reasoning: The paragraph describes the company's internal cybersecurity risk management function, its integration into ERM, a list of key cyber risks, and mentions processes/technologies/controls — all squarely Risk Management Process. No named frameworks, roles, tools, dates, or firm-specific facts are present; every sentence could be pasted into any company's filing unchanged.

thinking:
Classify this paragraph.

Content: Describes the company's cybersecurity risk management function, its integration into ERM, lists key cyber risks, and mentions processes/technologies/controls. This is about internal processes and risk management.

Category: Risk Management Process - describes risk assessment, ERM integration, and internal processes.

Specificity: No named frameworks, no named roles (cybersecurity-specific), no dates, no numbers, no named tools. "Enterprise risk management program" is generic. The list of risks is generic. "Dedicated cybersecurity risk management function" - not a named role or unique identifier.

→ Generic Boilerplate (1)


content_category: Risk Management Process

category_confidence: high

specificity_confidence: high

reasoning: The paragraph describes Arista's internal cybersecurity program components — policies, risk assessments, security team, audits, training, vendor vetting, and continuous improvement. This is squarely about the company's own processes. No named frameworks (NIST, ISO, etc.), no cybersecurity-specific titles from the IS list (CISO, CIO, etc.), no named tools, firms, dates, or quantified facts appear — all references are generic ('security team', 'external service providers', 'IT/IS team'), making this Generic Boilerplate.

provider: anthropic

generationId: agent-sdk

stage: benchmark

thinking:
Let me analyze this paragraph from Arista Networks' 10-K filing.

Content: Describes their cybersecurity risk management program - policies, risk assessments, security team, audits, training, vendor vetting, continuous improvement. This is clearly about internal processes.

Category: Risk Management Process - describes the company's own internal cybersecurity processes, tools, and methodologies.

Specificity: Let me check for specific facts:
- "information security management systems policy" - generic program name
- "security team" - generic
- "internal audit teams and external service providers" - unnamed

- "IT/IS team" - generic reference
- "external cybersecurity consultants" - unnamed
- No named frameworks, no named tools, no dates, no numbers, no named roles from the IS list

This is generic boilerplate with no concrete details or named standards.


content_category: Third-Party Risk

reasoning: The paragraph's central topic is identifying and overseeing cybersecurity threats from third-party vendors, service providers, and external users — squarely Third-Party Risk. No named frameworks, specific roles, dates, firms, or quantified details appear; all language ('comprehensive, risk-based approach,' 'outside auditors or consultants') is generic and could apply to any company.

thinking:
Classify this paragraph.

Content: About third-party vendor oversight, monitoring third-party systems, risk-based approach to vendor cybersecurity. Central topic is oversight of external parties.

Category: Third-Party Risk - vendor oversight is the central topic.

Specificity: No named frameworks, no named roles (cybersecurity-specific), no dates, no numbers, no named firms/tools. "risk-based approach" is generic. "outside auditors or consultants" is unnamed. This is Generic Boilerplate.


content_category: Board Governance

category_confidence: medium

specificity_confidence: medium

reasoning: The paragraph opens with the Board's risk oversight responsibility and its delegation of information security oversight to the Audit Committee, CFO, and IT resources — the Board is the grammatical subject establishing the governance frame. The subsequent sentences describing the Director of IT and team composition are subordinate details showing how the delegated oversight is carried out. Specificity is Firm-Specific: the reference to 'a certified information system security professional' on the team is a CISSP certification reference (one verifiable fact), but 'Director of IT' is generic IT leadership per the NOT list, 'Audit Committee' and 'CFO' are standard governance roles, and 'many years of experience' is a vague quantifier — only one qualifying fact, so Firm-Specific rather than Quantified-Verifiable.

thinking:
Let me analyze this paragraph carefully.

The paragraph covers multiple topics:
1. Board oversight of risks (Board Governance)
2. Delegation to Audit Committee, CFO, and IT resources (Board Governance)
3. Director of IT manages team and third-party providers (Management Role / Risk Management Process)
4. IT team composition including a CISSP holder

The opening frames this as Board delegation of oversight. But then it shifts to describing the Director of IT and the team. Let me apply the dominant category test.

The paragraph starts with Board oversight and delegation, then shifts to describing the Director of IT and team composition. The Board is the subject of the first two sentences.

The Director of IT becomes the focus in the third sentence, with the fourth describing team composition. So I'm looking at a mixed structure where the Board's delegation sets the frame, but the bulk of the content actually details the Director's role and the team's makeup. The opening context about Board oversight is really just establishing why the Director and team exist, while the substance is about their composition and responsibilities. I'd categorize this as Board Governance since the delegation structure is the organizing principle, even though the details lean toward management and personnel. the CISSP credential specifically, which would be a concrete detail. Let me look at what's actually stated - it mentions a CISSP holder on the team, so that's a named certification and counts as specific. The rest of the language around experience and monitoring practices is too generic to be meaningful specificity. I see that "Director of IT" is explicitly listed as generic IT leadership, not cybersecurity-specific, so it doesn't count. That leaves just the CISSP certification reference as the one verifiable fact, which means this falls into the Firm-Specific category rather than QV-eligible.

fact: certified information system security professional (CISSP certification holder on IT team)


content_category: Incident Disclosure

reasoning: The paragraph describes a specific cybersecurity incident — the September 2023 social engineering attack, what was compromised (loyalty program database with PII), and response actions taken — squarely fitting Incident Disclosure. For specificity, there is one QV-eligible hard fact (specific date: September 14, 2023); the attack vector and affected data are firm-specific details but the third-party firms and tools are unnamed, so only one QV-eligible fact exists, landing at Firm-Specific rather than Quantified-Verifiable.

thinking:
Let me analyze this paragraph from Caesars Entertainment's 10-K filing.

Content: Describes a specific cybersecurity incident - unauthorized access via social engineering attack on an outsourced IT vendor, loyalty program database compromised, response actions taken.

Category: Incident Disclosure - clearly describes what happened, when, scope, and response actions.

Specificity: Let me count hard verifiable facts:
1. Specific date: September 14, 2023
2. Attack vector: social engineering attack on outsourced IT support vendor
3. Loyalty program database compromised with driver's license/SSN data

QV-eligible facts: specific date (September 14, 2023) - that's one hard verifiable fact.

The third-party responders aren't named, there are no specific products or dollar amounts mentioned, and no headcount data. That leaves just the date as a QV-eligible fact, so this doesn't meet the QV threshold. The disclosure maps to Firm-Specific under the IS list since it contains the specific incident date.

fact: September 14, 2023

fact: social engineering attack on an outsourced IT support vendor

fact: loyalty program database containing driver's license numbers and/or social security numbers


content_category: Management Role

reasoning: The entire paragraph is about the CISO as a person — their years of experience, technical background building specific security technologies, prior leadership roles, pen-testing experience, education, and team composition. This is a textbook Management Role paragraph (person, not function). Multiple QV-eligible hard facts: 20+ years CISO experience, 20+ team members headcount, two IS leads with 20+ years each.

thinking:
Let me analyze this paragraph from Arista Networks' 10-K filing.

Content: This is entirely about the CISO's background, experience, credentials, and team composition. It's about the person, not the function.

Category: Management Role - clear case. The entire paragraph describes the CISO's experience, technical background, education, and team.

Specificity: Let me count QV-eligible hard facts:
- "over 20 years of experience" - specific number ✓
- Named technologies built (NIPS, HIPS, WAF, etc.) - these are named security technologies
- "over 20 members" - headcount ✓

- "two IS leads" - headcount ✓
- "more than 20 years" for leads - specific number ✓

The degrees mentioned are generic without named institutions, so those don't qualify. But I've got multiple quantified facts here—years of experience, team headcount, and leadership structure—which clearly meets the Quantified-Verifiable threshold. The CISO role itself is firm-specific, and combined with these hard verifiable metrics, this is definitely QV.

fact: CISO has over 20 years of experience in cybersecurity

type: quantified

fact: CISO role (cybersecurity-specific title)

fact: IS team includes over 20 members

fact: Two IS leads each with more than 20 years of security experience


content_category: Strategy Integration

reasoning: The paragraph contains an explicit materiality assessment ('have not materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition'), making it Strategy Integration per Rule 6. The appended cross-reference to Risk Factors does not change the classification. The language is boilerplate with no firm-specific facts.

thinking: Materiality assessment + cross-reference. Per Rule 6 and the codebook, this is Strategy Integration.


reasoning: The paragraph describes integration of cybersecurity risk assessment into the company's overall ERM framework — a core Risk Management Process topic. The 'IT Security Incident Response Plan' is a generic program name without a unique identifier or distinguishing abbreviation, and no named frameworks, roles, dates, or other firm-specific facts are present, so this remains Generic Boilerplate.

thinking:
Classify this paragraph.

Content: Describes integration of cybersecurity into overall risk management, mentions "IT Security Incident Response Plan" as part of broader framework.

Category: Risk Management Process - describes internal processes, ERM integration.

Specificity: The "IT Security Incident Response Plan" - is this a named internal program with a unique identifier? It's a generic program name without a distinguishing abbreviation. The codebook says generic program names like "incident response plan" don't qualify. "IT Security Incident Response Plan" is slightly more specific but still generic - no unique abbreviation like "(CIRP)".

No named frameworks (NIST, ISO, etc.), no firm-specific facts.

This falls into generic boilerplate territory since it lacks any distinctive identifiers or proprietary details.


reasoning: The paragraph is entirely about the person filling the cybersecurity leadership role — their managerial responsibility, years of experience, and educational background. This passes the person-vs-function test as Management Role. Two QV-eligible hard facts: specific years of experience (27 years) and a named university (California State University, Bakersfield) in credential context.

thinking:
Let me analyze this paragraph.

