reasoning: The paragraph opens with an explicit materiality assessment ('we do not believe that any past cybersecurity incidents have had, or are reasonably likely to have, a material adverse effect'), which per Rule 6 makes this Strategy Integration regardless of the appended cross-reference to Risk Factors. The 'February 28, 2024' date is the filing date (not a cybersecurity-specific fact), 'MPC' is a parent company self-reference, and the remaining language is boilerplate materiality and risk disclaimer — no IS-list facts remain after filtering.

thinking: Materiality assessment paragraph with cross-reference.


content_category: Risk Management Process

category_confidence: high

specificity_confidence: high

reasoning: The paragraph describes the company's cybersecurity programs, frameworks (NIST CSF, ISA/IEC 62443), areas of responsibility, testing practices, and ERM integration. The CISO is mentioned as attribution ('The CISO and Team manage...') but the substantive content is entirely about what the programs do — applying the person-vs-function test, removing the CISO reference leaves a complete process description. The CISO title (a cybersecurity-specific role on the IS list) elevates this beyond Sector-Adapted to Firm-Specific, but there are not two QV-eligible hard facts (no dates, dollar amounts, headcounts, named third-party firms, or named tools).

provider: anthropic

generationId: agent-sdk

stage: benchmark

thinking:
Let me analyze this paragraph from Xylem Inc.'s 10-K filing.

Content: Describes the CISO and Team managing cybersecurity programs, frameworks used (NIST CSF, ISA/IEC 62443), key areas of responsibility, risk management processes, testing, third-party assessments, and ERM integration.

Person-vs-function test: The CISO is mentioned as attribution ("The CISO and Team manage..."), but the entire paragraph is about what the program does - frameworks, areas of responsibility, processes, tools, testing, ERM integration. Remove "The CISO and Team" and replace with "The Company" and it still makes complete sense. → Risk Management Process.

Now I'm checking what qualifies as QV-eligible specificity. The paragraph names two frameworks—NIST CSF and ISA/IEC 62443—which are sector-adapted standards, and mentions the CISO as a cybersecurity-specific role. The "Enterprise Risk Management Program" is referenced with its abbreviation, but it's still a fairly generic program name without distinctive details. There are no specific dates, dollar amounts, headcounts, named third-party firms, products, certifications, or years of experience that would push this into QV territory.

So the classification comes down to the CISO title being firm-specific and ISA/IEC 62443 being a named sector-adapted standard, which puts this at Firm-Specific level 3.

fact: CISO

fact: NIST Cybersecurity Framework

type: framework

fact: ISA/IEC 62443 standard


reasoning: The paragraph describes Deutsche Bank Group's internal cybersecurity controls and practices (threat intelligence, network security, IAM, DLP, encryption, detection, incident response, information sharing) — all process descriptions. No named frameworks, no specific dates, no named tools or firms, no quantified facts; the listed practices are all common/generic security measures that could apply to any large financial institution.

thinking:
Let me analyze this paragraph from RREEF Property Trust's 10-K filing.

This describes Deutsche Bank Group's cybersecurity prevention methods, controls, and practices. RREEF Property Trust is a subsidiary/related entity of Deutsche Bank, so this is describing the parent group's cybersecurity processes.

Content: Lists prevention methods (threat intelligence, network security, IAM, DLP, cyber hygiene, encryption), detection emphasis, incident response, and information sharing with external organizations.

Category: This is about internal cybersecurity processes - Risk Management Process. It describes what the organization does for cybersecurity. No vendor oversight as central topic, no board/management focus, no incident, no materiality assessment.

Now I'm checking for specific facts that would make this substantive disclosure. The text references Deutsche Bank Group as the parent company, lists common cybersecurity practices like threat intelligence and encryption, and mentions unnamed external organizations for information sharing. There are no named frameworks, specific dates, tools, or metrics—just generic descriptions of standard industry practices. This is boilerplate language.


content_category: Incident Disclosure

specificity_confidence: medium

reasoning: The paragraph describes what happened during an actual cybersecurity incident — disruptions, systems taken offline, containment, and restoration. It is squarely Incident Disclosure. It contains one approximate but specific duration ('within a week of detection'), which is a firm-specific fact, but no second hard verifiable fact (no exact dates, named firms, or tools), so it stays at Firm-Specific rather than Quantified-Verifiable.

thinking: Classify this paragraph about a cybersecurity incident.

fact: systems restored within a week of detection

type: quantified


reasoning: The paragraph describes the company's internal cybersecurity safeguards (firewalls, intrusion prevention/detection, anti-malware) and mentions external service providers as one component of the program. These are all generic security practices with no named frameworks, tools, firms, dates, or other specific facts.

thinking:
Classify this paragraph.

Content: describes internal cybersecurity safeguards - firewalls, intrusion prevention/detection, anti-malware, use of external service providers to assess/test security.

Category: Risk Management Process - describes internal security controls and tools. The external service providers are mentioned as one component of internal processes.

Specificity: No named frameworks, no named tools/products, no specific roles, no dates, no numbers. "Firewalls, intrusion prevention and detection systems, anti-malware" are common practices. "External service providers" is unnamed. → Generic Boilerplate.


reasoning: The paragraph describes MPC's cybersecurity processes: external assessments, threat intelligence monitoring, communication with federal agencies and trade associations, and how gathered information informs cybersecurity investments and strategies. Although CDO and CISO titles are named, they appear as incidental attribution within a description of what the program does (the person-vs-function test favors Risk Management Process). The two cybersecurity-specific roles (CDO overseeing cyber, CISO) are firm-specific facts, but no QV-eligible hard facts (dates, dollar amounts, named firms/tools) are present.

thinking:
Let me analyze this paragraph carefully.

Content: Describes MPC's engagement with external resources for cybersecurity evaluation, monitoring of threat intelligence, and how MPLX GP's management team consults with specific roles (CDO, CISO) and the Audit Committee to inform cybersecurity investments and strategies.

Category analysis:
- The paragraph describes internal cybersecurity processes: external assessments, threat intelligence monitoring, communication with federal agencies/trade associations
- It mentions specific roles (CDO, CISO) but as part of describing how the program works
- The person-vs-function test: the paragraph is about what the program does (monitors threats, engages external resources, informs strategies), not about who the people are

- This falls under Risk Management Process

Now I'm checking the specificity of the roles mentioned. The CDO and CISO titles are cybersecurity-specific positions that appear on the IS list, making them firm-specific facts. The Audit Committee reference is generic and doesn't qualify. There are no quantifiable metrics like dates, amounts, or headcounts that would elevate this to QV-eligible status, so this categorizes as Firm-Specific.

fact: Senior Vice President and Chief Digital Officer (CDO)

fact: Vice President and Chief Information Security Officer (CISO)


content_category: Management Role

reasoning: The paragraph primarily describes the Cybersecurity Committee's composition (who is on it — four named roles) and members' qualifications and experience areas. This is about the people filling management cybersecurity roles, not about processes or tools. The Cybersecurity Committee is a named non-generic committee and CIO is a cybersecurity-specific title, both triggering Firm-Specific. Only one QV-eligible hard fact (headcount of 4), so it does not reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes the Cybersecurity Committee composition (4 members with named roles), its function (prioritizing programs, oversight, guidance), and members' qualifications.

Category: This is about a management-level committee. The Cybersecurity Committee is not a board committee - it consists of CIO, CFO, Director of Internal Audit, Director of IT. It "assists" the Executive Leadership Team and Board. This is a management committee responsible for cybersecurity. The paragraph describes who the members are and their qualifications. This is Management Role - it's about the people (their roles, composition, experience/qualifications).

Actually, I need to reconsider what's really being emphasized here. The core content is the committee's specific composition—four named roles including the CIO, CFO, Director of Internal Audit, and Director of IT—along with their qualifications and experience. While the paragraph does mention what the committee does, the substantial focus is on who sits on it and what they bring to the table, which makes this clearly a Management Role category.

Looking at the specificity markers: "Cybersecurity Committee" is a named committee, the CIO and Director of IT, Infrastructure and Flight Systems are cybersecurity-specific titles, and the four-member composition is explicitly quantified. The CFO and Director of Internal Audit are more generic roles, but the overall team composition is specific enough to qualify.

For the quantified value check, I only have one QV-eligible fact—the headcount of four members. The specific roles themselves aren't quantified, and there are no named firms, certifications, dates, or dollar amounts mentioned. So this would be a Firm-level classification based on that single quantified element.

fact: Cybersecurity Committee (named non-generic committee)

fact: four (4) members

fact: Chief Information Officer

fact: Committee composition: CIO, CFO, Director of Internal Audit, Director of IT Infrastructure and Flight Systems


content_category: Strategy Integration

category_confidence: medium

reasoning: The paragraph's primary communicative purpose is a materiality assessment — it opens and closes with explicit materiality conclusions ('no material cybersecurity incidents,' 'has not had a material impact on our business operations or financial condition'). The February 2025 incident is referenced briefly to support the materiality conclusion rather than to narrate the event in detail (no remediation steps, forensic investigation, or scope analysis), fitting the tiebreaker 'brief mention of a past incident + materiality conclusion as the main point → Strategy Integration.' Two specific dates (June 30, 2025 fiscal year-end and February 14, 2025 incident awareness date) provide two QV-eligible hard facts.

thinking:
Let me analyze this paragraph carefully.

Content: This paragraph contains a materiality assessment ("no material cybersecurity incidents"), then describes an actual incident (February 14, 2025, unauthorized access, misdirected vendor payments), and concludes with another materiality assessment about that specific incident.

