reasoning: The first sentence states a backward-looking materiality conclusion ('have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition'), making this SI per the materiality assessment rule; the cross-reference to Item 1A is subordinate. Specificity is Level 1: 'In 2023' is reporting-period context not a cybersecurity fact, the negative assertion about no material breaches is not externally verifiable, and the remaining language is standard SEC boilerplate with no domain terminology or firm-specific details.

thinking:
Let me analyze this paragraph.

Content: Two sentences. First states no material cybersecurity breaches in 2023 (backward-looking materiality assessment). Second is a cross-reference to Item 1A.

Category: The first sentence is a materiality assessment - "have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition" → SI per Rule 5. The cross-reference is subordinate (N/O vs SI rule: "Risks have not materially affected us. See Item 1A" → SI).

The language here is entirely generic—just standard SEC boilerplate with no specific details about the company's actual cybersecurity posture, no domain-specific terminology, and nothing verifiable beyond the bare assertion that no material breaches occurred in 2023. This falls squarely into Generic Boilerplate at Level 1.


content_category: Third-Party Risk

fact: Vendor Management Committee

fact: Vendor Management team

category_confidence: high

specificity_confidence: high

reasoning: The paragraph centrally answers 'how are third-party cyber risks managed?' — describing due diligence for new vendors, annual reviews of existing vendors, and reporting to a committee, all focused on vendor oversight. The named Vendor Management Committee and Vendor Management team are firm-specific organizational details that elevate beyond generic language, but no quantified or externally verifiable facts are present.

provider: anthropic

generationId: agent-sdk

stage: benchmark

thinking:
Let me analyze this paragraph.

Content: About managing third-party vendor cybersecurity risks. The central topic is vendor oversight.

Category: Third-Party Risk (TP) - clearly about how third-party cyber risks are managed. Requirements/assessments imposed ON vendors.

Specificity:
- "Vendor Management Committee" - named non-generic committee → firm-specific (Level 3)
- "Vendor Management team" - named team → firm-specific
- "cybersecurity, data and privacy protection" - general terms

- "due diligence analysis" - general business term
- "business continuity" - general term, not domain-specific

No QV facts present. The firm-specific elements are the named committees and teams, which puts this at Level 3.


content_category: Risk Management Process

fact: defense-in-depth approach

fact: National Institute of Standards and Technology Cyber Security Framework (NIST CSF)

type: framework

fact: vulnerability scanning

fact: penetration testing

fact: encryption

fact: identity and access management controls

fact: multi-factor authentication

fact: endpoint technology including threat management and monitoring

fact: cyber risk scoring (for third parties)

fact: Named internal program: "Written Information Security Program"

specificity_confidence: medium

reasoning: The paragraph primarily answers 'What does the cybersecurity program do?' by describing a defense-in-depth approach, NIST CSF alignment, and six key program areas covering proactive/reactive processes, endpoint technology, IAM, training, and third-party risk. Third-party risk and a brief materiality-adjacent clause are subordinate to the overall program description. Rich domain terminology elevates to Level 2, and the named 'Written Information Security Program' as a distinguishing internal program identifier pushes to Level 3, though no externally verifiable quantified facts are present to reach Level 4.

thinking:
Let me analyze this paragraph carefully.

Content Category: This paragraph describes what the cybersecurity program does - multiple security measures, framework alignment, six key areas of focus. It answers "What does the cybersecurity program do?" → RMP.

There's a materiality clause ("reasonably likely to defend against risks of cybersecurity threats that would have a material impact") but this is not stating a conclusion about whether cybersecurity HAS affected the business - it's describing the program's goal. It's closer to "material" as adjective. Actually, re-reading: "is reasonably likely to defend against risks of cybersecurity threats that would have a material impact" - this is about the program's capability, not a materiality assessment per se. The dominant content is clearly RMP.

Third-party risk management is woven in as one component of the overall program structure. Looking at the specificity level, I see domain terminology like defense-in-depth, NIST CSF, vulnerability scanning, penetration testing, encryption, identity and access management, multi-factor authentication, and endpoint technology. The program itself has a firm-specific identifier - "Written Information Security Program" - but I don't spot any quantified or dated details that would push this into the highest specificity tier. The security partners mentioned are generic references without names or specifics.

I'm reconsidering whether "Written Information Security Program" truly qualifies as a distinguishing identifier. It's a regulatory requirement in many jurisdictions, so it's fairly standard terminology rather than unique to this firm. Still, it's presented as their named program, so I'll count it as firm-specific. The six-key-areas framework is structural but not uniquely identifying. This lands at Level 3.


content_category: Management Role

fact: Managing Director of Enterprise IT

fact: over 30 years of IT experience

type: quantified

fact: over 20 years specializing in cybersecurity

reasoning: The paragraph primarily answers 'how is management organized to handle cybersecurity?' — it identifies who leads the program, their reporting line, qualifications, and how updates flow to senior executives. Person-removal test: removing the roles, experience, and reporting lines leaves only a generic sentence about identifying and assessing risks, confirming MR. Specificity is Level 4 due to quantified lower-bound years of experience ('over 30 years,' 'over 20 years') which are independently checkable against the individual's resume.

thinking:
Let me analyze this paragraph.

Category: This describes management's organizational role - who leads cybersecurity, their qualifications, reporting lines, and how updates flow to executives. The person-removal test: remove "Senior Manager of Enterprise IT Security Risk and Compliance team," "reports to Managing Director of Enterprise IT," "30 years IT experience, 20 years cybersecurity," reporting to CEO/COO/CFO/GC. What remains? Generic program description about identifying, assessing, preparing for threats. But the primary content is about the person and their role. This is MR.

The specificity here comes from the quantified experience - over 30 years in IT and over 20 years in cybersecurity are concrete, verifiable metrics. The role titles are firm-specific, though the executive reporting lines are generic. That combination of measurable credentials pushes this to Level 4.


content_category: None/Other

category_confidence: medium

reasoning: The paragraph describes the general cyber threat landscape (threat actors, ransomware targeting banks, phishing increases, nation-state threats) but does not answer any of the six substantive questions — it does not describe what the company's program does, how the board oversees cyber, how management is organized, any specific incident, or a materiality conclusion. 'Despite the significant resources and security measures' is a passing acknowledgment, not a description of actual measures. As N/O, specificity is automatically Level 1.

thinking:
Let me classify this paragraph.

Content: Discusses cyber risks in general terms - threat actors, ransomware, phishing, nation state threats. This is general risk language about the threat landscape, not describing what the company's program does, not about board oversight, not about management, not about incidents that happened, not a materiality assessment.

Category: This is general risk commentary. It doesn't answer any of the six substantive questions directly. It's not describing their program (RMP), not an incident (ID), not a materiality conclusion (SI). It's general threat landscape commentary. Could be N/O or possibly SI if it's about how cyber affects business - but it's not stating a materiality conclusion. It's more like general risk acknowledgment.

The paragraph mentions "significant resources and security measures" in passing but doesn't actually describe what those measures are, so it's still just general threat landscape commentary without substantive disclosure about the company's program or governance. This looks like None/Other - general risk acknowledgment without answering any of the six substantive questions, which means it would get Specificity 1.


reasoning: The paragraph opens with generic risk speculation ('could have a material adverse effect' — not a materiality assessment per Rule 5) and regulatory context, then describes establishing a cybersecurity risk management program that safeguards data, transactions, and systems — answering 'what does the program do?' albeit at a very high level, making it RMP over N/O. All language is general business terminology: 'robust cybersecurity risk management program,' 'enterprise risk management strategy,' named regulators (FRB, FDIC, DFR) are generic to every bank and not cybersecurity-specific verifiable claims. No domain terminology passes the ERM test, no firm-specific or QV facts.

thinking:
Let me analyze this paragraph.

Content: This paragraph discusses cybersecurity risks, mentions potential material adverse effects (speculation, not an assessment), regulatory compliance, and then mentions establishing a cybersecurity risk management program. The "could have a material adverse effect" is speculation per the codebook. The paragraph ends by describing the program at a very high level.

Category: The paragraph is a mix. It starts with risk speculation, mentions regulatory requirements, and then says the company "established a robust cybersecurity risk management program" that "safeguards sensitive customer data, financial transactions, and our information systems." This is an introductory paragraph that primarily sets up the cybersecurity program. The most substantive content answers "what does the cybersecurity program do?" - though very generically.

So this is RMP since the program description is the main substantive element, even if it's vague. The speculation about material adverse effects doesn't count, and the regulatory mentions are just generic references. But there's enough actual content about what the program does to make it substantive rather than nothing.

Now I'm checking the specificity. Looking for concrete facts—I see "FRB, FDIC and the DFR" which are named regulatory bodies, but they're just listed as regulators without any specific context or requirements tied to them.  Every bank has these regulators, so that's not really a cybersecurity-specific fact. The program itself is called a "cybersecurity risk management program" and mentions "enterprise risk management," but these are just generic terms without any firm-specific details or domain terminology that would elevate it. There's no substantive cybersecurity content beyond the basic acknowledgment that the program exists. This is Level 1.


content_category: Board Governance

fact: Chief Capability Officer (CCO)

fact: Chief Information Officer (CIO)

reasoning: The paragraph primarily answers 'How does the board oversee cybersecurity?' — the Audit Committee receives reports and engages with management on cybersecurity topics, with audit results flowing back to the committee. This is a classic oversight-structure paragraph (BG). The CCO, CIO, and CISO are firm-specific cybersecurity leadership titles (VP+ level), elevating to Level 3, but no QV-eligible facts are present (quarterly is a generic cadence, third-party audits are unnamed).

thinking:
Let me analyze this paragraph.

Content: Audit Committee receives quarterly reports, engages with CCO/CIO/CISO on cybersecurity topics, and program is evaluated through audits with results reported to Audit Committee.

Category: This is about how the board (via Audit Committee) oversees cybersecurity. The primary question answered is "How does the board oversee cybersecurity?" → Board Governance.