The paragraph is about the Chief Digital Information Officer - their responsibilities, experience, and education. This is about the person, not the function.

Content category: Management Role - the paragraph describes who the person is, their experience, credentials, and background.

Specific facts:
- "Chief Digital Information Officer" - cybersecurity-specific title (named_role)
- "over 27 years of experience" - specific number (quantified)
- "California State University, Bakersfield" - named university (other_specific)
- "Bachelor of Science degree in Computer Science" - specific degree

QV-eligible: 27 years of experience (quantified), California State University Bakersfield (named university in credential context) = 2 QV facts → Quantified-Verifiable

fact: Chief Digital Information Officer

fact: over 27 years of experience in information technology


reasoning: The paragraph describes Sabre's internal cybersecurity technologies, tools (listed by generic category, not named products), and processes (training, vulnerability assessments, pen testing, tabletop exercises). Third-party assessments are mentioned as one component of the internal program, not as the central topic. The reference to 'payment card industry certification' effectively names the PCI DSS standard, elevating beyond boilerplate, but all tools and practices are described in generic categorical terms (e.g., 'endpoint detection and response,' 'cloud security posture management') without naming specific vendors or products, so nothing reaches Firm-Specific.

thinking:
Let me analyze this paragraph from Sabre Corp's 10-K filing.

Content: Describes their cybersecurity technologies, tools, and processes. Lists categories of tools (cloud security posture management, endpoint detection, etc.) and processes (training, vulnerability assessments, pen testing, tabletop exercises). Also mentions third-party assessments and PCI certification.

Category: This is about the company's own internal cybersecurity processes, tools, and methodologies. Third parties are mentioned as one component. → Risk Management Process

Specificity: Let me check for specific facts.
- Tools listed are generic categories, not named products (no "CrowdStrike Falcon" or "Splunk")

- Processes are common industry practices (pen testing, vulnerability scanning, tabletop exercises)
- "Qualified Security Assessor" is a PCI DSS term, not a named firm
- "Payment card industry certification" references the PCI DSS standard
- No named frameworks explicitly mentioned
- No specific dates, dollar amounts, or headcounts
- No named third-party firms
- No cybersecurity-specific titles

The reference to PCI certification indicates they're following a sector-adapted standard → Sector-Adapted (Level 2)

fact: Payment card industry (PCI) certification referenced

type: framework


reasoning: The paragraph describes cybersecurity monitoring processes, security measures, system audits, vulnerability identification, and incident response planning. Although 'Director of Infrastructure' is repeatedly named as the actor, the person-vs-function test shows the content is about what the program does (prevention, detection, mitigation, audits, IR plan), not about the person's credentials or background. 'Director of Infrastructure' is not a cybersecurity-specific title on the IS list, and no named frameworks, tools, dates, or other specific facts are present, yielding Generic Boilerplate.

thinking:
Let me analyze this paragraph.

Content: Describes the Director of Infrastructure's role in monitoring cybersecurity incidents, implementing processes, deploying security measures, audits, and incident response.

Category: This is about what the program/function does - monitoring, security measures, audits, incident response. The Director of Infrastructure is mentioned as attribution but the content is about processes. Applying the person-vs-function test: remove "Director of Infrastructure" and replace with "the Company" - the paragraph still describes processes. → Risk Management Process.

Wait - "Director of Infrastructure" - is this a cybersecurity-specific title? Looking at the IS list: "CISO, CTO, CIO, VP of IT/Security, Information Security Officer, Director of IT Security, HSE Director overseeing cybersecurity." "Director of Infrastructure" is not on this list.

Since it's a general IT role rather than a cybersecurity-specific one, and there are no named frameworks, tools, dates, or numbers to anchor the content, this reads as generic boilerplate.


reasoning: The paragraph describes an actual cybersecurity incident — the social engineering attack, unauthorized access, detection, IRP activation, containment, and engagement of professionals. This is squarely Incident Disclosure. For specificity, the specific date (September 14, 2023) is one QV-eligible hard fact. The 'loyalty program database' identified with a unique label ('Data Incident') is a named internal system, providing a second hard fact, reaching the QV threshold — though this is a borderline call since 'loyalty program database' is more descriptive than a commercial product name. The remaining details (outsourced IT vendor, third-party professionals, forensic professionals) are unnamed and do not count.

thinking:
Let me analyze this paragraph from Caesars Entertainment's 10-K filing.

Content: Describes a specific cybersecurity incident - unauthorized access via social engineering attack on an outsourced IT vendor, affecting loyalty program database. Describes detection, response actions (IRP activation, containment, investigation, notifications, engaging professionals).

Category: Incident Disclosure - clearly describes what happened in an actual cybersecurity incident.

Specific facts:
- September 14, 2023 (specific date)
- Social engineering attack on outsourced IT support vendor (attack vector detail)
- Loyalty program database (named system/data)

- IRP activation (incident response plan)

Now I'm checking which facts qualify as QV-eligible. The September 14, 2023 date is clearly specific and counts. The loyalty program database is an internal system, but it's not a named product or third-party firm, so it doesn't meet the QV criteria. That leaves me with just one QV-eligible fact here.

The other details—the specific incident date, the loyalty program database reference, and the social engineering attack vector—are all firm-specific information that wouldn't be publicly known. So this falls into Firm-Specific (Level 3) territory: one hard QV fact plus contextual details unique to this organization's incident.

fact: loyalty program database ("Data Incident")


reasoning: The paragraph describes the company's internal cybersecurity risk management practices — ERM integration, framework adoption, controls testing, and industry engagement — all hallmarks of Risk Management Process. NIST is named as a recognized standard, but there are no firm-specific facts: 'information security organization,' 'independent third parties,' 'industry groups,' and 'third-party providers' are all generic/unnamed, placing this at Sector-Adapted.

thinking:
Let me analyze this paragraph.

Content: Describes the company's cybersecurity risk management practices - ERM integration, NIST framework, controls testing, industry engagement. This is about internal processes.

Category: Risk Management Process - describes framework adoption, ERM integration, controls testing, monitoring.

Specificity: Names NIST (a recognized standard). Any firm-specific facts? "information security organization" - not a specific title. "independent third parties" - unnamed. "industry groups" - unnamed. "third-party providers" - unnamed. No specific dates, numbers, named firms, or named roles.

So: Sector-Adapted (names NIST, nothing firm-specific beyond that).

fact: National Institute of Standards and Technology (NIST)


content_category: None/Other

reasoning: This paragraph is an executive biography for the Chief Corporate Officer, covering communications, franchising, government relations, and ESG — none of which are cybersecurity functions. It contains no substantive cybersecurity disclosure content and appears to be general corporate leadership information erroneously extracted from or adjacent to Item 1C.

thinking:
This paragraph describes Duncan Fulton's background and career history. He's the Chief Corporate Officer, not a cybersecurity-specific role. The paragraph is about his career in communications, franchising, government relations, and ESG - nothing cybersecurity related. This appears to be executive bio content that was included in or near Item 1C but contains no cybersecurity disclosure content.

None/Other, Specificity 1.


reasoning: The paragraph discusses potential business/financial impact of a future cybersecurity incident ('adverse effect on business operations, operating results, or financial condition'), which is Strategy Integration territory per the codebook's category markers. However, this is borderline with None/Other because the statement is purely hypothetical ('If we were to experience') and accompanied by a cross-reference — it does not make an explicit materiality assessment ('have not materially affected'). Assigned Strategy Integration because it does address cyber risk's potential impact on business strategy/financials, but with low confidence. Specificity is Generic Boilerplate: no named entities, frameworks, dates, or firm-specific facts — the language could appear unchanged in any filing.

thinking:
Let me analyze this paragraph.

Content: This discusses potential future material cybersecurity incidents and their adverse effects, plus a cross-reference to Risk Factors.

Category: This contains a materiality-adjacent statement but it's hypothetical/forward-looking ("If we were to experience"). It doesn't make an explicit materiality assessment about whether cybersecurity risks HAVE materially affected the company. It's more of a generic risk warning + cross-reference.

Per the codebook: "A pure cross-reference with no materiality conclusion is None/Other." And per Rule 6, materiality disclaimers that explicitly assess whether risks "have materially affected" or are "reasonably likely to materially affect" are Strategy Integration.

The language here is speculative rather than a definitive materiality judgment—it's framed as "if" and "may" rather than stating whether cyber risks actually have or are likely to materially impact operations. The paragraph does touch on potential business and financial consequences, which pushes it toward Strategy Integration, but the hypothetical framing and lack of explicit materiality assessment make it borderline between that and None/Other. I'm reconsidering whether this really qualifies as Strategy Integration. The statement "if a material incident happens, it could adversely affect operations" is circular reasoning—it's not actually making a substantive claim about cyber risk's business impact, just restating that material incidents are material. This feels more like generic boilerplate that mentions cybersecurity incidentally, so I'm leaning toward None/Other instead. The codebook's Case 4 is helpful here—hypothetical incident language should map to either Risk Management Process or Strategy Integration, not Incident Disclosure. Since this paragraph focuses on financial consequences rather than processes, Strategy Integration fits better. But the language is so generic—"if something bad happens, it would be bad"—that it barely qualifies as substantive. Still, the first sentence does gesture toward business impact, even if vaguely, so I'll stick with Strategy Integration, Specificity 1 rather than None/Other.


reasoning: The paragraph contains a materiality assessment ('have not experienced any material cyber breaches'), which per Rule 6 triggers Strategy Integration even when boilerplate. The second clause about 'periodically reviewing policies and procedures' is generic RMP language but is subordinate to the materiality claim. No named frameworks, specific dates, roles, or other facts from the IS list are present.

thinking:
Let me analyze this paragraph.

