reasoning: The grammatical subject is 'Management' and the paragraph describes how management is informed about and monitors cybersecurity incidents — this is about management's oversight role, not about internal processes/tools themselves. However, it contains no named individuals, titles from the IS list (CISO/CIO/CTO), credentials, or reporting lines — just a generic description of management monitoring. No named frameworks, specific dates, or firm-specific facts qualify under the IS list ('service providers' and 'Investment Manager' are generic/self-referential).

thinking:
Let me classify this paragraph.

The paragraph describes management's role in monitoring cybersecurity incidents, including receiving notifications from service providers and communicating with ISP personnel of the Investment Manager.

Category: This is about management being informed and monitoring - but it's about what management DOES (function), not who the person is. The person-vs-function test: remove any role reference and it's about monitoring/prevention/detection processes. However, the grammatical subject is "Management" and it's describing management's informational role. This is borderline between Management Role and Risk Management Process.

Looking at this more carefully, the core issue is that while the paragraph focuses on monitoring activities, the subject is "Management" and it's describing their responsibility to stay informed about cybersecurity incidents. This parallels the codebook example about management being responsible for assessing and managing risks—it's a generic statement about management's responsibilities rather than a specific process. So this falls under Management Role with no named frameworks or specific facts, making it Specificity 1.

Now examining "ISP personnel of the Investment Manager"—this is just a self-referential company designation with a generic job title that isn't cybersecurity-specific per the IS list. There's nothing here that ties to named standards or specific facts from the IS list, so this is Generic Boilerplate.


content_category: Board Governance

category_confidence: medium

specificity_confidence: high

reasoning: The paragraph is framed by the Board's overall oversight responsibility, with management and the Audit Committee reporting structure described as subordinate to that oversight. Per Rule 2, 'Board delegates responsibility to management → Board Governance.' The Principal Accounting Officer directing cybersecurity is notable but PAO is not a cybersecurity-specific title on the IS list; 'Audit Committee' is explicitly generic; 'cybersecurity consultants' are unnamed; and cadences ('at least annually') are generic. No IS-list facts survive validation, yielding Generic Boilerplate.

provider: anthropic

generationId: agent-sdk

stage: benchmark

thinking:
Let me analyze this paragraph carefully.

The paragraph covers multiple topics: board oversight, management responsibility, and the role of the Principal Accounting Officer. Let me determine the dominant category.

The paragraph starts with board oversight, then shifts to management responsibilities, then describes the Principal Accounting Officer's role, then mentions reporting to the Audit Committee and Board.

The primary communicative purpose seems to be describing the overall governance structure - both board and management. The board is mentioned at the start and end (reporting to Audit Committee and Board), but the middle bulk is about management and the Principal Accounting Officer.

Looking at the grammatical subjects: "Our Board" (first sentence), "Management" (second sentence), "Our cybersecurity programs are under the direction of our Principal Accounting Officer" (third sentence), "Any significant cybersecurity incidents are reported to the Audit Committee" (fourth sentence), "Management presents..." (fifth sentence).

This is really a governance chain - the board sets oversight at the top, management identifies risks in the middle, the Principal Accounting Officer directs the actual programs, and everything reports back up through the Audit Committee and Board. The first sentence establishes the board's oversight responsibility, which then cascades down through management and the Principal Accounting Officer, making this fundamentally about how the board delegates responsibility to management. The PAO isn't a cybersecurity-specific role, so that doesn't push this toward specificity. Looking at what's actually here—no named frameworks, no specific dates, no named firms—this reads as Generic Boilerplate. The structure centers on board oversight with management reporting back, but the language is all standard governance phrasing without distinguishing details. I'm settling on Generic Boilerplate, Specificity 1.


content_category: Strategy Integration

category_confidence: high

reasoning: The paragraph's primary content is a materiality assessment — stating the company has not experienced material losses from cybersecurity incidents and acknowledging future risks could materially affect business. Per Rule 6, explicit materiality conclusions are Strategy Integration even with an appended cross-reference to Risk Factors. No specific facts from the IS list are present; TMCC is a company self-reference and the cross-reference is metadata, not disclosure substance.

thinking:
Let me analyze this paragraph.

Content: Discusses past incidents (minor), materiality assessment (no material losses), forward-looking risk, and cross-reference to Risk Factors.