Specificity: Let me scan for facts.
- "Chief Capability Officer (CCO)" - named role, firm-specific
- "Chief Information Officer (CIO)" - firm-specific cybersecurity-adjacent role (VP+ level)

- "Chief Information Security Officer (CISO)" - firm-specific named role
- "incident response and recovery protocols" - generic ERM language
- "associate trainings and awareness" - generic
- "internal and third-party audits and assessments" - generic

The CCO, CIO, and CISO are firm-specific titles (VP+ level cybersecurity roles). No QV-eligible facts (quarterly is generic cadence, no specific dates/numbers/named firms/certifications).

Level 3 - Firm-Specific.


fact: CISO as cybersecurity leadership role

fact: 30 years of information technology experience

fact: 17 years focused specifically on information security and risk management

reasoning: The paragraph primarily answers 'how is management organized?' — it names the CISO role, describes responsibilities, and details qualifications/experience. Person-removal test: removing the CISO and experience details leaves only a generic program mention ('development, operation, and maintenance of our information security program'), confirming MR. Specificity is Level 4 due to two specific numeric experience claims (30 years IT, 17 years infosec) that are independently verifiable against the individual's resume or LinkedIn.

thinking:
Let me classify this paragraph.

Content Category: The paragraph describes who (CISO) is responsible and their qualifications/experience. Person-removal test: remove CISO, 30 years, 17 years, leadership skills, technical knowledge → "development, operation, and maintenance of our information security program, including assessing and managing risk from cybersecurity threats" — some program description remains but it's generic. The primary content is about the CISO's role and qualifications. → MR

Specificity:
- CISO → firm-specific (Level 3)
- 30 years of IT experience → quantified, verifiable (Level 4)

- 17 years in information security → quantified, verifiable (Level 4)


content_category: Strategy Integration

reasoning: The first sentence states a conclusion about materiality ('have not materially affected or are reasonably likely to materially affect'), which is the SEC's required backward- and forward-looking assessment — making this SI. The remainder is speculation ('could') and a cross-reference to Item 1A, both subordinate. No domain terminology, firm-specific facts, or verifiable claims; 'Pinnacle West or APS' are company self-references, not firm-specific details.

thinking:
Let me analyze this paragraph.

The first sentence is a materiality assessment: "we do not believe there have been risks from cybersecurity threats... that have materially affected or are reasonably likely to materially affect" → SI (backward-looking + forward-looking assessment).

The second sentence is a caveat. The third sentence is speculation ("If a significant cybersecurity event or incident were to occur... could all be materially impacted") - this is "could" language, not an assessment. The fourth sentence is a cross-reference to Item 1A.

The primary content is the materiality assessment in the first sentence → Strategy Integration.

This is generic boilerplate language with no domain-specific terminology or company-particular facts—just standard materiality disclaimers and self-references. Level 1.


reasoning: The paragraph contains a backward-looking materiality assessment ('we have not been subject to cyber attacks that, individually or in the aggregate, have been material to Verizon's operations or financial condition'), which is a conclusion about whether cybersecurity has affected business outcomes → SI per Rule 5. The surrounding general threat language and cross-reference to Item 1A are subordinate. Specificity is Level 1: no domain terminology (just general 'cyber attacks'), no firm-specific facts ('Verizon' is a self-reference), and the negative materiality assertion is not externally verifiable.

thinking:
Let me analyze this paragraph.

Content: Mixed - starts with general cyber threat language, then has a materiality assessment ("we have not been subject to cyber attacks that, individually or in the aggregate, have been material to Verizon's operations or financial condition"), then a cross-reference to Item 1A.

Category: The materiality assessment is the key substantive statement. "We have not been subject to cyber attacks that...have been material to Verizon's operations or financial condition" - this is a backward-looking materiality conclusion → SI. The cross-reference and general threat language are subordinate.

The forward-looking disclaimer about future incidents and the cross-reference to Item 1A are secondary elements, but the core of this is the negative materiality assertion—that Verizon hasn't experienced material cyber attacks. This self-assertion isn't externally verifiable and lacks specific operational details or committee references, so it fits the SI category.

Looking at the language itself, "cyber attacks" is generic terminology with no domain-specific jargon or firm-specific facts beyond the company name. There's no quantifiable data or evidence of firm-specific governance structures, which puts this squarely at Level 1—generic boilerplate.


reasoning: The paragraph describes how the Audit Committee and Board oversee cybersecurity risk, directly answering 'How does the board oversee cybersecurity?' No domain terminology, no firm-specific facts (Audit Committee exists at every public company), and no verifiable claims — remains Level 1.


reasoning: The paragraph centrally answers 'how are third-party cyber risks managed?' — describing vendor selection, oversight, and contractual obligations imposed on providers, making it TP. No domain terminology (just generic language like 'cybersecurity programs,' 'industry standards,' 'vendor management process'), no firm-specific facts, and no verifiable claims — everything here could appear in any company's filing unchanged.


fact: CIO as leader of DTI organization

fact: CISO as leader of CDT function

fact: CDT (Cyber Defense Technology) team responsible for monitoring, detecting, mitigating, and remediating

fact: DTI organization

fact: Incident Response team includes CISO and senior CDT members

reasoning: The paragraph primarily answers 'how is management organized to handle cybersecurity?' — it describes the CIO and CISO roles, the CDT team's responsibilities, the Incident Response team's composition, and how information flows between them. While monitoring/detection/remediation activities are mentioned, they serve to define each role's responsibilities rather than describe program processes in depth. Person-removal test: removing CIO, CISO, CDT team, and Incident Response team leaves only generic process language ('monitor threats, detect incidents, evaluate severity'), confirming MR. Specificity is Level 3 due to firm-specific named roles (CIO, CISO) and named internal teams (DTI, CDT, Incident Response team), but no QV-eligible facts.

thinking:
Let me analyze this paragraph.

Content: Describes how CIO and CISO monitor threats through internal reporting structure, CDT team responsibilities for monitoring/detecting/mitigating, incident response flow.

Category: This is about how management is organized to handle cybersecurity - roles, responsibilities, reporting lines, team structure. But let me apply the person-removal test: remove CIO, CISO, titles, reporting lines. What remains? "The Company's... organization monitors significant cybersecurity threats and incidents through internal reporting structure. The team is responsible for monitoring and detecting cybersecurity threats and incidents. The team is also responsible for mitigation and remediation.

When threats or incidents are detected—whether internally or through third-party service providers—they're escalated to the Incident Response team, which then assesses severity and communicates the findings. So there's a clear process here: detection triggers escalation, which triggers evaluation and communication. But again, the core of this is organizational structure and who communicates what to whom. The remaining content is about evaluating severity and sharing findings once threats are detected. Looking at the specificity here—the roles mentioned like CISO and the named teams are all firm-specific organizational references, with no quantifiable facts or external certifications involved. This is clearly Level 3, firm-specific information.


fact: Third Party Risk Management (TPRM) program — named internal program with distinguishing identifier

reasoning: The paragraph primarily answers 'how are third-party cyber risks managed?' by describing the TPRM program, vendor due diligence reviews, and ongoing supplier monitoring. The final sentence reads as a section header posing the materiality question rather than stating a conclusion, so it does not trigger SI. The named 'Third Party Risk Management (TPRM) program' is a firm-specific identifier elevating specificity to Level 3, but the remaining language (due diligence reviews, policies and standards, periodic reviews) is generic and does not include domain terminology or verifiable facts.

thinking:
Let me analyze this paragraph.

Content: This paragraph discusses third-party risk management (TPRM program), vendor cybersecurity due diligence, and ends with what appears to be a section header/transition about materiality.

Category: The primary content is about how third-party cyber risks are managed - the TPRM program, vendor due diligence, monitoring suppliers. The last sentence looks like a section header (SEC required language). The bulk is about third-party risk management → **Third-Party Risk**.

Wait, the last sentence "Whether any risks from cybersecurity threats...

...have materially affected or are reasonably likely to materially affect Unisys..." - this reads like a section header/topic sentence rather than an actual materiality assessment. It's not stating a conclusion, it's posing the question. So it doesn't trigger SI.

The majority of the text is about the TPRM program → **Third-Party Risk**.

Specificity:
- "Third Party Risk Management (TPRM) program" - named internal program with distinguishing identifier → firm-specific (Level 3)
- The rest is fairly generic - "cybersecurity due diligence reviews," "policies and standards," "periodic reviews" - general business language
- No domain terminology that passes

The last sentence is just a question framing the materiality issue rather than actually assessing it, so it doesn't count as a substantive statement. The real substance here is the TPRM program itself—that's the firm-specific element. Everything else about due diligence and monitoring is standard practice language that doesn't add specificity.


fact: Vice President of Cybersecurity

reasoning: The paragraph answers 'how does the board oversee cybersecurity?' — describing Board and Audit Committee oversight, briefing cadences, and escalation processes. The VP of Cybersecurity is a firm-specific cybersecurity leadership title (VP-level), elevating to Level 3; cadences like 'quarterly' and 'semi-annual' are generic and not QV-eligible, and 'Audit Committee' exists at every public company.

thinking:
Board oversight, committee structure, briefing frequency, escalation path.

Category: Board Governance - clearly about how the board oversees cybersecurity.

Specificity: Let me scan for facts.
- "Vice President of Cybersecurity" - firm-specific cybersecurity role (VP-level+)
- "quarterly basis" - generic cadence, not QV
- "semi-annual basis" - generic cadence
- "Audit Committee" - not firm-specific (every company has one)

No QV facts (no specific numbers, dates, named external entities, certifications). VP of Cybersecurity is firm-specific → Level 3.


fact: Director of Cybersecurity

fact: CIO reports directly to CEO

fact: Both CIO and Director of Cybersecurity have over 20 years of cybersecurity oversight experience

reasoning: The paragraph answers 'how is management organized to handle cybersecurity?' by detailing roles (Director of Cybersecurity, CIO), reporting lines (CIO → CEO), responsibilities, and career backgrounds. Person-removal test leaves almost nothing substantive. Specificity reaches Level 4 because 'over 20 years of cybersecurity oversight experience' is a lower-bound quantified claim that could be verified against resumes or professional records.

thinking:
Let me analyze this paragraph.

