reasoning: The paragraph contains the SEC's forward-looking materiality assessment language — 'reasonably likely to materially affect our business strategy, result of operations or financial condition' — which is a stated conclusion about materiality, making it SI per the materiality assessment rule. No domain terminology, firm-specific facts, or verifiable claims are present; 'Information Security Program' is a generic program name without a distinguishing identifier, the cross-reference to Item 1A and disclaimer language are boilerplate, leaving this at Level 1.

thinking:
Let me analyze this paragraph carefully.

Content: Mixed paragraph with several elements:
1. "not a previous cybersecurity incident" - negative assertion about incidents
2. "devote significant time and resources" - generic investment language
3. "Information Security Program described above" - references program
4. "Despite our efforts, there can be no assurance..." - disclaimer
5. "reasonably likely to materially affect our business strategy, result of operations or financial condition" - this is the SEC's forward-looking materiality language
6. Cross-reference to Item 1A

The key question: what does this primarily answer?

The materiality assessment rule says: "Are reasonably likely to materially affect" → SI (SEC Item 106(b)(2) forward-looking). This is a CONCLUSION about materiality.

The phrase "reasonably likely to materially affect" is the SEC's required language from Item 106(b)(2), which means this paragraph contains a forward-looking materiality assessment about cybersecurity threats. The paragraph combines multiple elements—a reference to the company's Information Security Program, a disclaimer about assurance, and the substantive conclusion that certain threats could materially impact business strategy and financial condition. While there's limited specific factual detail beyond the named program, the materiality assessment itself is the key substantive element here. "Information Security Program" is generic enough that it doesn't meet the firm-specific threshold—every institution has one with that same name. So this stays Level 1 boilerplate, categorized under SI for its forward-looking materiality language.


content_category: Risk Management Process

fact: Kroll (named external firm conducting assessment)

fact: November 2022 (specific date of security maturity assessment)

fact: September 2023 (specific date of most recent tabletop exercise)

fact: penetration tests

fact: network architecture

fact: Information Security Team

fact: Information Security Incident Response Policy (named internal program)

category_confidence: high

specificity_confidence: high

reasoning: The paragraph describes the company's cybersecurity program activities — a third-party assessment, gap remediation, policy development, and tabletop exercises — all serving the company's own security posture (Rule 3: Kroll hired to serve the company → RMP, not TP). Specificity is Level 4 due to multiple QV-eligible facts: Kroll as a named external firm and specific dates (November 2022, September 2023) that are independently verifiable.

provider: anthropic

generationId: agent-sdk

stage: benchmark

thinking:
Let me analyze this paragraph.

Content: Describes Kroll conducting a security maturity assessment, working with the company to close gaps, implementing solutions, developing an incident response policy, and conducting tabletop exercises.

Category: This is about what the cybersecurity program does - assessments, remediation, policy development, tabletop exercises. Kroll is hired to serve the company's own security program (Rule 3: third parties hired to serve the company → RMP). The central topic is the company's own security improvement, not vendor oversight.

→ **Risk Management Process**

Specificity:
- "Kroll" — named external firm → QV (Level 4)

- "November 2022" and "September 2023" — specific dates → QV
- "penetration tests" — domain-specific terminology
- "network architecture" — domain terminology
- "Information Security Team" — named internal team
- "Information Security Incident Response Policy" — named internal program with specific identifier
- "tabletop exercises" — general term, but in this cybersecurity incident response context it qualifies as domain-specific

Overall Level 4 due to the named firm Kroll.


content_category: None/Other

reasoning: This paragraph describes what another section covers and cross-references Item 1A for the materiality discussion — it does not itself state a conclusion about whether cybersecurity has materially affected the company. Per the N/O vs. SI rule, 'risks that may materially affect... see Item 1A' is N/O (pointing elsewhere). None/Other always receives Specificity 1.

thinking: This is a cross-reference paragraph pointing to Item 1A for materiality discussion.


content_category: Third-Party Risk

fact: security questionnaires

fact: information security addenda

specificity_confidence: medium

reasoning: The paragraph's central topic is how the company manages cybersecurity risks from third-party service providers — describing their vendor management program, assessment levels, and contractual obligations — squarely answering 'how are third-party cyber risks managed?' For specificity, the paragraph mentions security questionnaires and information security addenda, which are domain-specific terms a generic ERM professional wouldn't naturally use, but contains no firm-specific facts (no named roles, committees, or unique identifiers) and no verifiable claims.

thinking: Third-party risk management is the central topic.


fact: NIST CSF

type: framework

fact: CISO

fact: Global Information Security Policy (named program)

fact: endpoint detection

fact: security incident response and event management (SIEM)

fact: privileged access management

fact: documented security architecture program

reasoning: Person-removal test: removing the CISO attribution leaves a substantive program description (policies, NIST CSF alignment, endpoint detection, SIEM, privileged access management), so this is RMP. Specificity reaches Level 3 via the CISO role and the named 'Global Information Security Policy,' with multiple domain terms (endpoint detection, privileged access management, NIST CSF) but no QV-eligible facts like specific numbers, dates, or named external entities.

thinking:
Let me analyze this paragraph.

Content: Describes a global information security program, mentions NIST CSF, CISO role, and various cybersecurity measures (endpoint detection, SIEM, privileged access management, etc.)

Category: The paragraph describes what the cybersecurity program does - policies, framework alignment, and specific measures. The CISO is mentioned but as attribution for overseeing these activities. Person-removal test: remove "Our CISO is responsible for oversight of the cybersecurity program, supervision of the members of the team, and implementation of" — remaining text still describes substantive program elements. → RMP

Now I'm checking the specificity levels across the different elements. The CISO role and the named Global Information Security Policy both hit Level 3, while the technical measures like NIST CSF, endpoint detection, and privileged access management are domain terms at Level 2. There aren't any quantifiable facts like numbers or dates, so the highest specificity here is Level 3.


reasoning: The paragraph primarily answers 'how are third-party cyber risks managed?' — it describes reliance on third parties, contractual security/privacy addenda, and subcontractor incident reporting requirements, all of which are requirements imposed ON external parties. Specificity is Level 1 because the language is entirely general business vocabulary (contract addenda, incident reporting instructions); no cybersecurity domain terminology, firm-specific facts, or verifiable claims are present.

thinking:
Let me analyze this paragraph.

Content: Discusses third-party risk - supplier/subcontractor cybersecurity, contract addenda, incident reporting requirements for subcontractors.

Category: Third-Party Risk - the central topic is how third-party cyber risks are managed (requirements imposed on vendors/subcontractors).

Specificity: Let me scan for facts.
- "security and privacy addenda" - generic contract language, not domain terminology
- "cybersecurity incident at a key supplier or subcontractor" - general business language
- "subcontractors connecting to our network are instructed to report cybersecurity incidents" - this is a requirement imposed on vendors but uses general language

- The phrase "could materially adversely impact us" is speculative rather than factual
- Overall, this is standard third-party risk management language without any firm-specific details or domain-specific terminology that would elevate it beyond generic boilerplate.

This is Level 1 - the entire passage relies on general business language without any distinguishing facts or technical specificity.


reasoning: The paragraph's central topic is how third-party service providers are overseen for cybersecurity risk—vendor diligence, risk-based assessment criteria, and supply chain risk—making TP the best fit. All language is generic business/ERM vocabulary ('vendor diligence,' 'assessed for risk,' 'supply chain risk') that any enterprise risk manager could write without cybersecurity domain expertise, yielding Level 1.

thinking:
Classify this paragraph.

Content: About managing third-party cyber risks - vendor diligence, risk assessment of vendors based on service nature, data access, supply chain risk.

Category: Third-Party Risk - central topic is oversight of external parties.

Specificity: Let me check for domain terms, firm-specific facts, QV facts.
- "vendor diligence" - generic business term
- "assessed for risk based on the nature of their service, access to data and systems and supply chain risk" - generic risk assessment language

No domain terminology (no cybersecurity-specific terms), no firm-specific facts, no QV facts.

This reads like standard vendor management language that any ERM professional would use, so I'm classifying it as Level 1.


reasoning: The paragraph centrally answers 'how are third-party cyber risks managed?' — describing vendor oversight through an onboarding process, periodic reviews, and a vendor management policy, making it Third-Party Risk. Despite naming programs ('Third-Party Risk Management Program,' 'Vendor Management Policy') and referencing the Interagency Guidance on Third-Party Relationships, these are generic program names without distinguishing identifiers and the regulatory guidance is standard banking compliance (passes the ERM test — any bank risk manager would reference it), not cybersecurity domain terminology. No cybersecurity-specific practices, tools, or frameworks are mentioned, and no firm-specific or verifiable facts survive validation.

thinking:
Let me classify this paragraph.

Content Category: This is about how third-party cyber risks are managed - vendor oversight, vendor management policy, onboarding process, periodic reviews. The central topic is oversight of external parties. → Third-Party Risk

Specificity: Let me scan for facts.
- "Third-Party Risk Management Program" - named internal program but generic name
- "Vendor Management Policy" - named policy, but fairly generic
- "Interagency Guidance on Third-Party Relationships: Risk Management" - this is a named external regulatory guidance document, specific to financial services. Is this verifiable? It's a real regulatory document issued by federal banking agencies.

The Interagency Guidance is a specific named regulatory document that's publicly verifiable, which makes it QV-eligible as an external reference, even though the company's compliance claim itself is firm-specific. The rest of the language stays general—vendor management, onboarding, periodic reviews—without specialized cybersecurity terminology. a specific regulatory framework, which is domain-adjacent but not strictly cybersecurity terminology. The paragraph itself relies more on general business and enterprise risk management language—terms like "sensitive information," "operational risks," and "periodic reviews" rather than cybersecurity-specific concepts. The internal programs mentioned, like "Third-Party Risk Management Program" and "Vendor Management Policy," are fairly generic names without distinguishing identifiers that would mark them as firm-specific.