Content: "have not experienced any material cyber breaches" is a materiality assessment. "periodically reviewing our policies and procedures to respond to, and mitigate the impact of, emerging trends and technologies" is generic risk management language.

The materiality assessment ("not experienced any material cyber breaches") is a judgment about whether incidents have materially affected the company → Strategy Integration per Rule 6.

But wait - this says "not experienced any material cyber breaches" which is slightly different from the standard "have not materially affected our business strategy, results of operations, or financial condition." It's more of a factual claim about not having breaches rather than a strategic materiality assessment.

However, it does assess materiality of cyber incidents. The explicit claim that the company hasn't experienced material breaches is itself a materiality judgment about cybersecurity incidents, which falls under Strategy Integration. The second part about periodically reviewing policies is just standard risk management boilerplate. Since the materiality assessment is the dominant substantive claim here, this paragraph qualifies as Strategy Integration. The specificity is low though—no named frameworks, no concrete facts from the IS list, and "periodically" and "as of the date of this report" are both vague.


reasoning: The paragraph contains an explicit materiality assessment ('have not experienced any known cybersecurity incidents... that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition'), which per Rule 6 makes it Strategy Integration regardless of the appended cross-reference to Risk Factors. No specific facts are present—only boilerplate materiality language and a generic cross-reference.

thinking:
Materiality assessment + cross-reference. Per Rule 6 and the codebook, this is Strategy Integration because it contains an explicit materiality conclusion.

Specificity: boilerplate materiality language, no specific facts. Generic Boilerplate.


reasoning: The paragraph describes the company's internal cyber risk management process — identifying, assessing, and managing threats, with a cybersecurity team prioritizing mitigations. No named frameworks, specific roles from the IS list, dates, tools, or other firm-specific details are present; 'cybersecurity team' is generic.

thinking:
Classify this paragraph.

Content: Describes the company's cyber risk management process - identification, assessment, management of threats, cybersecurity team assessing threats and vulnerabilities.

Category: Risk Management Process - describes internal processes for managing cyber risk.

Specificity: No named frameworks, no specific facts from the IS list. "Cybersecurity team" is generic. No named roles, dates, tools, etc. → Generic Boilerplate.


reasoning: The Audit Committee is the dominant actor throughout — receiving briefings, maintaining dialogue, participating in strategic decisions, and conducting annual reviews. The COO's role is subordinate, serving as the information conduit to the board committee. Per Rule 2, when the board committee is the primary actor and management reports TO it, the category is Board Governance. No facts from the IS list are present: COO is generic C-suite (NOT list), Audit Committee is standard governance (NOT list), 'Via Renewables, Inc.' is a company self-reference (NOT list), and cadences like 'once per year' and 'annual' are generic. The bulleted briefing topics are boilerplate language found across many filings.

thinking:
Let me analyze this paragraph carefully.

The paragraph is titled "Management's Role Managing Risk" but the content is primarily about the Audit Committee's oversight activities, with the COO providing briefings to the Audit Committee.

Let me apply the category decision rules:

- The Audit Committee is the primary actor in most sentences - receiving briefings, maintaining dialogue, participating in strategic decisions, conducting annual reviews.
- The COO is described as informing/briefing the Audit Committee - this is about the board committee's oversight mechanism.

Per Rule 2: "Board delegates responsibility to management → Board Governance" and the Audit Committee is a board committee. The COO here is subordinate to the Audit Committee's oversight role.

I'm reconsidering the framing here. The opening mentions the COO's pivotal role, but the actual content focuses on what the Audit Committee does with those briefings—they're the dominant actor throughout. The COO is providing information to the committee, not driving the governance structure. This is clearly Board Governance, not Management Risk Oversight.

Looking at the specificity markers: the COO is generic C-suite, the Audit Committee is generic governance, the frequency is a standard cadence, and the bullet points are all boilerplate topics. There's nothing here that's company-specific or framework-based. This is Generic Boilerplate.


reasoning: The paragraph's primary content is the composition and responsibilities of a management committee (CISO, CFO, COO, General Counsel, CTO) and its reporting/escalation structure, making it about organizational roles rather than the processes themselves. It contains firm-specific facts including cybersecurity-specific titles (CISO, CTO), a specific team composition, and a named internal program (InfoSec Roadmap), but no QV-eligible hard facts (named roles and internal programs don't count toward QV).

thinking:
Let me analyze this paragraph carefully.

Content Category: This paragraph describes a management committee that oversees cybersecurity processes. The grammatical subjects are "a committee" and its members. It describes what the committee does - oversees strategy, approves processes, receives reports, assesses incidents, escalates to the board. The CISO is mentioned as part of the committee and as supervisor of the InfoSec team.

This is about management structure and committee composition - Management Role. The committee is the primary actor, and the paragraph describes who is on it and what it's responsible for. It's not about the board (the Audit Committee/Board are mentioned only as escalation targets).

The core focus here is the committee's composition and reporting structure rather than the processes themselves. The responsibilities listed serve to clarify the roles of these specific people - the CISO, CFO, COO, General Counsel, and CTO - not to detail how the processes work. This is fundamentally about who holds what position and how they relate to each other organizationally.

Looking at what qualifies as verifiable facts: the CISO and CTO are named roles specific to the organization, and the InfoSec Roadmap is a named internal program. These are firm-specific facts. However, for QV eligibility I need hard verifiable facts from the standard list - named roles don't count toward that threshold. Without dates, dollar amounts, headcounts, third-party firms, products, certifications, or years of experience, there aren't enough QV-eligible facts here to meet the requirement of two or more.

fact: Chief Information Security Officer

fact: Chief Technology Officer

fact: Committee includes CISO, CFO, COO, General Counsel, and CTO

fact: InfoSec Roadmap


reasoning: The paragraph's primary communicative purpose is establishing WHO comprises the Cybersecurity Team — naming specific roles (CTO, CAO/GC, CCO, outsourced firm reps) that form the leadership structure. The process descriptions that follow (maintain program, monitor trends, oversee training) are generic and subordinate to the team composition. CTO is a cybersecurity-specific title on the IS list, and the specific departmental composition qualifies as firm-specific, but no QV-eligible hard facts (dates, dollar amounts, named firms, headcounts) are present.

thinking:
Let me analyze this paragraph.

Content: Describes a "Cybersecurity Team" with specific composition (CTO, Chief Administrative Officer and General Counsel, Chief Compliance Officer and Senior Regulatory Counsel, senior representatives from outsourced technology firm). Then describes what this team does - maintains cybersecurity program, monitors trends, oversees training.

Category: This is about the team composition AND what the program does. The person-vs-function test: the paragraph names specific roles that compose the team, then describes what the team does (maintains program, monitors trends, oversees training). The team composition is specific, but the activities described are generic processes.

The paragraph opens with who's on the team, then shifts to what they do. The CTO is cybersecurity-specific per the IS list, but the other roles—Chief Administrative Officer, General Counsel, Chief Compliance Officer—are generic C-suite positions. The team composition itself is a concrete fact, even though the processes they oversee are standard functions.

I'm torn between Management Role and Risk Management Process. The paragraph spends roughly equal time on both, but the distinctive element is naming the specific roles responsible—that's the core communicative purpose. The process descriptions (maintaining the program, monitoring trends, overseeing training) are generic supporting details. I think Management Role is the better fit since the primary intent is establishing WHO is accountable, even though the functions are described afterward. I'm testing whether the paragraph still works if I swap out the team for "the Company" — the process descriptions hold up fine, but that first sentence about team composition is really the distinctive part. The activities described are generic enough that they could apply to any cybersecurity program.

Looking at the codebook definitions, Management Role is specifically about who someone is — their background, credentials, experience, reporting structure — which doesn't quite fit here since we're just listing team members without those details. Risk Management Process covers internal cybersecurity processes and methodologies, which does describe what the team does.

But the core of this paragraph is establishing the cybersecurity team's structure and composition — the CTO, CAO/GC, CCO, and outsourced firm representatives. That organizational setup feels like the real substance, with the process descriptions as supporting details. I'm leaning toward Management Role because the paragraph's primary purpose is defining who comprises the team and their roles, even if the processes mentioned are generic. The CTO is a firm-specific fact, and while the team composition is also specific to the company, it doesn't include the kinds of quantifiable details that would push this into QV territory—no dates, dollar amounts, headcounts, or named external firms. This lands it at Firm-Specific level 3.

fact: Chief Technology Officer (CTO) on Cybersecurity Team

fact: Team comprised of CTO, Chief Administrative Officer and General Counsel, Chief Compliance Officer and Senior Regulatory Counsel, and outsourced technology firm representatives


reasoning: The paragraph describes an actual cybersecurity incident: detection, activation of response protocols, and completion of an investigation. While it includes a materiality conclusion in the final sentence, two of three sentences narrate the incident itself, making Incident Disclosure the dominant category. Specificity is Firm-Specific based on the specific date ('During 2022'), but no second hard verifiable fact (no named firms, tools, dollar amounts, or headcounts) prevents it from reaching Quantified-Verifiable.

thinking:
Let me analyze this paragraph carefully.

The paragraph describes an actual cybersecurity incident (2022), mentions response actions, and includes a materiality assessment.

Content category: This has both incident description and materiality assessment. The first two sentences describe what happened (detected incident, activated response, completed investigation). The third sentence is a materiality conclusion. The dominant content is the incident narrative - two sentences describe the event vs one sentence on materiality.

