reasoning: The paragraph primarily answers 'how is management organized to handle cybersecurity?' by describing the Director of Operations & IT's responsibilities, experience, and certifications. Person-removal test: removing the director and their qualifications leaves only generic language ('evaluates cybersecurity risk profile,' 'strategies to mitigate risks') — the paragraph collapses, confirming MR. For specificity, 'Director of Operations & Information Technology' is a director-level IT title WITHOUT a security qualifier (not firm-specific per codebook), 'approximately 20 years' is a soft/hedged number (not QV-eligible), and 'certifications in cybersecurity from accredited providers' names no specific certification (not verifiable). No cybersecurity domain terminology is present — 'cybersecurity risk profile' and 'strategies to mitigate risks' are generic ERM language. All facts fail validation, leaving Level 1.

thinking:
Let me analyze this paragraph.

Content: Describes the Director of Operations & Information Technology's role, experience, and certifications in cybersecurity context.

Category: This is about management's organizational role - who handles cybersecurity, their qualifications. Person-removal test: remove the director, experience, certifications → "regularly evaluates the Company's cybersecurity risk profile and leads the development of strategies to mitigate risks and address cybersecurity issues that may arise, in consultation with members of our senior management team." That's somewhat generic but still describes activities. However, the primary focus is on the person - their role, experience, and certifications.

The program description itself is pretty generic—just strategies to mitigate risks and address cybersecurity issues. Looking at the specificity markers: "Director of Operations & Information Technology" lacks a security qualifier, so that's not firm-specific per the codebook. The "approximately 20 years of experience" is softened by "approximately," which makes it less precise, though I need to think through whether that affects the classification.

The certifications are unnamed from unnamed providers, so they're not verifiable. And scanning for domain-specific language—"cybersecurity risk profile," "strategies to mitigate risks"—these are generic risk management terms that could apply to any domain. That "cybersecurity risk profile" language doesn't really pass the ERM test either; you could swap in "financial risk profile" just as easily.

So I'm looking at no domain terminology, no firm-specific facts, and no quantifiable details that are precise enough. This seems to be Level 1 across the board.


content_category: Risk Management Process

fact: denial-of-service attacks

fact: phishing

fact: ransomware

fact: malware

fact: social engineering

fact: vendor software supply chain compromises

fact: Vice President of IT responsible for information security program

category_confidence: medium

specificity_confidence: high

reasoning: This introductory paragraph primarily frames the company's risk management posture — describing processes/controls to manage risks and enumerating the threat landscape — making RMP the best fit, though it briefly touches BG (Board/Audit Committee oversight) and MR (VP of IT). The VP of IT as responsible for the information security program is a firm-specific fact (VP-level title with IT/security portfolio), elevating specificity to Level 3. Multiple domain terms (ransomware, phishing, DDoS, social engineering, supply chain compromises) support at least Level 2.

provider: anthropic

generationId: agent-sdk

stage: benchmark

thinking:
Let me analyze this paragraph.

Content: This is an introductory paragraph covering multiple topics - commitment to governance, VP of IT role, Board oversight, threat landscape, and third-party vendors. The primary question it answers is broad - it's setting the stage for the cybersecurity disclosure section.

Category analysis:
- Mentions VP of IT responsible for information security program → MR element
- Board of Directors oversees risks through Audit Committee → BG element
- Lists threat types (cyber-attacks, denial-of-service, hacking, phishing, ransomware, malware, social engineering, supply chain compromises) → more like risk landscape/RMP

- Third-party vendors mentioned briefly at the end

The paragraph structure shows most of the content devoted to describing threats and potential impacts, which reads as generic risk language rather than describing what the program actually does. It's really functioning as an overview or introduction to the cybersecurity section, with governance and management roles mentioned but not deeply explored.

Looking at the framing more carefully, the opening explicitly references "Risk Management and Strategy" and discusses processes, controls, and technologies for assessing and managing material risks. The threat enumeration serves as context for why this risk management approach matters. The governance elements—VP of IT responsibility and Board oversight through the Audit Committee—are supporting details rather than the main focus. This feels like it belongs in the RMP category since it's introducing the risk management framework and landscape, even though much of the language is fairly generic.

The specificity analysis shows the VP of IT title is firm-specific (Level 3), while the threat types like ransomware and phishing are domain terminology (Level 2), and references to the Audit Committee and Board are standard governance structures found across companies. So the highest specificity level here is Level 3 based on the VP-level role with IT portfolio.


content_category: Strategy Integration

category_confidence: high

reasoning: The paragraph states a conclusion about materiality — no material incidents and immaterial expenses — which is a backward-looking assessment of cybersecurity's impact on business outcomes, making it SI. Specificity is Level 1: 'last three fiscal years' is a soft timeframe, and negative assertions about absence of material incidents are not externally verifiable; no domain terminology or firm-specific facts are present.

thinking:
Classify this paragraph.

"In the last three fiscal years, we have not experienced any material cybersecurity incidents, and the expenses we have incurred from cybersecurity incidents have been immaterial."

Category: This is a materiality assessment - stating a conclusion about whether cybersecurity has affected business outcomes. Both backward-looking ("have not experienced any material cybersecurity incidents") and expense assessment ("expenses... have been immaterial"). → Strategy Integration.

Specificity: Let me check for facts.
- "last three fiscal years" — soft timeframe, not a specific date
- "material cybersecurity incidents" — negative self-assertion, not externally verifiable

- "expenses... have been immaterial" — also a negative assertion about financials

These are all negative assertions without external verification or domain-specific terminology, just generic business language with no firm-specific facts. Level 1.


content_category: Management Role

fact: Senior Director of Information Technology

fact: over 20 years of cybersecurity experience

type: quantified

fact: last 10 years in leadership positions

fact: US Cyber Army Command (ARCYBER) Veteran Volunteer Instructor

fact: Information Systems Security Association (ISSA)

fact: Forum of Incident Response and Security Teams (FIRST)

fact: GSTRT certification

fact: CISSP certification

fact: CCSP certification

fact: CISSP-ISSAP certification (third-party vendors)

fact: CGEIT certification (third-party vendors)

fact: CDPSE certification (third-party vendors)

fact: CEH certification (third-party vendors)

reasoning: The paragraph primarily answers 'how is management organized to handle cybersecurity?' — detailing the Senior Director of IT's qualifications, experience, associations, and certifications. Person-removal test: removing all person-specific content leaves very little substance. Specificity is Level 4 due to multiple verifiable facts: specific years of experience (20+, 10), named certifications (CISSP, CCSP, GSTRT, CEH, etc.) verifiable via issuing bodies, and named external organizations (ARCYBER, ISSA, FIRST).


content_category: Board Governance

reasoning: The paragraph answers 'how does the board oversee cybersecurity?' by describing the audit committee receiving periodic reports about cybersecurity threats and risks — classic oversight structure. No domain terminology is present (no cybersecurity-specific practices, tools, or frameworks), and the roles mentioned (SVP & General Counsel, CFO, VP Finance & Controller) are not cybersecurity-specific titles per the codebook; 'audit committee' exists at every public company and is explicitly excluded from firm-specific facts. The language ('significant cybersecurity threats and risk,' 'processes the Company has implemented to address them') is generic enough for any filing.

thinking:
Let me analyze this paragraph.

Category: This describes how the audit committee receives reports about cybersecurity - answering "How does the board oversee cybersecurity?" → Board Governance.

Specificity: Let me scan for facts.
- "Senior Vice President and General Counsel" - General Counsel is not a cybersecurity-specific role, and SVP General Counsel is not cybersecurity leadership
- "Chief Financial Officer" - not firm-specific per codebook
- "Vice President, Finance and Controller" - not a cybersecurity-specific role
- "audit committee" - every public company has one, not firm-specific

- The roles reporting to the audit committee are all generic titles with no cybersecurity expertise indicated, and there's no domain-specific terminology or firm-specific facts about their actual cybersecurity responsibilities.

This is Level 1 - Generic Boilerplate.


fact: Chief Information Officer (CIO)

fact: vCISO (virtual Chief Information Security Officer)

reasoning: The paragraph answers 'How does the board oversee cybersecurity?' — describing the Board's delegation to the Audit Committee, the reporting chain from management to the committee and board, and the types of updates provided. This is a governance-chain paragraph with the oversight structure as its purpose → BG. Specificity reaches Level 3 due to the named cybersecurity-relevant roles (CIO and vCISO), which are firm-specific facts distinguishing this company's cybersecurity leadership structure; notably the use of a virtual CISO is a distinctive organizational choice. No QV-eligible facts (no specific numbers, dates, named external firms, or certifications).

thinking:
Let me classify this paragraph.

Content: Board delegates to Audit Committee, which oversees cybersecurity risk management. Board receives reports from Audit Committee. Audit Committee receives reports from management including CIO, vCISO, internal security staff, and external experts. Includes updates on significant incidents.

Category: This answers "How does the board oversee cybersecurity?" → Board Governance

Specificity: Let me scan for facts.
- "Chief Information Officer" - CIO is a firm-specific cybersecurity leadership role (VP+ level)
- "vCISO" - virtual CISO, this is a firm-specific fact (indicates they use a virtual CISO rather than full-time)

- "Audit Committee" and "internal security staff" are generic roles present at most companies, while "external experts" is too vague to be firm-specific

The vCISO designation is particularly telling—it reveals this firm's specific approach to CISO-level oversight rather than employing a traditional full-time CISO. Combined with the CIO reference, this gives me enough firm-specific detail to classify at Level 3, though there are no quantifiable facts like numbers, dates, or named external entities.


content_category: None/Other

reasoning: This is a cross-reference directing readers to Item 1A for additional information, with no substantive cybersecurity disclosure. N/O always receives Specificity 1.


fact: Chief Information Security Officer (CISO)

fact: Chief Technology and Digital Officer

reasoning: The paragraph answers 'how does the board oversee cybersecurity?' — describing the Audit and Finance Committee's oversight role, quarterly briefing cadence, and annual board discussions, all classic BG content. Specificity reaches Level 3 via two firm-specific cybersecurity leadership titles (CISO and Chief Technology and Digital Officer); the 'Audit and Finance Committee' is a board-level audit committee variant (not firm-specific per codebook), and 'quarterly'/'annually' are generic cadences.

thinking:
Let me analyze this paragraph.