The Interagency Guidance is a named external regulatory document, so it qualifies as a framework reference, but it's banking regulatory guidance about third-party relationships broadly, not cybersecurity-focused. By the ERM test, this guidance would appear in any banking company's vendor risk documentation regardless of cyber concerns, so it doesn't pass the cybersecurity domain specificity threshold. The Interagency Guidance is banking-wide third-party risk guidance, not cybersecurity-specific, so even though it's a named framework, it doesn't demonstrate domain expertise. This is clearly Third-Party Risk categorization, and the language stays at Level 1 since it's generic compliance boilerplate without cybersecurity terminology.


fact: information security and enterprise risk management teams conduct third-party risk assessments

reasoning: The paragraph centrally addresses how the company manages third-party cyber risks — vendor assessments prior to contracting, ongoing monitoring based on risk level, and contractual security requirements imposed on vendors — making it clearly Third-Party Risk. The specific identification of 'information security and enterprise risk management teams' as the groups conducting assessments is a firm-specific organizational detail, elevating to Level 3. The remaining language (risk assessment, contract terms, security program evaluation) describes processes in general business terms without domain-specific terminology that would pass the ERM test.

thinking:
Third-party risk management is the central topic.

Let me check specificity. Domain terms: "cybersecurity risk assessment" - does this pass the ERM test? "risk assessment" is generic but "cybersecurity risk assessment" is borderline. "information security" - this is a domain qualifier. "vendor's security program" - generic. "information security-related contract terms" - borderline.

Firm-specific: "information security and enterprise risk management teams" - this names specific team compositions. This is firm-specific since it identifies which teams conduct the assessments.

No QV facts (no numbers, dates, named external entities, certifications).

The content falls squarely under third-party risk management, focusing on vendor and supplier cybersecurity requirements and assessments. The specific mention of "information security and enterprise risk management teams" conducting these assessments qualifies as firm-specific detail at Level 3, since it identifies the particular departments involved, while "key business stakeholders" remains more generic.


reasoning: This is a cross-reference directing readers to Item 1A Risk Factors for additional cybersecurity information. It contains no substantive cybersecurity disclosure — just a pointer to another section. N/O always receives Specificity 1.


fact: external vendor risk management platform

fact: SOC 1 report requirement for vendors

fact: SOC 2 report requirement for vendors

reasoning: The paragraph centrally answers 'how are third-party cyber risks managed?' — describing vendor evaluation, monitoring, audits, and SOC report requirements imposed ON vendors, making it TP. SOC 1/SOC 2 are domain terminology (named standards), but these are requirements imposed on vendors rather than certifications the company itself holds, so they remain Level 2 rather than Level 4. No firm-specific facts (no named roles, committees, or unique organizational details) elevate beyond Domain-Adapted.

thinking: Third-party risk management is the central topic here.


reasoning: This paragraph describes the regulatory landscape (financial privacy laws, federal banking oversight, SEC disclosure rules) without disclosing anything about the company's own cybersecurity program, governance, or practices. It acknowledges being subject to regulations generically without describing what the company does to comply, making it N/O. No domain terminology, firm-specific facts, or verifiable claims are present.


content_category: Strategy Integration

fact: malware

fact: ransomware

reasoning: The paragraph's substantive core is a backward-looking materiality assessment ('have not identified any risks or incidents from cybersecurity threats that have materially affected our business strategy, our results of operations or our financial condition'), which is the SEC's required materiality conclusion → SI. The surrounding risk language and cross-reference to Item 1A are subordinate framing. Specificity reaches Level 2 due to named threat types (malware, ransomware) which are cybersecurity domain terms passing the ERM test, but no firm-specific or verifiable facts are present.

thinking:
Let me analyze this paragraph.

Content: The paragraph discusses cybersecurity risks, mentions past threats/breaches (malware, ransomware, computer viruses), discusses potential impact, states a materiality conclusion ("have not identified any risks or incidents from cybersecurity threats that have materially affected our business strategy, our results of operations or our financial condition"), and cross-references Item 1A.

Category: The key question is what this primarily answers. It contains:
- Generic risk language about cybersecurity threats
- Mention of past threats/breaches (malware, ransomware, computer viruses)
- A materiality assessment: "have not identified any risks or incidents from cybersecurity threats that have materially affected our business strategy, our results of operations or our financial condition" → This is a backward-looking materiality assessment → SI

- Cross-reference to Item 1A

The materiality assessment is really the substantive conclusion here. Per Rule 5, stating whether cybersecurity has affected business outcomes is Strategy Integration. The vague reference to past threats serves mainly as context for that materiality statement rather than a specific incident disclosure.

Category: **Strategy Integration**

Specificity: The threat types mentioned are domain terms, but the materiality language is standard boilerplate with no firm-specific facts.

The negative materiality assertion isn't verifiable under the codebook, and there are no quantifiable facts supporting it, so this lands at Level 2 (Domain-Adapted) based on the domain terminology alone.


content_category: Management Role

reasoning: The paragraph answers 'how is management organized to handle cybersecurity?' by enumerating the Director, IT's responsibilities (hiring, budgets, incident preparation, reviewing assessments). Person-removal test: removing the role leaves a generic list of management activities with no substantive program description → MR. 'Director, IT' is a general IT title below VP level without a security qualifier (codebook: NOT firm-specific), and the described activities (risk management strategy, approving budgets, reviewing security assessments) are generic management language that any ERM professional would use — no cybersecurity domain terminology present.

thinking:
Let me analyze this paragraph.

Content: Describes the Director, IT's responsibilities - hiring, integrating cyber risk into ERM, communicating priorities, approving budgets, preparing for incidents, approving processes, reviewing assessments.

Category: This is about how management is organized to handle cybersecurity. It describes a specific role's responsibilities. Person-removal test: remove "Director, IT" and reporting lines - what's left? Generic list of activities (hiring, integrating risk, communicating, approving budgets, preparing for incidents, reviewing assessments). These are responsibilities assigned to a role, not a description of program activities.

The paragraph falls apart without the role context. Looking at the specificity now - "Director, IT" is a general IT title without cybersecurity-specific language, and the codebook indicates this isn't firm-specific. The activities listed are all fairly generic: risk management, security assessments, budgets, incident preparation. Even "security assessments" and "cybersecurity risk" don't have enough domain-specific terminology to pass the ERM test. This looks like Level 1 - Generic Boilerplate.


fact: ERMC (Enterprise Risk Management Committee) — named non-generic committee

type: quantified

reasoning: The paragraph primarily answers 'how is management organized to handle cybersecurity?' — it identifies who is responsible (ERMC, VP of IT, legal/compliance), describes team composition (internal personnel and external consultants), and highlights qualifications (20+ years experience, cyber incident response training). Person-removal test: removing roles and qualifications leaves only generic 'responsible for assessing and managing risks' and 'supervises cybersecurity program,' which is near-nothing substantively → MR. Specificity reaches Level 4 via 'over 20 years of experience,' a lower-bound quantified claim that is independently checkable.

thinking:
Let me analyze this paragraph.

Content Category: This describes management's organizational role - who is responsible, their experience, team composition. The person-removal test: remove VP of IT, ERMC, experience details → "is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants." - this is quite generic, but the paragraph's primary focus is on WHO is responsible and their qualifications. MR.

Specificity:
- "Vice President of Information Technology" - VP-level IT title → firm-specific

- "ERMC" - named committee (Enterprise Risk Management Committee) → firm-specific
- "over 20 years of experience in information technology and cybersecurity" → QV (lower bound, verifiable)
- "external cybersecurity consultants" → not firm-specific (unnamed)

Level 4 due to "over 20 years."


fact: NIST governance requirements and cybersecurity framework

category_confidence: medium

reasoning: The first sentence mentions Board/Audit Committee oversight, but the majority of the paragraph describes program activities: ERM integration, IT department collaboration with risk management, and NIST framework alignment — answering 'what does the program do?' → RMP. NIST CSF is domain terminology elevating to Level 2, but no firm-specific or verifiable facts are present (Audit Committee and IT department are generic).

thinking:
Let me analyze this paragraph.

Content Category: The paragraph touches multiple categories. Let me apply the "what question" test:

- Board oversight mentioned briefly in first sentence → BG
- "integrates cybersecurity risk management into broader risk management framework" → RMP
- IT department works with risk management team → RMP (or MR?)
- NIST alignment → RMP

The first sentence mentions Board/Audit Committee oversight, but the bulk of the paragraph describes the risk management program - ERM integration, IT department collaboration, NIST alignment. The person-removal test: remove "Board," "Audit Committee," "IT department," "risk management team" - still have program description about integrating cyber into ERM and NIST alignment. This is primarily answering "what does the cybersecurity program do?" → RMP.

Though the opening references Board and Audit Committee oversight, the substance of the paragraph focuses on program activities and how cybersecurity integrates into the broader risk management framework. The NIST CSF reference provides domain-specific terminology, making this Level 2 specificity, but the generic references to IT department and risk management team don't add firm-specific detail.


reasoning: This paragraph is a general business executive biography describing David Shear's career trajectory through marketing and regional president roles—none of which are cybersecurity-related. It contains no substantive cybersecurity disclosure: no cybersecurity oversight, no security responsibilities, no program details. While placed in Item 1C, the paragraph itself answers none of the six substantive questions. N/O always receives Specificity 1.

thinking:
This paragraph describes David Shear's career history and roles. It's in Item 1C but describes a business executive's career path - not cybersecurity-specific.