The key substantive content is the materiality assessment: "we have not experienced material losses or other material consequences related to cybersecurity incidents." This is a Strategy Integration paragraph per Rule 6.

Specificity: Let me check for specific facts.
- "TMCC" - company self-reference → NOT list
- "Item 1A. Risk Factors" - cross-reference → not a specific fact
- No dates, dollar amounts, named firms, named tools, named roles, etc.

- No named frameworks either.

This is just generic boilerplate materiality language with no substantive specifics.


content_category: Risk Management Process

reasoning: The paragraph describes the company's internal incident response plan, a cyber emergency response team, escalation processes, and periodic meetings — all internal cybersecurity processes. No named frameworks, no cybersecurity-specific titles (just 'executive leadership team'), no specific dates or numbers. 'Cyber emergency response team' and 'cyber incident response plan' are generic program names without unique identifiers; 'periodically' is a vague cadence; 'Audit Committee' is standard governance. Everything falls on the NOT list.

thinking:
Let me analyze this paragraph from Smith & Wesson's 10-K Item 1C filing.

Content: Describes their cyber incident response plan, a cyber emergency response team, meeting cadence, escalation processes, and reporting to Audit Committee.

Category: This is about internal processes - incident response plan, team structure, escalation processes. The primary content is about what the company does (processes), not about the board or specific individuals. → Risk Management Process

Specificity: Let me check the facts:

- "cyber incident response plan" - generic program name
- "cyber emergency response team" - generic team name
- "members of our executive leadership team" - generic
- "periodically" - generic cadence
- "Audit Committee" - generic governance
- "escalate certain cybersecurity incidents" - generic

No named frameworks, no specific facts from the IS list. All items are on the NOT list or generic.

→ Generic Boilerplate (1)


reasoning: The paragraph primarily describes the company's internal cybersecurity program — controls, assessments, threat intelligence sources, and operational responsibilities. The CISO, CTO, and CIO are mentioned as attributions for program functions (who oversees what), not for their personal qualifications or backgrounds; applying the person-vs-function test, removing the titles leaves a coherent process description, so this is Risk Management Process. Three cybersecurity-specific roles make it Firm-Specific, but none are QV-eligible facts (no dates, dollar amounts, named firms, or named tools).

thinking:
Let me analyze this paragraph.

Content: Describes the company's cybersecurity program - measures, controls, assessments, threat intelligence, and mentions CISO, CTO, CIO roles. The bulk is about processes and program description. The roles are mentioned as attribution for who does what in the program.

Person-vs-function test: The CISO, CTO, CIO are mentioned but only as attributions for program functions. No credentials, background, or personal details. The paragraph is about the program/processes.

Category: Risk Management Process

The roles mentioned—CISO, CTO, and CIO—are firm-specific cybersecurity positions, but they're not named individuals and there's no quantifiable data like dates, budgets, or headcounts, so this doesn't meet the QV threshold. The Managed Security Service Provider is referenced generically without identification.

fact: Chief Information Security Officer (CISO)

fact: Chief Technology Officer (CTO)

fact: Chief Information Officer (CIO)


content_category: Incident Disclosure

reasoning: The paragraph describes an actual cyberattack—its timeline, operational impact, data exfiltration, containment, and remediation—making it squarely Incident Disclosure. It contains one hard verifiable fact (specific quarter/date of September 30, 2022) but no second QV-eligible fact (no named firms, tools, dollar amounts, or headcounts), so it is Firm-Specific rather than Quantified-Verifiable.

thinking:
Let me analyze this paragraph from Mativ Holdings' 10-K filing.

Content: Describes a cyberattack during Q3 2022 - unauthorized access, data exfiltration, operational impact, remediation. This is clearly an Incident Disclosure.

Specificity: Let me check for hard verifiable facts:
- "three-month period ending September 30, 2022" - specific date
- No named firms, no named tools, no dollar amounts, no headcounts

Only one hard verifiable fact (the date). So check IS list: specific date → Firm-Specific.

No second QV-eligible fact, so Firm-Specific (3).


reasoning: The paragraph describes the company's own internal security testing and external assessments aligned with named frameworks — classic Risk Management Process. Third-party experts here are assessors serving the company (not vendor oversight), per Rule 3. Two named frameworks (NIST CSF, PCI DSS) anchor it at Sector-Adapted, but no IS-list firm-specific facts appear: 'third-party experts' is unnamed, 'penetration testing' is a common practice, and 'The Program' is a generic program reference.

thinking:
Let me analyze this paragraph.