Content: Describes management positions (Director of Cybersecurity, CIO), their reporting lines, responsibilities, qualifications, and experience.

Category: This is primarily about how management is organized - roles, reporting lines, qualifications, experience. Person-removal test: remove all person-specific content and almost nothing remains. → MR

Specificity:
- "Director of Cybersecurity" - firm-specific (Director-level with security qualifier)
- "CIO" - firm-specific cybersecurity leadership role
- "over 20 years of cybersecurity oversight experience" - QV (lower bound, verifiable)

- "New York Stock Exchange listed manufacturing company" - not a named firm, not QV
- The "over 20 years" threshold appears twice, establishing a verifiable lower bound → QV

This lands at Level 4.


fact: CDO (Chief Digital Officer)

fact: CISO

fact: collectively over 25 years of prior work experience

fact: ISACA Certified Information Security Manager (CISM)

fact: ISC2 Certified Information Systems Security Professional (CISSP)

fact: ISACA (named external organization)

fact: ISC2 (named external organization)

reasoning: The paragraph answers 'how is management organized?' by describing the CDO and CISO's qualifications, required certifications, and experience; person-removal test leaves almost nothing substantive → MR. Specificity reaches Level 4 via 'over 25 years' (verifiable lower bound), named certifications CISSP and CISM (verifiable via issuing bodies ISC2 and ISACA), and the named external organizations themselves.

thinking:
Let me analyze this paragraph.

Content: Describes CDO and CISO roles, their collective experience (25+ years), required certifications (CISM, CISSP), and how they monitor cybersecurity incidents through management processes.

Category: This is primarily about management's organizational role - who leads cybersecurity, their qualifications, credentials. Person-removal test: remove CDO, CISO, their experience, certifications, job descriptions → very little remains. → MR

Specificity:
- CDO → named_role (firm-specific)
- CISO → named_role (firm-specific)
- "over 25 years" → quantified (verifiable lower bound)

- CISM and CISSP are both industry-recognized certifications issued by ISACA and ISC2 respectively, making them verifiable credentials. Level 4.


content_category: Incident Disclosure

fact: Specific date of disclosure: February 22, 2024

fact: cybercrime threat actors

reasoning: The paragraph primarily describes an actual cybersecurity incident — its disclosure, ongoing investigation, and attribution to cybercrime threat actors — making ID the dominant frame (occupying ~2/3 of text), with the materiality assessment in the final sentence subordinate to the incident context (Rule 4: mixed with incident frame dominant → ID). The specific date 'February 22, 2024' tied to the incident disclosure is a QV-eligible fact, elevating specificity to Level 4.

thinking:
Let me analyze this paragraph.

Content: Describes a cybersecurity incident (Feb 22, 2024 disclosure), ongoing investigation, cybercrime threat actors, and a materiality assessment.

Category: This touches both ID and SI. The paragraph describes an actual incident (what happened) AND states a materiality conclusion. Let me apply Rule 4: Mixed content. The paragraph has three sentences: (1) disclosed an incident, (2) investigating, committed by cybercrime threat actors, (3) materiality assessment. It's split between ID and SI. The incident frame (what happened, investigation) occupies more text, but the materiality conclusion is significant.

Actually, I'm reconsidering the weight here. The incident details take up roughly two-thirds of the text, which would favor ID under the rule about text volume. But the materiality assessment is SEC-required language and represents the core conclusion. The paragraph seems designed to both disclose what happened and establish its materiality status, making this genuinely split between the two categories.

Given the text dominance of the incident frame, ID wins. The specific date of February 22, 2024 tied to the incident pushes this to Level 4 for specificity, while the materiality assessment itself doesn't add qualitative value since it's a negative self-assertion rather than external validation.


fact: insider threats

fact: supply chain incidents

reasoning: The paragraph contains a backward-looking materiality assessment ('prior cybersecurity threats have not materially affected our business strategy, results of operations or financial condition'), which is a clear SI conclusion per the materiality rule. The speculation ('could be negatively impacted') and Item 1A cross-reference are subordinate. For specificity, 'insider threats' and 'supply chain incidents' are security-specific threat categorizations that pass the ERM test, elevating to Level 2, though the paragraph is otherwise generic business language.

thinking:
Let me analyze this paragraph.

Content: Mixed paragraph with materiality assessment + speculation + cross-reference.

Key sentences:
1. "prior cybersecurity threats have not materially affected our business strategy, results of operations or financial condition" — backward-looking materiality assessment → SI
2. "we could be negatively impacted by a cybersecurity breach" — speculation ("could") → NOT SI
3. Cross-reference to Item 1A → N/O element

The first sentence contains a materiality conclusion (backward-looking). Per Rule 5, this is SI. The speculation and cross-reference are subordinate.

Now I'm checking whether the threat categories listed—cyber-attacks, intrusions, insider threats, supply chain incidents—demonstrate domain-specific expertise or just common terminology. These terms are fairly standard in cybersecurity discussions, so they don't necessarily indicate specialized knowledge beyond what a general ERM professional would know. Looking at the specific terms in the codebook—ransomware, malware, phishing, DDoS, supply chain attack/compromise, social engineering, APT, zero-day—I can see that "supply chain incidents" maps directly to "supply chain attack/compromise," which qualifies as domain terminology. "Insider threats" also appears to be security-specific enough. So I'm settling on Level 2 for this paragraph based on those two domain terms, though I acknowledge "supply chain incidents" is somewhat vague as a descriptor. Insider threats and supply chain incidents are specific security domain terms that map directly to the codebook examples, so I'm classifying these as Level 2. The backward-looking materiality assessment clearly signals a SI category.


fact: Risk Committee designated for cybersecurity oversight

fact: CISO (Chief Information Security Officer)

fact: vulnerability assessments

reasoning: The paragraph primarily answers 'How does the board oversee cybersecurity?' — describing the Risk Committee's oversight role, how it reviews risk appetite/tolerance, receives reports from the CISO, and the Board's annual cybersecurity reporting. The CISO is mentioned in the context of reporting TO the committee (oversight flow), keeping this BG rather than MR. Specificity reaches Level 3 via the named Risk Committee (a non-generic board committee) and CISO title; 'vulnerability assessments' is a domain term but the firm-specific facts set the floor higher.

thinking:
Let me analyze this paragraph.

Content Category: This is about how the board (Risk Committee) oversees cybersecurity. The primary question answered is "How does the board oversee cybersecurity?" → Board Governance.

The paragraph describes: Risk Committee's role, how it oversees management's risk framework, key risk indicators, risk appetite/tolerance review and approval, regular presentations from CISO to Risk Committee, and annual reports to the Board.

While CISO is mentioned, it's in the context of reporting TO the board/committee — describing the oversight flow, not management's organizational role.

Now I'm evaluating the specificity of the terms used. "Risk Committee" and "CISO" are firm-specific identifiers, while terms like "vulnerability assessments" are domain-specific. Other elements like "risk assessment," "ERM program," and "key risk indicators" are general risk management concepts rather than cybersecurity-specific. This combination of firm-specific and domain-specific language points to a Level 3 classification, though I need to verify whether "Risk Committee" itself qualifies as firm-specific or if it's a generic governance structure. So the highest classification here is Level 3 for the firm-specific committee designation, and the frequency mention of "at least annually" doesn't change that since it's just a generic cadence descriptor.


reasoning: The first sentence states a backward-looking and forward-looking materiality conclusion ('have not materially affected or are reasonably likely to materially affect'), making this SI per the materiality assessment rule. The cross-reference to Item 1A is subordinate. No domain terminology, firm-specific facts, or verifiable claims are present; 'December 31, 2024' is reporting period context, not a cybersecurity fact.

thinking:
Materiality assessment + cross-reference.

The first sentence states a conclusion about materiality (backward-looking + forward-looking) → SI per Rule 5.

The second sentence is a cross-reference to Item 1A → N/O if standalone, but subordinate here.

Primary content: SI.

Specificity: "For the year ended December 31, 2024" is reporting period context, not a cybersecurity fact. The materiality language is boilerplate. No domain terms, no firm-specific facts, no QV facts.

This is a Level 1 disclosure.


fact: CIO and his security management team possess primary responsibility

reasoning: The first sentence addresses management's role (MR), but the majority of the paragraph describes the Board of Directors' annual cybersecurity review and the Audit Committee's quarterly updates — answering 'how does the board oversee cybersecurity?' The governance-chain rule assigns BG when the purpose is describing oversight structure. Specificity reaches Level 3 because 'CIO' is a cybersecurity-specific leadership title (firm-specific), but there are no verifiable quantities, dates, or named external entities to reach Level 4.

thinking:
Let me analyze this paragraph.

Category: This paragraph covers multiple topics - CIO and security team responsibility (MR), Board oversight (BG), and Audit Committee oversight (BG). The primary question: the first sentence is about management's role, but the bulk of the text (sentences 2 and 3) describes how the Board and Audit Committee oversee cybersecurity. The governance-chain rule says these default to BG when describing oversight structure. Most text is about board/committee oversight → BG.

Specificity: Let me scan for facts.
- "CIO" — this is a general C-suite title, not cybersecurity-specific.

Actually, checking the codebook again, CIO IS listed as a cybersecurity-specific title at VP level or above, so that qualifies as firm-specific (Level 3).
- "security management team" — generic
- "Board of Directors" — not firm-specific
- "Audit Committee" — not firm-specific
- "annual review" — generic cadence
- "quarterly cybersecurity updates" — generic cadence

No QV-eligible facts here—no specific numbers, dates, named external entities, or certifications.