Category: "How does the board oversee cybersecurity?" - This is about the Audit and Finance Committee's oversight, briefing frequency, and board-level discussions. BG.

Specificity: Let me scan for facts.
- "Audit and Finance Committee" - this is a board-level committee, similar to Audit Committee. Every company has an audit committee variant. NOT firm-specific per the codebook ("Audit Committee" is not firm-specific). But "Audit and Finance Committee" is slightly different... still, it's the board's audit committee equivalent. I'll treat it as not firm-specific.

- The briefing cadences are generic ("at least quarterly" and "at least annually"), but the specific leadership roles mentioned—CISO and Chief Technology and Digital Officer—are firm-specific positions. These named roles push this to Level 3.


fact: vulnerability testing (third-party vulnerability testing)

fact: scanning internal network and infrastructure (vulnerability scanning)

reasoning: The paragraph answers 'what does the cybersecurity program do?' by describing risk assessments, network scanning, vulnerability testing, and security tools — all program activities. Domain terms like vulnerability scanning and vulnerability testing pass the ERM test (a non-security ERM professional wouldn't naturally use these), elevating to Level 2. Cadences ('at least monthly,' 'at minimum on an annual basis') are generic frequency commitments, not specific dates or verifiable quantities. No named roles, committees, firms, or hard numbers push to Level 3 or 4.

thinking:
Let me classify this paragraph.

Content: Describes cybersecurity program activities - risk assessment, monitoring, vulnerability scanning, third-party testing, security tools.

Category: RMP - "What does the cybersecurity program do?"

Specificity analysis:
- "scanning our internal network and infrastructure at least monthly" - "at least monthly" is a cadence but also a lower bound frequency. Is this QV? The codebook says generic cadences like "quarterly", "annual" are not QV. But "at least monthly" is a specific frequency commitment... actually the codebook says "quarterly," "annual," "regular" are generic cadences without specific dates - NOT QV.

The other activities follow the same pattern - annual testing cadences and domain terminology like vulnerability scanning without any firm-specific details, named roles, or quantifiable facts. This lands at Level 2.


reasoning: The paragraph states a backward-looking materiality conclusion ('prior incidents have not had a material impact on us') and a forward-looking assessment ('future incidents could have a material impact'), making SI the primary category under the materiality assessment rule. However, 'could have a material impact' is closer to speculation than a firm assessment, so confidence is moderate. No domain terminology, firm-specific facts, or verifiable claims are present — the language is entirely generic business/risk language with a cross-reference to Item 1A.


reasoning: This paragraph merely restates the SEC's 8-K disclosure obligation — that the company will report material incidents and disclose their nature, scope, timing, and impact. It does not answer any of the six substantive questions: there is no actual incident described (not ID), no materiality assessment or conclusion about business impact (not SI), and no program, process, or governance structure described. It is a forward-looking procedural statement about compliance with disclosure rules. No domain terminology, firm-specific facts, or verifiable claims are present.

thinking:
Let me analyze this paragraph.

The paragraph says SoundHound will report material cybersecurity incidents and disclose material aspects. This is describing what they WILL do in the future regarding disclosure obligations - it's essentially restating SEC requirements.

Category: This doesn't answer any of the six substantive questions. It's not describing an actual incident (ID), not describing a program (RMP), not a materiality assessment (SI). It's just saying they'll comply with disclosure requirements. This is N/O.

Wait - let me reconsider. Could this be SI? The SI rule says a paragraph STATING A CONCLUSION about whether cybersecurity has or will affect business outcomes → SI.

But this paragraph doesn't state a conclusion about materiality - it just describes the company's disclosure policy and obligation. It's restating the SEC's 8-K requirements. That makes it N/O with a specificity score of 1.


content_category: Third-Party Risk

reasoning: The paragraph's central topic is managing cybersecurity risks from vendors — security assessments of third-party providers and ongoing monitoring of their compliance — squarely answering 'how are third-party cyber risks managed?' All language ('security assessments,' 'ongoing monitoring,' 'compliance with our cybersecurity standards,' 'data breaches,' 'security incidents') passes the ERM test as general business/risk vocabulary any non-security professional would use, with no domain-specific tools, frameworks, or practices mentioned, no firm-specific facts, and no verifiable claims.

thinking:
Third-party risk management is the central topic here.

Facts: "security assessments of key third-party providers" - this is about vendor oversight. "ongoing monitoring to ensure their compliance with our cybersecurity standards" - requirements imposed on vendors.

Domain terms: Let me check - "data breaches" is a specific threat type → domain term. "security assessments of key third-party providers" - the "security assessments" in vendor context... actually "vendor security assessments" per the codebook example is L1 ("We conduct vendor security assessments" → L1). But "data breaches" - is that domain terminology? It's quite common in general business language too.

Looking at the language more carefully, "data breaches" is borderline since it's widely used in business and legal contexts now, not just cybersecurity. The core terms like "security assessments," "ongoing monitoring," and "compliance with cybersecurity standards" are all fairly generic process language. Based on the codebook example matching "vendor security assessments" to L1, I'm classifying this as Level 1 overall.


fact: Vice President, IT Security and Compliance

fact: Chief Information Officer

fact: IT Security Director

fact: threat intelligence

reasoning: The paragraph is organized around management roles (VP IT Security and Compliance, CIO, IT Security Director), their reporting lines, responsibilities, and team qualifications — answering 'how is management organized to handle cybersecurity?' Person-removal test: removing roles, reporting lines, and team qualifications leaves only fragments about the program, so MR holds. Specificity is Level 3 due to multiple VP+ cybersecurity-specific roles; 'decades of experience' and 'various cybersecurity certifications' are soft/unnamed and do not reach QV.

thinking:
Let me analyze this paragraph.

Content: Describes VP IT Security and Compliance reporting to CIO, IT Security Director's responsibilities, cybersecurity team experience and certifications, threat intelligence sources.

Category: This is primarily about management organization - roles, reporting lines, qualifications. Person-removal test: remove VP title, CIO, IT Security Director, reporting lines, team composition/qualifications → what remains? "cyber risk management program... prevention, detection, mitigation, and remediation of cybersecurity incidents... cybersecurity technologies, initiatives and processes... threat intelligence... external consultants." There's some program content but the primary frame is about who does what and their qualifications.

The structure centers on organizational roles and team credentials. Looking at specificity, I see firm-specific titles like Vice President and Chief Information Officer, plus a Director-level security role, alongside generic mentions like "cybersecurity certifications" without naming particular credentials and soft references like "decades of experience." That puts this at Level 3 - Firm-Specific.


reasoning: This paragraph is a cross-reference directing readers to Item 1A Risk Factors for materiality-related cybersecurity information. Per the codebook, cross-references like 'risks that may materially affect... see Item 1A' are N/O (pointing elsewhere), not SI. N/O always receives Specificity 1.


reasoning: The first sentence states a materiality conclusion using SEC Item 106(b)(2) language ('have materially affected or are reasonably likely to materially affect...business strategy, results of operations or financial condition'), making this SI per the materiality assessment rule; the cross-reference to Item 1A is subordinate. No domain terminology, firm-specific facts, or verifiable claims are present—the negative materiality assertion is a self-reported claim about absence and not externally verifiable—so specificity remains Level 1.

thinking:
Materiality assessment paragraph with cross-reference.

Category: The first sentence states a conclusion about materiality ("not aware of any risks...that have materially affected or are reasonably likely to materially affect us") → SI per Rule 5. The cross-reference is subordinate.

Specificity: This is boilerplate materiality language. No domain terms, no firm-specific facts, no QV facts. The negative assertion about no material incidents is not verifiable. Level 1.


fact: ISO 27001 (framework basis, not certification claim)

type: framework

fact: least-privilege access provisioning

fact: phishing awareness exercises

fact: security-by-design principles

reasoning: The paragraph answers 'what does the cybersecurity program do?' by describing framework adoption, access control principles, employee training, and phishing exercises — all program activities (RMP). Multiple domain terms (ISO 27001 as a framework reference, least-privilege, phishing exercises, security-by-design) elevate to Level 2, but 'based on ISO 27001' is not a certification claim so stays at Domain-Adapted, and no firm-specific or verifiable facts are present.

thinking:
Let me analyze this paragraph.

Content: Describes cybersecurity program activities - framework, access controls, training, phishing exercises.

Category: RMP - "What does the cybersecurity program do?" - describes processes, framework adoption, training, access controls.

Specificity: Let me scan for facts.
- "ISO 27001" - named standard, domain term (Level 2). They say "based on" not "certified" so Level 2.
- "least-privilege" - architectural concept, domain term (Level 2)
- "phishing awareness exercises" - domain term (Level 2)
- "security-by-design principles" - domain term (Level 2)

- "annually" - generic cadence, not a quantifiable fact

No firm-specific details or quantifiable metrics here. This lands at Level 2.


specificity_confidence: medium

reasoning: The paragraph answers 'what does the cybersecurity program do?' by describing risk identification and assessment approaches integrated into overall risk management. While it mentions third-party assessments, internal audit, and various review types, all language fails the ERM test — 'risk management systems and processes,' 'independent third-party assessments,' 'internal audit,' 'governance, risk and compliance reviews' are all standard ERM vocabulary. No domain terminology, firm-specific facts, or verifiable claims are present.


reasoning: The paragraph answers 'How does the board oversee cybersecurity?' by describing the Audit Committee's oversight responsibilities, review cadence, and reporting to the Board — classic BG. Specificity is Level 1: 'Audit Committee' and 'Board of Directors' exist at every public company, 'at least annually' is a generic cadence, 'third-party subject matter experts' are unnamed, and there is no cybersecurity domain terminology — only general risk management language (risk assessment, risk management, monitor and control risks).

thinking:
Let me analyze this paragraph.