Category analysis:
- There's a materiality disclaimer (Strategy Integration)
- There's an actual incident description with date, nature, impact (Incident Disclosure)
- The paragraph describes what happened: unauthorized access, email systems, misdirected vendor payments, specific date

The dominant content: The paragraph both discloses an incident AND assesses materiality.

The incident details are concrete and specific—date, unauthorized access, email systems affected, vendor payment misdirection—but the paragraph's structure frames everything around materiality conclusions. It opens with "no material cybersecurity incidents" and closes with "has not had a material impact," using the incident details as supporting context rather than the main point. This is a close call between Incident Disclosure and Strategy Integration, but the materiality framing appears to be the organizing principle.

Looking at the tiebreaker guidance, this feels like Strategy Integration—the primary purpose is the materiality assessment, with the incident serving as a brief reference to support that conclusion. The actual incident description is compressed into one sentence.

For specificity, I have "February 14, 2025" and "year ended June 30, 2025" as specific dates that would qualify, but "misdirected vendor payments" describes impact without naming amounts or specific firms, and "email systems" is generic. I'm leaning toward Strategy Integration as the classification.

Wait—two specific dates means this qualifies as Quantified-Verifiable.

fact: year ended June 30, 2025

fact: February 14, 2025 — date company became aware of unauthorized access


reasoning: The paragraph describes the status of an ongoing investigation into an actual cybersecurity incident — scope unknown, no evidence of PII compromise, analysis continuing. This is squarely Incident Disclosure (scope assessment and response status of a real event). However, there are no specific dates, named firms, named systems, or other facts from the IS list; all language is standard incident boilerplate ('ongoing investigation,' 'personally identifiable information,' 'compromised systems').

thinking: Incident disclosure - describing ongoing investigation of an actual incident.


content_category: None/Other

reasoning: This paragraph is generic risk language describing hypothetical consequences of cybersecurity incidents (data loss, disruption, unauthorized access) and the evolving nature of threats. It contains no substantive disclosure of governance, processes, roles, incidents, or strategy — it is a catalog of what could go wrong, applicable to virtually any company. No named entities, frameworks, dates, or firm-specific facts are present.

thinking:
This is a generic risk factor paragraph about potential cybersecurity threats and their consequences. No specific facts, no frameworks, no named roles or tools. It's hypothetical risk language.

This reads like general risk language about what could happen - not describing any actual program, process, or incident. It mentions third parties and vendors but only as part of generic risk description, not vendor oversight.

This is None/Other or possibly Strategy Integration? Let me think... It's describing potential consequences of cyber incidents - "could potentially result in..." This is generic risk language, not a materiality assessment, not a process description, not an incident. It's the kind of language you'd find in Risk Factors.

Looking at the location in Item 1C, this is clearly just boilerplate risk language about potential threats and consequences - the kind of generic disclosure that applies broadly across companies, without any specific materiality assessment or governance details. None/Other is the right classification.


reasoning: The paragraph describes an actual cybersecurity incident: unauthorized access, data exfiltration (video meeting images, screen captures), public release of stolen data as part of an extortion attempt, and remediation actions taken. This is squarely Incident Disclosure. However, no specific dates, named firms, named tools, headcounts, or dollar amounts are provided — only vague references like 'certain computer systems,' 'threat actors,' and 'sensitive information,' all of which are on the NOT list. No IS-list facts are present, so specificity remains Generic Boilerplate.

thinking:
Incident disclosure - describes what happened in a cybersecurity incident.

Specificity: No specific dates, no named firms, no named tools, no dollar amounts, no headcounts. "threat actors," "certain computer systems," "sensitive information" are all generic/vague. No IS-list facts present.

Generic Boilerplate.


reasoning: The CISO is mentioned as attribution, but the paragraph's substantive content describes monitoring and detection processes—briefings from internal personnel, threat intelligence from external sources, and security tool alerts. Applying the person-vs-function test: removing the CISO reference leaves a complete process description. The ERMC (ERM Committee) is a named non-generic committee on the IS list, and CISO is a cybersecurity-specific title, yielding two IS-list facts but neither is QV-eligible, so Firm-Specific.

thinking:
Let me analyze this paragraph.

The paragraph describes what the CISO does - supervising and assisting the ERMC, monitoring efforts through various means (briefings, threat intelligence, security tools).

Person-vs-function test: Remove "Our CISO supervises and assists the ERMC in" - the paragraph still describes monitoring efforts, threat intelligence sources, and security tools. It's about the function/process, not about the person's credentials or background.

Content category: Risk Management Process - the paragraph describes internal cybersecurity monitoring processes, threat intelligence gathering, and security tools. The CISO is mentioned as attribution.

Now I'm checking what's actually eligible here. The CISO is a cybersecurity-specific title that qualifies for the IS list, and the ERMC is a named committee that appears on the IS list as well. There aren't any quantifiable facts like dates, amounts, or headcounts to flag.

fact: ERMC (Enterprise Risk Management Committee)


reasoning: The paragraph describes an actual cybersecurity incident — confirming data exfiltration and an ongoing investigation into the extent of compromise. However, it contains no specific dates, named systems, named firms, or other facts from the IS list; 'certain information' and 'accessed IT systems' are vague quantifiers per the NOT list.

thinking: Classify this paragraph about an ongoing investigation into data exfiltration.


reasoning: The paragraph makes an explicit materiality assessment ('not experienced any material cybersecurity incidents') about the company's cybersecurity posture, which per Rule 6 triggers Strategy Integration. The second sentence is generic forward-looking monitoring language. No named frameworks, roles, dates, or firm-specific facts are present.

thinking:
Classify this paragraph.

The paragraph states no material incidents have occurred and commits to continued monitoring. The first sentence is a materiality assessment ("not experienced any material cybersecurity incidents"). Per Rule 6, materiality disclaimers → Strategy Integration.

Specificity: No named frameworks, no specific facts from the IS list. Generic boilerplate.


reasoning: While the paragraph opens with generic program language (third-party oversight, incident response), the dominant content is the description of an actual cybersecurity incident: unauthorized access to two employee email accounts in June 2023, customer notification in September 2023, and $25,000 in related expenses. The cost mention is subordinate to the incident narrative per Rule 4. Multiple QV-eligible hard facts are present: two specific dates (June 2023, September 2023), a dollar amount ($25,000), and a specific headcount (two employees).

thinking:
This paragraph contains multiple topics - let me analyze it.

The paragraph starts with third-party risk management and incident response (risk management process), then transitions into describing an actual cybersecurity incident (June 2023, unauthorized access to email accounts, notification in September 2023, $25,000 in expenses).

The dominant content is the incident description - it takes up most of the paragraph and is the most specific content.

Specific facts:
- June 2023 (specific date)
- Two employees' email accounts (quantified)

- Early September 2023 (specific date)
- $25,000 expenses (dollar amount)

That's multiple QV-eligible facts: specific dates (June 2023, September 2023), dollar amount ($25,000), headcount (two employees). The paragraph describes what happened in an incident - unauthorized access, notification, expenses. While it starts with program descriptions, the incident narrative dominates. The expenses part ($25,000) could be Strategy Integration, but per the tiebreaker rules, I should assign based on which is dominant — the incident disclosure is the primary focus here.

Since the cost is just one sentence at the end of an incident narrative, this falls under Incident Disclosure. I'm seeing multiple quantified-verifiable facts across the content: June 2023, September 2023, $25,000, and two employees mentioned.

fact: June of 2023

fact: two employees' email accounts

fact: early September 2023 notification

fact: approximately $25,000 in expenses


reasoning: The paragraph's primary content is identifying the management committee responsible for cybersecurity oversight — its leader (VP of IT), its composition (CFO, General Counsel, IT/legal/finance/internal audit), and its function. The grammatical subject throughout is the cybersecurity committee, a management-level body, making this Management Role rather than Risk Management Process. Specificity is Firm-Specific: the named cybersecurity committee (non-generic committee per IS list), VP of IT as leader, and specific departmental composition are firm-specific facts, but no two QV-eligible hard facts (no dates, dollars, headcounts, named firms, or named tools) are present.

thinking:
Let me analyze this paragraph carefully.

Content Category: The paragraph describes who oversees the cybersecurity program - a cybersecurity committee led by VP of IT, composed of CFO, General Counsel, and members from IT, legal, finance, and internal audit. It describes what this committee does (meets regularly, monitors prevention/mitigation/detection/remediation).

Person-vs-function test: This is about the management structure - who the people are and what roles comprise the committee. The VP of IT leading the committee, the composition of the committee - this is about organizational structure and roles rather than the processes themselves. But it also describes what the committee does.

The grammatical subject is "our cybersecurity committee" - a management committee overseeing cybersecurity. The primary focus is identifying who's responsible (VP IT, CFO, General Counsel, cross-functional team) and their composition, though the paragraph also touches on their oversight activities around prevention, mitigation, detection, and remediation. The dominant content is really about the management structure and who holds responsibility rather than the technical processes themselves.

Looking at specificity against the lists: the cybersecurity committee is a named non-generic committee that appears on the IS list, making it firm-specific. The team composition spanning IT, legal, finance, and internal audit departments is also specific to this firm. The VP IT title is generic without the security designation, the CFO and General Counsel are standard C-suite roles, and "regular basis" is just generic cadence. So the firm-specific facts here are the named cybersecurity committee and the particular cross-departmental composition. The combination of leading the cybersecurity committee, holding a VP of IT position, and the specific departmental structure points to this being firm-specific information that qualifies for the IS list.

fact: Cybersecurity committee

fact: Vice President, IT leads the cybersecurity committee

fact: Team includes CFO, General Counsel, and members of IT, legal, finance and internal audit departments


reasoning: The paragraph describes internal cybersecurity monitoring, detection, and incident identification processes — all core risk management activities. It contains no named frameworks, no firm-specific roles, tools, dates, or other distinguishing details; the language is generic enough to apply to any company's incident identification workflow.

thinking:
Classifying this paragraph from SCI Engineered Materials' 10-K Item 1C.