So this is Level 3.


reasoning: The paragraph makes multiple materiality conclusions — 'results of operations and financial condition have not been materially affected' (backward-looking) and 'cybersecurity threats have materially affected our business strategy and processes' — squarely answering how cybersecurity affects the business. Specificity remains Level 1 because the entire paragraph uses generic business/risk language ('significant resources,' 'robust program of information security and controls,' 'security measures and procedures') with no domain terminology, firm-specific facts, or verifiable claims.

thinking:
This is a Strategy Integration paragraph - it's making materiality assessments about cybersecurity's impact on business/finances.

Let me analyze:

Content Category: Strategy Integration (SI)
- "results of operations and financial condition have not been materially affected" → backward-looking materiality assessment
- "cybersecurity threats and other technological risks involving our systems have materially affected our business strategy and processes" → another materiality conclusion
- "invested and expect to continue to invest significant resources" → budget/investment
- The paragraph is primarily answering "How does cybersecurity affect the business or finances?"

Specificity:

The paragraph lacks domain terminology, named roles, specific facts, or quantified details - just generic risk and business language throughout. There are no firm-specific facts or QV-eligible information here. This is Level 1 boilerplate.


reasoning: This paragraph is a cross-reference pointing to Item 1A Risk Factors for the materiality discussion. Per the N/O vs SI rule, a cross-reference is N/O even if it mentions materiality — 'risks that may materially affect us, see Item 1A' pattern. The paragraph does not itself state a conclusion about materiality; it describes what another section covers. N/O always receives Specificity 1.


reasoning: The paragraph states multiple materiality conclusions — 'have not been materially affected' (backward-looking) and 'have materially affected our business strategy and processes' (affirmative assessment) — squarely answering how cybersecurity affects the business/finances → SI. Despite its length, the paragraph contains no domain terminology passing the ERM test (terms like 'information security and controls,' 'security vulnerabilities,' and 'cybersecurity insurance' are general business language), no firm-specific facts, and no verifiable claims, leaving it at Level 1.

thinking:
Let me analyze this paragraph carefully.

Content Category: This paragraph is primarily about how cybersecurity affects the business and finances. It contains multiple materiality assessments:
- "results of operations and financial condition have not been materially affected by cybersecurity threats or incidents to date" - backward-looking assessment
- "cybersecurity threats and other technological risks involving our systems have materially affected our business strategy and processes" - another materiality conclusion
- Discussion of cybersecurity insurance, investment in resources

This clearly answers "How does cybersecurity affect the business or finances?" → Strategy Integration

Specificity: Let me scan for facts:

- "cybersecurity insurance coverage" and "information security and controls" are mentioned as strategy elements but lack domain-specific terminology
- "security vulnerabilities" is generic language
- No named roles, specific numbers, named firms, or certifications present
- "none of the cybersecurity incidents that we have encountered to date have materially affected us" is a negative self-assertion that's not independently verifiable
- Overall, the language stays at a general business level without technical depth or concrete details

This is Level 1 - Generic Boilerplate.


fact: CSO (Chief Security Officer) referenced as part of program structure

reasoning: The paragraph primarily answers 'what does the cybersecurity program do?' — describing its design purpose (protecting confidentiality, integrity, availability), scope (risk assessment, incident response, third-party risk), and general approach. The person-removal test confirms RMP: removing the CSO reference leaves a complete program description intact. Third-party risk is mentioned but only as one component, not the central topic. The CSO title (cybersecurity-specific C-suite role) elevates specificity to Level 3, though the remaining language is generic business/risk management vocabulary ('assessing, identifying, and managing risks,' 'identify and respond to security incidents') that any ERM professional could write.

thinking:
Let me analyze this paragraph.

Content: Describes AT&T's network and information security program - what it does, its scope, its design purpose. Mentions CSO briefly but as part of the program description. Covers risk assessment, third-party risk, incident response - all program activities.

Category: RMP - "What does the cybersecurity program do?" The person-removal test: remove "CSO" and the paragraph still fully describes the program. Third-party risk is mentioned but as one component, not the central topic.

Specificity: Let me scan for facts.

- "network and information security program" - generic
- "CSO" - Chief Security Officer - this is a cybersecurity leadership role at VP+ level → firm-specific (Level 3)
- "confidentiality, integrity, or availability" - CIA triad - this is domain terminology, and an ERM professional would recognize it as a core infosec concept → domain_term
- "cybersecurity threats" - generic
- "third-party risk from vendors and suppliers" - generic
- "security incidents" - generic
- "information assets" - generic

The CIA triad is fundamental to cybersecurity, so even though "confidentiality" alone might be generic, the specific combination is domain-specific. CSO definitely qualifies as firm-specific since it's a named C-suite role, whether referring to Chief Security Officer or the Chief Security Officer's organization.

So this maps to RMP at Level 3 due to the firm-specific CSO reference.


reasoning: The paragraph answers 'what does the cybersecurity program do?' by describing incident response planning, testing through crisis simulations, and an incident response team — all program activities → RMP. All terminology used (incident response plan, crisis simulation exercises, security events, external cybersecurity experts) falls within general business/ERM language per the codebook's NOT-domain lists; no named roles, committees, frameworks, or verifiable facts appear, keeping this at Level 1.

thinking:
Let me classify this paragraph.

Content: Describes incident response plan, policies, procedures, testing through crisis simulations, incident response team, collaboration with external experts.

Category: "What does the cybersecurity program do?" → RMP. This describes program activities and processes.

Specificity: Let me scan for facts.
- "incident response plan" - generic, Level 1
- "crisis simulation exercises" - this is basically "tabletop exercises" without cybersecurity qualifier, Level 1
- "incident response team" - generic

- "external cybersecurity experts" - unnamed, generic
- "shipboard and shoreside employees" - organizational context but not a cybersecurity-specific fact

The paragraph relies on general business and ERM terminology like "incident response plan," "policies and protocols," "crisis simulation exercises," and "security events" — all Level 1 specificity with no domain-specific details that would elevate the classification.

This is Level 1 disclosure.


fact: Core Cybersecurity Management Team ("CCMT") — named non-generic committee comprising CISO, Chief Legal Officer, and CFO

fact: CIRP (Cyber Incident Response Plan) — named internal program with distinguishing identifier

fact: Specific team composition: CISO, Chief Legal Officer, Chief Financial Officer

reasoning: The paragraph answers 'how is management organized to handle cybersecurity?' — it defines the CCMT's composition (CISO, CLO, CFO), its oversight responsibilities, and its communication duties. Person-removal test: removing the roles and committee structure leaves little substantive content. Specificity is Level 3 due to the named CCMT committee, specific team composition by named roles, and the named CIRP program, but no externally verifiable quantified facts push it to Level 4.

thinking:
Let me classify this paragraph.

Content Category: This describes management's organizational role - the CCMT composition, responsibilities, and communication duties. Person-removal test: remove CISO, CLO, CFO, CCMT membership → what remains is generic incident response communication. The paragraph is about WHO is responsible and HOW management is organized. → MR

Specific facts:
- CISO → named_role (firm-specific)
- Core Cybersecurity Management Team ("CCMT") → named_committee (firm-specific, named non-generic committee)
- CIRP (Cyber Incident Response Plan) → named internal program with distinguishing identifier (firm-specific)

- Chief Legal Officer and Chief Financial Officer as part of CCMT → named_team composition

Specificity: Level 3 (firm-specific). No QV facts. CISO is firm-specific, CCMT is a named non-generic committee, CIRP is a named program with identifier.


fact: Vice President of Information Security

reasoning: The paragraph primarily answers 'How does the board oversee cybersecurity?' — it describes the Board and Audit Committee receiving reports, briefing frequency, and incident escalation thresholds, with management roles mentioned as part of the oversight flow rather than as the primary subject. Specificity reaches Level 3 via firm-specific roles (VP of Information Security) and named teams (Information Technology Senior Leadership Team, Information Security and Compliance teams); no QV-eligible facts (cadences like 'at least once each quarter' are generic, no specific dates or named external entities).

thinking:
Let me analyze this paragraph.

Content Category: This paragraph describes how the Board and Audit Committee oversee cybersecurity. It covers oversight structure, reporting flows, briefing frequency and scope. While it mentions management roles (CIO, VP of Information Security), the primary purpose is describing the oversight/governance structure. → Board Governance

Specificity: Let me scan for facts:
- "Information Security and Compliance teams" - named team composition → firm-specific
- "CIO" - general role, not cybersecurity-specific per codebook
- "Vice President of Information Security" - VP-level title with security qualifier → firm-specific

- "Information Technology Senior Leadership Team" - named team → firm-specific
- "vulnerability assessments" - domain term
- "at least once each quarter" / "at least annually" - generic cadences
- "Board and Audit Committee" - generic, every company has these

The firm-specific facts are the VP of Information Security title, the Information Technology Senior Leadership Team, and the Information Security and Compliance teams composition. Vulnerability assessments is a domain term. Since there are no specific numbers, dates, named external entities, or certifications, this lands at Level 3 (Firm-Specific) with no QV-eligible facts.


fact: August 2023 cybersecurity incident affecting information systems

reasoning: The paragraph's central purpose is a materiality assessment: 'prior cybersecurity incidents...have not materially affected us' — a backward-looking conclusion about business impact, making it SI per the materiality rule. While actual incidents are referenced, the framing is about their financial/strategic significance rather than describing what happened. 'August 2023' is a specific month+year tied to a real cybersecurity event, which is independently verifiable (e.g., via news reports), elevating specificity to Level 4.

thinking:
Let me analyze this paragraph.

It describes past incidents (August 2023), states a materiality conclusion ("have not materially affected us"), includes forward-looking speculation, and a cross-reference.

Category: The paragraph primarily answers "How does cybersecurity affect the business or finances?" - it's making a materiality assessment. The incident is mentioned but the frame is about business impact assessment. The key sentence is "prior cybersecurity incidents...have not materially affected us" - this is a backward-looking materiality assessment → SI.