Content: Describes Audit Committee's role in overseeing cybersecurity risks, its responsibilities, review frequency, and third-party expert presentations.

Category: This answers "How does the board oversee cybersecurity?" — Board Governance (BG). The Audit Committee is a board-level committee overseeing cybersecurity.

Specificity: Let me scan for facts.
- "Audit Committee" — NOT firm-specific (every public company has one)
- "Board of Directors" — NOT firm-specific

- "at least annually" — generic cadence
- "third-party subject matter experts" — unnamed entities
- No domain terminology beyond general risk management language
- No cybersecurity-specific terms (just "cybersecurity" as topic)
- No firm-specific facts, no QV facts

This is generic oversight language any company could use. Level 1.


fact: Chief Technology Officer responsible for developing and implementing information security program

reasoning: The paragraph primarily answers 'How does the board oversee cybersecurity?' — describing board and audit committee oversight, reporting cadence, briefing topics, and information flow. The CTO is mentioned in a subordinate role-attribution capacity within the governance chain, keeping this as BG rather than MR. The CTO is a firm-specific cybersecurity leadership title (Level 3), but no QV-eligible facts are present: 'in 2023' is tied to an unnamed expert and vague event, 'quarterly' is a generic cadence, and the audit committee is not firm-specific.

thinking:
Let me analyze this paragraph.

Content Category: This paragraph covers board oversight, audit committee role, CTO responsibility, reporting structure, and briefing activities. The primary question answered is "How does the board oversee cybersecurity?" — it's a governance-chain paragraph describing oversight structure. BG.

Specificity: Let me scan for facts.
- "Chief Technology Officer" — CTO is listed as a firm-specific cybersecurity role (VP level or above)
- "audit committee" — NOT firm-specific (every company has one)
- "quarterly basis" — generic cadence, not QV

- "in 2023" — tied to a specific event where management brought in an expert for the annual board retreat to discuss cybersecurity threats, but the expert remains unnamed and the event itself is vague, so the year alone doesn't constitute a verifiable fact
- "information security program" — generic language
- "cybersecurity threat landscape" — standard business terminology

The CTO reference is firm-specific and pushes this to Level 3, but there are no quantifiable or verifiable facts that would elevate it further.

Level 3.


fact: penetration testing

fact: threat monitoring

reasoning: The paragraph is split between RMP and TP, but the primary sentence describes third-party firms hired to serve the company's own security program (pen testing, threat monitoring, risk assessments) → RMP per Rule 3. The vendor security controls sentence is subordinate. Penetration testing and threat monitoring are cybersecurity domain terms that pass the ERM test, elevating to Level 2; no firm-specific or verifiable facts are present.

thinking:
Let me analyze this paragraph.

Content: Describes partnering with third-party cybersecurity firms for pen testing, threat monitoring, risk assessments, AND requires vendors to adhere to security controls.

Category: This is split between RMP and TP. The first sentence describes third parties hired to serve the company (assessors, pen testers) → RMP per Rule 3. The second sentence describes requirements imposed on vendors → TP. The first sentence is about the company's own program using external firms; the second is about vendor oversight. It's roughly split but the first sentence has more substance. Per Rule 3: "Third parties hired to serve the company (assessors, pen testers) → RMP." But the second sentence is clearly TP.

The substantive content leans toward RMP—the third-party cybersecurity firms are actively supporting the company's penetration testing, threat monitoring, and risk assessment program, while the vendor security control requirement is more of a brief compliance statement. RMP wins.

Specificity:
- "penetration testing" → domain term
- "threat monitoring" → domain term
- "third-party cybersecurity firms" → unnamed, not firm-specific

Level 2.


fact: CTO provides reports to the Board

reasoning: The paragraph primarily answers how the board oversees cybersecurity — the CTO reports to the Board quarterly on cyber risks and incidents, describing the information flow upward. This is a governance-chain paragraph with the oversight structure as its purpose (BG per Rule 1). The CTO is a firm-specific cybersecurity leadership role (Level 3), but the remaining language ('quarterly reports,' 'cybersecurity practices,' 'risk management processes,' 'evolving cyber risk landscape') is generic oversight vocabulary that fails the ERM test, with no domain terminology or QV-eligible facts.

thinking:
Let me analyze this paragraph.

Category: The paragraph answers "How does the board oversee cybersecurity?" - it's about reporting TO the board, describing the oversight flow. The CTO reports to the Board quarterly. This is a governance-chain paragraph describing how information flows to the board.

BG vs MR: The CTO is mentioned as the person who reports, but the primary content is about the board receiving reports - the oversight structure. Per Rule 1, "Management reports TO the board (describing oversight flow)" → BG.

Specificity:
- "CTO" - cybersecurity-specific title at VP+ level → firm-specific (Level 3)

- "quarterly reports" is just a standard cadence, and the rest uses generic business language about reporting structures. The only firm-specific detail here is the CTO role itself, so this lands at Level 3.


fact: CTO (Chief Technology Officer) — cybersecurity leadership role

fact: COO (Chief Operating Officer) responsible for cybersecurity

fact: CTO has over 10 years of experience overseeing cybersecurity functions

fact: COO has over 5 years of experience overseeing cybersecurity and IT functions

reasoning: The paragraph traces a governance chain (Board → Audit Committee → CTO/COO → program) with the primary purpose of describing how oversight flows, making it BG per Rule 1. Sentences 1, 4, and 5 are pure board oversight; sentence 2 describes management responsibilities in the context of reporting to the Audit Committee. While the CTO/COO qualifications (sentences 3) are MR content, they are subordinate to the oversight-structure frame. Specificity reaches Level 4 because 'over 10 years' and 'over 5 years' of experience are lower-bound quantified facts that are independently verifiable against resumes.

thinking:
Let me analyze this paragraph.

Content Category: This paragraph covers board oversight (Board delegates to Audit Committee), management roles (CTO and COO responsibilities), qualifications (years of experience), and reporting lines. The governance chain is described but the paragraph splits between BG and MR.

Let me apply the primary test: "What question does this paragraph primarily answer?"

The paragraph starts with board oversight delegation, then shifts to management roles/qualifications, then back to reporting to the board. The governance chain (Board → Audit Committee → CTO/COO → Program) is described with the purpose of showing oversight structure. But there's significant MR content (CTO and COO responsibilities, their qualifications with specific years of experience).

Now I'm mapping out the sentence-by-sentence breakdown. The governance oversight flow really dominates here—the board delegation, the reporting structure back to the board, and the committee updates all point to a governance-focused paragraph. The management qualifications are there but they're secondary to the main oversight chain being described. By Rule 1, this defaults to BG since the governance structure is the primary organizing principle.

Looking at the specificity markers, the CTO role is clearly firm-specific cybersecurity work at Level 3, while the COO is just a general executive position. The experience claims—"over 10 years" and "over 5 years"—are lower bounds that are verifiable, so they qualify as QV. That pushes the qualifications section to Level 4 overall.


fact: threat intelligence sharing (intelligence sharing about emerging threats)

fact: Arizona Cyber Threat Response Alliance (ACTRA)

fact: The Internet and Television Association (NCTA)

reasoning: The paragraph describes a cybersecurity program activity — threat intelligence sharing through industry collaboration and public-private partnerships — answering 'what does the program do?' → RMP. Named external organizations ACTRA and NCTA are independently verifiable entities, elevating specificity to Level 4.

thinking:
Classify this paragraph.

Content: Describes intelligence sharing about emerging threats through collaboration with industry, consultants, and public-private partnerships, naming specific organizations (ACTRA, NCTA).

Category: This answers "What does the cybersecurity program do?" - it's about threat intelligence sharing as part of their cybersecurity program. RMP.

Specificity:
- "threat intelligence" / "emerging threats" - domain terminology (threat intelligence) → Level 2
- Named external entities: ACTRA (Arizona Cyber Threat Response Alliance), NCTA (The Internet and Television Association) - these are named external organizations → Level 4 (QV-eligible, named firms/organizations that can be independently verified)


reasoning: The paragraph answers 'what does the cybersecurity program do?' by describing a framework for threat detection, incident response, and risk mitigation — all RMP content. However, every term used (threat detection, incident response, risk mitigation, framework) is general business/ERM language that fails the ERM test — a non-security risk manager would naturally use all of these terms. No domain terminology, firm-specific facts, or verifiable claims are present.


fact: advanced persistent threats

reasoning: The paragraph contains a backward-looking materiality assessment — 'we have not experienced a material cybersecurity incident in the two-year period ended December 31, 2024' — which is a conclusion about whether cybersecurity has affected business outcomes, making it SI per the materiality rule. The surrounding speculation ('could materially adversely affect') and the Item 1A cross-reference are subordinate. For specificity, 'advanced persistent threats' is a cybersecurity-specific threat type (domain terminology), elevating to Level 2. The 'two-year period ended December 31, 2024' anchors a negative self-assertion which is not externally verifiable, so it does not reach Level 4.

thinking:
Let me analyze this paragraph carefully.

Content Category: The paragraph discusses cybersecurity threats, states they haven't experienced a material incident, discusses potential consequences, and references Item 1A. The key question is what this primarily answers.

The materiality assessment: "we have not experienced a material cybersecurity incident in the two-year period ended December 31, 2024" — this is a negative assertion with materiality framing → SI per Rule 5.

But the paragraph also has a lot of speculation ("could materially adversely affect") and risk factor language, plus a cross-reference to Item 1A. The materiality conclusion is present though — "have not experienced a material cybersecurity incident" is a backward-looking assessment.