This describes monitoring, detection, and incident identification processes. It's about internal cybersecurity processes - Risk Management Process.

No named frameworks, no specific roles, no dates, no firm-specific facts. This reads like a generic description of incident identification steps that could apply to any company.

Specificity: Generic Boilerplate - no named standards, no firm-specific facts.


reasoning: The paragraph describes the company's cybersecurity program structure — risk-based program, ERM integration, and cybersecurity frameworks. While CTO/CIO and CISO roles are named, they serve as attribution for who oversees the program functions rather than describing the persons' qualifications or backgrounds. Applying the person-vs-function test, removing the titles leaves a coherent description of program scope and structure, so Risk Management Process is dominant. Two cybersecurity-specific titles (CIO and CISO) are firm-specific facts, but no QV-eligible hard facts (dates, dollar amounts, named firms/tools) are present, so specificity is Firm-Specific.

thinking:
Let me analyze this paragraph from Delek Logistics Partners' 10-K filing.

Content: Describes their cybersecurity program, ERM integration, board oversight, and names specific roles (CTO & Digital Officer/CIO, CISO).

Category analysis:
- Mentions ERM program, cybersecurity program, frameworks → Risk Management Process
- Board oversight mentioned briefly → Board Governance
- CTO/CIO and CISO roles mentioned → Management Role

The paragraph describes the program structure broadly. The board mention is brief ("overseen by the board"). The roles are mentioned but no credentials/background - they're attributed as responsible for functions.

Now I'm applying the person-versus-function test to determine what's really central here. If I strip away the titles, the core content is about the program itself—the risk-based approach, how they identify and assess cyber risks, their ERM integration, and the frameworks they use. The roles are just listed as who's responsible for overseeing these functions. The board reference is generic governance language. This is fundamentally about the Risk Management Process, not the individuals. The specificity check confirms this: the titles mentioned (CIO, CISO) are cybersecurity-specific, but the program names and governance references are generic. This falls under IS facts category C.

Looking at the quantitative value check, there are no dates, financial figures, headcounts, or named external firms or tools—just role titles, which don't count toward QV. So this is Firm-Specific (3).

fact: Chief Technology Officer & Digital Officer/Chief Information Officer

fact: Chief Information Security Officer


reasoning: The paragraph describes the company's internal cybersecurity activities — IT team implementation, employee training, phishing tests, and awareness promotion. The CISO is mentioned as incidental attribution ('support the CISO'), not as the paragraph's subject; the content is about the function/program, not the person. CISO is the sole IS-list fact, yielding Firm-Specific.

thinking:
Let me analyze this paragraph.

Content: Describes the company's internal cybersecurity team, employee training, phishing tests, and awareness programs. The CISO is mentioned as attribution ("support the CISO"). The paragraph is about what the company does internally - processes and activities.

Category: Risk Management Process - describes internal processes (team, training, phishing tests, awareness). CISO is mentioned incidentally.

Specificity: Let me check for facts.
- "CISO" - cybersecurity-specific title → IS list item
- "phishing tests" - common practice, NOT list
- "employee trainings" - generic

- No named frameworks, dates, numbers, or specific tools mentioned, so this comes down to the one firm-specific fact: the CISO reference makes this Firm-Specific.

fact: CISO


reasoning: The paragraph describes an actual cybersecurity incident — unauthorized access, timeline, response actions (activating IR plan, notifying law enforcement, retaining experts), and nature of the attack (encryption and monitoring software deployment). This is squarely Incident Disclosure. For specificity, the specific date (October 15, 2025) is one hard verifiable fact triggering Firm-Specific. While FBI is named, 'law enforcement' is on the NOT list as standard incident language; 'external cybersecurity experts' are unnamed; and 'cyber incident response plan' is a generic program name. Only one QV-eligible fact remains, so this is Firm-Specific rather than Quantified-Verifiable.

thinking:
Incident disclosure - describes a specific cybersecurity event with details.

Facts: October 15, 2025 (specific date), FBI (named law enforcement), unauthorized access and encryption/monitoring software deployment.

Wait - FBI is a named entity but is it a "named third-party firm"? It's law enforcement, which is on the NOT list ("law enforcement"). External cybersecurity experts are unnamed.

QV-eligible: specific date (October 15, 2025) = 1. FBI - law enforcement is on the NOT list. "external cybersecurity experts" - unnamed. "encryption and monitoring software" - not named products.

So one hard verifiable fact (the date). That gives Firm-Specific.

Actually, I'm second-guessing myself on the FBI mention. It's explicitly named, which could count as a named third-party firm, but the NOT list specifically calls out "law enforcement" as standard incident language. Even though naming FBI is more specific than just saying "law enforcement," it's still fundamentally standard boilerplate that appears in every incident disclosure.

I'll lean toward not counting it as a qualifying fact since the intent seems to be excluding routine law enforcement notifications. The date alone is what makes this Firm-Specific.

For the category, this is clearly Incident Disclosure—it describes what happened, when it occurred, and what response actions were taken.

fact: October 15, 2025


reasoning: The paragraph describes the company's internal cybersecurity processes: employee policies, incident response plan activities (triage, assess, escalate, contain, investigate, remediate), and regular exercises. This is squarely about internal risk management processes. No named frameworks, no firm-specific facts from the IS list — generic program names like 'incident response policy and plan' and common practices like 'simulated incident response scenarios' do not qualify.


reasoning: The paragraph describes the company's own internal cybersecurity processes — monitoring/detection, incident response practices, and employee training — making it Risk Management Process. No named frameworks, tools, roles, dates, or specific numbers appear; all language (monitoring system, standard incident response practices, periodic trainings, phishing campaigns) is generic and could apply to any company.

thinking:
Let me analyze this paragraph.

Content: Describes monitoring/detection, incident response practices, and employee training. All internal processes. No board, no management person, no third-party focus, no incident, no materiality assessment.

Category: Risk Management Process

Specificity: No named frameworks, no named tools, no specific roles, no dates, no numbers. "Monitoring and detection system" is generic. "Standard incident response practices" is generic. "Periodic cybersecurity trainings including phishing campaigns and general awareness campaigns" - these are common practices on the NOT list.

→ Generic Boilerplate


reasoning: The paragraph describes the company's internal incident response and recovery processes — planning, documentation, testing, and backups. No named frameworks, no firm-specific facts, no named tools or roles. Every phrase could apply to any company.


reasoning: The paragraph's primary communicative purpose is assessing the materiality of cybersecurity risks and incidents — it explicitly states no material incident occurred in the year ended December 31, 2023, references two past material breaches, and discusses potential financial and reputational consequences. This is a materiality assessment (Strategy Integration per Rule 6), not a process description or incident narrative. Two QV-eligible hard facts: a specific date (December 31, 2023) and a specific count (two past breaches).

thinking:
Let me analyze this paragraph carefully.

This is a long paragraph from BION ENVIRONMENTAL TECHNOLOGIES INC's 10-K Item 1C filing.

Content analysis:
- Opens with generic risk acknowledgment
- Mentions commitment to oversight, controls, processes
- States no material cybersecurity incident in year ended December 31, 2023
- References two past material breaches
- Discusses potential costs and consequences
- Generic threat landscape language
- Cross-reference to Risk Factors

This is a mixed paragraph. Let me identify the dominant category:
- There's a materiality assessment: "we did not experience a material cybersecurity incident" in the year ended December 31, 2023

- There's mention of past breaches: "two such material breaches in the past"
- Most of the text is about potential risks and consequences (generic risk language)
- Cross-reference to Risk Factors at the end

The materiality assessment combined with references to past incidents suggests this leans toward Strategy Integration. The paragraph is primarily focused on the business impact and materiality of cyber risk rather than governance or process details. I need to reconsider the structure: it opens with generic risk language, includes a materiality statement for 2023, acknowledges two prior material breaches, and then discusses potential consequences before cross-referencing the Risk Factors section.

The dominant theme is really about risk and impact assessment—materiality and consequences fit Rule 6 for Strategy Integration. Looking at specificity: the filing references a specific date (December 31, 2023), mentions "two such material breaches" as a quantified number, and cites the Form 10-K for that year. That's two hard verifiable facts—a specific date and a specific incident count—which makes this Quantified-Verifiable.

fact: Year ended December 31, 2023 — no material cybersecurity incident

fact: Two material breaches experienced in the past


reasoning: This paragraph is a generic definition of DoS attacks with no company-specific cybersecurity disclosure content. It reads like educational/background text rather than describing any program, process, incident, or governance structure.


reasoning: The paragraph describes the company's internal security policy objectives — protecting CIA triad, developing security controls, managing cybersecurity risks company-wide — all of which are internal risk management processes. Despite naming the 'Enterprise Information Systems Security Policy,' this is a generic program name without a unique identifier, and the described objectives (confidentiality/integrity/availability, minimum security controls, oversight) are standard boilerplate that could apply to any company. No named frameworks, firm-specific facts, or verifiable details are present.

thinking:
Classifying this paragraph about IBOC's Enterprise Information Systems Security Policy.

Content: Describes an internal security policy with objectives around information security management, CIA triad, security controls, and oversight. This is about the company's own internal processes.

Category: Risk Management Process - describes internal framework, security controls, data protection objectives.

Specificity: The "Enterprise Information Systems Security Policy" - is this a named internal program with a unique identifier? It's a generic program name essentially. No named frameworks (NIST, ISO), no firm-specific facts from the IS list. The name is somewhat specific but per the NOT list, generic program names don't qualify.