Specificity:
- "August 2023" - specific date tied to a cybersecurity incident → QV-eligible

- The materiality claim itself is unverifiable self-assertion, so it doesn't qualify as QV
- But the August 2023 reference to an actual cybersecurity event does qualify → QV

This puts it at Level 4.


fact: over 18 years of experience in IT and information security

fact: Biogen (prior employer)

fact: AstraZeneca (prior employer)

fact: Iron Mountain (prior employer)

fact: Charles River Labs (prior consulting role)

fact: Sunovion Pharmaceuticals (prior consulting role)

fact: Agero (prior consulting role)

fact: DentaQuest (prior consulting role)

fact: master's degree in business administration from Boston University

fact: master's degree in electrical and computer engineering from Utah State University

fact: bachelor's degree in electronics engineering from Mumbai University

fact: IT team has over 10 years of experience

reasoning: The paragraph is entirely about management's organizational role — the VP's responsibilities, career history, qualifications, education, and team experience — collapsing to near-nothing under the person-removal test, making it clearly MR. Specificity is Level 4 due to numerous verifiable facts: named prior employers (Biogen, AstraZeneca, Iron Mountain, etc.), named universities (Boston University, Utah State University, Mumbai University), and quantified experience ('over 18 years', 'over 10 years').

thinking:
Let me classify this paragraph.

Content: Describes the VP of IT, Security and Business Intelligence role, qualifications, career history, education, and team experience. This is clearly about management's organizational role.

Category: Management Role (MR) - person-removal test: remove all person-specific content and nearly nothing remains.

Specificity: Let me scan for facts.
- "Vice President of Information Technology, Security and Business Intelligence" - firm-specific named role (VP-level with security qualifier)
- "over 18 years" in IT/security - quantified, lower bound → QV
- Named firms: Biogen, AstraZeneca, Iron Mountain, Charles River Labs, Sunovion Pharmaceuticals, Agero, DentaQuest → named external entities, verifiable

- Three degrees from named universities (Boston University, Utah State University, Mumbai University) with specific fields of study, plus over 10 years managing IT teams - all verifiable facts.

Level 4.


fact: pre-onboarding security assessments

fact: third-party security controls

reasoning: The paragraph centrally answers 'how are third-party cyber risks managed?' — describing vendor risk management policy, pre-onboarding assessments, annual re-assessments, and remediation tracking for service providers. Terms like 'security controls' and 'pre-onboarding security assessments' show cybersecurity domain knowledge beyond generic ERM language, but there are no firm-specific details (no named roles, committees, or programs with distinguishing identifiers) or verifiable facts, placing this at Level 2.

thinking:
Third-party risk management is the central topic here.

Specificity: Let me check for domain terms, firm-specific facts, and QV facts.

- "IT vendor risk management policy" - generic
- "third-party risk management program" - generic program name
- "pre-onboarding security assessments" - this is a process description but borderline domain
- "annual re-assessments" - generic cadence
- "third-party security controls" - this shows domain knowledge about what to assess

Hmm, let me apply the ERM test.

"Security controls" is domain-specific terminology that shows cybersecurity expertise, particularly when applied to evaluating vendor security posture. While "security assessments" appears in general risk management too, the phrase "third-party security controls" specifically demonstrates knowledge of how to assess external vendors' security practices, which passes the ERM test as domain language.

The response avoids firm-specific details like named roles or committees, contains no quantitative data or certifications, and fits Level 2 classification.


fact: SOC 2

fact: information security posture assessment

reasoning: The paragraph centrally answers 'how are third-party cyber risks managed?' — describing vendor onboarding assessments, security requirements imposed on suppliers, and periodic reviews of third-party hosted applications, making it clearly TP. SOC 2 and ISO 27001 are referenced as examples of reports vendors may provide (not certifications the company holds), so they are domain terminology at Level 2; no named external firms, specific numbers, or verifiable claims push it to Level 4, and the processes described (vendor assessments, security requirements) are general enough that no firm-specific facts reach Level 3.

thinking: Third-party risk management is the central topic.


fact: Corporate Risk Committee of the Board oversees IT systems including information security

fact: CIO

fact: CISO

reasoning: The paragraph primarily answers 'How does the board oversee cybersecurity?' by describing the Corporate Risk Committee's and Audit Committee's oversight roles and how information flows to the board via CIO/CISO reporting. Specificity is Level 3 due to the named Corporate Risk Committee (non-generic board committee) and named cybersecurity leadership roles (CIO, CISO); 'bi-annually' and 'annually' are generic cadences not qualifying as QV, and no specific numbers, dates, or named external entities are present.

thinking:
Let me analyze this paragraph.

Content: Describes board-level oversight of cybersecurity - Corporate Risk Committee oversees IT/security, Audit Committee oversees controls, CIO/CISO report to committees and board.

Category: Board Governance - clearly answers "How does the board oversee cybersecurity?"

Specificity: Let me scan for facts.
- "Corporate Risk Committee" - named non-generic committee → firm-specific
- "CISO" - cybersecurity leadership role → firm-specific
- "CIO" - firm-specific (VP-level equivalent)

- "Audit Committee" - standard across companies, not firm-specific
- "ERM team" - generic designation
- "bi-annually" - generic cadence without specific dates

The named committee and leadership roles are firm-specific, but there are no quantifiable facts or external certifications mentioned. This lands at Level 3.


fact: Third Party Risk Management (TPRM) program — named internal program with distinguishing identifier

fact: outside-in, hacker perspective monitoring of suppliers — describes attack surface monitoring, a cybersecurity-specific practice

reasoning: The paragraph's central topic is how Unisys manages third-party cybersecurity risk — TPRM program integrated into procurement, vendor due diligence reviews, and ongoing supplier monitoring — making TP the clear category. The final sentence reads like a pasted regulatory prompt/header rather than a materiality conclusion (it's phrased as a question: 'Whether any risks...'), so it does not trigger SI. The named 'Third Party Risk Management (TPRM) program' with its distinguishing acronym qualifies as a firm-specific fact (Level 3). No named external entities, specific numbers, or verifiable certifications are present, so it stays at Level 3.

thinking:
Let me analyze this paragraph carefully.

The paragraph covers multiple topics:
1. Third-party risk management (TPRM) program - central topic
2. A materiality assessment sentence at the end

Let me break it down:

- "Unisys recognizes the importance of overseeing and identifying material risks from cybersecurity threats associated with our use of third-party service providers." - intro about third-party risk
- "We have a Third Party Risk Management (TPRM) program, which is integrated into our procurement process and involves cybersecurity risk oversight and identification components." - TPRM program description

- Our TPRM program requires cybersecurity due diligence reviews on vendors based on their risk profile and the services they provide, and we continuously monitor key suppliers using external assessments that simulate hacker perspectives on their security posture. The passage then shifts to asking whether cybersecurity risks have materially impacted or could materially impact Unisys's business strategy, operations, or financial condition. The named TPRM program with its acronym is a firm-specific identifier at Level 3, while the cybersecurity due diligence and outside-in threat perspective language are more general domain terms without quantifiable facts or external references.


reasoning: This is an introductory paragraph that frames the disclosure section without answering any of the six substantive questions. It contains no cybersecurity domain terminology, no firm-specific facts, and no verifiable claims — purely generic business language that could appear in any filing.


fact: February 21, 2024 — specific date Change Healthcare notified them

fact: Change Healthcare — named external entity involved in incident

fact: UnitedHealth Group — named parent company of Change Healthcare

fact: February 28, 2024 — specific date of forensic assessment conclusion

reasoning: The paragraph primarily describes actual events surrounding the Change Healthcare cybersecurity incident — notification date, response actions (severing connections, conducting forensics), and current impact assessment — making incident narrative the dominant frame per Rule 4, even though it opens and closes with materiality conclusions (SI). Multiple named external entities and specific dates make this clearly Level 4.

thinking:
Let me analyze this paragraph carefully.

Content Category: This paragraph covers multiple topics - incident disclosure about Change Healthcare, materiality assessment, and some general statements. The primary content describes what happened with the Change Healthcare incident (timeline, response, investigation) and concludes with a materiality assessment. The incident description dominates the text, but the final sentences make materiality conclusions (SI). Let me weigh this.

The paragraph:
1. Opens with a negative materiality assertion ("not aware of having experienced a material compromise")
2. Describes the Change Healthcare incident in detail (dates, actions taken, forensics)
3. Concludes with a materiality assessment about the disruption

4. The Change Healthcare incident is a third-party event, not a direct breach, but the paragraph still narrates what actually occurred - detection, response, forensics, and impact assessment

The incident narrative from the February timeline through the forensic investigation and impact analysis takes up most of the text, so the incident frame is dominant here. That makes this an ID-dominant paragraph.

Looking at the specificity markers: February 21 and 28 are exact dates, Change Healthcare and UnitedHealth Group are named entities, and there's mention of forensic work on systems - all pointing to Level 4 specificity.


fact: Chief Information Officer (CIO)

fact: more than 30 years of experience in information technology

fact: Certified Information Systems Security Professional (CISSP)

fact: Certified Information Security Manager (CISM)

fact: Security+

fact: Certified Information Systems Auditor (CISA)

fact: Master's in Cybersecurity

fact: Graduate Certificates in Enterprise Cybersecurity and Data Science

reasoning: The paragraph primarily answers 'how is management organized to handle cybersecurity?' — describing the CIO's experience, qualifications, and the cybersecurity team's credentials. Person-removal test leaves almost nothing substantive. Specificity is Level 4 due to multiple externally verifiable certifications (CISSP, CISM, CISA, Security+, Microsoft Certified Cybersecurity Architect Expert) and a quantified lower-bound experience claim (more than 30 years).

thinking:
Let me classify this paragraph.

Content Category: This paragraph describes management's organizational role - the CIO's experience, qualifications, the cybersecurity team, and their credentials. Person-removal test: remove CIO, 30 years experience, certifications, team composition → very little remains. This is MR.