Content: Describes engaging third-party experts for security testing and external assessments aligned with NIST CSF and PCI DSS. This is about the company's own internal processes/program.

Category: Risk Management Process - describes internal security testing, framework alignment, risk assessment. The third-party experts are serving the company (external assessors), not vendor oversight. Per Rule 3, "External assessor hired to test the company → Risk Management Process."

Specificity:
- "third-party experts" → NOT list (unnamed entities)

- "penetration testing" → NOT list (common practice)
- NIST CSF → named framework ✓
- PCI DSS → named framework ✓
- "The Program" → generic program name, NOT list
- No firm-specific facts from the IS list beyond frameworks

The presence of two named frameworks keeps this at Sector-Adapted level since there are no firm-specific facts that would elevate it further.

fact: NIST Cybersecurity Framework

type: framework

fact: PCI DSS


reasoning: The paragraph describes an actual cyberattack: timeline, operational impact (delayed sales transactions), data exfiltration including PII, containment, notification, and remediation — all hallmarks of Incident Disclosure. Specificity is Firm-Specific: the specific quarter (Q3 2022) is one hard verifiable fact, but there are no named third-party firms, dollar amounts, headcounts, or named tools to reach the two-fact QV threshold. References to insurance, costs, and affected individuals use vague language ('some,' 'certain') that falls on the NOT list.

thinking:
Let me analyze this paragraph from Mativ Holdings' 10-K filing.

Content: Describes a cyberattack during Q3 2022 - unauthorized access, data exfiltration, operational impact, remediation. This is clearly an Incident Disclosure.

Specificity: Let me check for hard verifiable facts:
- "three-month period ending September 30, 2022" - specific date
- That's the only hard verifiable fact. No named firms, no dollar amounts, no named tools, no headcounts.

One specific date → Firm-Specific (3).


reasoning: The paragraph opens with an explicit materiality assessment ('have not materially affected... not reasonably likely to materially affect... business strategy, financial condition or results of operations'), making it Strategy Integration per Rule 6. The cross-reference to Risk Factors does not change the classification. No specific facts are present — all language is boilerplate.


reasoning: The paragraph describes what the information security team does — monitoring, assessing, mitigating threats, working with third parties, using tools, escalating issues, and maintaining insurance. This is a function/process description (person-vs-function test: replace 'information security team' with 'the Company' and it still reads as a process description). No named frameworks, no named tools, no named third-party firms, no specific dates or numbers — all entities are generic (CEO/CFO/COO are generic C-suite, Audit Committee is standard, third parties and tools are unnamed).

thinking:
Let me analyze this paragraph.

Content: Describes the information security team's responsibilities - monitoring, managing, assessing cyber risks, working with third parties, using tools, interacting with CEO/CFO/COO, escalation processes, and insurance.

Category: This is about what the information security team DOES - their functions, processes, activities. The person-vs-function test: remove the team name and it's still a process description. → Risk Management Process

The paragraph mentions board/audit committee but only in context of escalation (a component of the process). Insurance is mentioned briefly. The dominant content is the team's operational responsibilities.

Now checking the specificity - everything here is generic. No named third parties, unnamed tools, generic C-suite titles, no frameworks or standards mentioned, no dates or numbers. This is all boilerplate language without concrete details.


content_category: Management Role

reasoning: The paragraph leads with the CIO/CISO's qualifications (25+ years of experience) and frames all responsibilities as belonging to this individual ('He is responsible for...'), making the person the primary subject. While the second sentence lists functional responsibilities, these are presented as attributes of the role holder rather than standalone process descriptions. Applying the person-vs-function test: the experience qualifier and personal pronoun framing center the paragraph on who the person is. Specificity is Firm-Specific: CIO/CISO is a cybersecurity-specific title (IS list), and '25 years' is one QV-eligible fact, but only one hard verifiable fact prevents reaching Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

The paragraph is about the CIO/CISO - their experience and what they're responsible for. Let me apply the person-vs-function test.

The paragraph starts with the person's qualifications ("more than 25 years of experience") and then describes their responsibilities. If I remove the person's title and credentials, the remaining content is about responsibilities/functions. But the paragraph leads with the person's experience and frames everything as their individual responsibility.