The core issue is that while most of the text speculates about potential consequences, the materiality statement itself triggers SI classification. "Advanced persistent threats" is a domain-specific term that would be Level 2, but the negative assertion about not experiencing a material incident in the two-year period isn't externally verifiable — it's a self-assessment anchored to a reporting date, so that part doesn't qualify as QV. The cross-reference to Item 1A is a subordinate element.


fact: defense in depth

fact: zero trust based controls

fact: phishing email simulations

reasoning: The paragraph primarily answers 'what does the cybersecurity program do?' by describing processes, controls, training, and tools — squarely RMP. Domain terms (defense in depth, zero trust, phishing simulations) elevate to Level 2, but there are no firm-specific roles/committees or quantified-verifiable facts to push higher.

thinking:
Let me analyze this paragraph.

Content Category: The paragraph describes what the cybersecurity program does - processes, tools, controls, training. Primary question: "What does the cybersecurity program do?" → RMP

Specificity: Let me scan for facts:
- "defense in depth" → domain term
- "zero trust" → domain term
- "phishing email simulations" → domain term (phishing simulations)
- "cyber risk management and quantification system customized to our environment" → this is a named internal program? Not really, it's a description. But it's firm-specific? Hmm, it's describing a tool category.

- No named roles or QV facts present, just domain terminology like defense in depth, zero trust, and phishing simulations
- No firm-specific facts that meet the criteria - no CISO, named committees, or specific titles mentioned
- This falls into Level 2: Domain-Adapted


fact: vulnerability assessments

fact: Director of IT Security and Compliance

fact: IT Steering Committee

reasoning: Person-removal test: removing the Director titles and IT Steering Committee still leaves a substantive program description (assessment tools, control tests, vulnerability assessments, monitoring techniques) → RMP. Specificity reaches Level 3 via 'Director of IT Security and Compliance' (Director-level with security qualifier) and 'IT Steering Committee' (named non-generic committee); 'vulnerability assessments' is domain terminology but the firm-specific facts set the floor higher.

thinking:
Let me analyze this paragraph.

Category: The paragraph describes what the cybersecurity program does - assessment tools, control tests, vulnerability assessments, monitoring techniques. There are named roles (Director of IT, Director of IT Security and Compliance) but applying the person-removal test: remove those titles and you still have "assess our cybersecurity readiness through internal assessment tools as well as third-party control tests, vulnerability assessments, audits and evaluation against industry standards. We have governance and compliance structures... We also employ various defensive and continuous monitoring techniques using recognized industry frameworks and cybersecurity standards." That's a substantive program description → RMP.

Now I'm checking the specificity level. The Director of IT Security and Compliance is a director-level role with a security qualifier, which makes it firm-specific, and the IT Steering Committee is a named non-generic committee, also firm-specific. Vulnerability assessments and industry frameworks are more generic references. The highest specificity here is Level 3 from those firm-specific roles and structures.


content_category: Incident Disclosure

fact: October 2023 - specific date of cybersecurity incident

fact: 23andMe.com - named platform where unauthorized access occurred

fact: Security Operations

fact: two-step verification (MFA equivalent)

reasoning: The paragraph primarily describes an actual cybersecurity incident — unauthorized access to user accounts in October 2023 — along with remediation actions taken, making it Incident Disclosure. The trailing 'may materially impact' is speculation (not an assessment) and the cross-reference is subordinate. Specificity reaches Level 4 via the specific date (October 2023) and named platform (23andMe.com), both independently verifiable facts.

thinking:
Let me analyze this paragraph.

Content: Describes an actual cybersecurity incident (October 2023, unauthorized access to user accounts), remediation actions taken, and a forward-looking risk statement with cross-reference.

Category: The paragraph primarily answers "What happened in a cybersecurity incident?" - it describes the October 2023 incident, what was accessed, and remediation steps. This is Incident Disclosure (ID). The remediation details serve the incident narrative. The "may materially impact" is speculation, not an assessment. The cross-reference is subordinate.

Specificity: Let me scan for facts:

- "October 2023" is a specific date tied to the cybersecurity event
- "23andMe.com" is a named platform, though this appears in a Chrome Holding Co. filing so likely references 23andMe as the successor or acquirer
- "two-step verification" is domain-specific terminology for multi-factor authentication
- "reset customer passwords" is a concrete remediation action
- "enhanced our detection tools and capabilities" is more generic language

The key quantifiable facts here are the specific date and the named platform, along with the concrete remediation steps taken.


reasoning: The paragraph centrally answers 'how are third-party cyber risks managed?' — describing due diligence on suppliers, contractual notification obligations, and acknowledging monitoring limitations, making it TP. All language is general business/vendor management terminology (due diligence, contractual obligations, data handling requirements) that any ERM professional would use; no cybersecurity domain terms, firm-specific facts, or verifiable claims are present, so it remains Level 1.

thinking:
Let me classify this paragraph.

Content: About third-party risk management - due diligence on suppliers, requiring evidence of cybersecurity capabilities, contractual obligations for incident notification, acknowledging limitations.

Category: Third-Party Risk - central topic is managing third-party cyber risks.

Specificity: Let me scan for facts.
- "third-party suppliers, service providers and other business partners" - generic
- "requiring evidence demonstrating third parties' ability to meet our cybersecurity and data handling requirements" - generic process description
- "contractually obligated to notify us" - contractual requirements, generic
- "Members'" - Peloton-specific term for customers, but not a cybersecurity fact

- No domain terminology that passes the ERM test - "due diligence," "data handling requirements," "cybersecurity practices" are all general business language
- No firm-specific cybersecurity facts (no named roles, committees, etc.)
- No QV facts

This is Level 1 - Generic Boilerplate. The language is general vendor management that any company could write.


fact: Risk Management Committee of the Board of Directors

fact: EVP ERM

reasoning: The paragraph primarily answers how the board oversees cybersecurity: the Risk Management Committee oversees the ERM framework, receives quarterly reporting from management, and reports to the full Board — this governance-chain structure is classic BG. A materiality assessment sentence ('In 2024, no cybersecurity events were identified that materially impacted...') qualifies as SI, and the remainder is hypothetical speculation/cross-reference, but BG content occupies the most text and frames the paragraph's purpose. Specificity reaches Level 3 via the named non-generic board committee (Risk Management Committee, unlike the ubiquitous Audit Committee) and the EVP ERM role title (EVP-level with risk/cyber portfolio).

thinking:
Let me analyze this paragraph carefully.

**Content Category:**

This paragraph covers multiple topics:
1. Risk Management Committee of the Board oversees ERM framework - BG
2. Management team including EVP ERM provides quarterly reporting to the Risk Management Committee - BG (oversight flow)
3. "In 2024, no cybersecurity events were identified that materially impacted our business strategy, operations, or financial condition" - SI (materiality assessment, backward-looking)
4. Cross-reference to Risk Factors section + speculation about material risk - N/O / not SI (speculation)
5. Description of hypothetical breach consequences - not substantive

The paragraph starts with board oversight structure (BG), includes a materiality assessment (SI), and then has speculation/cross-reference. The first half describes how the board oversees cybersecurity through the Risk Management Committee and the reporting flow from management. The SI materiality statement is one sentence. The speculation takes up the rest. BG is the primary category - the paragraph primarily answers "how does the board oversee cybersecurity?" through the Risk Management Committee structure and reporting flow. The materiality assessment is present but secondary.

Looking more carefully at the breakdown: the first three sentences cover board oversight via the Risk Management Committee and reporting structure, the fourth sentence states no material cybersecurity events occurred in 2024, and the final sentences cross-reference risk factors and speculate about potential breaches. The BG content occupies most of the text in the first portion, but the paragraph is genuinely split between governance structure and materiality assessment.

Now I'm identifying the specificity level. The Risk Management Committee is a named non-generic committee specific to this firm, and the EVP ERM role indicates firm-specific governance. The quarterly reporting cadence is generic, and "In 2024" is tied to a negative assertion that isn't independently verifiable. The mention of ransomware appears only in a hypothetical context. The statement about no material cybersecurity events is also a negative assertion without verification. Based on the named committee and EVP-level role, this lands at Level 3 specificity.


reasoning: The paragraph describes what the cybersecurity program does — continuous monitoring, security tools, and incident response — answering 'what does the program do?' (RMP). No domain terminology passes the ERM test; 'monitor our environment,' 'security tools,' 'suspicious behaviors,' and 'respond to security incidents' are all general business language any ERM professional could write. 'Cyber security consultants' are unnamed, and 'IT support team' is a generic title, so nothing qualifies as firm-specific or verifiable.

thinking:
Let me classify this paragraph.

Content: Describes cybersecurity monitoring, security tools, and incident response activities performed by consultants and IT team.

Category: "What does the cybersecurity program do?" → RMP. The paragraph describes monitoring, tools, and incident response activities.

Specificity: Let me scan for facts.
- "cyber security consultants" - unnamed, not firm-specific
- "continuously monitor" - generic
- "security tools" - generic
- "suspicious behaviors" - generic
- "IT support team" - generic IT title

- "respond to possible security incidents" - generic

There's no domain-specific terminology here. The language around monitoring the environment, using security tools, identifying suspicious behaviors, and responding to incidents is all general enough that any ERM professional could write it. No mention of specific tools, penetration testing, SIEM implementations, or other concrete practices. This is Level 1.


fact: SOC2 report evaluations

fact: security, availability of data, processing integrity, confidentiality and privacy controls (SOC 2 Trust Services Criteria)

reasoning: The paragraph centrally answers 'how are third-party cyber risks managed?' — describing vendor due diligence surveys, centralized registry, SOC 2 evaluations, and oversight processes for service providers, making it TP. The final sentence on cybersecurity insurance (SI) is subordinate. SOC 2 and its Trust Services Criteria are domain terminology elevating to Level 2, but there are no firm-specific facts (no named roles, committees, or specific numbers) to reach Level 3.

thinking:
Let me analyze this paragraph.