Specificity:
- CIO → firm-specific (cybersecurity-adjacent leadership role at VP+ level)
- "more than 30 years of experience" → QV (lower bound, verifiable)
- CISSP, CISM, CISA → QV (verifiable certifications)
- Microsoft Certified Cybersecurity Architect Expert → QV

- Security+ certification, Master's degree in Cybersecurity, and graduate certificates in Enterprise Cybersecurity and Data Science are all verifiable credentials. Level 4.


reasoning: The paragraph answers 'how does the board oversee cybersecurity?' — describing board briefings from the CISO and external expert presentations as part of oversight. The CISO reference is firm-specific (Level 3), but 'external experts' are unnamed and 'annually'/'periodically' are generic cadences, so no QV facts push it to Level 4.


reasoning: The paragraph's central topic is requirements imposed on and assessments of third-party service providers' cybersecurity — directly answering 'how are third-party cyber risks managed?' making it TP. The language is entirely generic ('security measure protocols,' 'security frameworks,' 'adequate security measures,' 'assessments') with no domain terminology passing the ERM test, no firm-specific facts, and no verifiable claims, keeping it at Level 1.

thinking:
Let me classify this paragraph.

Content: About managing third-party service providers' cybersecurity - requiring them to have security measures and assessing their security frameworks.

Category: Third-Party Risk (TP) - central topic is oversight of external parties' cybersecurity. Requirements imposed ON vendors and assessment of vendors' security.

Specificity: Let me scan for facts.
- "security measure protocols" - generic
- "assessments of third-party service providers' security frameworks" - this is describing vendor security assessments, which is a generic process description
- No domain terminology that passes ERM test - "security measures," "security frameworks," "assessments" are all general

- No firm-specific facts, no QV facts

This is Level 1 - generic language about vendor oversight without domain terminology.


reasoning: The first sentence is a backward-looking materiality assessment ('have not identified any risks...that have materially affected...business strategy, results of operations or financial condition'), making this SI per the materiality rule. The cross-reference to Risk Factors is subordinate. 'As of March 31, 2024' is reporting-period context (like 'for the year ended'), not a cybersecurity-specific date, and the negative assertion ('have not identified') is not externally verifiable. No domain terminology or firm-specific facts elevate beyond Level 1.

thinking:
Let me analyze this paragraph.

Content: States that as of March 31, 2024, no material cybersecurity risks have been identified, then cross-references Risk Factors for forward-looking risks.

Category: The first sentence is a backward-looking materiality assessment ("have not identified any risks... that have materially affected"). This is SI per Rule 5. The second sentence is a cross-reference, but the first sentence IS an assessment, making SI dominant.

Specificity:
- "As of March 31, 2024" — this is a specific date anchoring the materiality assessment. But is it just a reporting period context? It's more than "for the year ended" — it's pinning a specific assessment date.

Actually, thinking about it more, the date functions as reporting period context rather than a cybersecurity-specific fact. The negative materiality assertion itself — "have not materially affected" — is a self-assessment that can't be externally verified per the codebook standards. There's no domain terminology, no firm-specific facts like named roles or committees. The date is just the fiscal year end, which is standard reporting context. This looks like Level 1.


fact: Chief Security and Trust Officer

fact: Reports to Executive Vice President, Operations

fact: Over 25 years of experience in IT and information security

reasoning: The paragraph describes the Chief Security and Trust Officer's reporting line, responsibilities, and qualifications — person-removal leaves only generic 'implement policies and procedures' language, confirming MR. 'Over 25 years' is a quantified lower-bound claim (verifiable against resume/public records), elevating to Level 4.

thinking:
Let me analyze this paragraph.

Content: Describes the Chief Security and Trust Officer role, reporting line, responsibilities, and qualifications.

Category: Person-removal test - remove "Chief Security and Trust Officer, who reports to our Executive Vice President, Operations" and qualifications ("extensive cybersecurity experience", "over 25 years"). What remains? "works collaboratively across our business to implement policies and procedures designed to protect our IT environment and our products and services from cybersecurity threats, and to promptly respond to cybersecurity incidents in accordance with our incident response policies and procedures." This is generic - no specific program details.

The paragraph centers on the role itself and its reporting structure, with firm-specific identifiers like the named position and its direct supervisor. The quantified experience requirement of over 25 years is verifiable and concrete. This lands at Level 4.


fact: denial of service attacks

fact: malicious software attacks (malware)

reasoning: The paragraph opens with a materiality assessment ('have not been materially impacted by cyber incidents') and then elaborates on the risk landscape — past incidents, third-party exposure, and potential future impacts — all framed around how cybersecurity risks affect the business. While it touches ID (past DDoS/malware) and TP (vendor assessments), the dominant frame is a business-impact risk assessment anchored by the SI materiality conclusion. Specificity reaches Level 2 via specific threat types: denial of service attacks and malicious software attacks are cybersecurity domain terms that fail the ERM test.

thinking:
Let me analyze this paragraph carefully.

**Content Category:**
This paragraph covers multiple topics. Let me break it down:

1. "We have not been materially impacted by cyber incidents" - materiality assessment → SI
2. "We have been subject to other intentional cyber incidents... denial of service attacks... malicious software attacks" - describes actual incidents → ID
3. "We also face risks related to cyber attacks... in connection with card transactions through various third parties" - third-party risk
4. "Some of these parties have in the past been the target of security breaches" - third-party incidents

5. "We also rely on numerous other third party service providers... we conduct security assessments on our higher risk third party service providers" - third-party risk management
6. "There can be no assurance that cyber incidents will not occur" - generic risk disclaimer

The paragraph starts with a materiality statement, then briefly mentions actual incidents like DDoS and malware attacks, but focuses heavily on third-party vendor risks and the security assessments we perform on higher-risk providers. It wraps up with a standard forward-looking disclaimer about cyber incident uncertainty. The opening materiality statement anchors this as a business impact disclosure, but I'm noticing the bulk of the content actually focuses on third-party risk exposure—much of it speculative language like "could impact" and "no assurance." There's a real incident mention buried in there, and one concrete control about security assessments, but the dominant frame seems to be risk factors rather than active management. I think SI fits best since the paragraph is fundamentally about how cybersecurity risks affect the business, even though third-party risks make up most of the discussion.

Looking at the specificity, "denial of service attacks" and "malware" are domain-specific terms, while "cyber attacks" and "security breaches" are generic. The security assessments mention is borderline—it's a control activity but described in vague terms. I'm settling on Strategy Integration as the classification since the materiality assessment opens the discussion and the rest elaborates on the risk landscape affecting the business.


fact: CISO manages cybersecurity program

fact: cybersecurity subcommittee

fact: board enterprise risk committee

fact: Senior Vice President – Enterprise Risk Officer

fact: more than 20 years of experience in cybersecurity and information technology

fact: Master's degree in Business Administration with a focus on Information Technology

fact: Certified Information Security Manager (CISM) certification

reasoning: The paragraph's primary content is the CISO's qualifications, credentials, experience, and reporting lines (CISO → SVP Enterprise Risk Officer → CEO), making it a Management Role paragraph. Person-removal test: removing the CISO details leaves only a generic program description ('identification, evaluation, and prioritization of security risks'), confirming MR. Specificity reaches Level 4 via multiple verifiable facts: 'more than 20 years of experience' (verifiable lower bound), and CISM certification (verifiable via ISACA registry).

thinking:
Let me analyze this paragraph.

Content category: This paragraph describes the CISO's role, qualifications, credentials, reporting lines, and experience. The person-removal test: remove CISO, 20 years experience, MBA, CISM, reporting lines → what remains? "cybersecurity program, which aligns to industry standards and is reviewed by the cybersecurity subcommittee and approved by the board enterprise risk committee annually, and which includes the identification, evaluation, and prioritization of security risks, as well as the company's response to security incidents." That's somewhat substantive but generic. However, the PRIMARY content is about the CISO - their qualifications, credentials, experience, and reporting lines. The program description is brief and subordinate.

Now I'm breaking down the specificity of each element: the CISO role itself is firm-specific, as are the named committees like the cybersecurity subcommittee and board enterprise risk committee. The SVP – Enterprise Risk Officer title is also firm-specific. The quantified experience threshold of 20+ years is verifiable, the MBA with IT focus is a specific credential, and the CISM certification can be verified through ISACA. Reporting to the CEO is more generic, but overall there are multiple firm-specific and quantifiable facts here.


fact: Chief Innovation Officer

reasoning: The paragraph answers 'how does the board oversee cybersecurity?' — describing the Audit Committee's review scope, reporting from management, and briefing cadence to the full Board. The Chief Innovation Officer is a distinctive cybersecurity-adjacent leadership title that identifies something unique about this company's organizational structure, elevating to Level 3. The remaining language ('information technology security processes,' 'internal controls,' 'risks and threats') is general business vocabulary that fails the ERM test.

thinking:
Let me analyze this paragraph.

Category: This describes how the Board and Audit Committee oversee cybersecurity - briefing frequency, what they review, how information flows. This is Board Governance.

Specificity: Let me scan for facts.
- "Chief Innovation Officer" - this is a named role. Is it firm-specific? It's not a standard cybersecurity title (CISO, CTO, CIO). It's a unique title that identifies something about THIS company's structure. I'd say it qualifies as firm-specific.
- "Audit Committee" - NOT firm-specific per codebook

- "at least annually" - generic cadence
- "information technology security processes" - general language
- "internal controls" - general language

The Chief Innovation Officer stands out as distinctive. It's not among the standard cybersecurity titles listed in the codebook like CISO, CTO, CIO, VP of IT/Security, or Chief Digital Officer when overseeing cyber. This unusual designation suggests it's specific to how this company structures its leadership.

Actually, I need to think about this more carefully. Chief Innovation Officer isn't a cybersecurity-specific role—it's a general executive title, similar to CEO, CFO, or COO, which the codebook marks as not firm-specific. But the context matters here: it's a C-level position with cybersecurity oversight responsibilities, which makes it distinctive enough to identify the company's unique structure. I'll classify it as firm-specific.