This is about a named individual's career history and roles, but these are general business leadership roles (President International), not cybersecurity roles. None of the titles are cybersecurity-specific (CISO, CTO, VP of Security, etc.).

Category: This could be MR if it's describing management's role in cybersecurity, but nothing here is cybersecurity-related. It's a general business executive bio placed in Item 1C. However, if it's in Item 1C, it might be there to describe management's role in cybersecurity oversight.

The paragraph itself contains no cybersecurity content whatsoever. Even though it's positioned in Item 1C where companies sometimes list leadership overseeing cyber, this is purely a business executive biography with roles in international operations and marketing that have no connection to cybersecurity. Classifying by paragraph in isolation, this is N/O, Specificity 1.


content_category: Board Governance

fact: CISO (Chief Information Security Officer)

fact: Certification earned in 2023

fact: Three times per year updates to full board

reasoning: The paragraph answers 'how does the board oversee cybersecurity?' — describing the board's and audit committee's oversight structure, briefing cadence, and information flow from the CISO upward. Specificity reaches Level 4 because the NACD CERT Certificate in Cybersecurity Oversight earned in 2023 is an externally verifiable credential from a named organization with a specific date.

thinking:
Let me analyze this paragraph.

Content Category: This is about board oversight of cybersecurity - how the board and audit committee oversee cyber risks, receive briefings, etc. The governance chain (Board → Audit Committee → CISO) is described for oversight purposes. → Board Governance

Specificity: Let me scan for facts:
- NACD's CERT Certificate in Cybersecurity Oversight in 2023 → named certification + specific date → QV
- CISO → firm-specific role
- "quarterly cybersecurity-related updates" → generic cadence

- "three times per year" → specific frequency that's quantified and verifiable
- 2023 → specific date tied to the certification

The NACD CERT Certificate is a named, verifiable certification with a specific year attached, and the briefing frequency is a concrete number. → Level 4


reasoning: This paragraph is a cross-reference pointing to Item 1A Risk Factors for cybersecurity risk descriptions. It uses speculative language ('may materially affect') and 'could have a material adverse impact' rather than stating a materiality conclusion, making it N/O rather than SI. No substantive cybersecurity disclosure is present—just a pointer to another section.


reasoning: The final sentence states a materiality conclusion using SEC Item 106(b)(2) language ('materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition'), making this SI. The earlier sentences are generic speculation ('could have a significant adverse impact') and a cross-reference to Risk Factors, which are subordinate to the assessment. No domain terminology, firm-specific facts, or verifiable claims appear — all language is standard boilerplate found in countless filings.

thinking:
Let me analyze this paragraph.

The paragraph has two main parts:
1. Generic risk language about cyber incidents and speculation ("could have a significant adverse impact") + cross-reference to Risk Factors
2. A materiality assessment: "we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition"

Per Rule 5 (SI materiality rule), the last sentence is a backward-looking AND forward-looking materiality assessment using SEC Item 106(b)(2) language. This is Strategy Integration.

The first parts are speculation/cross-reference, but the materiality conclusion dominates as the substantive content.

The language here is entirely boilerplate—no specific security practices, tools, or firm-specific facts. Terms like "cyber incidents" and "cyber attacks" are generic business language that don't meet the ERM test for domain specificity. This is Level 1 boilerplate.


reasoning: The paragraph describes how the Audit Committee is educated on cybersecurity topics and notes members' expertise, answering 'how does the board oversee cybersecurity?' — squarely BG. No cybersecurity domain terminology passes the ERM test ('information security' is general business language), 'Audit Committee' is not firm-specific (every public company has one), and all entities (consultants, accounting firm) are unnamed, leaving specificity at Level 1.

thinking:
Let me analyze this paragraph.

Content: About Audit Committee member education and expertise. Presentations on information security among other topics. Members have technology industry expertise and risk management strategies expertise.

Category: This answers "How does the board oversee cybersecurity?" - it's about the Audit Committee's education and expertise related to cybersecurity oversight. BG.

Specificity: Let me scan for facts.
- "Audit Committee" - generic, every public company has one → NOT firm-specific
- "information security" - this is a general term, not a cybersecurity domain term per the ERM test

- "independent registered public accounting firm" - unnamed, so not firm-specific
- "third-party consultants" - unnamed, so not firm-specific
- "technology industry" expertise - generic descriptor
- "corporate risk management strategies" - generic descriptor

No domain-specific terminology that meets the ERM test, no firm-specific facts, no QV facts. This is Level 1.


fact: CDIO (Chief Digital and Information Officer) chairs the security council

fact: Security council — named non-generic management-level committee

fact: Council composed of senior leaders from Legal and Regulatory, Corporate Security, Network Engineering, Internal Audit, Finance & Accounting and Risk and IT Infrastructure

fact: April 2024 cyber-attack — specific date tied to a real cybersecurity incident

reasoning: The paragraph's primary content describes how management is organized to handle cybersecurity: the CDIO chairs a security council, its cross-functional composition is enumerated by department, and dedicated teams handle materiality assessments. The Audit Committee escalation and April 2024 incident reference are subordinate to the management structure description. Specificity reaches Level 4 because 'April 2024 cyber-attack' is a specific date tied to a verifiable real-world event (Frontier's publicly reported breach).

thinking:
Let me analyze this paragraph carefully.

**Content Category:**
This paragraph covers multiple topics. Let me break it down:

1. CDIO chairs a security council - management-level committee structure (MR)
2. Security council composition - cross-functional departments (MR)
3. Processes and response teams for monitoring/materiality determinations - could be RMP or SI
4. Audit Committee escalation procedures - BG
5. Audit Committee involvement in April 2024 cyber-attack - BG/ID
6. Cross-reference to Item 1A - N/O

The primary question: "How is management organized to handle cybersecurity?" The security council structure, its membership, and the CDIO chairing it are central.

The paragraph really centers on two main components: the security council's structure and composition under CDIO leadership, and then the processes for assessing materiality and escalating issues through the governance chain to the Audit Committee, with a brief reference to the April 2024 incident.

Looking at the balance, the security council details—its cross-functional makeup and CDIO chairmanship—dominate the text, making this primarily management-level content. The Audit Committee escalation process is mentioned but feels secondary to the core focus on how management is organized around cybersecurity oversight.

Now examining specificity: the CDIO title is a firm-specific executive role, the security council itself is a named committee unique to this organization, and the specific department roster—Legal and Regulatory, Corporate Security, Network Engineering, Internal Audit, Finance & Accounting, and IT Infrastructure—all point to firm-specific governance. The April 2024 cyber-attack reference ties this to a concrete event, which elevates it to Level 4 specificity.

So this lands as MR, Level 4.


fact: National Institute of Standards and Technology Cybersecurity Framework (NIST CSF)

fact: monitoring and patching of vulnerabilities (patch management)

fact: multi-layered defenses (defense in depth concept)

reasoning: The paragraph primarily answers 'what does the cybersecurity program do?' by describing risk assessments, framework adoption, safeguards, and operational processes; the final Audit Committee mention is subordinate attribution, not the focus. Specificity reaches Level 2 via NIST CSF (named standard) and patch management (domain term), but no firm-specific facts (Audit Committee is generic) or verifiable claims push it higher.

thinking:
Let me classify this paragraph.

Content Category: The paragraph primarily answers "What does the cybersecurity program do?" - it describes the program's approach, risk assessments, framework usage, safeguards, and processes. The last sentence mentions Audit Committee oversight but it's subordinate. → RMP

Specific facts:
- NIST Cybersecurity Framework → domain term (named standard)
- "multi-layered defenses" → could be "defense in depth" concept, but it's generic enough
- "monitoring and patching of vulnerabilities" → patch management is a domain term

- The safeguards language and Audit Committee reference are standard boilerplate, not firm-specific details

The NIST CSF is a named standard pushing this to Level 2, and patch management is a recognized domain term, but there are no company-specific facts or quantifiable metrics here.

Level 2.


fact: CISO

fact: over 20 years of information security experience

fact: over four years as a director in the information security management practice of a big four accounting firm

fact: B.S. in Network Security

fact: Information Security Steering Committee (ISSC)

reasoning: The paragraph primarily answers 'how is management organized?' — it describes the CISO's reporting line to the CFO, qualifications, experience, and the ISSC's composition and responsibilities. While ISSC activities are described, they serve to define the committee's mandate (organizational role) rather than detailing program mechanics. Specificity reaches Level 4 via multiple verifiable claims: 'over 20 years' of experience, 'over four years' at a big four firm, and a named degree (B.S. in Network Security).

thinking:
Let me analyze this paragraph.

Content Category: This paragraph describes the CISO's reporting line, qualifications, experience, and the ISSC committee structure and activities. Let me apply the person-removal test for MR vs RMP.

Remove person-specific content: reporting to CFO, 20 years experience, director at big four firm, certifications, B.S. in Network Security, leads ISSC, committee composition. What remains? The ISSC "tracks risks and security initiatives, reviews results of annual cybersecurity risk assessments, reviews results of internal and third-party information security audits and assessments, identifies significant risks...

and identifies controls to mitigate such risks" plus staying apprised of cybersecurity trends. There's substantial content about both the person and the committee's activities, but the paragraph is really structured around the CISO's qualifications and the ISSC's composition and role. The activities are secondary—they're described as what this committee does rather than as standalone responsibilities.

The core question being answered is how management is organized for cybersecurity. The CISO's reporting line, qualifications, and the ISSC's structure and membership form the organizational framework, while the committee's activities are presented as context for what this structure accomplishes. I'd classify this as MR—the paragraph is fundamentally about management organization: the CISO's position, qualifications, and committee leadership, along with the committee's composition.