This is a mixed case. The first sentence is about the person (qualifications, experience). The second sentence describes what they do (functions). The person's credentials are prominent content, not just attribution.

This looks like a Management Role classification - the paragraph centers on who this person is and their responsibilities, with the CIO/CISO title and extensive background being the main framing. Looking at the specificity, I have the cybersecurity-focused role which fits the IS list, the concrete "25 years of experience" figure that qualifies for QV eligibility, and the named role itself. That gives me just one QV-eligible fact, so this would be Firm-Specific at level 3.

fact: CIO/CISO

fact: more than 25 years of experience in technology and information security risk management

type: quantified


reasoning: The paragraph's framing and communicative purpose is the board/Audit Committee oversight chain: Board oversees → Audit Committee has authority → IT Director reports to CFO → CFO updates Board. While management roles occupy significant text, they serve to explain how information flows up to the board, making board oversight the primary frame (similar to Case 5). For specificity, 'IT Director' maps to the NOT-list item 'Director of IT' (generic IT leadership, not cybersecurity-specific like CISO), 'Audit Committee' and 'CFO' are both generic, and no named frameworks, dates, firms, or quantified facts appear — leaving no facts after validation filtering.

thinking:
Let me analyze this paragraph carefully.

The paragraph covers both board oversight and management roles. Let me determine the dominant category.

First sentence: Board oversees, Audit Committee has authority → Board Governance
Second sentence: IT Director's experience and responsibilities → Management Role
Third sentence: IT Director reports to CFO → Management Role (reporting line)
Fourth sentence: CFO provides updates to Board/Audit Committee → Could be Board Governance or Management Role

The paragraph is split. The first sentence is about the Board/Audit Committee. Sentences 2-4 are about management (IT Director, CFO, reporting lines).

Most of the content focuses on the management structure and reporting hierarchy, though the opening frames everything within the Board's oversight authority. The key question is whether this is primarily about the Board's governance function or the management roles themselves. Looking at the substance—the IT Director's background, their responsibilities, and how information flows up through the CFO to the Board—this is fundamentally describing the management reporting structure, with the Board mentioned as the ultimate recipient of information rather than as the primary subject. The reporting chain really does frame this as governance—the board and audit committee establish the oversight structure, and the IT Director's role with the CFO serves to explain how that oversight actually functions. I'm settling on Board Governance as the category since the paragraph's core purpose is describing the governance architecture, even though the management details take up more space.

Now checking specificity: IT Director maps to the generic "Director of IT" on the NOT list, and Audit Committee, Board, and CFO are all too generic to count as specific facts. There are no named frameworks, dates, firms, or numbers here either. This is boilerplate language with no concrete specifics.


reasoning: The paragraph is about the company's internal ERM program and how cybersecurity risk is managed within it. The risk management steering committee is a named non-generic committee (qualifying as Firm-Specific), but there is only one IS-list fact, so it does not reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes Ameren's enterprise risk management program and how cybersecurity is managed within it. Mentions risk management steering committee composed of senior-level officers with board oversight.

Category: This is about the company's internal risk management processes - risk assessment, ERM integration, risk tolerance, policies, controls. The steering committee is mentioned but in context of overseeing ERM processes. Primary topic is the risk management program/framework. → Risk Management Process

Specificity: Let me check for specific facts:
- "risk management steering committee" - this is a named internal committee, but is it on the IS list? It's not a "Technology Committee, Cybersecurity Committee, Risk Committee, ERM Committee" exactly...

Actually, the risk management steering committee qualifies as a named non-generic committee since it's essentially a risk/ERM committee. The other details like senior-level officers and company references are generic, and there are no named frameworks, dates, or dollar amounts mentioned. With just this one specific fact, it falls into the Firm-Specific category.

fact: risk management steering committee (named non-generic committee composed of senior-level officers)


reasoning: The paragraph's primary subject is the CISO throughout — their responsibilities, reporting lines (to CIO, updates to Audit Committee Chair and CFO), experience (20+ years), and certifications (CISSP, CISA, CRISC). While early sentences describe functional responsibilities, the overall communicative purpose centers on who the CISO is and what qualifies them. Multiple QV-eligible hard facts: specific years of experience plus three named certifications.

thinking:
Let me analyze this paragraph carefully.

The paragraph discusses the CISO's role, responsibilities, reporting lines, and qualifications. Let me apply the person-vs-function test.