This is just laying out standard security policy concepts without anything distinctive or firm-specific, so it falls into Generic Boilerplate.


content_category: Third-Party Risk

reasoning: The paragraph's central topic is oversight of third-party service providers and suppliers, including security requirements imposed on them (SOC 2 reports, business associate agreements, incident notification obligations). SOC 2 is a named standard triggering Sector-Adapted, but no firm-specific facts (no named vendors, dates, headcounts, or unique program identifiers) are present.

thinking:
Third-party risk management is the central topic here.

Specific facts: SOC 2 is a named standard. "business associate agreement" is a generic contract term. No named firms, no dates, no headcounts.

Category: Third-Party Risk - vendor oversight is the central topic.

Specificity: Names SOC 2 (a recognized standard). But is there anything firm-specific? "business associate agreement" is standard HIPAA language, not unique. The paragraph describes requirements imposed on vendors. SOC 2 is a named standard → Sector-Adapted. Nothing on the IS list that's unique to this company.

The business associate agreement is HIPAA-specific terminology, though it's common practice in healthcare rather than firm-specific. Either way, SOC 2 is explicitly named, which puts this at Sector-Adapted minimum, and there's nothing from the IS list that's unique to this organization.

fact: SOC 2 reports


reasoning: The Chief Security Office/Officer is the primary actor throughout — maintaining the metrics framework, providing reporting to governance forums, and updating the Supervisory Board's Committee. While boards receive the reports, the CSO is the grammatical subject performing the key actions (reporting upward), making this Management Role per Rule 2. Contains a cybersecurity-specific title (CSO) and a named non-generic committee (Supervisory Board's Committee responsible for technology, data and innovation), yielding Firm-Specific. No two QV-eligible hard facts are present (Deutsche Bank Group is a parent company self-reference, not an external third party).

thinking:
Let me analyze this paragraph carefully.

Content: Describes the Chief Security Office's metrics/reporting framework, reporting to governance forums, Management Board receiving quarterly reports, and CSO providing updates to the Supervisory Board's Committee.

Category analysis:
- "Chief Security Office" and "Chief Security Officer" are mentioned
- The paragraph describes reporting structures and metrics frameworks
- The Management Board receives quarterly reports
- The CSO reports to the Supervisory Board's Committee

This is about reporting/oversight structure. The primary actors are the Chief Security Office/Officer reporting TO governance bodies. The CSO is the grammatical subject in the last sentence. The Management Board receives reports.

I'm seeing this is really about the CSO's management function—maintaining metrics and providing reports to various governance bodies—rather than describing the person in the role. The focus is on the reporting lines and oversight structure, with both the Management Board and Supervisory Board's Committee receiving updates from the Chief Security Office. I'm identifying the specific entities and roles mentioned: the Chief Security Officer as a cybersecurity-specific title, the Supervisory Board's Committee on technology, data and innovation as a named committee, and Deutsche Bank Group as the parent company reference. These are the key facts that determine whether this qualifies for the specificity requirements.

fact: Chief Security Officer / Chief Security Office


reasoning: The paragraph describes the company's cybersecurity risk management program for identifying, assessing, and mitigating risks to data and systems — squarely Risk Management Process. It references 'recognized industry standards and frameworks' without naming any specific standard (NIST, ISO, etc.), and contains no firm-specific facts, making it Generic Boilerplate.

thinking:
Let me analyze this paragraph from Plug Power's 10-K filing.

Content: Generic statement about cybersecurity risks, data handling, and having a risk management program "informed by recognized industry standards and frameworks" without naming any specific framework.

Category: Risk Management Process - describes the company's internal cybersecurity program for identifying, assessing, and mitigating risks.

Specificity: No named frameworks (just "recognized industry standards and frameworks"), no named roles, no specific facts.

This is just boilerplate language that could apply to almost any company.


reasoning: The paragraph contains a materiality assessment ('no such incident has had any such impact to date') and then cross-references Item 1A for further detail on whether cyber risks 'have materially affected or are reasonably likely to materially affect' the company's business strategy, results of operations, or financial condition. Per Rule 6, the presence of a materiality conclusion — even a partial one — makes this Strategy Integration rather than None/Other, despite the prominent cross-reference. No firm-specific facts, named standards, or verifiable details are present; the language is boilerplate.

thinking:
Let me analyze this paragraph carefully.

The paragraph has three parts:
1. Generic statement about maintaining protocols and monitoring
2. A materiality-adjacent statement: "no such incident has had any such impact to date"
3. A cross-reference to Item 1A Risk Factors for information about whether cyber risks have materially affected the company

The key question: Is this Strategy Integration or None/Other?

The paragraph says "no such incident has had any such impact to date" - this is a brief materiality-related statement.

But then it refers readers to Item 1A for the full materiality assessment regarding whether cybersecurity risks have materially affected or are reasonably likely to materially affect the company. The tricky part is that the paragraph itself makes a partial materiality claim—saying no incidents have had impact so far—but then delegates the comprehensive materiality analysis to another section rather than making a definitive conclusion here.

Actually, that statement "no such incident has had any such impact to date" is itself a materiality assessment under Rule 6, which means this qualifies as Strategy Integration. The cross-reference to Item 1A doesn't change that classification. And since there are no named standards or company-specific facts mentioned—just a generic cross-reference to a risk factor section—this is Boilerplate.


reasoning: The paragraph describes the scope and response to an actual cybersecurity incident—investigation findings, types of data affected (employee records, personal information), confirmation of data deletion, and notification of affected individuals. These are all incident narrative and response actions. No specific dates, named third-party firms, named tools, dollar amounts, or other hard verifiable facts are present; 'certain third parties' is generic and unnamed.

thinking:
Incident Disclosure - describes what happened in an incident (scope, affected data, response actions).

Facts: No specific dates, no named firms, no named tools, no dollar amounts, no headcounts. "certain third parties" is generic. No named anything.

Specificity: Generic Boilerplate.


reasoning: The paragraph describes the company's own internal information security processes for identifying, assessing, and managing cybersecurity risks — squarely Risk Management Process. Despite defining a term ('Information Systems and Data'), there are no named frameworks, cybersecurity-specific roles, specific dates, tools, or any other facts from the IS list. The content is generic and could apply to any company.

thinking:
Classify this paragraph.

Content: Describes the company's information security processes for identifying, assessing, and managing cybersecurity risks. This is about internal processes - Risk Management Process.

Specificity: No named frameworks, no named roles, no specific dates, no named tools. The term "Information Systems and Data" is defined but it's just a generic internal definition. No IS-list facts. Generic Boilerplate.


reasoning: The paragraph describes the company's minimal cybersecurity risk management approach: CEO oversees risks (incidental attribution, not about the person's qualifications), standard commercial software with basic security features. The person-vs-function test points to Risk Management Process since the content is about what the company does (uses standard software, basic protections), not about the CEO's credentials. 'Risk is minimal' is a general risk statement, not a formal materiality assessment using SEC language. No IS-list facts remain after filtering (CEO is generic C-suite on the NOT list), and no named frameworks, yielding Generic Boilerplate.

thinking:
Small company, minimal cyber risk, CEO oversees everything, standard commercial software.

Content: Mix of strategy (risk is minimal), management (CEO responsible), and risk management (standard software). The dominant purpose seems to be explaining why they don't have much of a cybersecurity program - it's a small company assessment. But let me think about this more carefully.

The paragraph has three parts:
1. "risk is minimal" - could be strategy/materiality or just context-setting
2. "CEO is responsible for overseeing... including cybersecurity risks" - Management Role

3. "standard commercial software with basic security features" - Risk Management Process

CEO is generic C-suite (on the NOT list). "Standard commercial software" is generic. "Password protection and data encryption" are generic practices.

This is a small company with minimal disclosure. The CEO mention is generic (CEO is on the NOT list for specificity). No named frameworks, no specific facts. The "risk is minimal" claim lacks formal materiality assessment language. The practices described—standard software with basic security—are too generic to indicate meaningful risk management processes.

Looking at the substance here, this is really just boilerplate about their minimal cybersecurity approach. The CEO attribution is incidental and doesn't add specificity since CEO is on the NOT list. The risk assessment is vague and context-setting rather than a formal materiality determination. The actual content is describing how they manage cyber risk in the most generic terms possible: CEO oversees, they use standard software, they have basic security features. No named frameworks, no specific facts, no IS-list details. This is Generic Boilerplate.


reasoning: Although the paragraph opens with a materiality disclaimer (Strategy Integration) and touches on costs, the dominant content is a detailed narrative of the February 2023 ransomware incident — its nature (global ransomware encrypting servers), response actions (unencryption, restoration from backups, retained IR teams), outcome (minimal disruption, no ransom paid), and remediation costs. The incident narrative occupies the majority of the text. Specificity is Firm-Specific: 'February 2023' is one QV-eligible date, but no second hard verifiable fact (third-party firms are unnamed, durations are approximate), so it does not reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph carefully.

This is a complex paragraph that covers multiple topics. Let me break it down:

1. Opens with a materiality assessment ("have not materially affected...")
2. Describes general threat landscape
3. Describes a specific incident (February 2023 ransomware attack)
4. Describes response actions and outcome
5. Mentions costs

The dominant content is clearly the incident description - the February 2023 ransomware attack, the response, the outcome. The materiality disclaimer is the opening frame, but the bulk of the paragraph is incident narrative.

Category: **Incident Disclosure** - The paragraph primarily describes what happened in a specific cybersecurity incident.