Now I'm scanning for specific facts to assess their verifiability. The CISO role is firm-specific, the CFO reporting line is documented, and there are quantified experience metrics—over 20 years in information security and four years as a director at a Big Four firm. The degree in Network Security is specific and verifiable. The committee name is concrete, though the experience descriptions and certifications lack the granularity needed for higher specificity levels. The cybersecurity activities mentioned—annual risk assessments and third-party audits—are generic in nature without named providers or additional detail.

The quantified experience metrics push this to Level 4.


reasoning: The paragraph describes a governance chain (senior leadership → Audit Committee → Board) for cybersecurity oversight, answering 'how does the board oversee cybersecurity?' No domain terminology, no firm-specific facts (Audit Committee and Board exist at every public company), and no verifiable claims — all language is generic boilerplate.

thinking:
Let me classify this paragraph.

Content: Generic statement about importance of cybersecurity, mentions a "holistic process" for managing risks, supported by senior leadership, Audit Committee, and Board.

Category: This describes oversight structure - Board → Audit Committee → senior leadership. It's a governance-chain paragraph. The purpose is describing who oversees cybersecurity. It answers "How does the board oversee cybersecurity?" - BG.

Wait, it also says "holistic process for overseeing and managing cybersecurity and related risks." That's about the process. But the main point is the oversight structure. The paragraph is setting up governance. BG.

The language here is entirely generic—"holistic process," "senior leadership team," "Audit Committee," "Board of Directors"—with no firm-specific details or domain terminology. This is Level 1 specificity.


fact: Audit, Risk and Finance Committee

fact: Information Security group

fact: Information Security Program

reasoning: The paragraph primarily answers how information flows to the board-level committee (Audit, Risk and Finance Committee) via CISO updates and Information Security/Internal Audit reports — this is oversight structure, making it Board Governance. Specificity is Level 3 due to firm-specific facts: CISO (cybersecurity leadership role), the named non-generic board committee (Audit, Risk and Finance Committee), and the named Information Security group. No QV-eligible facts (no specific numbers, dates, named external entities, or certifications).

thinking:
Let me analyze this paragraph.

Content Category: This describes how information flows from management (CISO, Information Security group) to the board committee (Audit, Risk and Finance Committee). The primary question answered is "How does the board oversee cybersecurity?" - it's about the oversight structure and reporting flow to the board committee.

BG vs MR: The paragraph describes reporting TO the board committee, which is about oversight flow → BG.

Specificity:
- CISO → firm-specific (named cybersecurity role)
- "Audit, Risk and Finance Committee" → this is a board-level committee with a non-generic name (not just "Audit Committee") → firm-specific

- "Information Security Program" and "Information Security group" are named internal entities, though the program name is somewhat generic without additional identifiers
- "at least quarterly" is a standard cadence, and "Internal Audit functions" is generic terminology
- The CISO role and the specifically-named committee push this toward Level 3 classification, even though some elements like the program and team names lack distinguishing details
- No specific numbers, dates, external entities, or certifications are mentioned


reasoning: The paragraph answers 'how does the board oversee cybersecurity?' by describing the Board's delegation to the Audit Committee, the Committee's oversight role, and information flow back to the full Board. Specificity remains Level 1 because all elements (Board, Audit Committee, generic reporting cadence 'as necessary') exist at every public company — no domain terminology, firm-specific facts, or verifiable claims are present.

thinking:
Board oversight, Audit Committee, delegation, reporting structure. This is clearly BG.

Specificity: "Audit Committee" is generic (every company has one). No domain terms, no firm-specific facts, no QV facts. Level 1.


fact: penetration testing firms

fact: managed cybersecurity service providers

reasoning: The paragraph describes third parties hired to serve the company's own cybersecurity program (assessors, consultants, pen testers), which per Rule 3 is RMP rather than TP — the central topic is how the company's program operates, not oversight of vendors' cybersecurity posture. 'Penetration testing' and 'managed cybersecurity service providers' are domain terms that pass the ERM test, elevating specificity to Level 2, but no firm-specific or verifiable facts are present.

thinking:
Classify this paragraph.

Category: This describes third parties hired to serve the company's own cybersecurity program. Per Rule 3, "Third parties hired to serve the company (assessors, pen testers) → RMP." The central topic is not vendor oversight but rather the company's own program using external help.

Specificity: "penetration testing" is domain terminology → Level 2. "Managed cybersecurity service providers" could be considered domain-adjacent but is fairly generic. Let me check - "managed cybersecurity service providers" implies MDR-type services, which is domain. "Penetration testing firms" clearly uses domain terminology.

The rest of the language is generic enterprise risk management terminology, with no company-specific details or quantitative facts.


fact: IT Security Director (Director-level title with security qualifier)

fact: Chief Information Officer (CIO)

fact: threat intelligence

reasoning: The paragraph primarily describes management's organizational structure for cybersecurity — the IT Security Director's reporting line to the CIO, responsibilities, and team qualifications — making it MR. While some program activities remain after the person-removal test (risk management, threat intelligence), the dominant content is about roles, responsibilities, reporting lines, and team credentials. Specificity reaches Level 3 via the IT Security Director (Director + security qualifier) and CIO (VP-level cybersecurity-adjacent role); 'various cybersecurity certifications' and 'decades of experience' are too vague to be QV-eligible.

thinking:
Let me analyze this paragraph.

Content Category: This paragraph is about the IT Security Director role, their responsibilities, reporting lines, team experience and qualifications. The person-removal test: remove titles, reporting lines, qualifications → "assessing and managing cyber risk management program... prevention, detection, mitigation, and remediation of cybersecurity incidents... selecting, deploying and operating cybersecurity technologies, initiatives and processes... threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants." There's still some program description, but the primary focus is on WHO is responsible, their reporting structure, team qualifications. It's primarily about management organization → MR.

The specificity here breaks down to firm-specific titles like IT Security Director and CIO at the director and VP+ levels, plus domain terminology like threat intelligence, but the certifications and experience metrics are too vague to be verifiable—no specific credentials are named and "decades" and "various" are soft descriptors. That puts this at Level 3.


reasoning: The paragraph centrally answers 'how are third-party cyber risks managed?' — describing risk assessments, questionnaires, and contractual obligations imposed on service providers, making TP the clear category. All terminology ('risk assessments,' 'questionnaires,' 'contractual obligations,' 'annual') is standard ERM language that any non-security risk professional would use; no cybersecurity domain terms, firm-specific facts, or verifiable claims are present, so specificity remains Level 1.

thinking:
Third-party risk management is the central topic here.

Facts: "risk assessments," "questionnaires," "annual third-party risk assessments," "contractual obligations for cybersecurity, regulatory and industry requirements"

This is about oversight of external parties' cybersecurity - requirements imposed on vendors and assessment of vendors' cybersecurity posture → TP.

Specificity: No domain terms that pass ERM test. "Risk assessments," "questionnaires," "contractual obligations" are all general business language. No firm-specific facts, no QV facts. Level 1.


reasoning: The paragraph is split between third parties serving the company's own program (consultants for risk assessment, policy design, monitoring/testing → RMP) and requirements imposed on those providers (certification of security measures, breach reporting → TP). The first two sentences describing how third parties support the company's own cybersecurity program occupy the majority of the text, so RMP wins per the tie-breaking rule; Rule 3 also directs that third parties hired to serve the company are RMP. No domain terminology passes the ERM test — 'risk assessment,' 'policies and procedures,' 'monitor and test safeguards,' and 'security measures' are all general business language. No firm-specific or verifiable facts are present.

thinking:
Let me analyze this paragraph.

Content: Describes third-party service providers in two roles: (1) helping design/implement/monitor the company's own security, and (2) requirements imposed on those providers.

Category: The first part (consultants helping with risk assessment, designing policies, monitoring/testing) is about third parties serving the company's program → RMP. The second part (requiring providers to certify security measures and report breaches) is about requirements imposed on vendors → TP.

Which dominates? The paragraph is roughly split. First two sentences describe third parties helping the company (RMP). Third sentence describes requirements imposed on providers (TP).

So the core tension here is that the paragraph covers both sides—third parties engaged to help the company with its own security work, and then the flip side where the company imposes requirements on its vendors. The requirement piece is substantial enough that I'd classify this as genuinely mixed, with the first half leaning RMP and the second half leaning TP.

Looking at the specificity now, everything here is pretty generic—unnamed consultants, standard risk assessment language, boilerplate cybersecurity policy references, and standard contractual language about breach reporting. None of it ties to the company's particular circumstances or operations, so this stays at Level 1.


fact: CIO

fact: over 20 years in information technology and information security

fact: undergraduate degree in Information Systems from Xavier University

fact: MBA from Michigan State

fact: combined total of over 25 Information Technology and Cybersecurity certifications

fact: Certified Information Systems Security Professional (CISSP)

fact: Certified Cloud Security Professional (CCSP)

fact: Certified Information Security Manager (CISM)

reasoning: The paragraph is entirely about the CISO's role, reporting line to CIO, team composition, qualifications, and credentials — person-removal leaves nothing substantive, confirming MR. Specificity is Level 4 due to numerous verifiable facts: 'over 20 years' experience (lower bound), named universities (Xavier University, Michigan State), 'over 25' certifications (lower bound), and specifically named certifications (CISSP, CCSP, CISM) verifiable via issuing bodies.

thinking:
Let me analyze this paragraph.

Content category: This is about the CISO's role, qualifications, team, and credentials. Person-removal test: remove all person-specific content → very little remains. This is MR.