Actually, let me reconsider. The incident description is quite generic (no specific details about what happened), and the materiality conclusion is also present. Per the tiebreaker rules: "Paragraph DESCRIBES what happened in an incident (dates, access, encryption, scope, response actions) → Incident Disclosure." The paragraph does describe detection and response actions.

Two sentences describe the incident (detection, response, investigation) versus one sentence on materiality, so the dominant content is the incident itself. → Incident Disclosure.

Now looking at specificity: "During 2022" gives me a specific year, which counts as a specific date. But there's nothing else concrete—no named firms, tools, dollar amounts, or headcounts. Just that one temporal reference. → Firm-Specific (3).

fact: During 2022


reasoning: The paragraph describes how cybersecurity is integrated into the company's ERM program and the organizational structure for managing cyber risk. Although multiple roles are named (CDIO, CISO, VP Internal Audit), the person-vs-function test applies: no credentials, backgrounds, or personal qualifications are given — the paragraph is about how the function is structured, not who the people are. Multiple firm-specific facts (CISO, CDIO, named GRC function) reach Firm-Specific, but no QV-eligible hard facts (dates, amounts, named firms/tools) are present.

thinking:
Let me analyze this paragraph from Kellanova's 10-K filing.

The paragraph describes the ERM program and how cybersecurity fits into it, naming several roles and the organizational structure.

Content Category: This is about the company's internal risk management processes - ERM program, how cybersecurity is evaluated within it, and the organizational structure for managing cyber risk. While it names several roles (VP Internal Audit, Chief Digital and Information Officer, CISO), these are mentioned to describe the function/structure, not the person's credentials or background. Applying the person-vs-function test: if you remove the titles, the paragraph still describes how the ERM program works and how cybersecurity risk is managed. → Risk Management Process

Now I'm checking the specific facts mentioned: the ERM program itself, the Chief Digital and Information Officer role which appears on the IS list when overseeing cyber, the CISO title, and the GRC function are all named programs or cybersecurity-specific roles. However, there aren't two hard verifiable facts beyond these named roles and programs, and no dates are provided.

fact: Enterprise Risk Management ('ERM') program

fact: Chief Digital and Information Officer

fact: Chief Information Security Officer ('CISO')

fact: Governance, Risk, and Compliance (GRC) function


reasoning: The paragraph describes the company's internal incident response process (DSEP) — how incidents are identified, investigated, escalated, and reported. Although CISO, CPO, and VP of Technology Risk are named as co-managers, they appear as attribution for who runs the process; the substantive content is about the function (repeatable process, reporting obligations, response strategies, documentation, escalation). Removing the role titles, the paragraph still describes a complete process → Risk Management Process. Firm-Specific due to the named program with unique identifier (DSEP) and multiple cybersecurity-specific roles, but no two QV-eligible hard facts (no dates, dollar amounts, named third-party firms, or named tools).

thinking:
Let me analyze this paragraph.

Content: Describes the company's Data Security Event Plan (DSEP) - how they identify, investigate, respond to, and report incidents. Co-managed by CISO, Chief Privacy Officer, and VP of Technology Risk. Describes the process for identifying significance, reporting obligations, response strategies, documentation, and escalation to Audit Committee and Board.

Category: This is about the company's internal processes - specifically their incident response planning process. The CISO and other roles are mentioned but as attribution for who manages the program. The paragraph is about what the DSEP does, not about the people. → Risk Management Process

Now I'm checking the specificity of the named elements. The DSEP is a clearly identified internal program, and the three roles—CISO, Chief Privacy Officer, and VP of Technology Risk—are all firm-specific titles that qualify for the IS list. However, looking at the QV criteria, none of these items meet the threshold since there are no hard verifiable facts like dates, dollar amounts, headcounts, or named third-party vendors.

fact: Data Security Event Plan ("DSEP") — named internal program with unique identifier

fact: CISO

fact: Chief Privacy Officer

fact: Vice President of Technology Risk


reasoning: The paragraph's central topic is that NEE affiliates provide substantially all of XPLR's cybersecurity functions under agreements — this is about oversight of external parties providing cybersecurity services, making it Third-Party Risk. The brief board mention is subordinate. NEE Management and NEER are parent/affiliate names (company self-references per the NOT list), and no IS-list facts (cybersecurity-specific titles, named frameworks, dates, tools, etc.) survive filtering, yielding Generic Boilerplate.

thinking:
Let me analyze this paragraph.

The paragraph says NEE's affiliates provide IT/cybersecurity functions to XPLR, and XPLR's board oversees the provision of these services.

Content: This is about an outsourced arrangement where a parent/affiliate provides cybersecurity services. The board oversight is mentioned but is secondary to the third-party service arrangement.

Actually, let me reconsider. The central topic is that cybersecurity functions are provided by an affiliate (NEE Management and NEER). The board oversight is a brief mention. The paragraph is primarily about the arrangement with external entities providing cybersecurity services.

This is definitely Third-Party Risk since the dominant content focuses on external parties—NEE Management and NEER—providing cybersecurity services, even though they're affiliates rather than fully independent firms. These named entities would count as QV-eligible facts, giving me two specific third-party firms to track.

But wait—if affiliate names fall under the "company self-references" exclusion on the IS-NOT list, then NEE Management and NEER might not actually qualify since they're subsidiaries of the parent company NEE. The arrangement itself is firm-specific, but without named frameworks, specific dates, or headcounts, I'm left questioning whether the affiliate names actually contribute to QV eligibility or if they're just internal company references.

Looking at what survives the filtering: the organizational structure of outsourcing cybersecurity to parent affiliates is somewhat distinctive to this company, but the codebook requires facts from the IS list. Checking again—NEE Management and NEER are subsidiary names on the NOT list, the board reference is generic, and there are no frameworks, dates, or cybersecurity-specific titles. This looks like Generic Boilerplate with no IS-list facts remaining.

The central topic is Third-Party Risk since affiliates are providing cybersecurity services to XPLR, but the specificity level is Generic Boilerplate.


reasoning: The paragraph describes the company's internal cybersecurity program components — risk assessments, a security team, external service providers, training, incident response plan, and third-party risk management. All content is about internal processes, not a specific person, board, or vendor oversight as the central topic. No named frameworks, cybersecurity-specific titles, named firms, tools, dates, or quantified facts appear; 'quarterly' training and 'incident response plan' are generic per the NOT list.

thinking:
Let me analyze this paragraph from Hess Corp's 10-K filing.

Content: This is a bulleted list describing the company's cybersecurity risk management program components - risk assessments, security team, external service providers, training, incident response plan, third-party risk management.

Category: Risk Management Process - describes internal processes, no focus on a person or board.

Specificity: Let me check for specific facts:
- No named frameworks (NIST, ISO, etc.)
- No named roles (CISO, CIO, etc.) - just "a security team"
- "quarterly" training - generic cadence
- No named tools, firms, dates, dollar amounts

- The incident response plan and third-party risk management process are both described in generic terms without any distinguishing details

This is all standard boilerplate language with no concrete specifics or named standards, so it's a Specificity 1 rating.


reasoning: The Audit Committee is the grammatical subject throughout, describing its oversight role, briefing cadence, and reporting to the full Board — classic Board Governance. The CIO mention is a cybersecurity-specific role (IS list), making it Firm-Specific, but there is only one qualifying fact so it does not reach Quantified-Verifiable.

thinking:
Classify this paragraph.

The paragraph is about the Audit Committee's oversight of cybersecurity risk - board is the grammatical subject throughout. This is Board Governance.

Specific facts:
- CIO mentioned (cybersecurity-specific role per IS list)
- "quarterly basis" - generic cadence, NOT list

The Audit Committee is generic (NOT list). "Board of Directors" is generic. "Quarterly" is generic cadence.

CIO is on the IS list as a cybersecurity-specific title → Firm-Specific.

Only one hard verifiable fact (CIO role), so not QV.

fact: Chief Information Officer leads cybersecurity team


reasoning: The paragraph describes the company's cybersecurity risk management integration into its broader ERM program, which is a description of internal processes. It contains no named frameworks, no firm-specific facts, and no verifiable details — the language could apply to any company.


reasoning: The paragraph describes the company's internal cybersecurity program — ERM integration, disaster recovery testing, encryption, vulnerability scanning, annual evaluation, and insurance renewals. All content is about processes and activities, not a person or vendor oversight. No named frameworks, roles, tools, firms, dates, or quantified facts appear; references to 'industry standards,' 'external advisors,' and 'every year' are all on the NOT list.

thinking:
Let me analyze this paragraph.

Content: Describes the company's cybersecurity program - policies, procedures, ERM integration, exercises (disaster recovery, tabletop), encryption, vulnerability scanning, annual evaluation, external advisors for insurance renewals.

Category: This is about internal processes - risk assessment, monitoring, testing, framework evaluation. → Risk Management Process

Person-vs-function: No specific person mentioned, it's all about what the program does.

Specificity check:
- No named frameworks (mentions "industry standards and established frameworks" but doesn't name them)
- No named roles (CISO, CTO, etc.)

- No specific dates
- No named tools/products
- No named firms ("external advisors" is generic)
- No specific numbers
- Common practices: disaster recovery testing, encryption, vulnerability scanning, automated/manual scanning
- "cybersecurity insurance renewals" - mentions insurance but no specifics
- "every year" - generic cadence

Everything here is either generic language or standard industry practice with no concrete details. No named standards, no specific vendors, no actual metrics or timelines. → Generic Boilerplate


reasoning: The paragraph describes an actual cybersecurity attack — its date, affected systems (Aurora acquisition), response actions, investigation, and outcome. This is clearly Incident Disclosure. Specificity is Firm-Specific: the specific date (January 31, 2022) and named acquisition (Aurora) are firm-specific facts, but only one QV-eligible hard fact (the exact date) exists — the forensics firm is unnamed and 'first half of 2024' is approximate — so it does not reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes a specific cybersecurity incident - date, what happened, response actions, investigation, outcome.