---

Looking at the verifiable facts here, I'm finding only one that qualifies as a hard date: February 2023. The other details like the response timeline and ransom decision are either vague or don't meet the criteria for what counts as a quantifiable fact. So this lands in Firm-Specific territory with just that single concrete data point.

fact: February 2023 ransomware attack


content_category: Board Governance

reasoning: The paragraph opens with and primarily frames Board/Audit Committee oversight of cybersecurity risk (3 of 5 sentences), with the CTO's role and qualifications presented as subordinate to that governance structure — consistent with Case 5 where the board sets the frame. For specificity, the paragraph contains multiple QV-eligible hard facts: a specific number of years of experience (25 years) and named external organizations (Real Estate Board of Cyber Committee, Real Estate Cyber Consortium, Global Cyber Consortium) that are independently verifiable.

thinking:
Let me analyze this paragraph carefully.

This is a complex, multi-topic paragraph. Let me break down the content:

1. "ESRT's Board of Directors oversees our risk management process, including with respect to cybersecurity risks" → Board Governance
2. "The Audit Committee of ESRT's Board oversees our risk management program" → Board Governance
3. "Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports on our enterprise risk profile on a quarterly basis" → Board Governance

4. The CTO holds primary responsibility for assessing and managing cybersecurity risks, leading teams across the organization on prevention, detection, mitigation and remediation efforts, with quarterly reporting to the Audit Committee → Management Role and Risk Management Process
5. The CTO brings extensive cybersecurity and IT background spanning over 25 years, and holds leadership positions including Chair of the Real Estate Board of Cyber Committee, Board Member of the Real Estate Cyber Consortium, and Board Member of the Global [text appears to continue]

The paragraph structure opens with Board governance framing—the Board and Audit Committee as primary overseers—then shifts focus to the CTO's responsibilities and qualifications. The board content spans roughly three sentences while the CTO-focused content takes up about two sentences. Even though it's fairly balanced, the opening governance framing sets the context, but the CTO's role and credentials dominate the substance. Looking at the tiebreaker rules, since board oversight is mentioned but the management role and qualifications are the main focus, this leans toward Management Role. Looking at the sentence breakdown, the first three sentences establish the board governance framework, while sentences four and five shift to the CTO as an individual—their responsibilities and qualifications. The governance structure clearly dominates the paragraph's opening and overall framing, so Board Governance is the stronger category. For specificity, I'm noting the CTO title, the 25+ years of experience, and the three named external board positions as the key factual details.

fact: Chief Technology Officer (CTO)

fact: over 25 years of experience in cybersecurity and information technology

fact: Board Member of the Global Cyber Consortium


reasoning: The paragraph describes an actual cybersecurity incident: the DISH Network outage on February 23, 2023, the activation of incident response plans, engagement of cybersecurity experts, law enforcement notification, and further disclosure of data extraction on February 28, 2023. Two specific dates constitute two hard verifiable facts, reaching Quantified-Verifiable. Note: 'certain cyber-security experts and outside advisors' are unnamed and do not count as specific facts per the NOT list.

thinking:
Let me analyze this paragraph from EchoStar's 10-K filing.

Content: Describes a specific cybersecurity incident - the DISH Network outage on February 23, 2023, response actions, and data extraction disclosed on February 28, 2023.

Category: Incident Disclosure - describes what happened, when, scope, and response actions for an actual incident.

Specific facts:
- February 23, 2023 (specific date)
- February 28, 2023 (specific date)
- DISH Network (named entity - though this is a subsidiary/related company)

- These two specific dates make this quantified-verifiable information.

fact: February 23, 2023 — date of DISH Network network outage

fact: February 28, 2023 — date of further disclosure of data extraction


reasoning: The paragraph describes the company's own internal incident response and recovery planning processes, placing it squarely in Risk Management Process. It contains no named frameworks, no firm-specific roles, no dates, no named tools or firms — only generic language ('comprehensive,' 'regular basis') that could appear unchanged in any company's filing.

thinking:
Classify this paragraph.

Content: Describes incident response and recovery plans, testing them regularly. This is about internal processes.

Category: Risk Management Process - describes IR planning and testing.

Specificity: No named frameworks, no firm-specific facts, no dates, no named tools. "comprehensive incident response and recovery plans" is generic. "tested and evaluated on a regular basis" is generic cadence. → Generic Boilerplate.


reasoning: The paragraph describes the company's use of various external service providers as components of its own cybersecurity risk management program (threat intelligence, penetration testing, managed services). Per Rule 3, external parties hired to serve the company's program are Risk Management Process, not Third-Party Risk. All entities are unnamed ('threat intelligence service providers,' 'cybersecurity consultants,' etc.), with no named firms, frameworks, or firm-specific facts, yielding Generic Boilerplate.

thinking:
Classify this paragraph.

Content: describes use of various service providers for cybersecurity risk management. The central topic is about third-party service providers being used as part of the company's risk management. But per Rule 3: "External assessor hired to test the company → Risk Management Process (they serve the company)." These third parties are components of the company's internal program, not about oversight OF the vendors. So this is Risk Management Process.

Wait - let me reconsider. The paragraph lists types of service providers used. Is vendor oversight the central topic? No - the paragraph is about how the company uses these providers to manage its own cybersecurity risks. The providers serve the company's program.

This falls under Risk Management Process, and since it references generic provider types without naming specific standards or company details, it's Generic Boilerplate.


reasoning: The paragraph describes the cybersecurity team's composition and qualifications (85 years combined experience) in support of named cybersecurity-specific roles (CIO, Director of Cybersecurity), making it primarily about the people rather than the processes they run. Two cybersecurity-specific roles and a quantified experience figure provide firm-specific facts, but only one QV-eligible fact (85 years), so it stays at Firm-Specific rather than Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes a cross-functional cybersecurity team that supports the CIO and Director of Cybersecurity. Mentions 85 years of combined experience. They handle day-to-day implementation.

Category: This is about the people/team - their experience and composition. The CIO and Director of Cybersecurity are named roles. But is this about the person or the function? It describes the team's experience (85 years combined) and their responsibility. It's more about who these people are (their experience) than what processes they run. However, the "person-vs-function" test: if you remove the roles and experience, what's left? "We established a cross-functional team...

The core of this is really about team composition and qualifications rather than operational processes. The paragraph names specific roles like CIO and Director of Cybersecurity and emphasizes their combined credentials, which points to Management Role as the category. For specificity, both the CIO and Director of Cybersecurity titles are cybersecurity-specific, making them Firm-Specific, and the 85 years of prior work experience is a credential metric.

fact: CIO

fact: Director of Cybersecurity

fact: over 85 years of combined prior work experience in cybersecurity


reasoning: The paragraph describes the company's internal cybersecurity processes, framework adoption, and policies — squarely Risk Management Process. It names the CIS Controls framework (which alone would be Sector-Adapted), but also references a named internal program ('Cybersecurity Risk and Compliance Program') and a specific version implementation claim ('version 8.0' supporting Zero Trust), which together push it to Firm-Specific. However, no two QV-eligible hard facts (dates, dollar amounts, named third-party firms, named tools) are present, so it does not reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes the company's cybersecurity program, framework adoption (CIS Controls), policies and processes. This is about internal processes and methodology.

Category: Risk Management Process - describes risk assessment methodology, framework adoption, policies and processes.

Specific facts:
- "Cybersecurity Risk and Compliance Program" - named internal program with a specific name
- "Center for Internet Security (CIS) Controls framework" - named framework
- "version 8.0 of the CIS Controls" - specific version
- "Zero Trust architecture" - architectural approach

Decision test for specificity:

Version 8.0 doesn't qualify as a hard verifiable fact since version numbers aren't on the eligible list—I need specific dates, dollar amounts, headcounts, named third-party firms, or named products. The "Cybersecurity Risk and Compliance Program" is a named internal program, and CIS Controls is a recognized standard that would trigger the Sector-Adapted category.

The program name is borderline—it's more specific than generic "cybersecurity program" but I'm not certain it's truly unique. However, implementing a specific version of CIS Controls is a firm-specific claim, so I'll classify this as Firm-Specific based on the named program and the version specification.

fact: Cybersecurity Risk and Compliance Program (named internal program)

fact: Version 8.0 of the CIS Controls implemented


reasoning: This appears to be a fragment from a bulleted list describing the company's cybersecurity program components — specifically security controls and mitigation measures. It describes internal risk management processes. No named frameworks, roles, tools, or firm-specific facts are present; the language is entirely generic.


reasoning: The paragraph's primary content is management organizational structure for cybersecurity: the CISO's role, the composition and purpose of an IT risk committee, and reporting lines (CISO → management risk committee → Board). While some process language appears ('review information security risks, development of policies'), it is subordinate to describing who is responsible and how management is organized. Management Role covers 'management committees responsible for cybersecurity' and reporting structures. Specificity is Firm-Specific due to CISO (cybersecurity-specific title), specific date (2023), and specific departmental composition, but only one QV-eligible hard fact (the date), so it does not reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes management team including CISO responsible for cybersecurity risks, an IT risk committee established in 2023 with specific departmental composition, monthly meetings, reporting chain from CISO to management risk committee to Board.

Category: The paragraph starts with management team/CISO as subject, but the bulk is about the IT risk committee structure and reporting lines. This is about organizational structure and reporting - who does what. The person-vs-function test: it's not about the CISO's credentials/background, it's about the organizational structure. But it's also not really about processes/tools/frameworks - it's about the committee structure and reporting lines.