Specificity: Let me scan for facts.
- CISO (firm-specific role)
- CIO (firm-specific role)
- "over 20 years" of experience → QV (lower bound, verifiable)
- Xavier University → QV (named university)
- Michigan State → QV (named university)

- "over 25 Information Technology and Cybersecurity certifications" → QV (lower bound)
- CISSP, CCSP, CISM → QV (all verifiable certifications)

This is clearly Level 4.


fact: malware

fact: computer virus attacks

reasoning: The paragraph states a backward-looking materiality conclusion ('have not materially affected us, including our business strategy, results of operations or financial condition'), making it SI per Rule 5. While it mentions past threats and breaches, the materiality assessment is the primary frame. Specificity reaches Level 2 because 'malware' and 'computer virus attacks' are cybersecurity-specific threat types that pass the ERM test; however, no firm-specific or verifiable facts are present.

thinking:
Let me analyze this paragraph.

Content: States materiality conclusion + mentions past threats/breaches including malware and computer virus attacks.

Category: The paragraph states a conclusion about materiality ("such risks have not materially affected us, including our business strategy, results of operations or financial condition") → SI per Rule 5. There's also mention of past incidents but the materiality assessment is the primary frame.

Specificity:
- "malware and computer virus attacks" — these are specific threat types → domain terminology → Level 2
- "have not materially affected us" — negative self-assertion, not verifiable
- No QV facts, no firm-specific facts

- This lands at SI, Level 2.


reasoning: The paragraph primarily answers 'what does the cybersecurity program do?' by describing its integration into enterprise risk management, shared methodologies, and reporting channels — ERM integration is explicitly covered under RMP. Person-removal test: removing 'Chief Risk Officer' (a general enterprise role, not a cybersecurity-specific title) leaves a complete description of program integration. No cybersecurity domain terminology passes the ERM test — 'methodologies, reporting channels, governance processes' are all standard enterprise risk management language — and Chief Risk Officer is not a cybersecurity-specific title, so no facts elevate above Level 1.

thinking:
Classify this paragraph.

Content: Describes how the cybersecurity program is integrated into ERM, overseen by Chief Risk Officer, shares methodologies and reporting channels across enterprise risk management.

Category: This primarily answers "What does the cybersecurity program do?" — specifically about ERM integration. RMP covers ERM integration explicitly.

But wait - "Chief Risk Officer" is mentioned. Person-removal test: remove "overseen by our Chief Risk Officer" → "Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares certain methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other areas affecting our business risks, including financial, compliance, EHS, compensation and governance matters, among other topics." — Still describes program integration. → RMP.

Now checking the specificity: Chief Risk Officer isn't a cybersecurity-specific title like CISO or CIO, and terms like "EHS" and "methodologies, reporting channels and governance processes" are all generic ERM language without any domain-specific terminology. This is Level 1.


reasoning: This is a cross-reference directing readers to Item 1A for risk factor information, with no substantive cybersecurity disclosure. Cross-references are N/O and always receive Specificity 1.


reasoning: The paragraph centrally answers 'how are third-party cyber risks managed?' by describing vendor risk assessments, questionnaires, security program reviews, and contractual obligations imposed on vendors — all TP indicators. Despite describing a structured program, all language (vendor risk assessments, questionnaires, contractual obligations) is general business/ERM vocabulary that would appear in any non-cyber vendor oversight context, with no domain terminology, firm-specific facts, or verifiable claims.

thinking:
Paragraph about third-party risk management. Central topic is managing vendor/supplier cybersecurity risks.

Category: Third-Party Risk - clearly answers "How are third-party cyber risks managed?" with vendor risk assessments, questionnaires, contractual obligations imposed on vendors.

Specificity: Let me check for facts.
- "vendor risk assessments" - generic ERM language
- "questionnaires" - generic
- "review of the vendor's security program" - generic
- "contractual obligations for vendors" - generic

- "data-hosting companies" - generic reference
- "third-party risk management program" - generic program name
- "Information Systems and Data" - generic

No domain terminology that passes ERM test. No firm-specific facts. No QV facts. This is Level 1 content.


fact: VP of Information Technology

reasoning: The paragraph answers 'how is management organized to handle cybersecurity?' by listing the senior leaders responsible and noting their collective experience. Person-removal test leaves no substantive program description, confirming MR. VP of Information Technology is a VP-level title with an IT portfolio, qualifying as firm-specific. The other titles (President/CEO, SVP/CFO, General Counsel) are generic governance roles per the codebook. The language about 'managing information security' and 'cybersecurity programs' describes experience topics rather than demonstrating domain expertise, so no domain terms elevate beyond the firm-specific floor set by the VP of IT role.

thinking:
Let me analyze this paragraph.

Content: Describes who leads cybersecurity - a team of senior management including President/CEO/Chairman, SVP/CFO/Treasurer, SVP/General Counsel/Secretary, and VP of IT. Then says they collectively have experience.

Category: This is about how management is organized to handle cybersecurity - who the people are, their roles. Person-removal test: remove all person-specific content → "Our cybersecurity risk management and strategy processes... are led by a team... Such individuals collectively have significant prior work experience..." → collapses to nothing substantive about the program. → MR

Specificity: The VP of Information Technology title qualifies as firm-specific per the codebook, but the other roles like President/CEO and CFO are generic governance positions that don't count. There's no domain-specific terminology beyond standard cybersecurity language and no quantifiable facts.

Actually, I think this stays at Level 3 because of the VP of Information Technology designation.


reasoning: The paragraph states a materiality conclusion ('have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition'), which is the SEC's Item 106(b)(2) language and triggers SI per Rule 5. The brief incident acknowledgment lacks specifics and the cross-reference to Item 1A is subordinate. For specificity, 'December 31, 2023' is a reporting period anchor rather than a cybersecurity-specific date, the negative materiality assertion is not externally verifiable, and no domain terminology or firm-specific facts are present.

thinking:
Let me analyze this paragraph.

The paragraph has three parts:
1. Acknowledges past threats/breaches
2. States materiality conclusion
3. Cross-reference to Item 1A

The materiality assessment ("have not materially affected and are not reasonably likely to materially affect") is a clear SI trigger per Rule 5. The incident mention is brief and lacks specifics. The cross-reference is subordinate.

Category: Strategy Integration

Specificity: Let me check for facts.
- "breaches of our data within third party vendor's system" - vague, no specific incident details

- The reporting date is just a standard period marker, the materiality language is self-assessed rather than independently verified, and the Item 1A reference doesn't introduce any domain-specific terminology or company-specific facts. This disclosure lacks substantive detail—it's Level 1.


fact: CIO (Chief Information Officer) responsible for information security program

fact: CIO has 25 years of experience in the information technology industry

reasoning: This is a governance-chain paragraph (Board → Audit Committee → CIO → team) whose primary purpose is describing the oversight structure, defaulting to BG per Rule 1. While substantial MR content exists (CIO role, qualifications, reporting line), the framing and opening focus is 'how does the board oversee cybersecurity?' with management details serving to complete the oversight chain. Specificity reaches Level 4 because '25 years of experience' is a specific, verifiable quantity.

thinking:
This is a complex paragraph covering multiple topics. Let me analyze it.

The paragraph covers:
1. Board/Audit Committee oversight of cybersecurity risk
2. Board receives reports from management
3. Management provides Audit Committee updates
4. CIO's role and responsibilities
5. CIO's experience (25 years)
6. CIO reporting line to CEO
7. Dedicated cybersecurity team
8. Multidisciplinary incident response team

Primary question: This is a governance-chain paragraph. It starts with board oversight, then flows to management. The first half is about board oversight (BG), the second half is about the CIO's role (MR).

The paragraph is roughly split between governance structure and management resources, with the title framing it as an oversight structure. The first few sentences establish board and committee oversight, while the remaining content focuses on the CIO's qualifications, reporting relationship, and team composition. Given that the paragraph traces the full chain from Board down through the CIO to the operational team, and the primary purpose is describing how oversight flows through the organization, this leans toward governance structure—though the substantial detail about CIO credentials and team makeup does pull toward management resources.

Looking at the specificity markers: the CIO role is firm-specific, the 25 years of experience is a hard quantified number that signals Level 4 detail, while the team descriptions are generic enough not to be firm-specific. The quantified experience metric is the strongest indicator here.

I'm settling on governance structure as the primary classification since the paragraph's architecture is fundamentally about the oversight chain, with the CIO details functioning as supporting evidence of that structure's credibility rather than as standalone management resource content.


fact: NEE Management and NEER named as affiliated entities providing cybersecurity functions

fact: NEP named as the entity receiving services

reasoning: The paragraph describes the board's oversight of cybersecurity services outsourced to parent/affiliate entities, answering 'how does the board oversee cybersecurity?' — the arrangement structure is subordinate to the board oversight framing. Named affiliated entities (NEE Management, NEER, NEP) are independently verifiable organizations, elevating specificity to Level 4.

thinking:
Let me analyze this paragraph.

The paragraph says NEE's affiliates provide IT/cybersecurity functions to NEP, and NEP's board oversees these services.

Category: This is about how the board oversees cybersecurity services provided by affiliates. The primary question answered is "How does the board oversee cybersecurity?" — but it's quite thin. It also touches on third-party/affiliate provision of services. The board oversight is mentioned but the main content is about the outsourcing arrangement. Actually, the paragraph is split: first sentence describes the outsourcing arrangement, second sentence says the board oversees it.

The outsourcing arrangement is the core content here, with board oversight serving as the anchor to governance. The paragraph essentially explains that cybersecurity functions are handled through affiliate agreements, and the board's role is to oversee this outsourced structure. So BG fits because the paragraph's main purpose is describing how the oversight mechanism works — the board monitors the provision of these services by external parties. Now I'm looking at the specific facts mentioned to assess how detailed this is.