Category: Incident Disclosure - clearly describes an actual cybersecurity event with timeline, scope, response.

Specific facts:
- "January 31, 2022" - specific date
- "Aurora acquisition" - named system/context (this is firm-specific but not a QV-eligible hard fact like a named third-party firm or tool)
- "first half of 2024" - approximate date
- "outside cybersecurity forensics firm" - unnamed, doesn't count

- Only the January 31, 2022 date qualifies as a hard verifiable fact, so this falls into the Firm-Specific category with a score of 3.

fact: January 31, 2022

fact: Aurora acquisition systems


reasoning: The paragraph describes the company's incident response escalation process — how incidents are routed to management and the Audit Committee. This is about the function/process, not about any person's credentials or background. CFO is generic C-suite (NOT list), Audit Committee is generic governance (NOT list), 'legal department' and 'incident response policy' are generic — no IS-list facts remain.

thinking:
Let me analyze this paragraph.

Content: Describes incident response escalation policy - incidents go to CFO and legal, CFO works with IR team, policy includes reporting to Audit Committee.

Category: This is about the incident response process/policy - how incidents are escalated and managed. The CFO is mentioned but CFO is on the NOT list (generic C-suite). The paragraph describes internal processes. → Risk Management Process

Person-vs-function test: The paragraph describes what the policy does (escalation, remediation, reporting), not who the person is. → Risk Management Process

Specificity:

Looking at the entities mentioned, I'm seeing generic titles and functions rather than specific details. The CFO, legal department, and Audit Committee are all standard governance elements, and the incident response policy itself is a common program name without any distinctive characteristics or frameworks referenced. This falls into generic boilerplate.


reasoning: The paragraph describes the company's internal cybersecurity risk identification and assessment processes — monitoring, automated tools, audits, vulnerability assessments — with third-party vendors mentioned as components of the internal program (not as the central topic of vendor oversight). No named frameworks, no cybersecurity-specific titles from the IS list ('chief information consultant' is not CISO/CTO/CIO), no named firms, dates, or quantified facts; all methods listed are common practices on the NOT list.

thinking:
Let me analyze this paragraph.

Content: Describes the company's cybersecurity risk management approach - they retain a "chief information consultant" and a "third-party security management vendor" to identify, assess, and manage threats. Then describes methods used (automated tools, subscription services, threat reports, audits, assessments).

Category: This is about the company's internal processes for managing cybersecurity risk. The third-party vendor is mentioned as a component of their internal program, not as vendor oversight. → Risk Management Process

Specificity: Let me check the facts:
- "chief information consultant" - this is not a standard cybersecurity-specific title from the IS list (CISO, CTO, CIO, etc.). It's more of a generic consultant reference.

- The third-party vendor remains unnamed, and the methods they describe—automated tools, subscription services, audits, assessments—are all standard industry practices without any specific frameworks, named firms, dates, or metrics attached. This reads as generic boilerplate language rather than substantive detail.


reasoning: The board of directors is the grammatical subject throughout, describing its oversight of cybersecurity risk management and receipt of reports from management. All details are generic: unnamed 'cybersecurity advisors,' generic 'management team,' and vague cadences ('at least quarterly,' 'at least twice per year') — none of which appear on the IS list.

thinking:
Let me analyze this paragraph.

Content: Board of directors oversight of cybersecurity risk management, receiving reports from management, quarterly cadence plus additional trainings twice per year.

Category: Board Governance - the board is the grammatical subject throughout, describing their oversight role.

Specificity: Let me check the facts:
- "board of directors" - generic governance, NOT list
- "cybersecurity advisors" - unnamed entities, NOT list
- "management team" - generic, NOT list
- "at least quarterly" - generic cadence, NOT list
- "at least twice per year" - generic cadence, NOT list

No named frameworks, no IS-list facts.

This is generic boilerplate language without specific details or named entities.


reasoning: The paragraph's primary content is about the CIO as a person — their years of experience, tenure at the company, and professional certifications. While the latter portion describes team structure and reporting processes, the dominant communicative purpose is establishing the CIO's qualifications and credentials. Multiple QV-eligible hard facts: 19 years experience, 11 years tenure, SANS GISL certification, and CISA certification.

thinking:
Let me analyze this paragraph.

Content: About the CIO's qualifications (19 years experience, 11 with company, SANS GISF and CISA certifications), their responsibility, and the team structure. Then mentions processes like escalation, monthly scorecards, quarterly dashboards.

Category: The paragraph is primarily about the CIO as a person - their experience, tenure, certifications. There's also process description at the end. Applying the person-vs-function test: the first half is clearly about the person (credentials, experience, tenure). The second half describes what the team does. The dominant content is about the person's qualifications.

Now I'm checking the specificity level. The CIO role is cybersecurity-focused, which qualifies for the IS list. I've got four concrete, verifiable facts here: 19 years of total experience, 11 years tenure with the company, plus two named certifications (SANS GISF and CISA). That puts this squarely in the Quantified-Verifiable category.

fact: CIO has primary responsibility for information security program

fact: 19 years of experience in technology risk management

fact: 11 years with the Company (or its affiliates)

fact: SANS Global Information Security Leader certification

fact: Certified Information Systems Auditor (CISA) certification


reasoning: The paragraph is framed around the Board's oversight of cybersecurity risk management, supported by the Audit Committee. While the CIO and Head of Information Security are mentioned, they appear in the context of how they support board-level oversight (meeting with the Audit Committee quarterly), making the Board the primary actor and frame. The CIO and HIS are cybersecurity-specific titles on the IS list, elevating specificity to Firm-Specific, but no QV-eligible hard facts (dates, dollar amounts, named firms/tools) are present.

thinking:
Let me analyze this paragraph.

Content: Discusses board oversight (Audit Committee), mentions CIO and Head of Information Security roles, describes meeting cadence between management and board.

Category analysis:
- Board governance signals: "Board's oversight," "Audit Committee of the Board," "regularly reviews operational risks"
- Management signals: CIO, Head of Information Security, management team meetings
- The paragraph starts with the Board's oversight, then describes how CIO/HIS meet regularly, then how they meet with the Audit Committee quarterly.

The primary frame is about the Board's oversight structure and how it's supported.

The structure here is interesting—it opens with board oversight as the main subject, then layers in the management activities that feed into that oversight. The CIO and Head of Information Security are positioned as supporting players in the governance framework, meeting regularly among themselves before reporting to the Audit Committee. The paragraph essentially traces the flow from management-level risk review up through the board's oversight mechanism, making governance structure the central theme rather than the management roles themselves.

Looking at what makes this specific: the CIO and Head of Information Security are both cybersecurity-focused titles, which pushes this toward firm-specific territory. The Audit Committee is generic, and "quarterly" is just a standard cadence. There aren't any concrete details like dates, dollar amounts, headcounts, or named third-party vendors that would qualify this for QV treatment. So this lands as Firm-Specific.

fact: Chief Information Officer (CIO)

fact: Head of Information Security (HIS)


reasoning: The paragraph describes the company's internal incident reporting, escalation, and materiality determination processes — all functional process descriptions. CISO, CIO, CFO, Board, and Audit Committee appear as participants in the process, not as the paragraph's subject; removing them leaves a complete process description. The four-tier risk classification system and cybersecurity-specific roles (CISO, CIO) are firm-specific facts, but no QV-eligible hard facts (dates, dollar amounts, named firms/tools) appear.

thinking:
Let me analyze this paragraph from BGC Group's 10-K filing.

Content: Describes incident reporting/escalation process, four-tier risk system, recovery plans, notification steps, materiality determination process, and escalation procedures.

Category: This is primarily about the company's internal incident response and risk management processes. While it mentions CISO, CIO, CFO, Board, and Audit Committee, these are incidental to describing the process. The person-vs-function test: remove the titles and the paragraph still describes the process fully. → Risk Management Process

I'm identifying the specific facts here: CISO and CIO are cybersecurity-specific titles that appear on the IS list, while CFO and the Board are generic C-suite references. The "four-tier system" is a firm-specific detail about their risk classification. Since CISO and CIO are named roles without dates, dollar amounts, or other quantifiable metrics, they don't qualify as QV-eligible facts, making this content Firm-Specific.

fact: Four-tier risk identification system based on service, user, financial, and security impact

fact: CISO involved in materiality determination

fact: CIO involved in materiality determination


reasoning: The paragraph's grammatical subjects are management figures (Director of IT, CPO, CLO, CFO) describing their reporting lines and meeting participation related to cybersecurity oversight. Per Rule 2, management reporting TO the board makes management the primary actor → Management Role. However, all titles are generic: 'Director of Information Technology' is on the NOT list as generic IT leadership (not cybersecurity-specific), and CFO/CPO/CLO are generic C-suite. No named frameworks, dates, firms, or specific numbers appear, yielding Generic Boilerplate.

thinking:
Let me analyze this paragraph.

Content: Describes meetings between Director of IT and Chief People Officer, reporting to audit committee, and participation in audit committee meetings by various officers.

Category: This is about management roles and their interactions with the board. The paragraph describes reporting lines and meeting participation. The primary actors are management figures (Director of IT, CPO, CLO, CFO) reporting to the audit committee/board. It's a mix of management structure and board governance.