Content Category: The paragraph primarily answers "How are third-party cyber risks managed?" - it's about vendor oversight, due diligence, SOC 2 evaluations, centralized registry, etc. The last sentence mentions cybersecurity insurance which is SI, but the vast majority is about third-party risk management. → Third-Party Risk

Specificity: Let me scan for facts.
- "SOC2 report evaluations" - this is a domain term (SOC 2 is a named standard/framework) → Level 2
- "security, availability of data, processing integrity, confidentiality and privacy controls" - these are the SOC 2 Trust Services Criteria, domain knowledge → Level 2

- The remaining elements like centralized registry, due diligence surveys, and cybersecurity insurance are all generic practices without firm-specific details, named roles, committees, or concrete metrics → Level 2


reasoning: The paragraph describes the company's commitment to cybersecurity and mentions implementing policies, procedures, and security measures — answering 'what does the program do?' albeit at the most generic level. No domain terminology, firm-specific facts, or verifiable claims are present; every phrase could appear unchanged in any company's filing.


fact: CISO

fact: information security team

reasoning: The paragraph primarily answers how the board oversees cybersecurity: Board delegates to Audit Committee, which receives reporting from the CISO and information security team. This is a governance-chain paragraph focused on oversight structure → BG. The CISO is a firm-specific cybersecurity leadership role, elevating to Level 3. No QV-eligible facts (cadences are generic 'at least annually,' no specific dates/numbers/named external entities).

thinking:
Let me analyze this paragraph.

Content Category: The paragraph answers "How does the board oversee cybersecurity?" - Board delegates to Audit Committee, receives briefings, CISO reports to the board. This is a governance-chain paragraph describing oversight structure → BG.

Specificity: Let me scan for facts.
- "CISO" → firm-specific (named cybersecurity role)
- "information security team" → not quite firm-specific enough, generic
- "Audit Committee" → NOT firm-specific (every company has one)

- "at least annually" → generic cadence
- "threat landscape" → general business language in cyber context
- "client security audits" → somewhat domain-adjacent but not clearly domain terminology
- "cybersecurity risk mitigation" → general

CISO is firm-specific → Level 3. For domain terms, "threat landscape" is fairly common in general risk management and passes the ERM test since it's specific to cybersecurity context, though it's borderline.

"Client security audits" refers to audits done by clients rather than domain terminology. The CISO role is the key firm-specific fact that determines the level.


reasoning: The paragraph answers 'how are third-party cyber risks managed?' with vendor oversight as the central topic — due diligence and periodic review of third-party providers' cybersecurity compliance. No domain terminology (just generic 'due diligence,' 'cybersecurity standards'), no firm-specific facts, no verifiable claims — remains Level 1.


fact: Chief Information Security Officer (CISO)

fact: Chief Information Officer (CIO)

reasoning: The paragraph primarily answers 'how does the board oversee cybersecurity?' — it describes the governance chain from Board/Audit Committee through senior management via quarterly updates and periodic briefings, making it BG. The CISO and CIO are mentioned as part of the reporting flow (governance-chain paragraph), not as primary content about their roles/qualifications. CISO and CIO are firm-specific cybersecurity leadership titles elevating to Level 3; 'quarterly' is a generic cadence and 'Audit Committee' exists at every public company, so neither qualifies further.

thinking:
Let me analyze this paragraph.

Category: This describes board/committee oversight structure with governance chain. The primary question answered is "How does the board oversee cybersecurity?" - Board, Audit Committee oversight, quarterly updates to Audit Committee, briefings to Board. The CISO and CIO are mentioned but in the context of the reporting/oversight flow. This is BG.

Specificity: Let me scan for facts.
- "Chief Information Officer" (CIO) - firm-specific role
- "Chief Information Security Officer" / "CISO" - firm-specific role

- "quarterly updates to the Audit Committee" - generic cadence
- "Legal team" - specific team composition mentioned alongside Board and Audit Committee
- "Audit Committee" - every company has one, NOT firm-specific
- "Board of Directors" - NOT firm-specific

The CISO and CIO are cybersecurity-specific VP+ level titles, making them firm-specific at Level 3. There are no quantifiable facts here—no specific numbers, dates, named external entities, or certifications mentioned. The quarterly cadence is just a generic timeframe.

Level 3.


reasoning: The paragraph states a conclusion about whether cybersecurity has materially affected business outcomes, using both backward-looking ('have materially affected') and forward-looking ('reasonably likely to materially affect') SEC materiality language → SI per Rule 5. Specificity is Level 1: 'December 31, 2023' is a fiscal year-end reporting context (not a cybersecurity-specific date), and the negative assertion about no material incidents is not externally verifiable. No domain terms, firm-specific facts, or QV-eligible facts remain after validation.

thinking: Materiality assessment paragraph.


reasoning: The paragraph is predominantly speculative risk language ('could have a material adverse impact') which per the codebook is not SI, and describes no actual cybersecurity measures or program — only an aspiration ('we plan to dedicate'). The closing negative assertion ('not aware of any cybersecurity threats') lacks materiality framing and does not constitute a materiality assessment. With no substantive cybersecurity disclosure, this is N/O at Level 1.

thinking:
Let me analyze this paragraph.

Content: This is speculative risk language ("may be unable to", "could have a material adverse impact") combined with a negative assertion at the end ("we are not aware of any cybersecurity threats, nor have we had any cybersecurity incidents").

Category: The bulk is speculation ("could have a material adverse effect") which is NOT SI per the rules. The last sentence is a negative assertion but without materiality framing - it says "not aware of any cybersecurity threats, nor have we had any cybersecurity incidents" - this isn't "have not experienced any material cybersecurity incidents" (which would be SI). It's more of a general statement.

Actually, I'm reconsidering this. The paragraph is mostly generic risk language and speculation without any actual description of cybersecurity measures or programs - just aspirational language about planning to dedicate efforts. That makes this N/O, which means it gets a Level 1 specificity rating.


reasoning: This is a cross-reference pointing to Item 1A Risk Factors, with no substantive cybersecurity disclosure of its own. The fragment mentions 'operations or financial condition' but is directing the reader elsewhere rather than stating a materiality conclusion. N/O always receives Specificity 1.


reasoning: The paragraph directly answers 'how are third-party cyber risks managed?' by describing a review of service providers' cybersecurity measures during the engagement process, making TP the primary category. The language is entirely generic — 'review of such providers' cybersecurity measures' contains no domain terminology, no firm-specific details, and no verifiable facts; any company could paste this unchanged.

thinking:
Classify this paragraph.

Content: Reviewing third-party IT service providers' cybersecurity measures during engagement process.

Category: This answers "How are third-party cyber risks managed?" → Third-Party Risk. The central topic is vendor oversight.

Specificity: No domain terminology (just "cybersecurity measures" - generic), no firm-specific facts, no QV facts. "Review of providers' cybersecurity measures" is generic - any ERM professional could write this. Level 1.


reasoning: Both sentences state conclusions about whether cybersecurity risks have or are reasonably likely to materially affect business strategy, results of operations, or financial condition — classic SI materiality assessments (backward-looking and forward-looking). Specificity remains Level 1: 'December 31, 2024' is reporting-period context rather than a cybersecurity-specific date, and the negative assertions ('have not materially affected,' 'did not detect any cybersecurity incidents') are not externally verifiable. No domain terminology, firm-specific facts, or QV-eligible claims are present.

thinking:
Let me analyze this paragraph.

Content: Two sentences making materiality assessments - backward-looking ("have not to date materially affected") and forward-looking ("not reasonably likely to materially affect"), plus a negative assertion for the year ended December 31, 2024.

Category: Strategy Integration - both sentences state conclusions about whether cybersecurity has/will affect business outcomes. This is clearly SI per Rule 5.

Specificity: Let me check for facts:
- "December 31, 2024" - this is a reporting period context date, not a cybersecurity fact tied to a specific event.
- "Have not materially affected" - negative self-assertion, not externally verifiable
- "We did not detect any cybersecurity incidents" - negative assertion, not verifiable

No domain terms, no firm-specific facts, no quantifiable facts. This lands at Level 1.


reasoning: The paragraph states a backward-looking materiality conclusion ('has not experienced a cybersecurity incident that has materially affected our operations, reputation, or financial performance'), which is an SI assessment per Rule 5. The remaining text is generic speculation ('remain exposed to cyber threats') and boilerplate ('invest in technologies and partnerships'). No domain terminology, firm-specific facts, or verifiable claims are present — the negative materiality assertion is a self-reported claim about absence, not externally verifiable.

thinking:
Let me analyze this paragraph.

Content: States no material cybersecurity incident has occurred (materiality assessment), mentions exposure to cyber threats, and generic investment in technologies/partnerships.

Category: The first sentence is a materiality assessment - "has not experienced a cybersecurity incident that has materially affected our operations, reputation, or financial performance." This is a backward-looking materiality conclusion → SI per Rule 5.

The rest is generic speculation and boilerplate.

Specificity:
- "has not experienced a cybersecurity incident that has materially affected" → negative self-assertion, not externally verifiable

- "invest in technologies and partnerships" → vague language with no concrete details or firm-specific examples
- Lacks domain expertise, company-specific facts, or quantifiable metrics

This lands at Level 1 due to the absence of substantive, verifiable information.


reasoning: The paragraph contains a backward-looking materiality assessment ('have not experienced a cybersecurity incident that resulted in a material adverse impact to our business or operations'), which is a negative assertion with materiality framing → SI per Rule 5. The cross-reference to Item 1A and speculation ('there can be no guarantee') are subordinate to this assessment. Specificity is Level 1: the negative materiality assertion is not externally verifiable, 'information security policies and procedures' is generic business language, and no domain terminology, firm-specific facts, or QV-eligible facts are present.

thinking:
Let me analyze this paragraph.

Content: Mixed content - mentions security policies review, a negative materiality assertion, speculation about future incidents, and a cross-reference to Item 1A risk factors.