NEE Management and NEER are named affiliated entities providing these services, which makes them verifiable facts. The codebook examples of QV include named third-party firms like Mandiant or Deloitte, but these are affiliates rather than independent external vendors. I'm thinking these named affiliates are more likely firm-specific facts at Level 3 rather than QV — they're specific to NEP's structure and verifiable, but they're internal affiliates rather than external third-party vendors in the traditional cybersecurity consulting sense.


fact: Task Force (named non-generic group providing cybersecurity information to the board)

reasoning: The paragraph answers 'how does the board oversee cybersecurity?' by describing information flow from the Task Force to the Audit Committee, including briefings and incident notification — a governance-chain paragraph with the board-level committee as the recipient. Specificity is Level 3 because 'Task Force' is a named non-generic organizational group specific to this company's cybersecurity structure; no domain terminology passes the ERM test, and no QV-eligible facts are present ('at least annually' is a generic cadence).

thinking:
Let me analyze this paragraph.

Content: Describes how the Task Force provides information to the Audit Committee, including briefings on cyber risk management and notification of material incidents. This is about information flow to the board-level committee.

Category: This answers "How does the board oversee cybersecurity?" — the Audit Committee receives information from the Task Force. This is a governance-chain paragraph describing oversight structure → BG.

Specificity:
- "Task Force" — this is a named non-generic committee/group → firm-specific (Level 3)

- "Audit Committee" — every public company has one → NOT firm-specific
- "at least annually" — generic cadence → not QV
- "cyber risk management program" — generic
- "material cybersecurity incidents" — "material" as adjective, general language

The distinguishing factor here is the Task Force itself—it's a named organizational element specific to this company's cybersecurity structure, not a generic committee. There's no domain terminology that would qualify as ERM, and no quantifiable facts. This lands at Level 3 due to the Task Force being a firm-specific named group.


reasoning: The paragraph states a backward-looking materiality conclusion ('have not been materially affected by risks from cybersecurity threats') which is an SI assessment per Rule 5; the cross-reference to Item 1A is subordinate. No domain terminology, firm-specific facts, or verifiable claims are present — purely boilerplate materiality language found in countless 10-K filings.

thinking:
This paragraph states a conclusion about materiality ("have not been materially affected") which is a backward-looking assessment, plus a forward-looking note. The cross-reference to Item 1A is subordinate.

Category: Strategy Integration (Rule 5 - materiality assessment)
Specificity: Level 1 - Generic Boilerplate. No domain terms, no firm-specific facts, no QV facts. The materiality language is boilerplate.


fact: penetration testing

fact: SOC reports (service organization controls)

fact: vulnerability testing

fact: encryption standards

fact: access reviews and controls

fact: ISO (Information Security Officer)

reasoning: The first sentence describes hiring third parties to assess the company's own security (RMP), but the bulk of the paragraph—sentences 2 through 4—details the ISO's assessment of third-party service providers: reviewing SOC reports, vendor penetration testing, data protection controls, and assigning vendor risk ratings. This makes vendor oversight the central topic → TP. The ISO (Information Security Officer) is a firm-specific cybersecurity role elevating to Level 3; multiple domain terms (penetration testing, SOC reports, encryption, vulnerability testing) establish at least Level 2, but no QV-eligible facts (no specific numbers, dates, named external firms, or certifications held).

thinking:
Let me analyze this paragraph carefully.

**Content Category:**
The paragraph describes two main things:
1. Engaging third-party assessors to test the company's own security (RMP)
2. The ISO performing security assessments OF third-party service providers (TP)

The bulk of the text is about assessing vendors - what the ISO reviews (SOC reports, vendor testing, data protection controls, etc.) and providing a risk rating for the vendor. This is clearly third-party risk management as the central topic.

Let me weigh: The first sentence is about hiring third parties to assess the company (RMP).

But the middle section focuses on vendor oversight - the ISO evaluates service providers through penetration testing, SOC reports, encryption standards, vulnerability assessments, and access controls, then assigns risk ratings. The last sentence circles back to RMP. Since most of the content centers on how the company assesses and monitors its vendors, this falls under third-party risk management.

**Specificity:**
Looking at the technical details: penetration testing, SOC reports, encryption standards, vulnerability testing, and access reviews are all mentioned. The ISO role is cybersecurity-specific, and there's reference to an Information Security Program. I don't see any QV-eligible details like specific numbers, dates, named external firms, or certifications held.

The ISO role is firm-specific and the domain terminology pushes this to at least Level 2, but the ISO as a cybersecurity leadership position makes this Level 3.


reasoning: The paragraph states a backward-looking materiality conclusion ('risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition'), which is an SI assessment per Rule 5. The mention of past threats/breaches is brief and subordinate to the materiality framing, and the trailing pharmaceutical competition sentence is unrelated filler. No domain terminology, firm-specific facts, or verifiable claims are present — 'breaches' and 'threats' are general business language — so specificity remains Level 1.

thinking:
Let me analyze this paragraph.

The paragraph has two parts:
1. A materiality assessment statement + mention of past threats/breaches + cross-reference to Item 1A
2. A generic statement about pharmaceutical industry competition

For category: The first sentence states a conclusion about materiality ("have to date not materially affected us, our business strategy, results of operations or financial condition") → SI per Rule 5. The cross-reference and the pharmaceutical competition sentence are N/O material, but the materiality assessment dominates.

For specificity: Let me scan for facts.
- "have to date not materially affected us, our business strategy, results of operations or financial condition" — backward-looking materiality assessment, generic boilerplate language

- "experienced threats to and breaches of our and our third-party vendors' data and systems" — they acknowledge past incidents, but the language is vague and lacks specifics
- "breaches" is common business terminology now, not specialized domain language
- No firm-specific facts, no quantitative details → Level 1.


reasoning: The paragraph centrally answers 'how are third-party cyber risks managed?' — describing due diligence assessments of vendors before engagement, contractual rights to monitor vendor security, and ongoing compliance monitoring, all squarely about requirements imposed on external parties. Specificity remains Level 1 because the language is generic vendor risk management any ERM professional could write: 'due diligence security assessments,' 'contractual rights,' 'monitor compliance,' 'periodic assessments' all fail the ERM test. 'IT Security team' is equivalent to 'dedicated cybersecurity team' (not firm-specific per codebook), and 'data breaches or other security incidents' is mainstream business language, not cybersecurity domain expertise.

thinking:
Third-party risk management is the central topic here.

Facts: "IT Security team" - named team? It's a generic team name. "due diligence security assessments" - generic. "contractual rights" - about vendor oversight. "periodic assessments and ongoing monitoring" - generic.

This is about requirements imposed on vendors and assessment of vendors' cybersecurity posture → TP.

Specificity: "IT Security team" - is this firm-specific? It's a generic team name, not a named non-generic committee. "data breaches" - domain term? Yes, but it's used in a general risk context.

The language around vendor oversight—security assessments, compliance monitoring, contractual data gathering rights—is fairly generic and doesn't use firm-specific terminology or named committees, so this reads as standard third-party risk management language rather than something tailored to this particular organization. I'm going back and forth on whether "data breaches" counts as domain-specific terminology or mainstream business language at this point. The codebook lists specific threat types like ransomware and phishing, but "data breaches" has become so common that any ERM professional would use it naturally. Looking at the overall paragraph—"cybersecurity standards," "data breaches," "security incidents," "due diligence assessments," "contractual rights," "monitor compliance"—this all reads as generic vendor risk management language, so I'm settling on Level 1. "IT Security team" is essentially the same generic reference as "dedicated cybersecurity team" — not firm-specific at all. So my final classification stands: Third-Party Risk, Level 1.


reasoning: The paragraph describes third-party firms (consultants, legal counsel) hired to serve the company's own cybersecurity program, which per Rule 3 is RMP rather than TP. The language is entirely generic—'identify, assess, and manage material risks' is standard ERM phrasing, entities are unnamed, and no domain terminology, firm-specific facts, or verifiable claims are present.

thinking:
Classify this paragraph.

Content: Uses third-party service providers to help identify, assess, and manage material risks from cybersecurity threats, including professional services firms, legal counsel, and cybersecurity consultants.

Category: This describes third parties hired to serve the company's own security program. Per Rule 3, "Third parties hired to serve the company (assessors, consultants, pen testers) → RMP." But wait - is the central topic about the third parties themselves or about the company's program? The paragraph is entirely about using third-party providers. However, per the rules, third parties hired to serve the company → RMP.

These are consultants helping the company manage its own cybersecurity risks, not vendors whose security posture we're evaluating, so this is clearly RMP. Looking at the specificity now - the language is generic ERM terminology like "identify, assess, and manage material risks," the service providers are unnamed, and there's no firm-specific detail, which points to Level 1.


fact: Firewalls

fact: Intrusion detection/prevention systems (IDS/IPS)

fact: Data loss prevention (DLP)

fact: Antivirus, anti-malware

fact: Principle of least privilege

fact: Encryption at rest and in transit

fact: Phishing (as a threat in training context)

reasoning: The paragraph enumerates specific cybersecurity controls and practices across network, endpoint, access, data, and training domains — squarely answering 'what does the program do?' → RMP. It is dense with domain terminology (IDS/IPS, DLP, antivirus, least privilege, encryption at rest/in transit, phishing) but contains no firm-specific facts (no named roles, committees, or products) and no quantified-verifiable claims, placing it at Level 2.

thinking:
Classifying this paragraph from C3.ai's 10-K Item 1C.

Content: Lists specific security controls - network security (firewalls, IDS/IPS, DLP), endpoint security (antivirus, anti-malware, MDM), access controls (least privilege), data security (encryption), security awareness training (phishing).