The dominant topic is the reporting structure - how management reports to the board. The audit committee is mentioned as receiving reports, but the grammatical subjects are mostly management figures. Let me re-read...

Actually, I'm seeing the pattern more clearly now. The Director of IT coordinates with the CPO on cybersecurity oversight, then reports periodically to the audit committee, while the CFO, CPO, and CLO all participate in both audit committee and board meetings. So this is fundamentally about how management interfaces with board-level governance through regular reporting and meeting participation.

Looking at the specificity question: "Director of Information Technology" is explicitly listed as generic IT leadership, not cybersecurity-specific. The other titles—Chief People Officer, Chief Legal Officer, Chief Financial Officer—are all generic C-suite roles. The audit committee itself is also generic governance language. None of these are specialized cybersecurity positions, so this doesn't meet the specificity threshold.

The content describes organizational structure and reporting lines for cybersecurity oversight, with management figures as the primary actors, which points toward Management Role. But combined with the generic titles and lack of specific facts, this reads as Generic Boilerplate.


reasoning: The paragraph is framed under the heading 'Impact of cybersecurity risks on business strategy, results of operations or financial condition' and its primary communicative purpose is discussing potential business and financial consequences of cyber risk — reputation damage, lost revenue, regulatory actions, litigation, and a concluding statement that disruptions 'could also have a material adverse impact on our results of operations, financial condition and cash flows.' This constitutes an assessment (albeit hypothetical and generic) of how cybersecurity risks could materially affect the business, fitting Strategy Integration per Rule 6. No specific facts from the IS list are present — all language is generic risk factor boilerplate applicable to any company.

thinking:
Let me analyze this paragraph.

This is a lengthy paragraph about cybersecurity risks. Let me check what it's actually saying:

- They rely on computer networks/systems
- They may face threats
- Security breaches could hurt reputation, cause data losses
- Could result in negative consequences including disruption, costs, lost revenue, regulatory actions, litigation
- Could have material adverse impact on results of operations, financial condition, cash flows

This is essentially risk factor language - describing potential negative consequences of cybersecurity risks. The heading says "Impact of cybersecurity risks on business strategy, results of operations or financial condition."

Does it contain a materiality assessment? The last sentence says "Any disruption of internal operations could also have a material adverse impact on our results of operations, financial condition and cash flows." This is hypothetical/forward-looking risk language, not an explicit materiality assessment like "have not materially affected." It's saying cybersecurity risks COULD have material adverse impact - this is generic risk factor language.

The heading mirrors SEC disclosure requirements, but the actual content is just standard risk language without a concrete materiality conclusion. This looks like it could fit Strategy Integration if there were an explicit assessment of impact, but since it's only speculating about potential consequences rather than evaluating actual effects, it's probably just generic risk disclosure. The SEC requirement about business impact means this paragraph qualifies as Strategy Integration, even though it's purely hypothetical language about potential consequences. The specific phrase about "material adverse impact" on operations and financial condition is the key indicator, regardless of how generic the rest of the disclosure is. Since there are no named entities, specific frameworks, or concrete facts—just generic references to third parties and data types—this falls squarely into Generic Boilerplate.


reasoning: The paragraph describes the company's internal cybersecurity risk management program — its legal basis, ERM integration, risk assessment cadence, and multi-layered reporting structure. While the Board and specific committees are mentioned, they appear as components of the overall risk management process rather than as the primary actors; the paragraph's communicative purpose is to explain how the program works. Multiple firm-specific facts exist (named committees, CISO/CIO roles, specific team compositions), but no hard verifiable facts (dates, dollar amounts, named third-party firms, tools) reach the two-fact QV threshold.

thinking:
Let me analyze this paragraph carefully.

Content: Describes the company's cybersecurity risk management program - ERM integration, risk assessments, reporting cadences, and committee structures.

Category: This is primarily about Risk Management Process - it describes the company's internal processes for managing cybersecurity risk, including ERM integration, risk assessments, and reporting structures. While it mentions the Board and names committees, the primary focus is on the internal risk management program and processes.

Wait - let me reconsider. The paragraph describes:
1. Program basis (legal/regulatory)

2. ERM integration
3. Quarterly review by cross-functional team
4. Regular reporting to Board
5. Quarterly reporting to Enterprise Risk Committee (with named members)
6. Monthly Security Steering Committee meetings

This is about the process/program structure. The Board mention is one component. The named committees and roles are part of describing how the program works. So the category is Risk Management Process - the paragraph describes the company's internal cybersecurity risk management program, its integration with ERM, and the various reporting and review mechanisms that support it. The specific named committees (Enterprise Risk Committee, Security Steering Committee) and roles (CIO, CISO) are all part of how this program is structured and executed.

Now I'm looking at the team compositions across these committees—cybersecurity, ERM, IT, internal audit, and legal—and the specific membership of the Enterprise Risk Committee. These are firm-specific details about how the governance structure is staffed, which reinforces that this is a documented, named program rather than generic risk management language.

fact: Enterprise Risk Committee

fact: Security Steering Committee

fact: CIO

fact: Enterprise Risk Committee composition: CEO, CFO, SVP Legal, General Counsel & Secretary, Internal Audit, CIO and CISO

fact: Security Steering Committee composition: cybersecurity, ERM, IT, internal audit and legal teams


reasoning: The paragraph establishes the cybersecurity sub-committee as the responsible management body and devotes significant text to their qualifications ('combined 45 years of experience,' 'wealth of expertise,' 'in-depth knowledge'). While the latter half describes functions (oversees strategies, tests compliance, remediates risks, leads training), the primary communicative purpose is identifying who holds responsibility and establishing their credentials — a Management Role focus. Specificity is Firm-Specific: the named 'cybersecurity sub-committee' is a non-generic committee (IS-list item), and '45 years' is one QV-eligible quantified fact, but only one hard verifiable fact prevents reaching Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes a "cybersecurity sub-committee" - their experience, expertise, and what they do (oversee strategies, test compliance, remediate risks, lead training).

Category: This is about a management-level body. The "cybersecurity sub-committee" is described in terms of both who they are (experience) and what they do (processes). Let me apply the person-vs-function test.

The paragraph has:
- Combined 45 years of experience (about the people)

- "wealth of expertise" and "in-depth knowledge" (about the people)
- Oversees strategies, tests compliance, remediates risks, leads training (about the function)

It's roughly split between the people's qualifications and their responsibilities. The primary framing centers on the sub-committee as a management body with "Primary responsibility... rests with the cybersecurity sub-committee." Their credentials are highlighted to establish credibility. If I strip away the qualifications, what remains is just the functions they perform - but the paragraph emphasizes who they are first. I'd categorize this as Management Role, since it establishes accountability and validates it through credentials.

The "cybersecurity sub-committee" is a named, firm-specific committee, not generic. The "combined 45 years of experience" is a quantified fact. That's one QV-eligible data point. The named committee itself is firm-specific but doesn't qualify as QV-eligible on its own.

fact: cybersecurity sub-committee

fact: combined 45 years of experience in cybersecurity


reasoning: The paragraph touches on data collection, board oversight, and risk management, but the dominant content describes the company's risk management process (identify, prioritize, monitor, mitigate risks) with board oversight mentioned only briefly in one sentence. All language is entirely generic — no named frameworks, no cybersecurity-specific roles, no firm-specific details — making it Generic Boilerplate.

thinking:
Let me analyze this paragraph.

The paragraph covers general business data collection, acknowledges cyber risks, mentions board oversight briefly, and describes risk management process in generic terms.

Dominant category: This spans multiple topics. Let me assess:
- "Our Board is responsible for overseeing risk management" - Board Governance (one sentence)
- "Cybersecurity is an integral part of the Company's overall risk management program. Our risk management process is designed to identify, prioritize, and monitor risks..." - Risk Management Process

The bulk is about the risk management process. The board mention is brief. By Rule 1 (dominant category), this is Risk Management Process.

Everything here is boilerplate language with no specific frameworks, named committees, or concrete details—just generic statements about the board and risk management without any substantive commitments or named structures.


reasoning: This paragraph describes generic cybersecurity risk consequences (disruption, reputation harm, litigation, regulatory exposure) without any substantive disclosure of processes, governance, incidents, or strategy. It is general risk language that could appear in any company's filing, similar to Case 9 in the codebook — acknowledging risks exist without describing any program, making any materiality assessment, or providing company-specific detail.


reasoning: The paragraph describes the company's internal cybersecurity processes, controls, and technologies as part of its ERM framework — squarely Risk Management Process. The person-vs-function test is not triggered since no individual roles are the focus. For specificity, enrollment in US CISA data hygiene service and FBI InfraGard are two named external organizations providing specific services, meeting the two-hard-fact threshold for Quantified-Verifiable.

thinking:
Let me analyze this paragraph from Vertex Energy Inc.'s 10-K filing.

Content: Describes the company's cybersecurity processes - risk identification, assessment, monitoring, ERM integration, and lists specific security measures including endpoint protection, firewall technology, monitoring, intrusion detection, and enrollment in specific threat intelligence services.

Category: This is clearly about the company's internal cybersecurity processes, tools, and methodologies. → Risk Management Process

Specific facts:
- "Oil and Gas ("O&G") threat intelligence service" - named program/service

- US CISA data hygiene service and FBI InfraGard are both named external organizations providing threat intelligence and security services. These count as QV-eligible facts since they're specific third-party programs the company enrolls in.
- The O&G threat intelligence service is less concrete since it's sector-specific but not a named firm.
- So I'm counting CISA and FBI InfraGard as two quantified-verifiable facts about external security partnerships.

fact: Enrolled in US Cybersecurity & Infrastructure Security Agency (US CISA) data hygiene service

fact: Enrolled in FBI InfraGard threat intelligence

fact: Enrolled in Oil and Gas (O&G) threat intelligence service


reasoning: The paragraph describes the company's own internal cybersecurity processes and controls (encryption, access controls, DR/BC, incident detection, MFA, annual training). All items listed are common practices that could appear in any company's filing; no named frameworks, tools, firms, roles, dates, or quantified facts are present.

thinking:
Let me classify this paragraph.