Category analysis:
- "have not experienced a cybersecurity incident that resulted in a material adverse impact" - this is a materiality assessment (SI per Rule 5)
- "there can be no guarantee..." - speculation
- "For a description of the risks... see Item 1A" - cross-reference (N/O)
- The cross-reference with "may materially affect" is pointing elsewhere

The materiality assessment "have not experienced a cybersecurity incident that resulted in a material adverse impact to our business or operations" is a backward-looking negative assertion → SI per the codebook.

The materiality assertion about not experiencing material cybersecurity incidents is the core of this disclosure, making it SI. Even though the paragraph includes a cross-reference to Item 1A, that's secondary to the primary negative assertion with materiality framing. The specific language "have not experienced a cybersecurity incident that resulted in a material adverse impact" clearly qualifies as SI under the codebook's guidance on negative assertions.

Looking at the specificity now, this is just generic language about information security policies without any firm-specific details, domain terminology, or quantifiable facts—that puts it squarely at Level 1 boilerplate.


reasoning: This paragraph is a cross-reference directing readers to Item 1A Risk Factors for cybersecurity risk descriptions. It does not make a materiality assessment itself — it says risks 'may materially affect' and points elsewhere, fitting the N/O cross-reference pattern. No substantive cybersecurity disclosure is present, so specificity is Level 1.


reasoning: The paragraph contains a backward-looking materiality assessment ('not aware of any cybersecurity incidents that have materially affected us to date') which is a conclusion about business impact → SI. The surrounding text is generic risk speculation ('could have a material impact') and a cross-reference to Item 1A, which are subordinate. Specificity is Level 1: no domain terminology (only generic 'cybersecurity threats,' 'information technology'), no firm-specific facts, and the negative materiality assertion is a self-reported claim about absence—not externally verifiable.

thinking:
Let me analyze this paragraph.

Content: Mixed content - mentions cybersecurity measures generally, third-party reliance, a materiality assessment ("not aware of any cybersecurity incidents that have materially affected us to date"), speculation ("could have material impact"), and a cross-reference to Item 1A.

Category analysis:
- "We employ several measures to prevent, detect and mitigate cybersecurity threats" - very generic RMP
- "We also rely on information technology and other third-party vendors" - generic TP mention

- The backward-looking materiality assertion about no material incidents qualifies as SI, while the forward-looking speculation about future attacks doesn't, and the Item 1A reference is just a cross-reference element.

The most substantive piece here is that negative materiality statement—it's the only specific disclosure anchored to actual experience rather than generic risk language or speculation.

Looking at the specificity markers, this lacks any domain-specific terminology, firm-specific facts, or quantifiable details—just generic cybersecurity language and a self-assessment that isn't externally verifiable. This reads as Generic Boilerplate level 1.


reasoning: The paragraph states a backward-looking materiality conclusion ('have to date not materially affected us, our business strategy, results of operations or financial condition'), which is an SI assessment per Rule 5. The mention of past threats/breaches is subordinate to the materiality framing. No domain terminology, firm-specific facts, or verifiable claims are present — all language is generic boilerplate that could appear in any filing.


fact: ORIX USA named as the entity whose cybersecurity risk management program they rely on

fact: ORIX (parent company of ORIX USA) named

reasoning: The paragraph primarily answers 'what does the cybersecurity program do?' — the company relies entirely on ORIX USA's cybersecurity risk management program to identify, assess, and manage material risks from cybersecurity threats. While it describes the externally-managed organizational structure, the core disclosure is about how cybersecurity risk management functions (via ORIX USA's program). The naming of ORIX USA and ORIX as specific external entities whose cybersecurity program the company participates in constitutes verifiable claims, elevating specificity to Level 4. The remaining language ('identify, assess and manage material risks') is generic ERM vocabulary at Level 1.

thinking:
Let me analyze this paragraph.

Content: This describes an externally managed company (Lument Finance Trust) that relies on its Manager (affiliate of ORIX USA) for operations and cybersecurity. Key points: externally managed, operations managed by Manager, dependent on Manager's systems, Manager participates in ORIX USA's cybersecurity program, relies on ORIX USA's cybersecurity risk management program.

Category: The paragraph primarily answers "What does the cybersecurity program do?" — but actually, it's more about explaining the organizational structure and that they rely on an external parent's program. It's describing how cybersecurity risk is managed but in a very structural/organizational way.

So the real takeaway here is that as an externally managed entity, they don't operate their own cybersecurity program at all — instead they're dependent on ORIX USA's program to handle identification, assessment, and management of cybersecurity threats. The distinction I'm wrestling with is whether this falls under Third-Party Risk Management or just describes their operational arrangement, since ORIX USA is the parent company rather than a separate vendor.

Looking at it more carefully, this is fundamentally about Risk Management Process — the paragraph is explaining how cybersecurity risk gets managed within their structure through reliance on the affiliate's program. For specificity, ORIX USA is a named external entity that's verifiable, which puts this at Level 4, though the actual risk management activities described are fairly generic. ERM language → Level 1. ORIX USA is a named external entity that could be verified—it's the parent company whose cybersecurity program the filing company relies on, making it a verifiable claim even though it's not a third-party vendor like Mandiant or Deloitte. I'll classify this as Level 4 with ORIX USA as the named firm.


reasoning: The paragraph primarily answers how the board oversees cybersecurity — management reports to the Audit Committee, committee members engage in discussion, and the committee evaluates cybersecurity strategy. This is a classic oversight-flow description (BG). The 'Senior Director, Global Information Security' is a director-level title with a security qualifier, qualifying as firm-specific, but 'Audit Committee' and 'periodic' are generic and do not elevate further.

thinking:
Let me analyze this paragraph.

Category: This describes how information flows from management to the Audit Committee (board-level). The primary question answered is "How does the board oversee cybersecurity?" - reporting to the Audit Committee, committee meetings, committee evaluating strategy. This is BG.

Specificity: Let me scan for facts.
- "Senior Director, Global Information Security" - This is a named role. Is it firm-specific? It's a director-level title WITH a security qualifier ("Global Information Security"), so yes, firm-specific per the codebook.
- "Audit Committee" - NOT firm-specific (every public company has one)

- "periodic reports" - generic cadence, not specific

The Senior Director, Global Information Security title pushes this to Level 3 (Firm-Specific).


reasoning: Despite being a fragment, the paragraph states a backward-looking materiality conclusion ('have [not] materially impaired our operations or financial standing'), which is an assessment of cybersecurity's business impact → SI. The cross-reference to Item 1A is subordinate. No domain terminology, firm-specific facts, or verifiable claims are present — the negative materiality assertion is not externally verifiable — so specificity remains Level 1.

thinking:
Let me analyze this paragraph from IMAC Holdings' 10-K filing.

The paragraph says: "encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, 'Risk Factors,' in this Annual Governance"

This appears to be a fragment - likely the end of a sentence that began with something like "We have not encountered..." This is a materiality assessment (backward-looking negative assertion) combined with a cross-reference.

Category: The main substance is a materiality conclusion - "have [not] materially impaired our operations or financial standing" - this is a backward-looking materiality assessment → Strategy Integration.

The cross-reference to Item 1A is just supporting detail. Looking at the specificity, I see only generic materiality language without any domain-specific facts or verifiable claims - the negative assertion about not experiencing material incidents isn't externally verifiable either. This is clearly Level 1 boilerplate.


reasoning: This paragraph states a backward-looking conclusion about whether cybersecurity has materially affected business outcomes, making it a materiality assessment → SI. Despite using SEC materiality language, it contains no domain terminology, firm-specific facts, or verifiable claims — the negative self-assertion ('have not experienced') is not externally verifiable.


reasoning: The paragraph primarily answers 'what does the cybersecurity program do?' by describing processes, technologies, and capabilities for risk management; the Audit Committee and Board mentions at the end are subordinate framing. Despite its length, the paragraph uses entirely generic business language ('processes to identify, assess, and manage risks,' 'protection, detection, response, and recovery capabilities,' 'significant investments') with no cybersecurity domain terminology, no firm-specific cybersecurity roles, and no verifiable facts — all terms would fit an ERM document about any risk type.

thinking:
Let me classify this paragraph.

Content Category: This paragraph describes what the cybersecurity program does - risk management processes, technologies, capabilities. It mentions the board/audit committee at the end but the bulk is about the program. Person-removal test: remove executive management, Audit Committee, Board references - still a full program description. → RMP

Specificity: Let me scan for facts:
- "connected vehicles" - this is somewhat firm-specific but it's describing what they protect, not a cybersecurity practice

- Everything else is generic business language - standard risk management terminology like protection, detection, response, recovery, and the typical risk processes of identification, assessment, and mitigation. No domain-specific security tools, frameworks, or practices mentioned. No firm-specific roles like CISO. No QV facts either.

→ Generic boilerplate throughout.


reasoning: The paragraph states two materiality conclusions — a backward-looking assessment ('have not materially affected') and a forward-looking assessment ('are reasonably likely to materially affect') — both triggering SI under the materiality assessment rule. The trailing cross-reference to Risk Factors is subordinate to the assessments. No domain terminology, firm-specific facts, or verifiable claims are present, so specificity remains Level 1.

thinking:
Let me analyze this paragraph.

Content: This paragraph makes two materiality assessments - backward-looking ("have not... materially affected") and forward-looking ("are reasonably likely to materially affect"), then cross-references Risk Factors. Per Rule 5, both of these are materiality assessment conclusions → SI.

Specificity: No domain terminology, no firm-specific facts, no QV facts. Pure boilerplate materiality language. Level 1.


reasoning: The majority of the paragraph answers 'How are third-party cyber risks managed?' — describing vendor security assessments, ongoing review, and compliance with cybersecurity standards, making TP the primary category. The closing materiality sentence ('have not encountered cybersecurity challenges that have materially impaired') is SI but subordinate in volume. All language is generic business vocabulary — 'security assessments,' 'ongoing review,' 'data breaches,' 'compliance with our cybersecurity standards' — none passes the ERM test as cybersecurity domain terminology, and there are no firm-specific or verifiable facts.

thinking:
Let me analyze this paragraph carefully.