Category: RMP - describes what the cybersecurity program does.

Specificity: Heavy domain terminology - firewalls, IDS/IPS, DLP, antivirus, anti-malware, least privilege, encryption at rest/in transit, phishing. All domain terms.

This disclosure lacks any firm-specific details like named roles, concrete numbers, or proprietary product names, so it's a Level 2 disclosure.


reasoning: This paragraph is a cross-reference pointing to Item 1A Risk Factors with speculative 'could have a material adverse effect' language — it does not answer any of the six substantive cybersecurity questions. No domain terminology, firm-specific facts, or verifiable claims are present.

thinking: Cross-reference to Item 1A with speculative materiality language ("could have a material adverse effect"). No substantive cybersecurity disclosure.


reasoning: The paragraph answers 'How does the board oversee cybersecurity?' — describing Audit Committee oversight, quarterly management briefings, and Board-level discussions of material cyber risks. All terms used (Audit Committee, quarterly, incident response plan, risk management, business continuity planning, third-party assessments) are generic business/ERM language; no cybersecurity domain terminology passes the ERM test, no firm-specific facts beyond the universal Audit Committee, and no verifiable claims.

thinking:
Let me classify this paragraph.

Content: Audit Committee oversight, quarterly briefings from management, topics covered in briefings, ad hoc conversations, Board meeting discussions of material cyber risks.

Category: This answers "How does the board oversee cybersecurity?" → Board Governance

Specificity: Let me scan for facts.
- "Audit Committee" — not firm-specific (every public company has one)
- "quarterly" — generic cadence
- Topics listed: "data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan and material cybersecurity threat risks or incidents" — these are general business terms

- "incident response plan," "risk management," and "business continuity planning" all fall under Level 1 per the codebook

No domain-specific terminology that would pass the ERM test, no firm-specific facts, no QV facts. This is Level 1 — Generic Boilerplate.


reasoning: The paragraph answers 'how does the board oversee cybersecurity?' describing Board and Audit Committee oversight with quarterly updates on cybersecurity program status — classic BG. All entities mentioned (Board of Directors, Audit Committee, quarterly cadence) exist at every public company and fail the firm-specific test; no domain terminology passes the ERM test ('cybersecurity assessments,' 'third party risk management' are general business language), yielding Level 1.

thinking:
Let me classify this paragraph.

Category: This answers "How does the board oversee cybersecurity?" — Board and Audit Committee oversight, quarterly updates, briefing scope. This is BG.

Specificity: Let me scan for facts.
- "Board of Directors" — not firm-specific (every company has one)
- "Audit Committee" — not firm-specific
- "quarterly updates" — generic cadence
- "cybersecurity assessments" — general
- "third party risk management" — general business language

No domain terminology that passes the ERM test. No firm-specific facts. No QV facts.

This rates as Level 1.


reasoning: The paragraph states a materiality conclusion — 'not aware of any risks from cybersecurity threats... that have materially affected or are reasonably likely to materially affect us' — which is both a backward-looking and forward-looking assessment, making it SI. The cross-reference to Item 1A is subordinate. No domain terminology, firm-specific facts, or verifiable claims are present; the materiality language is standard SEC boilerplate.

thinking:
Let me analyze this paragraph.

Content: States no material cybersecurity risks, then cross-references Item 1A risk factors.

Category: The first sentence is a materiality assessment - "not aware of any risks... that have materially affected or are reasonably likely to materially affect us" → SI per the materiality rule (backward-looking + forward-looking assessment).

The second sentence is a cross-reference to Item 1A, which would be N/O on its own. But the first sentence IS the assessment, and the cross-reference is subordinate. Per the codebook: "Risks have not materially affected us. See Item 1A" → SI.

The language here is pure boilerplate—standard SEC materiality language with no firm-specific details, domain terminology, or quantitative facts. Just a generic cross-reference to a section heading. That's Level 1 specificity.


reasoning: The opening sentence states a materiality conclusion ('have not materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition'), which is the SEC's Item 106(b)(2) assessment language → SI. The remainder is speculation ('could result in...') and cross-references to Item 1A, which are subordinate. No domain terminology, firm-specific facts, or verifiable claims appear anywhere in the paragraph.

thinking:
Let me analyze this paragraph.

The first sentence states a conclusion about materiality - "do not believe risks from cybersecurity threats...have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition." This is a materiality assessment → SI.

The rest is speculation ("could result in...") and cross-references to Item 1A. But the first sentence IS the materiality assessment, making this SI per Rule 5.

Specificity: The materiality statement is boilerplate language found in many filings. The cross-references and speculation don't add domain terminology or firm-specific facts.

There's no domain terminology here, no firm-specific details, and nothing tied to quantifiable values—this is clearly a Level 1 disclosure.


reasoning: The paragraph states a conclusion about whether cybersecurity risks have materially affected business strategy, financial condition, or results of operations — both backward-looking ('have not...materially affected') and forward-looking ('are reasonably likely to materially affect'), making it SI under the materiality assessment rule. The second sentence is a cross-reference with speculative 'could' language, subordinate to the assessment. Specificity is Level 1: 'December 31, 2024' anchors a negative self-assertion which is not externally verifiable, the materiality language is boilerplate SEC phrasing, and no domain terminology, firm-specific facts, or verifiable claims are present.

thinking:
Let me analyze this paragraph.

The first sentence is a materiality assessment - stating a conclusion about whether cybersecurity has materially affected the business. That's SI.

The second sentence is a cross-reference to Item 1A with speculative "could" language.

The primary content is the materiality assessment → SI.

Specificity: "As of December 31, 2024" - this is a reporting period anchor for a negative assertion. Per the codebook, negative self-assertions are not externally verifiable. The date just anchors the negative assertion.

The materiality language is boilerplate SEC language. No domain terminology, no firm-specific facts, no verifiable claims.

This is SI, Level 1.


reasoning: The paragraph answers 'how are third-party cyber risks managed?' by describing requirements imposed on franchisees and licensees regarding information security compliance with brand standards and incident reporting obligations — this is vendor/counterparty cybersecurity oversight, making it TP. No domain terminology (only general 'information security' language), no firm-specific cybersecurity roles or committees, and no verifiable facts — the language is generic enough to apply to any franchise-model company, staying at Level 1.

thinking:
Let me analyze this paragraph.

Content: This is about franchisees/licensees being responsible for their own information security, with requirements to comply with Marriott brand standards and report incidents.

Category: This is about how third-party cyber risks are managed - requirements imposed on franchisees/licensees regarding information security. → Third-Party Risk

Specificity: Let me scan for facts.
- "franchisees, licensees" - general business terms
- "Marriott brand standards relating to information security" - this is a named internal program? Not really, it's generic.
- No domain terminology, no firm-specific cybersecurity roles, no QV facts.

- The language here is generic and doesn't contain domain-specific terms or firm-specific cybersecurity facts, so this falls into Level 1.


reasoning: The paragraph states a backward-looking materiality conclusion ('none of these threats or incidents...has materially affected the Company'), which is an SI assessment per Rule 5. The cross-reference to Item 1A is subordinate. No domain terminology, firm-specific facts, or verifiable claims are present — the negative assertion about no material impact is a self-reported claim about absence, not externally verifiable.


fact: vulnerability scanning

fact: threat intelligence feeds

fact: security questionnaires

reasoning: The paragraph primarily answers 'what does the cybersecurity program do?' with multiple bullet points describing program activities (vulnerability scanning, pen testing, threat intelligence, risk framework). Third-party vendor assessment is included but as one component of the broader program, not the central topic, so RMP over TP. Multiple domain terms (vulnerability scanning, penetration testing, threat intelligence feeds) elevate to Level 2, but no firm-specific facts (no named roles, committees, or individuals) or verifiable claims (no specific numbers, dates, named firms, or certifications held) keep it at Domain-Adapted.

thinking:
Let me analyze this paragraph.

Content Category: This paragraph describes what the cybersecurity program does - vulnerability scanning, penetration testing, threat intelligence monitoring, risk assessment framework, and vendor risk assessment. The primary question it answers is "What does the cybersecurity program do?" → RMP.

However, there's substantial third-party risk content at the end. Let me assess: the majority of the text is about the overall program (vulnerability scanning, pen testing, threat intelligence, risk framework), with vendor risk as one component within the broader program description. RMP wins by text volume.

Wait - the last portion about third-party vendor risk assessment is fairly detailed.

But looking at the whole paragraph, the central framing is "comprehensive cybersecurity risk management program" with multiple bullet points, of which third-party is just one component. → RMP.

Now I'm checking the specificity level. I see domain-specific terms like vulnerability scanning, penetration testing, threat intelligence feeds, and security questionnaires scattered throughout, while other phrases like security policies and certifications are more general. There are no named roles, specific numbers, named firms, or certifications mentioned, which puts this at Level 2.


fact: Technology & Operations Committee

fact: CISO

fact: CIO

fact: information technology, legal, and internal audit functions regularly presenting

reasoning: The paragraph answers 'how does the board oversee cybersecurity?' by describing information flow to board-level committees (Audit Committee and Technology & Operations Committee), briefing frequency, and report content — classic BG. Specificity is Level 3 due to the named non-generic Technology & Operations Committee, CISO and CIO roles, and specific departmental composition (IT, legal, internal audit). No QV-eligible facts: 'quarterly' is a generic cadence, not a specific date.

thinking:
Let me analyze this paragraph.

Category: This describes how information flows to board-level committees (Audit Committee, Technology & Operations Committee). The primary question answered is "How does the board oversee cybersecurity?" — it's about briefing frequency, scope, and information flow to the board. BG.