Content: Describes internal cybersecurity processes - encryption, access controls, DR/BC, incident detection, antivirus, MFA, employee training. This is about the company's own internal processes.

Category: Risk Management Process

Specificity: No named frameworks, no named tools, no specific dates, no named roles. Just common practices listed. Annual training cadence is generic. → Generic Boilerplate


reasoning: The paragraph identifies the specific management roles (CIO, VP IT, Manager of Security) responsible for cybersecurity and describes their collective qualifications (over 50 years of experience). This is about the people and their credentials, not about processes or tools, satisfying the person-vs-function test for Management Role. Multiple cybersecurity-specific roles qualify as IS facts for Firm-Specific, but only one QV-eligible fact (the 50 years figure) prevents reaching Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes management roles (CIO, VP IT, Manager of Security) and their collective experience. This is about the people - their titles and experience.

Category: Management Role - the paragraph identifies specific cybersecurity leadership positions and their qualifications (collective experience).

The first sentence is generic ("Management is responsible for day-to-day assessment..."). The second sentence names specific roles: CIO, VP Information Technology, Manager of Security. The third sentence describes their collective experience: "over 50 years."

Person-vs-function test: The paragraph is about WHO leads the cybersecurity effort and their qualifications. Remove the titles and experience, and there's not much left about processes.

Now I'm checking which elements qualify as quantifiable values. The "over 50 years" of collective experience is a specific number that would be QV-eligible, while the role titles themselves (CIO, VP Information Technology, Manager of Security) are named positions from the IS list but don't contain quantifiable metrics on their own.

fact: VP Information Technology

fact: Manager of Security

fact: collectively over 50 years of work experience


reasoning: The Audit Committee is the primary subject overseeing cybersecurity risk, and the CTO's reporting relationship is framed in the context of board-level oversight, making this Board Governance. The CTO is a cybersecurity-specific title on the IS list, providing one firm-specific fact, but no second QV-eligible hard fact exists (Audit Committee is generic, 'at least annually' is a generic cadence).

thinking:
Let me analyze this paragraph.

Content: The Audit Committee oversees cybersecurity risks. The CTO reports to the Audit Committee. The CTO escalates incidents.

Category: The Audit Committee is the grammatical subject of the first sentence. The CTO reports TO the Audit Committee. This is about board-level oversight. The CTO is mentioned but in the context of reporting to the board committee. Per Rule 2: "Board delegates responsibility to management → Board Governance" and "Board/committee is the grammatical subject → Board Governance". The primary frame is the Audit Committee's oversight role. → Board Governance

The CTO is a cybersecurity-specific title that appears in the IS list, making this firm-specific. There are no hard verifiable facts like dates or dollar amounts, so it doesn't qualify as QV. → Firm-Specific (3)

fact: CTO reports to the Audit Committee on cybersecurity


reasoning: The paragraph's dominant content is about the ISO as a person — their 25+ years of experience and extensive list of named certifications. The final sentence about tabletop exercises is subordinate. Per the person-vs-function test, the paragraph is primarily about who the person is and what qualifies them. Multiple QV-eligible hard facts: specific years of experience plus multiple named industry certifications (CEH, CompTIA Security+, CCNA, etc.).

thinking:
Let me analyze this paragraph.

The paragraph has three parts:
1. "The ISO leads program development, implementation, and reporting to the Board." - ISO (Information Security Officer) role and responsibilities
2. The ISO's qualifications - 25 years experience, many named certifications
3. Company conducts simulations and tabletop exercises

The dominant content is about the ISO as a person - their experience and certifications. That's Management Role per the person-vs-function test.

Specific facts:
- ISO (Information Security Officer) - cybersecurity-specific role → IS list
- "over 25 years" - specific number of years → QV-eligible

- Named certifications like MCSE+Security, CEH, CompTIA Security+, Pentest+, CySA+, CCNA+Security, CCDA → QV-eligible

With the quantified years of experience plus multiple named certifications, this clearly qualifies as Quantified-Verifiable with at least two hard verifiable facts.

fact: ISO (Information Security Officer)

fact: over 25 years of experience

fact: Microsoft Certified Software Engineer + Security

fact: CompTIA Security+, Pentest+, CySA+

fact: Cisco Certified Network Admin + Security, Cisco Certified Design Architect

fact: Certified Ethical Hacker (CEH)


reasoning: The paragraph identifies the management committee (DPIRC) overseeing cybersecurity, its composition (co-chaired by CCO and CIO, with named departments), and dedicates significant text to the CIO's qualifications — appointment year and years of experience. The primary communicative purpose is about WHO manages cybersecurity (the people and committee structure), not WHAT processes they run, satisfying the person-vs-function test for Management Role. Two QV-eligible hard facts (appointed 2017 + over 20 years of experience) reach the Quantified-Verifiable threshold.

thinking:
Let me analyze this paragraph carefully.

Content category: This paragraph covers multiple topics. Let me break it down:
- Opening sentence: general statement about cyber being part of ERM
- DPIRC committee oversight
- DPIRC composition (co-chaired by CCO and CIO, members from specific departments)
- Vista CIO's experience and background

The paragraph describes both a committee (DPIRC) and management credentials (CIO). The DPIRC is a named non-generic committee. The primary actors are management-level (CIO, CCO, the DPIRC committee).

Now I'm applying the person-versus-function test to distinguish what's really being described here. The final sentences focus on the CIO as an individual—their background and tenure. The middle section lays out the DPIRC's structure and who sits on it. The core content is really about the people and committee managing cybersecurity rather than the actual processes they oversee. Since the DPIRC is chaired by management-level executives like the CCO and CIO, this is fundamentally about Management Role.

Looking at the specificity, I can identify several concrete details: the committee has a specific name, the CIO title is cybersecurity-specific, the departments involved are named, and there are quantifiable facts like the 2017 appointment date and over 20 years of experience. Those last two details would qualify as QV-eligible specifics.

fact: Data Privacy and Information Risk Committee (DPIRC)

fact: CIO (Vista CIO)

fact: Information Security, Legal, and Human Resources departments

fact: Appointed in 2017

fact: Over 20 years of cybersecurity experience


reasoning: This paragraph is entirely forward-looking, describing what the company 'will focus on' in the coming fiscal year. It lists generic aspirational goals (enhancing threat detection, conducting tabletop exercises, staying abreast of threats, collaborating with partners) but discloses nothing about the company's current cybersecurity program, governance, or incidents. While it touches on risk management topics, the forward-looking framing and lack of any substantive current-state disclosure pushes it toward None/Other. No specific facts, named frameworks, or firm-specific details are present.

thinking: Forward-looking statements about future plans, no substantive disclosure of current processes.


reasoning: The paragraph describes the company's internal incident response escalation process — how a cross-functional committee reviews incidents and determines whether to escalate to the Audit Committee or Board. The primary communicative purpose is the process workflow (assess → escalate → report), not board oversight itself; the Board/Audit Committee appear only as escalation targets, not as primary actors. The named departmental composition (IT, Finance, Legal) is a firm-specific fact per the IS list, yielding Firm-Specific specificity, but there are no QV-eligible hard facts (no dates, dollar amounts, named firms, or tools).

thinking:
Let me analyze this paragraph.

Content: Describes incident response escalation process involving cross-functional committee (IT, Finance, Legal), with escalation to Audit Committee/Board for material incidents.

Category: This describes an internal process for handling cybersecurity events - the escalation workflow. The Board/Audit Committee is mentioned but only as the escalation target, not as the primary actor. The paragraph is about the process of review, assessment, escalation, and reporting. The primary subject is "a cross-functional steering committee" and the process flow. → Risk Management Process

Wait, let me reconsider. The second sentence has the Audit Committee and Board as subjects receiving escalation.

But the dominant content is the process description - how incidents get assessed and escalated. The first sentence covers the committee's process while the second describes escalation to governance bodies, but the overall purpose is explaining the incident response workflow. → Risk Management Process

Specificity: The cross-functional steering committee with IT, Finance, and Legal departments is a firm-specific detail, while Audit Committee and Board are generic governance references. So I have one IS fact here: the specific departmental composition. That's Firm-Specific (3).

Now I'm checking which facts are V-eligible - looking for anything without dates, dollar amounts, headcounts, named firms, tools, or certifications.

fact: Cross-functional steering committee involving IT, Finance, and Legal departments


reasoning: Applying the person-vs-function test: the paragraph names SVP of Finance and Director of IT as attribution, but the substantive content describes processes — monitoring threats, conducting scans, evaluating threats, completing audits, and third-party assessments. Remove the titles and the paragraph still functions as a process description. Neither 'SVP of Finance' (generic C-suite) nor 'Director of Information Technology' (generic IT leadership per the NOT list) qualifies as a cybersecurity-specific title on the IS list. No named frameworks, tools, firms, dates, or numbers appear, leaving no specific facts after validation.

thinking:
Let me analyze this paragraph.

The paragraph mentions SVP of Finance and Director of IT as subjects, then describes what they do - which is primarily about processes (monitoring, evaluating, scanning, audits, assessments).

Person-vs-function test: Remove the titles and the paragraph still describes processes. The content is about risk identification methods, tools, scans, audits, assessments. The roles are attribution.