So I'm looking at the core elements here: the CISO's role in risk oversight, the IT risk committee's composition and meeting frequency, and how information flows up through the management risk committee to the Board. This is fundamentally about the governance structure for cybersecurity oversight rather than specific risk management methodologies or processes. Looking at the QV-eligible facts more carefully: "In 2023" is a specific date, which counts as one QV-eligible fact. The CISO title itself isn't QV-eligible since it's a role rather than a named individual. With only one QV-eligible fact present, this falls into the Firm-Specific category.

fact: CISO

fact: In 2023, established information technology risk committee

fact: Committee comprised of senior managers in information technology, loan origination, loan servicing, accounting, and legal groups


reasoning: The CISO is mentioned repeatedly but as attribution for what the cybersecurity program does — monitoring, defense-in-depth safeguards, incident response planning, system audits. Applying the person-vs-function test, removing 'The CISO' leaves a complete process description, so this is Risk Management Process. The CISO title (IS list) and the specific composition of incident response teams (accounting team representatives) make it Firm-Specific, but no QV-eligible hard facts (no dates, dollar amounts, named firms, or named tools) reach the two-fact threshold.

thinking:
Let me analyze this paragraph.

Content: Describes monitoring, defense-in-depth safeguards, incident response planning, security measures. The CISO is mentioned multiple times but as attribution for what the program does. Applying the person-vs-function test: remove "The CISO" and replace with "The Company" — the paragraph still makes complete sense as a process description. This is Risk Management Process.

Specific facts:
- CISO (cybersecurity-specific title) → IS list
- Lists specific security measures (firewalls, IDS/IPS, etc.) — common practices, NOT list
- Incident Response Plan — generic program name, NOT list

- Incident response teams include representatives from accounting — that's a firm-specific composition detail, but CISO is the only QV-eligible fact here and it's a named role so it doesn't count. No dates, dollar amounts, named firms, or tools to push this toward QV.

This lands at Firm-Specific (3) based on the CISO title being a cybersecurity-specific role on the IS list.

fact: CISO role identified as leading monitoring and incident response

fact: Incident response teams include representatives from the accounting team


reasoning: The paragraph primarily describes the company's internal cybersecurity risk management processes — ERM integration, NIST framework alignment, layered strategy, policies, and review processes. Board and committee mentions are subordinate to the process description. The Risk Committee is a named non-generic committee (IS list), elevating specificity beyond Sector-Adapted to Firm-Specific, but there are no two QV-eligible hard facts (no dates, dollar amounts, headcounts, named firms, or named tools).

thinking:
Let me analyze this paragraph carefully.

Content Category: This is a long paragraph covering multiple topics. Let me identify the dominant one:
- ERM integration, cross-departmental approach, NIST framework, policies, risk assessment methodology - all Risk Management Process
- Board/Risk Committee/Audit Committee mentioned but as part of the broader description
- The primary communicative purpose is describing the company's cybersecurity risk management program

The dominant topic is clearly Risk Management Process.

Specificity: Let me check the facts:
- NIST framework → named standard (Sector-Adapted baseline)
- "Risk Committee" → named non-generic committee → IS list ✓ (Firm-Specific)

- Information security, IT, and operations areas are mentioned as part of the cross-departmental structure, though "Information Security Policy and Program" is a generic program name without unique identifiers
- The Risk Committee is the key firm-specific element here

So this falls under Firm-Specific (3) due to the Risk Committee reference.

fact: Risk Committee

fact: NIST framework


reasoning: The paragraph describes the company's internal cybersecurity controls and defense-in-depth posture, listing numerous control domains under 'the ISP' — this is squarely about internal risk management processes. While the listed domains closely mirror CIS Controls v8 categories, the paragraph does not explicitly name CIS or any other recognized framework, and 'ISP' is a generic program name without a unique identifier. No named roles, dates, tools, firms, or numbers appear, so no IS-list facts are present, resulting in Generic Boilerplate.

thinking:
Let me analyze this paragraph from Merchants Bancorp's 10-K filing.

Content: Describes a defense-in-depth posture and lists control domains under "the ISP" (Information Security Program). This is about the company's internal cybersecurity processes and controls.

Category: Risk Management Process - describes internal security controls, domains, and methodology.

Specificity: Let me check for specific facts:
- "ISP" - this is a generic program name (Information Security Program), not a unique identifier
- The list of domains (Information Security Governance, Inventory and Control of Enterprise Assets, etc.) - these look like they map to CIS Controls categories, but CIS is not explicitly named

- The domain names mirror CIS Controls v8 categories closely, but since CIS isn't explicitly mentioned in the paragraph, this doesn't qualify as a named framework reference. Without that explicit naming, this falls into generic boilerplate rather than sector-adapted guidance.


reasoning: The paragraph describes the company's internal access management processes — least privilege methodology, centralized provisioning/de-provisioning, routine access reviews, and SSO controls for third-party hosted environments. Third-party environments are mentioned as one component of the internal access management function, not as vendor oversight (Rule 3). No named frameworks, tools, roles from the IS list, dates, or quantified facts are present; all descriptions are common security practices applicable to any organization.

thinking:
Let me classify this paragraph.

Content: Describes access management processes - least privilege, centralized user access management, provisioning/de-provisioning, routine reviews, SSO controls for third-party environments.

Category: This is about internal processes (access management methodology). Third-party hosted environments are mentioned but as a component of the internal access management process, not as vendor oversight. → Risk Management Process

Specificity: No named frameworks, no named tools, no specific dates, no named roles from the IS list. "Least privilege" and "need-to-know" are common practices. "Single sign-on" is a generic concept. No firm-specific facts.

This looks like generic boilerplate - standard language without company-specific details or concrete examples.


reasoning: The paragraph describes how the company prevents, detects, mitigates, and remediates cybersecurity threats through briefings, threat intelligence, and security tools. Applying the person-vs-function test: 'management team' is generic attribution, and the substantive content describes processes and information sources. No named frameworks, tools, firms, roles, dates, or specific numbers are present — all entities are unnamed and generic.

thinking:
Let me analyze this paragraph.

Content: Describes what the management team does - supervises efforts through briefings, threat intelligence, alerts/reports from security tools. This is about what the function does (processes, activities), not about who the person is.

Category: The management team is the subject, but the paragraph describes processes (prevent, detect, mitigate, remediate) and information sources. Applying the person-vs-function test: remove "Our management team supervises" and replace with "The Company" - it still makes sense as a process description. → Risk Management Process

Specificity: No named frameworks, no specific roles (just "management team" which is generic), no named tools, no dates, no numbers.

The references to personnel and consultants are all vague and unnamed, with no concrete details about who's involved or what tools are actually being used. This is clearly generic boilerplate language.


reasoning: The paragraph describes the company's own internal cybersecurity processes and policies, including framework adoption and incident response planning — squarely Risk Management Process. It names the NIST CSF (Sector-Adapted baseline) and a named internal program with a unique abbreviation ('CIRP'), which qualifies as an IS-list fact, elevating specificity to Firm-Specific. Only one QV-eligible fact exists, so it does not reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes processes and policies for managing cybersecurity risks, based on NIST CSF, includes a named internal program (CIRP). This is about internal processes/methodology.

Category: Risk Management Process - describes the company's own internal processes, framework adoption, policies.

Specificity:
- NIST CSF → named framework (Sector-Adapted baseline)
- "Cybersecurity Incident Response Plan ("CIRP")" → named internal program with unique identifier → IS list item → Firm-Specific

Check for QV: No dates, dollar amounts, headcounts, named third-party firms, named tools.

The CIRP reference is the only IS-list fact here, so this qualifies as Firm-Specific.

fact: NIST Cybersecurity Framework


reasoning: The entire paragraph is about oversight of third-party service providers — vendor management program, security questionnaires, vendor audits, and contractual cybersecurity obligations imposed on providers. No named standards, no named firms, no specific dates or numbers; the practices described (security questionnaires, audits, tiered assessments, contractual obligations) are generic and could apply to any company.

thinking:
Third-party vendor management is the central topic.

Specific facts: No named frameworks, no named firms, no named tools, no dates, no numbers. "vendor management program" is generic. "security questionnaires, reviews of vendor's written security program and audits" are common practices. "different levels of assessment" and "contractual obligations" are generic.

No IS-list facts. No named standards.

Category: Third-Party Risk (vendor oversight is the central topic)
Specificity: Generic Boilerplate


reasoning: The paragraph leads with and centers on a detailed incident narrative — malware detection, quarantine, server rebuild, operational outage, and specific consequences (1,700 cancellations, $16M loss). While the latter half contains materiality assessments and insurance recovery details (Strategy Integration signals), the incident description is the dominant content that anchors the paragraph; the financial and materiality language serves to complete the incident disclosure. Multiple hard verifiable facts (specific year, quantified cancellations, dollar amount, specific date for insurance recovery) clearly reach the QV threshold.

thinking:
Let me analyze this paragraph carefully.

This is a complex paragraph that covers multiple topics. Let me break it down:

1. Incident description: malware in 2021, quarantined, server rebuild, server outage, ~1,700 flight cancellations
2. Financial impact: ~$16M pre-tax loss
3. Insurance recovery: approximately half recovered through cyber insurance by Dec 31, 2023
4. Materiality assessment: don't believe it materially affected them
5. Forward-looking materiality: no material risks identified for 2023, but ongoing risks exist
6. Cross-reference to Risk Factors

7. Now I'm applying the dominant content test to classify this. The paragraph opens with a detailed incident narrative—specific dates, access details, encryption status, scope, and response actions—then shifts into materiality assessments and insurance recovery. The tiebreaker rules suggest that substantial incident narratives with specific consequences and dollar amounts lean toward Incident Disclosure, but the paragraph seems to be cut off before reaching its conclusion. I'm settling on Incident Disclosure as the dominant category since the paragraph is anchored by the specific cybersecurity event itself—the malware detection, quarantine, server rebuild, and operational consequences—while the financial impact and materiality assessments function as supporting details that contextualize the incident rather than drive the narrative.