No domain terms meet the ERM threshold—everything here is standard business language. This puts it at Level 3 based on the Chief Innovation Officer designation.


reasoning: This paragraph is a cross-reference directing readers to Item 1A for materiality discussion. Per the N/O vs SI rule, 'risks that may materially affect us, see Item 1A' is N/O because it points elsewhere rather than stating a materiality conclusion itself. No substantive cybersecurity disclosure is made in this paragraph.


fact: February 21, 2024 — specific date of Change Healthcare notification

fact: Change Healthcare — named external entity involved in incident

fact: UnitedHealth Group — named parent company of Change Healthcare

reasoning: The bulk of the paragraph describes an actual cybersecurity incident involving Change Healthcare — timeline, response actions (severing connections, conducting forensics), and operational impact (inability to submit claims). While the paragraph opens and closes with materiality assessments (SI), the incident narrative dominates the text volume, making ID the primary category per Rule 4. Specificity is Level 4 due to multiple QV-eligible facts: a specific date (February 21, 2024) and named external entities (Change Healthcare, UnitedHealth Group), all independently verifiable.

thinking:
Let me analyze this paragraph carefully.

Content Category: This paragraph discusses multiple things:
1. A materiality assessment ("not aware of having experienced a material compromise")
2. An actual incident involving Change Healthcare (February 21, 2024)
3. The company's response and impact assessment
4. A materiality conclusion at the end

The paragraph describes what happened with the Change Healthcare incident in detail - timeline, response actions, forensic investigation, operational impact. But it also concludes with a materiality assessment.

Rule 4: ID vs SI - Mixed with incident frame dominant → ID. Mixed with financial frame dominant → SI.

The bulk of the text describes the incident itself - what happened, when, response actions, forensic investigation. The final sentence states a materiality conclusion. Since the incident narrative dominates by volume, I'm categorizing this as ID, even though it's framed around materiality.

Actually, wait - I'm second-guessing myself. The paragraph's purpose is to answer "how does cybersecurity affect the business?" The Change Healthcare incident is presented as evidence supporting the conclusion that cybersecurity risks haven't materially impacted the company. The materiality assessment frames the entire discussion, and the incident details serve that purpose. That makes this SI.

But the sheer volume of text devoted to incident specifics - the date, the actions taken, the forensic details - that's pulling me back toward ID. Let me settle on ID since the incident narrative is what actually dominates the content.

Looking at the specificity markers: the February 21, 2024 date is precise, Change Healthcare and UnitedHealth Group are named entities, and there's explicit materiality language plus forensics mentioned. This all points to Level 4 specificity.


reasoning: The paragraph's central topic is managing cybersecurity risks from third parties (acquisition targets), including due diligence, independent testing, remediation requirements, and contractual protections — directly answering 'how are third-party cyber risks managed?' Despite being substantive in content, the language uses only general business terms (due diligence, vulnerability, remediation, contractual protections, liability parameters) that would appear naturally in any ERM context. No cybersecurity domain terminology, no firm-specific facts, and no verifiable claims.

thinking:
Let me analyze this paragraph.

Content: About third-party security risks, specifically acquisition targets - security due diligence, independent testing, remediation requirements, contractual protections.

Category: This is about managing third-party cyber risks - specifically acquisition targets. The central topic is oversight of external parties' cybersecurity. → Third-Party Risk

Specificity: Let me scan for facts.
- "independent testing of the target technology" - this is a process description, not domain terminology
- "vulnerability" - in cybersecurity context, but "vulnerability" alone... let me think. The ERM test: would "vulnerability" appear in a generic ERM document? Yes, it could.

But "security due diligence" is also general. "Contractual protections and liability parameters" uses standard business language. The timeframe reference is vague. And looking closer at "independent testing of the target technology" - that's just a general concept, not specialized terminology like penetration testing or vulnerability scanning. There are no domain-specific cybersecurity terms, no named roles or committees, no quantifiable facts. The whole thing reads as general business language, so this is Level 1.


fact: over 30 years of experience

fact: over 19 years of experience

fact: GIAC Security Essentials certification

fact: GIAC Certified Enterprise Defender certification

fact: GIAC Certified Incident Handler Certification

fact: GIAC Certified Windows Security Administrator certification

fact: GIAC Critical Controls Certification

fact: CISSP (Certified Information Systems Security Professional) certification

fact: Defense Industrial Base environment

reasoning: The paragraph is overwhelmingly about management qualifications, experience, reporting lines (Director → VP), and credentials — person-removal leaves almost nothing substantive, confirming MR. Multiple independently verifiable certifications (five GIAC certs, CISSP) and quantified experience (30+ years, 19+ years) firmly place this at Level 4.

thinking:
This paragraph is primarily about management roles, qualifications, and reporting lines.

Content category: Management Role - describes the Director of IT Infrastructure and Security and VP of IT, their qualifications, certifications, experience, and reporting lines.

Person-removal test: Remove all person-specific content → "Our IT Security team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards and processes. Team members are afforded opportunities to attend external training, conferences and other events to remain on top of most recent cybersecurity trends." That's fairly thin - the bulk is about the people. → MR.

Specificity: Let me scan for facts.

- "Director of IT Infrastructure and Security" — named role with security qualifier, firm-specific

- "over 30 years of experience" — quantified (lower bound, verifiable)
- "Defense Industrial Base environment" — firm-specific context
- GIAC Security Essentials, GIAC Certified Enterprise Defender, GIAC Certified Incident Handler, GIAC Certified Windows Security Administrator, GIAC Critical Controls Certification — all verifiable certifications
- "Vice President of Information Technology" — VP-level IT role, firm-specific
- "over 19 years of experience" — quantified
- "Masters of Business Administration" — not really QV for cybersecurity
- "CISSP" — verifiable certification

Multiple QV facts → Level 4.


reasoning: Two of three sentences address materiality: the process for determining material impact and a backward-looking conclusion that no threats have materially affected operations or financial position — both are SI per the materiality assessment rule. The Incident Response Team mention is subordinate. No domain terminology passes the ERM test ('incident response team' is on the NOT-domain list), no firm-specific facts (the team name is generic, no specific departments named), and the negative materiality assertion is not externally verifiable.

thinking:
Let me analyze this paragraph.

Content category: This paragraph has multiple elements. Let me check what question it primarily answers.

1. "Incident Response Team comprised of members from the major business areas" - describes a team/process (RMP)
2. "All cybersecurity events include a determination of whether the incident has materially affected or is reasonably likely to materially affect" - materiality assessment process (SI)
3. "Dime has not identified any cybersecurity threats that have materially affected operations or financial position" - materiality conclusion (SI)

The paragraph has an RMP element (Incident Response Team) but the bulk is about materiality assessment and conclusion.

Since two of the three sentences focus on materiality and whether cybersecurity has affected business outcomes, this falls under Strategy Integration. Looking at the specifics, the language is mostly generic—the Incident Response Team name isn't firm-specific, the departments aren't named, and the materiality language mirrors standard SEC disclosures. The conclusion itself is a negative assertion without verifiable details.


fact: Operational Risk Committees (named management committee)

fact: Enterprise Risk Management Committee

fact: Head of Technology & Operations (chairs ERM-related committee)

fact: Chief Technology Officer (chairs the IS&DM Committee)

fact: Committee membership specified: CEO, heads of businesses, second LOD representatives, Internal Audit representatives

reasoning: The paragraph's primary content is management-level committee structures, their chairs, and their membership composition — answering 'how is management organized to handle cybersecurity?' The board mention is a brief subordinate clause at the end. Per Rule 1, management-level committees with structure/membership focus → MR. Multiple firm-specific facts (CTO, Head of Technology & Operations, named non-generic committees like Information Security and Data Management Committee, specific member composition) elevate to Level 3, but no QV-eligible facts (no numbers, dates, named external entities, or certifications).

thinking:
Let me analyze this paragraph.

**Category:** This paragraph covers multiple things: governance model, management processes, management committees, and board experience. Let me apply the "what question" test.

The paragraph describes:
1. Governance model for identifying/escalating material risks
2. Management processes across the information security program
3. Risk escalation and reporting paths via management committees (Operational Risk Committees, ERM Committee)
4. A dedicated Information Security and Data Management Committee with its chair and members
5. Board members' experience

The bulk of the text is about management-level committee structures and their membership/leadership. The board mention is brief at the end. The primary content is about how management is organized - committee structures, who chairs them, who sits on them.

Applying the person-removal test, if I strip out the titles, committee chairs, and membership details, there's not much substance left about the actual program. The governance-chain rule would normally default these to Board Governance, but the core focus here is really on management-level committee structure and composition. Since Rule 1 maps management-level committees to Management Role when they're about structure and membership, and the board content is just a brief mention at the end, this falls under **Management Role**.

Looking at the specificity markers, the CTO and the Information Security and Data Management Committee are the firm-specific elements that anchor this as substantive content rather than generic governance language.


fact: National Institute on Standards and Technology Cybersecurity Framework (NIST CSF)

fact: third party security operation center (SOC)

fact: multi-factor authentication

fact: firewalls

fact: encryption of information

fact: malware defenses

fact: email filtering

fact: patching

reasoning: The paragraph answers 'what does the cybersecurity program do?' by describing a multi-layered approach including controls, defenses, monitoring, and training — squarely RMP. Rich cybersecurity domain terminology (MFA, IDS/IPS, firewalls, encryption, malware defenses, SOC, NIST CSF) elevates to Level 2, but the third-party SOC is unnamed and NIST is 'aligned with' not certified, so nothing reaches Level 3 or 4.

thinking:
Let me classify this paragraph.

Content Category: This paragraph describes what the cybersecurity program does - controls, tools, defenses, training. "What does the cybersecurity program do?" → RMP.

