph focuses on potential business, financial, legal, and operational impacts of hypothetical cyber events rather than governance, management roles, or the company’s risk management processes. It does not describe an actual incident and contains only generalized consequences of cybersecurity threats.


reasoning: The paragraph primarily describes the company’s internal cybersecurity controls and processes, including monitoring, patching, backups, and handling risks from third-party technology and services. Although the CISO and CIO are mentioned, the focus is on what the cybersecurity function does rather than on those individuals’ qualifications or reporting roles.


reasoning: The paragraph mainly presents cybersecurity risk and materiality statements, including that prior incidents have not had a material adverse effect, rather than detailing governance, a management role, or a specific incident. The process references are generic and secondary to the broader business-risk and materiality discussion.


reasoning: The paragraph is primarily about AFG’s internal ERM structure and how cybersecurity risk is monitored within that process, making Risk Management Process the best fit. Although it includes a director’s cyber training, board oversight is not the main focus of the paragraph.


reasoning: The paragraph mainly explains that the company relies on Blackstone-affiliated entities to assess, identify, and manage cybersecurity risks, which is most consistent with how cybersecurity risk management is organized. Although the Board is mentioned, board oversight is secondary and not the main subject of the paragraph.


reasoning: The paragraph describes the company's ongoing internal cybersecurity monitoring and incident response activities, making it a risk management process disclosure. It contains no qualifying specific facts such as named roles, frameworks, dates, tools, firms, or quantified details.


reasoning: The paragraph is primarily about oversight by a board committee, making board governance the central topic. Although the Audit Committee is generic and not counted as a specific fact, the named management roles CIO and CISO make the disclosure firm-specific.


reasoning: The paragraph primarily describes the company's internal cybersecurity risk assessment and reporting processes rather than focusing on the board as the main actor or on the CISO's qualifications. The Audit Committee is mentioned only as a recipient of briefings, while the core topic is the company's risk management activity.


reasoning: Although the paragraph mentions committee reporting, its substantive focus is on management participants and their experience, especially the interim chief information officer and chief risk officer. The named committees, cybersecurity-relevant role, and quantified experience make it company-specific, but it lacks the two qualifying hard verifiable facts needed for Quantified-Verifiable under the rubric.


reasoning: The paragraph is centered on the CIO as a management role—his leadership of the cybersecurity program, reporting line, support structure, and experience. Although it mentions program activities, the primary focus is the person and role rather than the broader risk management process.


reasoning: The paragraph is centered on the board of directors' oversight of cybersecurity risk, making Board Governance the best fit. It contains only generic governance language and no qualifying specific facts such as named committees, roles, frameworks, dates, or quantified details.


reasoning: The paragraph is primarily about oversight of cybersecurity policies and processes by a named committee, which fits Board Governance best. Although the CISO is also mentioned, the core disclosure concerns governance oversight rather than the individual's qualifications or background.


reasoning: The paragraph primarily describes the company’s internal cybersecurity response, escalation, coordination, and recovery processes, so it fits Risk Management Process. Although it mentions the Audit Committee, board oversight is ancillary rather than the main focus.


reasoning: The paragraph describes an internal cybersecurity control focused on limiting and reviewing access to sensitive systems and data, which fits the company's risk management process. It contains no named roles, frameworks, tools, dates, or other firm-specific details.


reasoning: The paragraph describes actions taken in response to an actual cybersecurity incident, including forensic analysis findings, remediation steps, and a payment related to the theft. It contains two hard verifiable facts—a specific reporting date and a dollar amount—supporting Quantified-Verifiable specificity.


reasoning: The paragraph primarily describes the company's internal cybersecurity risk management framework, including assessment, mitigation, monitoring, training, and escalation processes, so Risk Management Process is the best fit. Although much of the language is boilerplate, the integration into the company's enterprise risk management program makes it modestly company-specific.


reasoning: The paragraph is primarily about management roles—especially the CIO and CISO—their responsibilities, reporting, and the CIO's tenure and experience. Although board oversight is mentioned, the bulk of the paragraph focuses on management personnel rather than the board as the main subject.


reasoning: The paragraph primarily describes the company's internal cybersecurity monitoring, event categorization, escalation, and integration into risk management processes. Although it briefly mentions escalation to the Board, the focus is on operational risk management processes rather than board oversight.