Looking at the verifiable facts, I can identify several concrete data points: the 2021 incident date, the approximately 1,700 flight cancellations, the $16 million pre-tax cost, the December 31, 2023 disclosure date, and the reference to cyber insurance coverage. That gives me at least 3-4 hard verifiable facts with specific numbers and dates, so this clearly qualifies as Quantified-Verifiable.

fact: During 2021 (incident timeframe)

fact: approximately $16 million (pre-tax) financial impact

fact: December 31, 2023 (insurance recovery period)


reasoning: The Board is the grammatical subject overseeing cybersecurity risk, making this Board Governance. The paragraph contains only generic governance language ('Board', 'management', 'risk oversight function') with no named frameworks, cybersecurity-specific roles, or firm-specific facts.

thinking:
Classify this paragraph.

Content: Board oversees cybersecurity risk as part of risk oversight function. Board is the grammatical subject.

Category: Board Governance

Specificity: No named frameworks, no specific facts from the IS list. "Board" and "management" are generic. No cybersecurity-specific titles, no named committees beyond generic "Board."

Generic Boilerplate.


reasoning: The paragraph describes the company's internal cybersecurity program review cycle, audit processes, and annual risk/maturity assessment methodology. While the Board is mentioned as approving the program and receiving reports, the grammatical subjects are the Information Security Program and the Information Security team — the primary content is about processes (reviews, audits, assessments), not board oversight. The FFIEC Cybersecurity Assessment Tool is a named recognized standard, elevating to Sector-Adapted, but no firm-specific facts (no named roles from the IS list, no specific dates, no named auditors) push it to Firm-Specific.

thinking:
Let me analyze this paragraph.

Content: Describes the Information Security Program's review process, audits, and annual assessment using FFIEC CAT tool, with results reported to the Board.

Category: The paragraph describes internal processes - periodic review, audits, annual assessment using FFIEC CAT. The Board is mentioned as receiving reports and approving the program, but the primary content is about the program's review/audit/assessment processes. This is Risk Management Process.

Wait - let me check the person-vs-function test and board vs management rules. The Board approves the program and receives reports, but the paragraph's main content is about the program's review cycle, audits, and assessment methodology.

The grammatical subjects here are the Information Security Program, the periodic audits, and the Information Security team—the Board only appears in supporting clauses. Looking at specificity, the FFIEC Cybersecurity Assessment Tool is a recognized named framework, which points to Sector-Adapted. The Information Security team is a generic title rather than a specific role, and the auditors and Board aren't on the list. The cadences mentioned are standard frequencies, not distinctive. Since the FFIEC CAT is the key specific element and the content centers on the assessment methodology itself, this leans toward Sector-Adapted.

fact: FFIEC Cybersecurity Assessment Tool


reasoning: The paragraph describes the company's use of external service providers to support its own cybersecurity risk management (identify, assess, manage risks). Per Rule 3, third parties hired to serve the company's own program are Risk Management Process, not Third-Party Risk—vendor oversight is not the central topic. All entities are unnamed and generic ('professional service firms,' 'cybersecurity consultants,' 'managed cybersecurity service providers'), with no named firms, frameworks, dates, or firm-specific facts.

thinking:
Classify this paragraph.

Content: describes use of third-party service providers for cybersecurity risk management. The central topic is about using external parties, but it's describing them as tools/resources the company uses in its own risk management process. Let me check Rule 3: "External assessor hired to test the company → Risk Management Process (they serve the company)." vs "Requirements imposed ON vendors → Third-Party Risk."

This is about engaging third parties to help with the company's own cybersecurity - they serve the company. This is Risk Management Process.

Wait, but Third-Party Risk covers "external assessor engagement." Let me re-read.

The rule distinguishes between hiring external assessors to test the company versus overseeing vendors' security posture. Since this is about using third parties as tools for the company's own risk management rather than vendor oversight, it falls under Risk Management Process. The language is generic throughout—just references to unnamed professional service firms and threat intelligence providers with no specific frameworks or named entities—so this is Generic Boilerplate.


reasoning: The paragraph describes the company's internal incident response escalation and vulnerability management policies — who gets notified, who works to mitigate, and the reporting chain to the Audit Committee. Applying the person-vs-function test: remove the role titles and the paragraph still describes an escalation process, so it is about the function, not the people. The specific composition of the escalation team (CFO, Executive Director of IT, VP of Finance) is a firm-specific team composition per the IS list, pushing specificity to Firm-Specific. However, no individual role here is a cybersecurity-specific title from the IS list (CFO and VP of Finance are generic C-suite/finance; Executive Director of IT is a general IT title per the NOT list), and there are no QV-eligible hard facts, so it does not reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes incident response escalation policies, naming specific roles (CFO, Executive Director of IT, VP of Finance) and reporting to Audit Committee.

Category: This is about incident response and vulnerability management policies - internal processes. The roles are mentioned as part of the escalation process, not as the primary subject (their qualifications, background, etc.). The person-vs-function test: remove the titles and the paragraph still describes an escalation/reporting process. → Risk Management Process.

Wait - let me reconsider. The paragraph describes WHO is involved in incident response escalation. CFO is generic C-suite (NOT list).

Looking at the specific titles mentioned: "Executive Director of IT" is a general IT role, not cybersecurity-specific per the IS list. "Vice President of Finance" and "Audit Committee" are both generic roles. The "incident response team" is also generic, and there are no named frameworks, specific dates, or tools referenced. This is fundamentally about the escalation process and policy structure, with roles serving as part of that flow. → Risk Management Process.

Wait, but the paragraph does specify exactly which roles are involved in the incident response escalation path—the CFO, Executive Director of IT, and Vice President of Finance working together. That's a firm-specific team composition, which the IS list identifies as cybersecurity-specific when it includes examples like "Legal, Compliance, and Finance." This particular combination of roles handling incidents is unique to this company.

fact: Escalation team comprises CFO, Executive Director of IT, and Vice President of Finance


reasoning: The paragraph's primary purpose is to establish which management roles (Executive Director of IT and CFO) are responsible for cybersecurity functions, delineating their respective duties. While it lists responsibilities, the communicative purpose is role assignment rather than process description. Both 'Executive Director of IT' (generic IT leadership per the NOT list) and 'CFO' (generic C-suite) fail to qualify as cybersecurity-specific titles, and no named frameworks, dates, or other specific facts appear, yielding Generic Boilerplate.

thinking:
Let me analyze this paragraph.

Content: Describes the Executive Director of IT and CFO's responsibilities regarding cybersecurity. This is about what these roles DO (functions/responsibilities), not about the persons' qualifications or background.

Person-vs-function test: If I remove the titles, the paragraph describes processes - hiring, integrating cyber risk into ERM, communicating priorities, preparing for incidents, approving processes, reviewing assessments. This is about functions/responsibilities rather than the person's credentials.

Wait - but the primary content is about WHO is responsible and WHAT their responsibilities are. The roles are the grammatical subjects. This is describing management responsibilities and reporting structure, not detailed process descriptions.

Actually, I'm seeing this is specifically about what the Executive Director of IT and CFO are responsible for - their functional duties rather than their qualifications. The codebook's Management Role category covers management committees and reporting lines, which seems to fit here, though the person-vs-function test is making me uncertain since the content focuses on responsibilities rather than detailed processes.

Looking at the examples, "Management is responsible for assessing and managing cybersecurity risks" maps closely to this paragraph's structure. The key distinction is that this is establishing WHO holds cybersecurity management authority and what they're accountable for, even though the duties themselves are fairly generic. I'm leaning toward Management Role because the primary purpose is delineating responsibility assignment to specific management positions.

Now checking the specificity criteria: "Executive Director of IT" isn't on the IS list—it's essentially a generic IT leadership title like "Director of IT," which the NOT list explicitly flags. CFO is also generic C-suite. With no IS-list titles and no named standards referenced, this falls into Generic Boilerplate.


reasoning: The paragraph primarily describes internal cybersecurity processes (risk assessments, safeguard design/implementation, monitoring effectiveness). The IT consultant's reporting line is secondary attribution, not a description of the person's qualifications or background. Applying the person-vs-function test: removing the role references, the paragraph still describes processes. No cybersecurity-specific titles (IT consultant and IT Manager are generic IT roles per the NOT list; COO is generic C-suite), no named frameworks, no firm-specific facts.

thinking:
Let me analyze this paragraph.

Content: Describes safeguards process (re-design, implement, maintain, monitor) and then attributes responsibility to an IT consultant who reports to IT Manager and COO.

Category: The paragraph describes internal processes (safeguards, risk assessments, monitoring) and then mentions who is responsible. The person-vs-function test: the paragraph is primarily about what the company does (processes), with the IT consultant mentioned as attribution. Remove the IT consultant reference and it still describes processes. → Risk Management Process.

Wait, but the second half is about reporting structure. Let me re-read.

The first sentence lays out the processes, and the second sentence identifies who owns them and their reporting chain. The process description dominates here, so this still falls under Risk Management Process. The IT consultant, IT Manager, and COO are all generic titles not specific to cybersecurity roles, so they don't push this into a different category.

Looking at the next part, there are no named frameworks, specific dates, or tools mentioned—just generic language without any IS-list standards or specifics. This reads as Generic Boilerplate.


reasoning: The paragraph's primary content is about which management roles (CFO, COO, Controller, Director-Finance) are involved in cybersecurity communications and reporting lines (CFO notifies Audit Committee and CEO). Management roles are the grammatical subjects performing actions. However, all titles listed (CFO, COO, Controller, Director-Finance, CEO) are generic C-suite/finance roles on the NOT list, 'Audit Committee' is standard governance, and 'IT consultants and auditors' are unnamed entities — no facts from the IS list remain after validation.

thinking:
Let me analyze this paragraph.