Specificity: Let me scan for facts:
- NIST Cybersecurity Framework → domain term (framework reference, "aligned with" = Level 2)
- multi-factor authentication → domain term
- firewalls → domain term
- intrusion prevention and detection systems → domain term
- encryption → domain term
- malware defenses → domain term
- "third party security operation center" → SOC is domain term
- email filtering → domain term

- access controls, network segmentation, and patch management → all standard security domain terms

No firm-specific details like named roles, committees, or individuals. No quantifiable metrics, dates, external certifications, or named third parties either. This lands at Level 2 - Domain-Adapted, with the paragraph relying heavily on established cybersecurity terminology throughout.


reasoning: The paragraph states a materiality conclusion — 'there have been no material incidents incurred to-date' — which is a backward-looking negative assertion triggering SI per Rule 5. The subsequent 'could materially affect' is speculation (not an assessment) and the Item 1A cross-reference is subordinate. Specificity is Level 1: the negative materiality assertion is not externally verifiable, no domain terminology is present, and no firm-specific or quantified facts appear.

thinking:
Let me analyze this paragraph.

Content: Mixed - starts with a negative materiality assertion, then speculation, then cross-reference.

"there have been no material incidents incurred to-date at the Company" - negative assertion with materiality framing → SI per Rule 5
"Cybersecurity threats could materially affect..." - speculation with "could" → NOT SI
Cross-reference to Item 1A → N/O element

The first sentence makes a materiality assessment (backward-looking negative assertion). That's SI per the codebook.

Specificity: "no material incidents" is a negative self-assertion - NOT externally verifiable.

This is a Level 1 disclosure with no domain-specific terminology, company-specific facts, or quantitative verification elements.


reasoning: This paragraph describes the career history and responsibilities of Eastman's Chief Human Resources Officer, covering HR strategy, talent acquisition, and leadership development. It contains no substantive cybersecurity disclosure — no cybersecurity oversight, program, or risk management content — so it is N/O. N/O always receives Specificity 1.

thinking: This is about a CHRO's career history and responsibilities - entirely HR-focused, not cybersecurity.


reasoning: The paragraph opens with a backward reference to disclosures made elsewhere ('as disclosed above') and then consists entirely of speculative risk language ('could disrupt,' 'could damage,' 'could have a material adverse effect') — this is generic risk-factor boilerplate, not a substantive cybersecurity disclosure. The materiality language uses 'could,' which is speculation per Rule 5, not an assessment. No domain terminology, firm-specific facts, or verifiable claims are present.

thinking:
This paragraph starts by referencing cybersecurity processes but then shifts to speculative risk language ("could disrupt," "could damage," "could have a material adverse effect"). The materiality language is speculative ("could have a material adverse effect") not an assessment. This is generic risk factor language.

Category: None/Other - pure speculation, no substantive disclosure. The "we have implemented several cybersecurity processes" is a backward reference ("as disclosed above") not a description itself.

Specificity: Level 1 - no domain terminology, no firm-specific facts, no QV facts.


fact: Chief Security Officer (CSO) — cybersecurity leadership role

fact: Reports to the CFO — reporting line

fact: Served in role since 2018

fact: Over 14 years of global executive cybersecurity experience

reasoning: The paragraph primarily answers 'how is management organized to handle cybersecurity?' — it describes the CSO's responsibilities, reporting line to CFO, and qualifications. Person-removal test leaves only thin program references ('implementation of cybersecurity programs'), confirming MR. Specificity reaches Level 4 via 'since 2018' (specific date) and 'over 14 years of experience' (verifiable lower-bound quantity).

thinking:
Let me analyze this paragraph.

Content: Describes the CSO role, responsibilities, reporting line, tenure, and experience.

Category: This is primarily about management's organizational role - who holds the responsibility (CSO), reporting line (to CFO), and qualifications (experience). Person-removal test: remove CSO, reporting to CFO, tenure since 2018, 14 years experience → what remains? "implementation of cybersecurity, product security, and corporate/physical security programs" and "cyber risk mitigation priorities" - some program description but fairly thin. The primary content is about the person and role. → **Management Role**

Specificity:

The details here are quite granular - I've got the specific title and reporting structure, plus quantified experience metrics with exact dates and tenure lengths. These are all firm-specific identifiers that push this into the highest specificity tier.


reasoning: The paragraph describes how two board-level committees (Audit Committee and Risk Committee) oversee cybersecurity governance and coordinate on information security matters, directly answering 'how does the board oversee cybersecurity?' Both the Audit Committee and Risk Committee are standard board-level governance bodies (especially at a bank), not cybersecurity-specific committees. No domain terminology, firm-specific facts, or verifiable claims are present — the language is general oversight vocabulary any ERM professional would use.

thinking:
Let me analyze this paragraph.

Content: The Audit Committee monitors internal audit's coverage of cybersecurity governance, risks, and controls. The Risk Committee coordinates with the Audit Committee on information security matters.

Category: This is about board-level committee oversight of cybersecurity. Both Audit Committee and Risk Committee are board-level committees. This answers "How does the board oversee cybersecurity?" → Board Governance.

Specificity: Let me scan for facts:
- "Audit Committee" — every public company has one, NOT firm-specific

- "Risk Committee" — this is trickier. It's a standard board committee at many banks, but not universal like the Audit Committee. The codebook distinguishes between generic committees that every company has versus named, firm-specific ones. Since Risk Committee isn't in the universal list but is fairly common, I need to consider whether it's specific enough to count as firm-specific. The guidance suggests that truly firm-specific committees are those with unique names like "Cybersecurity Committee" or "Technology Risk Committee," whereas "Risk Committee" is more of a standard governance structure.

Looking at the language around governance and information security, nothing here rises to the level of domain-specific terminology that would trigger the ERM test. The references to cybersecurity governance and information security matters are general enough that they wouldn't qualify as specialized jargon.

As for the Risk Committee itself, while it's common at banks, it's not universal across all public companies the way an Audit Committee is. The codebook doesn't explicitly list it as non-firm-specific, but the spirit of the distinction is whether it actually sets this company apart. At a large bank, a Risk Committee is pretty standard and doesn't really differentiate the organization. I'm treating this as Level 1 boilerplate. Risk Committee at banks is typically mandated by regulators, so it's a standard governance requirement rather than a firm-specific choice. I'll classify this as Level 1 since these are generic governance committees, not specialized ones like cybersecurity or technology risk committees.


reasoning: The paragraph's central topic is oversight of third-party vendors — assessing their control environments, managing cyber risks of engaging them, and reviewing their security practices — directly answering 'how are third-party cyber risks managed?' (TP). The language is entirely generic ERM vocabulary ('assess vendor control environments,' 'evaluate risks,' 'due diligence process,' 'information security practices'); none of these terms pass the ERM test as cybersecurity-domain-specific. 'ISP' is likely an abbreviation for a generic program name (Information Security Program) without a distinguishing identifier, so it does not qualify as firm-specific.

thinking:
Classify this paragraph.

Content: About vendor due diligence process - assessing vendor control environments, evaluating risks of vendor access, managing cyber risks of third-party vendors, reviewing their information security practices.

Category: This is clearly about how third-party cyber risks are managed → Third-Party Risk (TP). The central topic is vendor oversight.

Specificity: Let me scan for facts.
- "ISP" - named internal program? It's an acronym for what's likely "Information Security Program" - but it's just a generic program name abbreviation. Not firm-specific enough without a distinguishing identifier.

- "vendor due diligence process" - generic
- "assess vendor control environments" - generic ERM language
- "cyber risks" - general
- "information security practices" - general

No domain terminology that passes the ERM test. No firm-specific facts. No QV facts. "ISP" is just an abbreviation of a generic name, not a distinguishing identifier. This is Level 1.


reasoning: This is a cross-reference directing readers to Item 1A Risk Factors for cybersecurity risk discussion. It provides no substantive cybersecurity disclosure itself — it merely points elsewhere. N/O always receives Specificity 1.


reasoning: The paragraph states two materiality conclusions — a backward-looking assessment ('not aware of any... that have had a material impact') and a forward-looking assessment using SEC Item 106(b)(2) language ('reasonably likely to materially affect us') — making it SI. No domain terminology, firm-specific facts, or verifiable claims are present; the cross-reference to Item 1A is subordinate to the materiality assessments, and all language is generic boilerplate.

thinking:
Let me analyze this paragraph.

Content: States no material incidents, acknowledges ongoing risks that are "reasonably likely to materially affect," and cross-references Item 1A.

Category: This contains materiality assessments. "not aware of any cybersecurity threats or incidents... that have had a material impact" is a backward-looking assessment. "reasonably likely to materially affect us" is a forward-looking assessment (SEC Item 106(b)(2) language). → Strategy Integration.

Specificity: Let me scan for facts.
- "last fiscal year" — generic timeframe
- "reasonably likely to materially affect" — SEC boilerplate language

- "have not had a material impact" — negative self-assertion, not verifiable
- Cross-reference to Item 1A — just pointing elsewhere

No domain terms, no firm-specific facts, no QV facts. This is generic materiality boilerplate language. Level 1.


reasoning: This paragraph describes Travis Smith's career history in manufacturing, engineering, and business segments — none of which relate to cybersecurity. He holds no cybersecurity role; this is general executive biography content placed in Item 1C but not answering any of the six substantive cybersecurity questions. N/O always receives Specificity 1.


reasoning: The paragraph centrally answers 'how are third-party cyber risks managed?' — it describes risk assessments of service providers, requesting security information from vendors, and monitoring vendor incidents, all of which are requirements/oversight imposed on external parties (→ TP, not RMP). The language is entirely generic ('risk assessments,' 'security policies and procedures,' 'monitor cybersecurity incidents') with no domain terminology passing the ERM test, no firm-specific details, and no verifiable facts.

thinking:
Let me classify this paragraph.

Content: About managing third-party cyber risks - vendor assessments, requesting security info from providers, monitoring incidents involving third parties.

Category: This clearly answers "How are third-party cyber risks managed?" → Third-Party Risk. The central topic is oversight of external parties.

Specificity: Let me scan for facts.
- "third-party risk assessments" - general risk management language
- "security policies and procedures" - generic
- "monitor cybersecurity incidents" - generic

No domain terminology that passes the ERM test. No firm-specific facts. No QV facts. This is generic language about vendor oversight that any company could write.

Level 1.