Specificity: Let me scan for facts:
- "information technology, legal, and internal audit functions" — specific team composition by department → firm-specific
- "Audit Committee" — every company has one, NOT firm-specific
- "Technology & Operations Committee" — this is a named non-generic committee → firm-specific

- "CISO" and "CIO" are leadership roles specific to this organization, and the quarterly briefing cadence combined with these named roles and committee structure points to firm-specific details. This lands at Level 3 due to the Technology & Operations Committee, the identified leadership positions, and the particular team composition.


reasoning: The paragraph answers 'How does the board oversee cybersecurity?' by describing the flow of information from the security team to the Audit Committee/Board, including briefing content and cadence — a classic BG oversight-structure paragraph. No domain terminology passes the ERM test ('cybersecurity systems testing' is generic), 'Audit Committee' and 'Board of Directors' exist at every public company, 'quarterly' is a generic cadence, and 'security team' is not a named VP+ cybersecurity role, leaving this at Level 1.

thinking:
Classify this paragraph.

Content: Describes how the security team reports to the Audit Committee/Board - quarterly updates on cybersecurity risks, incidents, testing, third-party activities.

Category: This answers "How does the board oversee cybersecurity?" - information flows to the board. BG.

Specificity: Let me scan for facts.
- "security team" - not a named cybersecurity role at VP+ level, just a generic team reference
- "quarterly updates" - generic cadence
- "Audit Committee" - every company has one, not firm-specific
- "Board of Directors" - generic
- No domain terminology that passes the ERM test - "cybersecurity risks," "cybersecurity incidents," "cybersecurity systems testing" are general

- "cybersecurity systems testing" is borderline but generic enough, not like "penetration testing" or "vulnerability scanning"

No domain terms, no firm-specific facts, no QV facts. Level 1.


reasoning: The paragraph answers 'How does the board oversee cybersecurity?' — describing full Board designation as primary oversight body, management reporting to the Board annually, and Audit Committee's role regarding financial statement implications. All entities mentioned (Board of Directors, Audit Committee, management) are generic governance structures present at every public company, with no cybersecurity domain terminology, firm-specific facts, or verifiable claims.

thinking:
Board oversight paragraph. Let me classify.

Content: Board oversees cybersecurity, full Board designated as primary responsible, management reports to Board annually, Audit Committee handles financial statement cybersecurity risks.

Category: BG - clearly answers "How does the board oversee cybersecurity?"

Specificity: Let me scan for facts.
- "Board of Directors" - not firm-specific (every company has one)
- "Audit Committee" - not firm-specific
- "at least annually" - generic cadence
- "management" - generic
- No domain terminology, no firm-specific facts, no QV facts.

- This is boilerplate governance language that applies to any company. Level 1.


reasoning: The paragraph describes general goals of a cybersecurity program (business continuity, protecting technology, safeguarding data), answering 'what does the program do?' at a very high level. No domain terminology, firm-specific facts, or verifiable claims — entirely generic language any company could use.


fact: data exfiltration

reasoning: The paragraph describes the company's methodology for determining materiality of cybersecurity incidents, listing business and financial impact factors — this answers 'how does cybersecurity affect the business?' and falls under SI's 'materiality assessments' coverage. 'Data exfiltration' is a cybersecurity-specific term that passes the ERM test, elevating to Level 2.

thinking:
Let me analyze this paragraph.

Content: Describes how the company determines materiality for cybersecurity incidents, listing various factors (financial impacts, data exposure, operational impacts, reputational harm). Ends with a cross-reference to Item 1A.

Category: This is about materiality assessment methodology - how they evaluate whether incidents are material. It's describing the process/criteria for determining materiality. Is this SI or RMP?

The paragraph describes the criteria used to assess materiality of cybersecurity incidents. Per the codebook, materiality assessments fall under SI. But this isn't stating a conclusion about materiality - it's describing the process for determining materiality.

The key distinction is that while the materiality rule focuses on conclusions about whether incidents have materially affected the business, this paragraph is laying out the assessment methodology itself. The SI definition covers materiality assessments broadly, which includes both the conclusions and the underlying process for reaching them. By describing the factors they consider—financial impacts, data exposure, operational effects, reputational harm—they're essentially explaining how cybersecurity incidents connect to business and financial outcomes, which falls squarely under SI. I'm settling on Level 2 for this classification.


reasoning: The paragraph answers 'what does the cybersecurity program do?' by describing the incident response escalation process — how the team identifies, assesses, and responds to incidents and when it escalates to the CEO and Board. Person-removal test: removing CEO/Board references leaves a substantive process description, so this is RMP not BG or MR. Specificity stays Level 1: 'Incident Response Team' lacks a distinguishing identifier (generic name), CEO and Board are generic governance roles, and 'cybersecurity experts' and 'outside counsel' are unnamed. No domain terminology passes the ERM test — the language describes general escalation procedures any business professional could write.

thinking:
Let me analyze this paragraph.

Content: Describes the Incident Response Team's role in identifying, assessing, responding to cybersecurity incidents, including escalation procedures to CEO and Board.

Category: This describes what happens in the event of a cybersecurity incident - the process/procedures. It's about incident response planning as part of the risk management process. The escalation to CEO/Board is subordinate to describing the process. Person-removal test: remove CEO, Board references - still describes an incident response process. → RMP

Specificity: Let me scan for facts:
- "Incident Response Team" - generic name, no distinguishing identifier

- "Chief Executive Officer" - generic role, not cybersecurity-specific
- "Board of Directors" - generic
- "cybersecurity experts, outside counsel" - unnamed

No domain terminology that passes the ERM test - "incident response" is general, "cybersecurity incident" is the topic not domain expertise. The paragraph describes a process but uses general business language. "Incident Response Team" as a named team doesn't count either - it's a fairly generic program name without firm-specific identifiers.

This is Level 1 - Generic Boilerplate. No domain terms, no firm-specific facts, no QV facts.


reasoning: This is a meta-summary sentence that describes the filing's own structure rather than providing any substantive cybersecurity disclosure. It contains no domain terminology, no firm-specific facts, and no verifiable claims — pure generic framing language.


fact: Chief Information Officer (CIO) briefs the Board

reasoning: The paragraph primarily answers 'How does the board oversee cybersecurity?' — describing Board and Audit Committee oversight, briefing content, and information flow from management to the board. The CIO is a cybersecurity-specific VP+ title qualifying as firm-specific (Level 3). Other roles mentioned (CFO, General Counsel, SVP Internal Audit) are generic governance roles, and the vocabulary (business continuity, disaster recovery, risk management) does not pass the ERM test for domain terminology, so specificity stays at Level 3.

thinking:
Let me analyze this paragraph.

Content Category: This is about board oversight of cybersecurity. The primary question answered is "How does the board oversee cybersecurity?" → Board Governance.

The paragraph describes: Board oversight of ERM including cyber, Board briefed by CIO, what briefs include, Audit Committee receiving updates from leadership team.

Specificity: Let me scan for facts.

- "Chief Information Officer" (CIO) — cybersecurity-specific title at VP+ level → firm-specific
- "Senior Vice President Internal Audit" — SVP level but not cybersecurity-specific... actually this is a generic audit role

- "Chief Financial Officer" — NOT firm-specific (generic)
- "General Counsel" — NOT firm-specific
- "Audit Committee" — NOT firm-specific (every company has one)
- "at least annually" — generic cadence
- "business continuity and disaster recovery plans" — Level 1 terms
- "key security metrics" — generic
- "cybersecurity initiatives" — generic
- "cyber threats and mitigation plans" — generic

Wait - CIO is listed as firm-specific in the codebook: "CISO, CTO, CIO, VP/SVP/EVP of IT..." → yes, CIO is firm-specific. So the only firm-specific element here is the CIO title; everything else is standard governance language that could apply to any company.

Now checking "Senior Vice President Internal Audit" — while it's an SVP-level role, the codebook specifically requires VP-or-above titles whose portfolio includes IT, cybersecurity, or information security. Internal Audit doesn't fit that criterion, so it's not firm-specific.

Looking at the terminology used — "business continuity and disaster recovery plans," "cyber threats," "cybersecurity risks," "key security metrics" — none of these qualify as domain-specific language. They're all generic governance terms.

This looks like BG, Level 3, driven by the CIO reference.


fact: Risk and Governance Committee

fact: Head of Information Technology

fact: Certified Information Systems Security Professional (CISSP)

reasoning: The paragraph describes the full governance chain from Board delegation to the Risk and Governance Committee, quarterly updates from senior management, and the reporting line of the Head of IT to the CFO — answering 'how does the board oversee cybersecurity?' Per Rule 1, governance-chain paragraphs default to BG. While the Head of IT role details lean toward MR, the framing purpose is oversight structure. CISSP certification is independently verifiable via (ISC)², elevating specificity to Level 4.

thinking:
Let me analyze this paragraph.

Content Category: This paragraph covers board delegation to Risk and Governance Committee, updates at committee meetings, and then describes the Head of IT's role. The primary question: "How does the board oversee cybersecurity?" — the delegation to committee and reporting structure. But there's also significant MR content about the Head of IT.

The first half is clearly BG (board delegates to committee, committee receives updates). The second half describes a management role (Head of IT, CISSP, reports to CFO).

By text volume, it's roughly split. The governance-chain rule says these default to BG when describing oversight structure.

The paragraph traces the full governance chain from Board through the Risk and Governance Committee down to the Head of IT and their CFO reporting line, so this is fundamentally about oversight structure and defaults to Board Governance. The Risk and Governance Committee is firm-specific, while the Head of IT role itself isn't, though the CISSP credential adds some specificity.