Content: Describes CFO, COO, Controller, and Director-Finance communicating with IT consultants/auditors, and CFO notifying Audit Committee and CEO of threats.

Category: This is about management roles and their responsibilities regarding cybersecurity communications/reporting. The grammatical subjects are management roles (CFO, COO, etc.). It describes reporting lines and communication structure. However, it's not about a cybersecurity-specific person's qualifications — it's about generic C-suite roles communicating.

The person-vs-function test: Is this about the people or the function? It's about who communicates with whom — reporting structure.

These are all generic C-suite and finance roles—CFO, COO, Controller, Director-Finance, CEO—with no cybersecurity-specific titles involved. The paragraph describes how management communicates about cybersecurity threats through standard reporting lines, which makes this fundamentally about management structure and responsibilities rather than specialized cybersecurity roles.


reasoning: The paragraph describes a specific cybersecurity incident — a network outage on February 23, 2023, the response actions taken, and a follow-up disclosure on February 28, 2023 about data extraction. This is squarely Incident Disclosure. Two specific dates are QV-eligible hard verifiable facts, reaching the Quantified-Verifiable threshold. The unnamed 'cyber-security experts and outside advisors' and 'DISH Network IT systems' (company self-reference) do not count as additional specific facts.

thinking:
Classifying this paragraph about DISH DBS CORP's cybersecurity incident.

Content: Describes a specific cybersecurity incident - network outage on Feb 23, 2023, response actions, and data extraction disclosed on Feb 28, 2023.

Category: Incident Disclosure - describes what happened, when, scope, response actions.

Specificity:
- Specific date: February 23, 2023 (QV-eligible)
- Specific date: February 28, 2023 (QV-eligible)
That's already 2 hard verifiable facts → Quantified-Verifiable

- References to "cyber-security experts and outside advisors" and "DISH Network IT systems" are too vague to count as specific verifiable details.

fact: February 23, 2023 — date of network outage

fact: February 28, 2023 — date of further disclosure about data extraction


reasoning: The paragraph opens with generic board language but its substantive, specific content is about the person filling the cybersecurity leadership role — their title, reporting line to the CEO, and 20+ years of experience. Per the tiebreaker, board oversight mentioned briefly plus management roles as main focus → Management Role. The title 'Director of Information Technology and Data Management Systems' is a general IT title (NOT list), but the specific years of experience (quantified fact) makes this Firm-Specific. Only one QV-eligible fact prevents Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: The paragraph starts with Board oversight, then transitions to management. Let me apply the dominant category test.

- First two sentences: Board identifies risks and works with management — Board Governance
- Last two sentences: Director of IT and Data Management Systems, reports to CEO, 20 years of experience — Management Role

The paragraph shifts from board to describing a specific person's qualifications. The last two sentences are about the person — their title, reporting line, experience. Let me assess which is dominant.

Two sentences about board, two sentences about the management person. The more specific/substantive content is about the person. The board sentences are generic ("one of the functions of our Board is to identify principal risks").

The management sentences contain firm-specific details about the Director of IT — their title, reporting line, and experience — which is far more substantive than the generic board language. The paragraph's most informative content centers on this person's qualifications and role. I'd categorize this as Management Role.

Now checking the specificity of the title: "Director of Information Technology and Data Management Systems" is a general IT leadership position rather than a specialized information security role.

Looking at what qualifies as QV-eligible: the "over 20 years of experience" is a specific quantifiable fact, and the reporting line to the CEO is documented. But that's just one QV fact. The title itself is essentially a generic "Director of IT" — which the NOT list flags as non-cybersecurity-specific — even though it's worded in a detailed way.

So I'm landing on Firm-Specific (Level 3) since I have one IS fact but can't reach the two QV facts needed for higher classification.

fact: over 20 years of experience with cybersecurity and IT


reasoning: The paragraph describes the operational impact and restoration timeline of a specific cybersecurity incident, making it Incident Disclosure. Two hard verifiable facts — named products/services (DISH TV, SLING TV) and a specific date (March 31, 2023) — qualify it as Quantified-Verifiable.

thinking:
Classifying this paragraph about DISH DBS CORP's cybersecurity incident.

This describes the operational status during an incident, system restoration timeline, and conclusion assessment. It's about what happened with a specific incident.

Content: Incident Disclosure - describes operational impact, restoration timeline, and status of a specific cybersecurity incident.

Specific facts:
- "DISH TV and SLING TV services" - named systems/products
- "March 31, 2023" - specific date

Two hard verifiable facts (named products + specific date) → Quantified-Verifiable

fact: DISH TV and SLING TV services named as remaining operational

fact: March 31, 2023 — date by which all significant systems restored


reasoning: The paragraph describes the company's internal escalation process for cybersecurity threats — how threats move from detection through management layers to the board. While multiple roles are named (CISO, CIO, CRO, CFO, General Counsel), they appear as components of the escalation workflow, not as descriptions of the people themselves; the person-vs-function test points to Risk Management Process. Specificity is Firm-Specific: multiple IS-list facts (CISO, CIO, Risk Committee, 15 years experience) but only one QV-eligible hard fact (over 15 years), falling short of the two needed for Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes an escalation process for cybersecurity threats - how they move up the chain from detection to management to board. Mentions specific roles (CISO, CIO, CRO, CFO, General Counsel), describes their expertise, mentions "over 15 years of experience", and mentions Risk Committee.

Category: This is about the company's internal process for escalating cybersecurity threats. The person-vs-function test: the paragraph describes the escalation process, not the people themselves. The roles are mentioned as part of the escalation chain, not to describe their backgrounds. The "over 15 years of experience" is a brief aside.

Now I'm checking which roles fit the IS list criteria. CISO and CIO are clearly cybersecurity-specific titles that qualify. The Chief Risk Officer isn't explicitly listed in the IS categories, but CFO and General Counsel are on the exclusion list. I also notice the "over 15 years of experience" is a quantified detail, and the Risk Committee is a named non-generic committee, both of which are relevant to the classification.

Looking at what counts toward QV eligibility, only the years of experience metric qualifies as a specific number. That gives me one QV-eligible fact, which means this falls into Firm-Specific rather than QV—with the supporting facts being the CISO, CIO, Risk Committee, and the experience quantification.

fact: CISO

fact: Chief Information Officer

fact: over 15 years of experience in their respective fields


reasoning: The grammatical subjects are the CEO, CFO, and corporate controller — management figures described as having cybersecurity experience and providing briefings to the audit committee. This is management reporting TO the board, making management the primary actor (Management Role per Rule 2). However, all titles mentioned (CEO, CFO, corporate controller, Audit Committee) are on the NOT list as generic C-suite/governance terms, and 'once per year' is a generic cadence, so no IS-list facts remain after validation — Generic Boilerplate.

thinking:
Let me analyze this paragraph.

The paragraph discusses CEO, CFO, and corporate controller's experience in cybersecurity risk, and their role briefing the audit committee. The primary actors are management figures (CEO, CFO, corporate controller) briefing the audit committee.

Category: The grammatical subjects are "chief executive officer, chief financial officer and corporate controller" - these are management figures. They brief the audit committee. The paragraph is about what these people do (brief the committee) and their experience. But wait - CEO, CFO, corporate controller are generic C-suite titles per the NOT list.

Is this Board Governance or Management Role? The paragraph describes management briefing the board committee.

The primary actors are management providing briefings to the audit committee, which fits the Management Role category by the tiebreaker rule. Even though the content touches on briefing cadence to the board, the focus is on what these management figures do and their operational experience rather than the governance structure itself.

Looking at specificity, everything here falls into generic territory: CEO, CFO, and corporate controller are all on the NOT list, "audit committee" is generic, and "minimum frequency of once per year" is just a standard cadence with no concrete details. There are no named cybersecurity roles like CISO or CTO, no specific dates, no named organizations, and no referenced frameworks.

This is Generic Boilerplate.


reasoning: The Board of Directors is the grammatical subject throughout, with the paragraph describing board oversight responsibility, committee oversight structure, and board-level cybersecurity expertise — all hallmarks of Board Governance. No facts from the IS list are present: 'Board of Directors,' 'Audit Committee,' 'management,' and generic ERM references are all on the NOT list. The four risk areas (strategic, compliance, operational, financial) are standard ERM categories, not firm-specific. No named frameworks, cybersecurity-specific roles, dates, or quantified facts appear.

thinking:
Let me analyze this paragraph.

Content: Board oversight of cybersecurity risks, ERM framework, board committees, Audit Committee expertise mention, governance commitment.

Category: Board Governance - the Board is the grammatical subject throughout, discussing oversight responsibility, committee structure, and board expertise.

Specificity: Let me check the facts:
- "Board of Directors" - generic (NOT list)
- "Enterprise Risk Management framework" - generic program name
- "Audit Committee" - generic (NOT list)
- "four areas of risk: strategic, compliance, operational, and financial" - this is a specific organizational detail about how they categorize risk

- Board members having cybersecurity expertise - a generic claim with no specifics
- The four risk categories don't appear on the IS list, and there are no named frameworks, cybersecurity-specific roles, dates, or numbers

This is Generic Boilerplate.


reasoning: The paragraph describes integration of cybersecurity risk management into the overall ERM program, which is a process description. No named frameworks, specific roles, dates, or firm-specific facts are present — this is generic language about ERM integration that could apply to any externally managed company.


reasoning: The paragraph contains an explicit materiality assessment ('have materially affected or are reasonably likely to materially affect us or our business strategy, results of operations or financial condition'), making it Strategy Integration per Rule 6. The appended cross-reference to Risk Factors does not change the classification. No specific facts from the IS list are present — only boilerplate materiality language and a generic cross-reference.

thinking: Materiality assessment with cross-reference.