The paragraph covers:
1. CISO leads cybersecurity program (attribution)
2. CISO responsibilities (assessing/managing risks, prevention, mitigation, detection, remediation)
3. CISO informed about threats per incident response plan
4. CISO reports to CIO, provides updates to Audit Committee Chair and CFO
5. Protocols for reporting incidents to Audit Committee Chair and CFO

6. CISO's experience: 20+ years, multiple certifications (CISSP, CISA, CRISC)

The person-vs-function test shows a mix of what the CISO does and who they are—their credentials, experience, and organizational positioning. The reporting structure and qualifications anchor this to the individual, making it clearly a Management Role where the CISO is the consistent subject throughout.

Now I'm checking what qualifies as Quantified-Verifiable: the specific duration of experience (over 20 years), plus three named certifications (CISSP, CISA, CRISC) are all concrete, verifiable facts. That's enough to classify this as Quantified-Verifiable.

fact: CISO

fact: CIO

fact: over 20 years of cybersecurity experience

fact: Certified Information Systems Security Professional (CISSP)

fact: Certified Information Systems Auditor (CISA)

fact: Certified in Risk and Information Systems Control (CRISC)


specificity_confidence: medium

reasoning: The paragraph identifies who is responsible for cybersecurity management — executive officers, a third-party consultant overseeing strategy, and a SOC Manager with certifications and background — focusing on the people and their advisory/reporting structure rather than the processes themselves. The SOC Manager is a cybersecurity-specific role title (analogous to IS-list entries like Information Security Officer), making this Firm-Specific, though the unnamed consultant, unnamed certifications, and generic background descriptors prevent a higher specificity rating.

thinking:
Let me analyze this paragraph.

Content: Describes management's role in cybersecurity - executive officers manage risks, a third-party consultant oversees cybersecurity strategy, and the consultant is advised by a Security Operations Center Manager with certifications and background.

Category: This is about management roles and who fills them. The paragraph describes the people responsible - executive officers, a third-party consultant, and a SOC Manager. It's about WHO manages cybersecurity, their structure, and qualifications. This fits Management Role - it's about the people and their reporting/advisory relationships.

Wait - let me apply the person-vs-function test.

The paragraph is definitely focused on the people involved and their qualifications rather than the processes they execute. The consultant's responsibilities are mentioned, but the emphasis is on who holds the position and what background they bring - the SOC Manager's technical certifications and extensive IT infrastructure experience. The organizational structure showing how the SOC Manager advises the consultant reinforces this is about roles and reporting relationships, not operational procedures. This clearly falls under Management Role.

Now I'm checking whether the specific roles and qualifications mentioned meet the criteria for being "specific" versus "generic." The third-party consultant isn't named, and the technical certifications aren't detailed - those are generic references. But the Security Operations Center Manager is a distinct role title, and while it's not on the explicit list of CISO or CIO positions, it's still a cybersecurity-specific role that's unique to this organization's structure. The background descriptions - IT infrastructure, risk mitigation, incident response planning - are fairly generic without concrete examples or names attached. "Security Operations Center Manager" is more cybersecurity-specific than generic IT titles like "Director of IT" since SOCs are inherently cybersecurity functions, and the organizational structure with a third-party consultant leading cybersecurity advised by a SOC Manager is somewhat unique to this company. I'll classify this as Firm-Specific.

fact: Security Operations Center Manager


reasoning: The paragraph is about the person — the VP of Platform and Technology Services' experience, credentials, tenure, and career history, plus the CISO's reporting line to that person. This is squarely Management Role under the person-vs-function test. Two QV-eligible hard facts: a specific joining date (October 2012) and a specific duration of experience (over two decades).

thinking:
Let me analyze this paragraph.

The paragraph is about the VP of Platform and Technology Services - their experience, background, reporting structure, and prior roles. The CISO's reporting line is mentioned. This is about the person - qualifications, experience, tenure, career history.

Content category: Management Role - the paragraph describes the person (VP of Platform and Technology Services), their credentials, experience, and career background.