The paragraph has two distinct sections:

1. "Oversee Third-party Risk" - describes vendor oversight processes
2. "Risks from Cybersecurity Threats" - a materiality assessment statement

For content category: The first part answers "How are third-party cyber risks managed?" (TP), and the second part is a materiality assessment (SI). The third-party risk content occupies more text, but let me assess.

First section (TP): "implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing review to ensure compliance with our cybersecurity standards. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties."

The second section is a backward-looking materiality statement saying they haven't encountered cybersecurity challenges that materially impacted operations or finances. Since the TP content dominates the paragraph, I'm categorizing this as Third-Party Risk. Now looking at specificity—the language around "security assessments of all third-party providers" reads fairly generic, something an ERM professional would describe as standard vendor assessment practice. "Data breaches" is mentioned as a specific threat type, though it's common business terminology rather than deeply technical.

Scanning through the domain terminology list, I'm not finding anything that rises above general business language. "Security assessments," "third-party providers," "data breaches," "security incidents," "compliance with our cybersecurity standards," and the materiality language are all standard boilerplate. There's no firm-specific detail, no quantified values, nothing that suggests domain expertise beyond what any business would say about cybersecurity. This is clearly Generic Boilerplate at Level 1.


reasoning: The paragraph describes executive management's responsibility for overseeing cybersecurity strategy, answering 'how is management organized to handle cybersecurity?' No board is mentioned — this is about management's organizational role. The paragraph appears truncated and contains only generic business language ('executive management,' 'risk oversight,' 'cybersecurity strategy') with no domain terminology, firm-specific facts, or verifiable claims, yielding Level 1.

thinking:
Let me analyze this paragraph from Snail, Inc.'s 10-K filing.

The paragraph is: "Company's executive management considers cybersecurity risk and other information technology risk as part of its risk oversight and has the ultimate responsibility for overseeing our cybersecurity strategy. Furthermore, during the year ended"

This appears to be a truncated paragraph. Let me classify what's here.

Content: Executive management oversees cybersecurity risk/strategy. This is about management's role in oversight. But it's describing management's oversight responsibility - is this BG or MR?

The paragraph says "executive management" has "ultimate responsibility for overseeing our cybersecurity strategy" - this is about management's organizational role.

No board mentioned, so this is answering how management is organized to handle cybersecurity → MR. But the language is extremely generic—"executive management" isn't a specific role like CISO, and there's no domain-specific terminology beyond standard risk language. No firm-specific details either → Level 1 specificity.

The paragraph cuts off mid-sentence, so I'm classifying based on what's actually present: management's responsibility for cybersecurity oversight, which falls under MR, though the vague terminology keeps it at the lowest specificity tier.


reasoning: The paragraph describes business resilience/continuity planning processes (business impact analyses, risk assessments, continuity strategies, exercises), answering 'what does the program do?' → RMP. However, all terminology is business continuity/ERM language — BCI, DRII, and ISO 22301 are business continuity standards (not cybersecurity domain terms), and terms like 'business impact analyses,' 'risk assessments,' 'continuity strategies,' and 'tabletop exercises' all fail the ERM test. 'Business resilience team' is a generic organizational label without distinguishing identifiers. No cybersecurity domain terms, no firm-specific facts, no verifiable claims → Level 1.

thinking:
Let me analyze this paragraph.

Content: This is about business resilience/continuity planning - BCI, DRII, ISO 22301 standards, business impact analyses, risk assessments, continuity strategies, exercises.

Category: This is about what the program does - specifically business continuity/resilience. The question is whether this is RMP or something else. It describes processes and frameworks for business continuity. This is part of the cybersecurity program description in Item 1C, so it's RMP.

Specificity: Let me check the facts:

- BCI and DRII are business continuity organizations, not cybersecurity-specific
- ISO 22301 is a business continuity standard, not a cybersecurity standard
- The terminology here—business impact analyses, risk assessments, continuity strategies, tabletop exercises—are general business continuity and enterprise risk management terms that don't align with cybersecurity frameworks
- The key question is whether these named standards count as QV-eligible when the organization says they "apply controls from best practices such as BCI, DRII, ISO 22301"—this looks like alignment with external standards rather than certification, which would suggest Domain-Adapted (Level 2) at best

.
- But ISO 22301, BCI, and DRII are business continuity standards and organizations, not cybersecurity-specific ones, so they'd fail the ERM test for domain terminology anyway—they're general enterprise risk management concepts.
- Named external entities do get special consideration in the codebook, but I need to think through whether these particular ones qualify as cybersecurity domain terminology or if they're too broad to count.
- The key issue is that the paragraph references these as alignment/following best practices rather than certification, which maps to Domain-Adapted (Level 2) per the codebook examples, not QV.

Now I'm reconsidering whether "business resilience team" counts as firm-specific - it's just a generic department name without distinguishing details. The real problem is that BCI, DRII, and ISO 22301 are business continuity standards, not cybersecurity frameworks, so they'd fail the ERM test - a business continuity professional would naturally use this language, not a cybersecurity expert. Since this is a cybersecurity filing but the paragraph is fundamentally about business continuity practices, I need to assess what's actually being claimed here.

Looking at the specificity levels more carefully: these named standards and organizations are external entities, which would place them at Level 4, but they're business continuity references in a cybersecurity context, which complicates the classification. The codebook treats the list as illustrative, so I need to apply the ERM test to these terms—would a non-security professional use ISO 22301, BCI, or DRII? A business continuity professional would, but these are still specific named standards and organizations. ISO 22301 is borderline since it's a named standard like ISO 27001, just for business continuity instead of cybersecurity. Following the certification trilogy pattern, "apply controls from best practices such as" signals alignment rather than certification, which would map to Level 2 like "Aligned with ISO 27001."

The real question is whether naming specific frameworks—even business continuity ones—demonstrates enough domain knowledge to qualify as domain terminology rather than generic language. I think it does; a purely generic paragraph wouldn't reference BCI, DRII, or ISO 22301 by name. But the ERM test pushes back: these terms would naturally appear in an enterprise risk management professional's vocabulary, especially one focused on business continuity, so they might actually fail the test and drop to Level 1. I'm testing whether this really qualifies as RMP or if it should be N/O instead—the paragraph has no cybersecurity-specific language, just business continuity content, but since it describes operational resilience measures that are part of the disclosed risk management program, RMP still seems like the right fit. The mention of "business resilience team" makes me wonder if there's a firm-specific element I should consider, but the actual practices described (impact analyses, exercises, continuity strategies) are general enough to support the RMP classification at Level 1.


reasoning: This paragraph is speculative risk language ('we are at risk for', 'if our security controls are breached', 'could affect') combined with a cross-reference to Item 1A Risk Factors. It does not describe any actual cybersecurity measures, make a materiality assessment/conclusion, or answer any of the six substantive questions. While 'ransomware' and 'nation states' appear, the paragraph is N/O so specificity is always Level 1.


reasoning: The paragraph primarily answers 'what does the cybersecurity program do?' — it describes program evaluation by internal/external experts and external engagement with vendors, industry, and law enforcement to enhance policies. The reporting to senior management and the Board is subordinate context for the evaluation results, not the paragraph's primary purpose. No domain terminology (no specific security practices, tools, or frameworks), no firm-specific cybersecurity roles (Audit Committee and Board are generic governance structures present at every company; 'ELT' is a generic management label), and no QV-eligible facts, leaving this at Level 1.

thinking:
Let me analyze this paragraph.

Content: Describes evaluation of the information security program by internal/external experts, reporting results to senior management/ELT/Audit Committee/Board, and engagement with vendors, industry participants, and law enforcement.

Category: This touches on multiple areas. The first sentence describes program evaluation (RMP) but frames it around reporting to management/Board (BG). The second sentence describes external engagement as part of program effectiveness (RMP/TP).

The primary question: "What does the cybersecurity program do?" - program evaluation and external engagement. But the reporting chain (to ELT, Audit Committee, Board) is also prominent.

I'm working through how to categorize this. The first sentence actually contains two distinct elements: the program evaluation itself, which is an RMP activity, and the reporting structure to senior leadership and the Board, which is a governance oversight function. The second sentence focuses on external engagement to strengthen policies. While the governance reporting chain is clearly present, the paragraph's main thrust is describing what the program actually does—evaluating itself and engaging externally. I think RMP is the right fit here.

Looking at the specificity markers: "ELT" is just a generic reference to executive leadership, the Audit Committee isn't firm-specific per the codebook, and the Board of Directors is standard corporate governance. The vendors and law enforcement communities are described generically without naming. There's no domain-specific security terminology, no firm-specific cybersecurity roles, and no QV facts. This lands at Level 1—Generic.


fact: January 2020 — specific date when the CEO began leading the information security team

fact: more than 20 years of experience — verifiable lower bound (≥20 years)

reasoning: The paragraph primarily answers 'how is management organized to handle cybersecurity?' — it identifies who leads (President/CEO), their qualifications (20+ years), and reporting lines (reports to the Board). Person-removal test: removing the CEO's role, experience, and reporting line leaves only a generic list of program areas, so MR holds. Specificity is Level 4 due to two QV-eligible facts: 'January 2020' (specific date tied to a cybersecurity role) and 'more than 20 years of experience' (verifiable lower bound).

thinking:
Let me analyze this paragraph.

Content: The paragraph describes the President/CEO's experience, his role leading the information security team, and his reporting to the Board on cybersecurity programs.

Category: This is about management's organizational role - who is responsible (President and CEO), what qualifies them (20 years experience), and reporting lines (reports to Board). The person-removal test: remove "President and CEO who has more than 20 years of experience" and "He reports directly to our Board" - what remains is "assessing and managing cybersecurity programs" and a list of areas. That's thin. This is MR.