But wait - "Director of Information Technology" - is this a cybersecurity-specific title? The IS list includes "Director of IT Security" but not generic "Director of IT".

Looking at the titles more carefully, "Director of Information Technology" appears on the NOT list as "Director of IT" - that's generic IT leadership, not security-specific. And "SVP of Finance" is clearly generic C-suite. The paragraph itself focuses on processes like monitoring, evaluating threats, scanning, and third-party assessments - these are risk management activities, not role-specific content. With no named frameworks, tools, specific dates, or numbers, this reads as generic boilerplate. → Risk Management Process, Generic Boilerplate


reasoning: The paragraph describes the company's overall cybersecurity program structure — monitoring, the GIS team, the Enterprise Security Council's composition and function, controls evaluation, and ERM integration. While CISO credentials and the CEO's DoD background are mentioned, the primary communicative purpose is how the company organizes and executes its cybersecurity risk management. Removing the personal credentials, the paragraph still functions as a process description. Two QV-eligible hard facts: 'more than twenty years' of experience (specific number) and '2018 Department of Defense Cyber Strategy' (specific date/named document).

thinking:
Let me analyze this paragraph carefully.

Content Category: This is a complex paragraph. Let me apply the person-vs-function test.

The paragraph covers:
1. Monitoring cybersecurity landscape (process)
2. GIS team has day-to-day responsibility (process/team)
3. Led by CISO with 20+ years experience (person)
4. CISO collaborates, participates in audits, industry groups (function)
5. Enterprise Security Council composition (team/structure)
6. Risks escalated to Enterprise Risk Council chaired by President/CEO with Deputy Secretary of Defense background (person/structure)

7. Controls implementation and evaluation (process)

This paragraph is fundamentally about organizational structure and processes—the GIS team's responsibilities, how the CISO functions within the program, the council compositions, and how controls are managed. While there are person-specific details like the CISO's 20+ years of experience and the CEO's Deputy Secretary of Defense background, these are secondary to describing the overall governance framework and risk management processes. Even without those biographical details, the core content about team roles, escalation paths, and control evaluation remains intact. The Enterprise Risk Council includes the CEO, who has a specific background as Deputy Secretary of Defense during the 2018 DoD Cyber Strategy development. Looking at the specificity here, I've got concrete facts: the GIS team name, the CISO title with over twenty years of experience, named committees with specific compositions, and that notable credential. This paragraph is fundamentally about the risk management structure and how the program operates, with the management credentials serving as supporting detail rather than the main point. I'm narrowing down what counts as a genuine QV fact here. The "more than twenty years of experience" is clearly eligible, but I'm second-guessing whether the 2018 DoD Cyber Strategy reference stands on its own as a separate QV fact or if it's just background context about the CEO. The Deputy Secretary role with that specific date might be verifiable, but I need to be stricter about what qualifies as independent QV evidence rather than biographical detail.

fact: Global Information Security (GIS) team

fact: CISO

fact: more than twenty years of audit and cybersecurity experience

fact: Enterprise Security Council comprised of GIS, Information Technology, Legal, Compliance, Internal Audit, and Enterprise Risk Management

fact: Enterprise Risk Council

fact: Deputy Secretary of Defense during the development of the 2018 Department of Defense Cyber Strategy


reasoning: The paragraph describes the company's internal cybersecurity processes — risk assessment, monitoring, vulnerability testing, and various security capabilities (MDR, SIEM, EDR, etc.). These are all generic security practice categories, not named products/tools or recognized frameworks. No firm-specific facts (no named roles, dates, vendors, tools, or quantified details) appear, so this is Generic Boilerplate.

thinking:
Let me analyze this paragraph from Cano Health's 10-K Item 1C filing.

Content: Describes the company's internal cybersecurity processes - risk assessment, monitoring, vulnerability testing, and lists various security tools/capabilities (MDR, SIEM, vulnerability management, etc.).

Category: Risk Management Process - clearly about internal processes and security capabilities.

Specificity: The paragraph lists many security practices (MDR, SIEM, EDR, etc.) but these are all common/generic security practices, not named products or tools. No named frameworks (NIST, ISO), no named roles (CISO), no specific dates, no named vendors/products.

These are just generic security capability categories without any hard verifiable facts, specific standards, or named tools - this is boilerplate language.


reasoning: The Board and its Committee are the grammatical subjects throughout — the Committee reports to the Board, the Board receives briefings, Board members receive presentations. This is squarely about board-level oversight activities. The mention of the CIO (a cybersecurity-specific title on the IS list) provides one firm-specific fact, but no second QV-eligible hard fact exists ("external experts" is generic, cadences are unspecified).

thinking:
Let me analyze this paragraph from Tilly's Inc. SEC filing.

The paragraph is about Board oversight - the Committee reports to the Board, the Board receives briefings, Board members receive presentations. The grammatical subject throughout is the Committee/Board.

Content category: Board Governance - the Board and Committee are the primary subjects receiving briefings and reports.

Specific facts:
- CIO mentioned - that's a cybersecurity-specific title per the IS list
- "external experts" - generic, NOT list
- "Audit Committee" isn't mentioned, just "the Committee" - generic

- "full Board" and "management" are also generic references

Since only the CIO qualifies as a firm-specific element from the IS list, this rates as Firm-Specific (3), not QV.

fact: Chief Information Officer


reasoning: The paragraph describes the company's internal risk assessment methodology and how it selects security controls, which is squarely Risk Management Process. It names the CIS Critical Security Controls framework (a recognized standard), elevating it to Sector-Adapted, but the remaining content — likelihood/severity analysis, feasibility/cost considerations — is generic risk assessment language with no firm-specific facts.

thinking:
Let me classify this paragraph.

Content: Describes risk assessment methodology using CIS Controls framework, risk-based analysis for selecting security controls, considering factors like likelihood, severity, impact, feasibility, cost.

Category: Risk Management Process - describes internal risk assessment processes, framework adoption, methodology.

Specificity: Names "Center for Internet Security Critical Security Controls" (CIS Controls) - a recognized framework → at least Sector-Adapted. Any firm-specific facts? The rest is generic description of risk assessment factors. No firm-specific facts beyond the named framework.

So this lands at Sector-Adapted level.

fact: Center for Internet Security Critical Security Controls (CIS)


reasoning: The paragraph describes the company's internal cybersecurity program assessment methodology, framework alignment (NIST), and evaluation process. The third-party firm is unnamed, the Audit Committee is generic, and 'bi-annual' is a generic cadence—leaving only the named NIST Framework as a specific element, which triggers Sector-Adapted but not Firm-Specific.

thinking:
Let me analyze this paragraph.

Content: Describes the cybersecurity program's basis, third-party assessment against NIST Framework, and reporting to Audit Committee.

Category: The paragraph describes the company's internal cybersecurity processes - program basis, assessment methodology, framework alignment, evaluation scope. The third-party firm is engaged to assess the company (serves the company), and the Audit Committee mention is brief. Primary topic is the risk management process.

→ Risk Management Process

Specificity: Let me check facts:
- "NIST Framework" - named standard → Sector-Adapted

- "third-party firm" - unnamed → NOT list
- "Audit Committee" - generic → NOT list
- "bi-annual basis" - generic cadence → NOT list

No IS-list facts beyond the named framework. No firm-specific facts after filtering.

→ Sector-Adapted

fact: NIST Framework


reasoning: The paragraph describes the company's internal incident response structure, monitoring processes, and how multidisciplinary teams are deployed to address threats — all function-oriented content. The EVP of IT is mentioned repeatedly but as attribution for who runs the process; the substantive content is about what the IRT and cybersecurity plan do (implement programs, monitor, detect, mitigate, respond). Applying the person-vs-function test: removing the role titles, the paragraph still describes an incident response program. Specificity is Firm-Specific due to the named 'Cyber Incident Response Team (IRT)' with a unique abbreviation and the specific team composition, but no two QV-eligible hard facts (no dates, dollar amounts, named third-party firms, or named tools).

thinking:
Let me analyze this paragraph.

Content: Describes the Cyber Incident Response Team (IRT), its composition, how the EVP of IT coordinates with the IRT, and the cybersecurity plan's processes for monitoring and responding to threats.

Category: This is about the company's internal cybersecurity processes - the IRT structure, incident response planning, monitoring, detection, mitigation. The EVP of IT is mentioned but as attribution for who runs the process. The paragraph is about the function (what the program does), not the person. → Risk Management Process

Specific facts:
- "Cyber Incident Response Team (the 'IRT')" — named internal program with unique identifier ✓ IS

- "Executive Vice President of Information Technology" maps to VP of IT, which is on the IS list ✓ IS
- "CFO", "COO", "CLO" are generic C-suite titles, not IS-specific
- "Cybersecurity Plan" lacks a unique identifier beyond capitalization, so it reads as generic
- The team composition includes specific roles but I need to evaluate whether they're named programs or just functional descriptions

Looking at what qualifies: the Cyber Incident Response Team (IRT) is a named program with a unique abbreviation, and the EVP of IT is a cybersecurity-specific title. The team composition itself—listing those executive roles—is specific to this firm. For QV purposes, named roles and team compositions don't count as hard verifiable facts without dates, dollar amounts, headcounts, or third-party references. But I have at least one IS fact, so this lands as Firm-Specific (3).

fact: Cyber Incident Response Team (the 'IRT') — named internal program with unique identifier

fact: Executive Vice President of Information Technology — cybersecurity-specific leadership title (maps to VP of IT)

fact: IRT composition includes EVP of IT, CFO, COO, CLO — specific team/department composition