Specific facts:
- CISO (named cybersecurity role)
- VP of Platform and Technology Services (cybersecurity-adjacent specific title)
- "over two decades" of experience (specific duration - ~20 years)
- "October 2012" joining date (specific date)

- Prior experience at two telecommunications companies (unnamed)

QV check:
- "over two decades" - years of experience as specific number? It's approximate but "over two decades" ≈ "over 20 years" which calibration examples treat as countable
- "October 2012" - specific date (month+year) ✓
- Named role: CISO, VP of Platform and Technology Services

QV-eligible: specific date (October 2012), years of experience (over two decades). That's two hard verifiable facts → Quantified-Verifiable.

Wait - "over two decades" is a bit vague. But calibration says "17 years" and "over 20 years" count. "Over two decades" = "over 20 years". I'll count it.

So: October 2012 (specific date) + over two decades of experience (specific duration) = 2 QV-eligible facts → Quantified-Verifiable.

Actually, let me reconsider. "a relevant degree" is vague - no named university. "two telecommunications companies" - unnamed.

VP of Platform and Technology Services - is this a cybersecurity-specific title? It's more of a technology leadership title. Let me check the IS list: "CISO, CTO, CIO, VP of IT/Security, Information Security Officer, Director of IT Security..." - VP of Platform and Technology Services isn't exactly on the list. But CISO is mentioned.

QV-eligible facts: October 2012 (specific date) + over two decades (years of experience as specific number). That's 2 → Quantified-Verifiable.

fact: CISO (reports to VP)

fact: Vice President of Platform and Technology Services

fact: over two decades of technology leadership experience

fact: joined Paychex in October 2012


reasoning: The paragraph discusses cybersecurity insurance as a financial/strategic measure to mitigate cyber risk, which falls under Strategy Integration. However, it provides no specifics — no named insurer, no coverage amounts, no deductible — making it Generic Boilerplate.


content_category: Third-Party Risk

reasoning: The paragraph's central topic is AMG's cybersecurity oversight of its Affiliates — entities with operational autonomy and their own technology systems. AMG conducts program assessments, assists with incident response, and performs pre-investment diligence reviews of Affiliates' security programs. This is requirements/support imposed on external parties, fitting Third-Party Risk. No named frameworks, tools, dates, roles, or other facts from the IS list appear; the descriptions (assessments, diligence reviews, incident assistance) are generic practices without firm-specific detail.

thinking:
Let me analyze this paragraph from AMG's 10-K filing.

The paragraph describes how AMG provides cybersecurity support to its Affiliates - program assessments, incident response assistance, and pre-investment diligence reviews. This is about oversight of external/affiliated entities' cybersecurity, which has elements of both Third-Party Risk and Risk Management Process.

The key question: are "Affiliates" third parties or internal? AMG is an asset management company that takes equity stakes in investment firms (Affiliates). These are partially-owned entities with "operational autonomy." The paragraph describes requirements/support imposed on these affiliated entities - conducting assessments, assisting with incident response, and pre-investment diligence.

This does read like Third-Party Risk since the focus is on overseeing external parties and their security posture, especially given that Affiliates operate independently with their own technology infrastructure. But looking at the specifics - there are no named frameworks, tools, or firm-specific details, just generic descriptions of assessments and diligence reviews. This is boilerplate language without concrete facts from the IS list. Though the "Affiliates" concept with operational autonomy does suggest a distinct relationship model that might matter for classification.


reasoning: While the first sentence introduces the information security program, the bulk of the paragraph describes how the Information Security Governance Committee reports to the Board of Directors — covering incident communications, risk summaries, program updates, and educational sessions. The Board is the primary recipient of oversight throughout, making Board Governance the dominant category. The named CIO role and the uniquely named 'Information Security Governance Committee' are firm-specific facts, but no QV-eligible hard facts (dates, dollar amounts, named firms, etc.) are present.

thinking:
Let me analyze this paragraph carefully.

Content Category: This paragraph covers multiple topics. Let me identify the dominant one.

- "formal information security program" → Risk Management Process
- "governed by a committee comprising members of senior management, including our CIO" → mentions management/committee
- "Information Security Governance Committee" → named committee
- "reports to the Board of Directors at least annually" → Board Governance
- "Members of the Information Security Governance Committee oversee communications with the Board of Directors" → Board Governance
- "provide the Board with a summary of risks" → Board Governance
- "Board of Directors is also regularly provided with cybersecurity educational sessions" → Board Governance

- The Information Security Governance Committee serves as the management body that channels oversight activities to the Board, with most of the paragraph detailing what the Board receives—incident reports, risk summaries, and educational sessions. The dominant theme is Board Governance, since the Board functions as the ultimate oversight body throughout.