The governance structure matters here since he reports directly to the Board, but the core content is still about the management role and qualifications. I'm also noting that "President and CEO" isn't a cybersecurity-specific title according to the codebook, and the quantified experience threshold of 20+ years and the January 2020 start date are both specific facts that could be QV.


reasoning: The paragraph states conclusions about whether cybersecurity has materially affected the business (backward-looking: 'not materially adversely affected') and whether risks are 'reasonably likely to materially affect' the business (forward-looking SEC 106(b)(2) language), making it SI under the materiality assessment rule. The trailing cross-references to risk factor sections are subordinate. Specificity is Level 1: 'In 2023' is reporting-period context not a cybersecurity-specific date, the negative assertion about no material incident is not externally verifiable, and the remaining language is standard materiality boilerplate with no domain terminology, firm-specific facts, or verifiable claims.

thinking:
Let me analyze this paragraph.

Content: States no material incident in 2023, not aware of risks reasonably likely to materially affect business, doesn't believe materially affected, then cross-references to risk factors.

Category: The first two sentences are materiality assessments (SI). The last part is a cross-reference to Item 1A risk factors. The primary content is stating conclusions about materiality → Strategy Integration.

Specificity:
- "In 2023" - reporting period context, not a specific cybersecurity date
- "We did not experience a material cybersecurity incident" - negative self-assertion, not externally verifiable

- The language about risks not being reasonably likely to materially affect the business is standard SEC boilerplate with no domain-specific details or firm-specific facts. This is generic materiality assessment language at Level 1.


reasoning: This paragraph is a cross-reference directing readers to Item 1A Risk Factors for cybersecurity risk descriptions — it does not itself state a materiality conclusion or describe any cybersecurity measures. Per the codebook, 'risks that may materially affect... see Item 1A' is N/O (pointing elsewhere). No substantive cybersecurity disclosure, domain terminology, or firm-specific facts are present.

thinking: Cross-reference to Item 1A risk factors discussing cybersecurity risks that "may materially affect" — this is pointing elsewhere, not stating a conclusion.


reasoning: The paragraph primarily answers 'how is management organized to handle cybersecurity?' — it describes the COO's reporting line to the CEO, responsibilities (cybersecurity strategy, risk assessments, incident response, compliance), and experience. Person-removal test: removing the COO, reporting line, and experience leaves only generic activity labels ('risk assessments, incident response, compliance with industry standards'), confirming MR. Note that COO is not a cybersecurity-specific title per the codebook, so it does not qualify as firm-specific; however, 'over 15 years of experience' is a lower-bound quantified fact that is independently checkable, elevating specificity to Level 4.

thinking:
Let me classify this paragraph.

Content: About the COO's role in cybersecurity - reporting line, responsibilities, experience.

Category: This is about management's organizational role - who holds responsibilities, qualifications. Person-removal test: remove COO, reporting to CEO, 15 years experience → "leads the development and implementation of our cybersecurity strategy... oversees risk assessments, incident response, and compliance with industry standards." There's some program description remaining but the primary focus is on the person's role and qualifications. This is MR.

Wait - let me reconsider. The remaining text after person-removal: "leads the development and implementation of our cybersecurity strategy...

Actually, looking at what's left - "oversees risk assessments, incident response, and compliance with industry standards" - these are fairly generic terms. The paragraph is fundamentally about the COO's position, reporting structure, and experience level, making this MR.

Now checking specificity: COO isn't a cybersecurity-specific title like CEO or CFO, so that's not firm-specific. "Reporting to the CEO" is generic organizational language. The "over 15 years of experience in cybersecurity" is a quantified lower bound that's verifiable. And "risk assessments, incident response, compliance with industry standards" are standard ERM terminology, not domain-specific.

So this qualifies as Level 4 based on the quantified experience metric alone.


fact: Oversight by independent board members (a specific subset, not a named generic committee)

reasoning: The paragraph answers 'How does the board oversee cybersecurity?' — describing board-level oversight structure, quarterly reviews, and incident escalation procedures. The specificity is elevated to Level 3 because the oversight is delegated to 'independent board members' as a specific subset rather than a standard named committee like the Audit Committee, which is a firm-specific organizational choice. However, 'quarterly' is a generic cadence (not QV), and no domain terminology, verifiable claims, or other firm-specific facts are present.


reasoning: This is a definitional fragment defining 'systems' in generic IT/business terms — it does not answer any of the six substantive cybersecurity questions. No domain terminology, firm-specific facts, or verifiable claims are present.


fact: ransomware virus

reasoning: The paragraph describes an actual cybersecurity event — a ransomware attack — including identification, isolation, impact assessment, and remediation via backups, directly answering 'what happened?' The brief business/financial impact statements are subordinate to the incident narrative (Rule 4). 'Ransomware' is a specific threat type passing the ERM test (Level 2), but there are no named external entities, specific dates, or hard numbers that would elevate further — 'last decade' is a soft timeframe and 'one incident' is a self-reported historical claim not independently verifiable.

thinking:
Incident disclosure about a real ransomware event, with some strategy integration (no significant financial impact). The incident frame dominates.

Facts: "ransomware" (domain term), "one cybersecurity incident in the last decade" (quantified? "one" is a specific number, "last decade" is soft), backup/restore details.

Wait - "one cybersecurity incident in the last decade" - "one" is a specific number but "last decade" is a soft timeframe. However, "one" is a hard number. Is this verifiable? It's a self-reported negative-ish assertion about frequency. Actually it's a positive claim - they had exactly one incident.

The claim about having exactly one incident in the past decade is self-reported and can't really be verified by external parties—it's similar to saying "we haven't had material incidents," which lacks independent confirmation. "Ransomware" itself is a domain term that rates at Level 2, and the paragraph centers on the actual incident narrative rather than business impact. Overall specificity is Level 2: domain terminology present, but no named firms, specific dates, or verifiable credentials.


fact: phishing attempts

reasoning: The paragraph's primary purpose is stating a conclusion about materiality — no cybersecurity incidents had a material impact on operations, liquidity, or financial condition during the specified fiscal years, which is a backward-looking materiality assessment (SI). The second sentence about routine threats observed and mitigated is subordinate to this assessment frame. 'Phishing attempts' is a specific threat type that passes the ERM test, elevating to Level 2. The fiscal year dates are reporting-period context (not cybersecurity facts), and the negative assertion about no material incidents is not externally verifiable, so no QV-eligible facts are present.

thinking:
Let me analyze this paragraph.

Content: The paragraph makes two claims: (1) no material cybersecurity incidents in fiscal years 2025 and 2024, and (2) they observed routine scanning, phishing attempts, and minor vulnerabilities that were mitigated.

Category: The first sentence is a materiality assessment - "did not identify any cybersecurity incidents that had a material impact on our operations, liquidity, or financial condition" - this is a backward-looking negative assertion about materiality → SI.

The second sentence describes routine threats observed and mitigated. This could be RMP or ID. But these aren't "incidents" in the SEC sense - they're routine observations.

The overall frame is about materiality impact assessment. The primary question being answered is how cybersecurity affects the business or finances, which points to Strategy Integration. Looking at specificity, "phishing attempts" stands out as a concrete threat type that meets the domain terminology threshold, while "scanning" and "minor technical vulnerabilities" are too generic. The materiality claim itself is a negative self-assertion without external verification, and there's no firm-specific information here.


reasoning: The paragraph describes the company's Incident Response Plan — its purpose, coordination structure, and annual evaluation — answering 'what does the cybersecurity program do?' The person-removal test confirms RMP: removing the COO reference leaves a complete program description. For specificity, 'Incident Response Plan' is explicitly generic, COO is not a cybersecurity-specific title, 'at least annually' is a generic cadence, and no domain terminology passing the ERM test is present — all language could describe any enterprise risk process.

thinking:
Let me analyze this paragraph.

Content: Describes an Incident Response Plan - its purpose, coordination, and evaluation frequency.

Category: This describes what the cybersecurity program does - specifically incident response planning. The primary question answered is "What does the cybersecurity program do?" → RMP.

Person-removal test: Remove "Chief Operations Officer" and "key members of management" - the paragraph still describes the IRP framework, coordination, and annual evaluation. → RMP confirmed.

Specificity:
- "Incident Response Plan" - generic program name, not firm-specific
- "Chief Operations Officer" - COO is a generic business role, NOT a cybersecurity-specific title (not CISO/CTO/CIO/VP of IT)

- "management committees" - generic
- "Bank Board" - generic
- "at least annually" - generic cadence
- "cybersecurity incidents" - the word cybersecurity as a topic doesn't make it domain terminology
- "timely notification of and escalation" - generic process language

The paragraph relies entirely on standard business and risk management language. Incident response plan itself isn't domain terminology by the ERM test, and there are no firm-specific facts or qualified value indicators present.

→ Level 1, Generic Boilerplate.


reasoning: This paragraph is a cross-reference directing readers to Item 1A for materiality discussion — it describes what another section covers rather than stating a materiality conclusion itself ('We describe whether and how... under the heading... included as part of our risk factor disclosures at Item 1A'). Per the codebook, cross-references pointing elsewhere are N/O. No substantive cybersecurity disclosure is present, so specificity is Level 1.

thinking: Cross-reference to Item 1A describing what that section covers regarding materiality. Per the codebook, "risks that may materially affect... see Item 1A" → N/O.


reasoning: The paragraph answers 'how does the board oversee cybersecurity?' by describing delegation from the Board to the Audit Committee and the committee's oversight of management's implementation — a classic governance-chain paragraph. No domain terminology, no firm-specific facts (Board and Audit Committee exist at every public company), and no verifiable claims, so it remains Level 1.

thinking:
Classify this paragraph.

Category: "How does the board oversee cybersecurity?" → Board Governance. Board delegates to Audit Committee, Audit Committee oversees management's implementation. This is oversight structure.

Specificity: No domain terminology (just generic risk/oversight language). "Audit Committee" is not firm-specific (every public company has one). "Board" is generic. No QV facts. → Level 1.