Looking at the specific facts: the CIO is a cybersecurity-specific role on the IS list, and the Information Security Governance Committee is a named, non-generic committee. The cadence mentioned ("at least annually") is generic rather than specific. There are no QV-eligible facts like dates, dollar amounts, headcounts, or named firms, so this falls into Firm-Specific at level 3 with two IS facts.

fact: Chief Information Officer (CIO)


reasoning: The paragraph is a bulleted list describing the company's internal cybersecurity program components — risk assessments, roadmap, monitoring, training, incident response plan, and vendor risk management. Third-party mentions are components of the internal program, not the central topic. No named frameworks, named firms, named tools, cybersecurity-specific roles, specific dates, or quantified facts appear; all items are common practices described in generic terms.

thinking:
Let me analyze this paragraph.

Content: This is a bulleted list describing the company's cybersecurity risk management program components - risk assessments, roadmap, third-party security team, external service providers, training, incident response plan, and vendor risk management.

Category: This is clearly Risk Management Process - it describes the company's internal cybersecurity processes and program components. The third-party mentions are components of the internal program, not the central topic.

Specificity: Let me check for specific facts:
- "multi-year cybersecurity roadmap and prioritization rubric based on risk" - this is a named internal program but generic

- "contracted third-party security team" - unnamed entity
- "cybersecurity awareness training" - common practice
- "cybersecurity incident response plan" - generic program name
- "third-party risk management process" - generic

No named frameworks, no named roles, no specific dates, no named firms or tools. Everything here is generic practices described in generic terms.

→ Generic Boilerplate (1)


content_category: None/Other

reasoning: This is a blank check company (SPAC) that explicitly states it has no operations and no personnel or processes of its own for cybersecurity. Per the SPAC rule, the absence of a program is not a description of a program. The mentions of board reporting and incident response are hypothetical and perfunctory, not substantive disclosure.

thinking:
Blank check company/SPAC with no operations. Let me analyze.

Content: This is a SPAC explicitly stating "we do not have any operations" and "we have no personnel or processes of our own for this purpose." Per the codebook, SPACs and shell companies explicitly stating they have no operations get None/Other regardless of incidental mentions of board oversight or risk acknowledgment.

The paragraph mentions board reporting and incident response plan, but these are hypothetical/perfunctory given they have no operations or personnel.

Category: None/Other, Specificity: 1 (Generic Boilerplate)


reasoning: The paragraph's primary content is organizational: the CISO's background and reporting line, the establishment and composition of the CGC with Deputy CISOs, and the management structure supporting cybersecurity. While CGC responsibilities touch on risk management processes (NIST CSF alignment, risk assessment), these are presented to explain the council's role rather than to describe the processes themselves. The CISO's prior CTO experience and the unique CGC structure make this about the people and organizational design. Multiple firm-specific facts (CISO, CGC with unique abbreviation, Deputy CISOs, reporting to EVP of Cloud + AI) but no two QV-eligible hard facts (no dates, dollar amounts, headcounts, named third-party firms, or named certifications), so Firm-Specific rather than Quantified-Verifiable.

thinking:
Let me analyze this paragraph from Microsoft's 10-K Item 1C filing.

The paragraph covers multiple topics:
1. CISO's reporting line and background
2. Cybersecurity Governance Council (CGC) - its composition and responsibilities
3. General employee training

Let me determine the dominant category. The paragraph starts with the CISO's role and background, then shifts to the CGC structure and responsibilities. The CISO's background is described (prior CTO role, senior leadership roles) - that's Management Role. But then it describes the CGC structure and what it does - that's a mix of Management Role (committee structure, Deputy CISOs) and Risk Management Process (risk assessment, NIST CSF alignment, compliance).

Now I'm weighing whether this is primarily about the organizational structure and people involved, or the processes they execute. The CISO reports to the EVP of Cloud + AI, and the CGC includes Deputy CISOs and other leaders - that's the organizational hierarchy. But the paragraph also details what the CGC actually does: risk assessment, NIST CSF alignment, compliance work. Looking at the balance, the paragraph spends more time describing the structure and composition than diving deep into specific processes, so Management Role seems dominant here.

For specificity, I'm checking what's actually firm-specific versus generic cybersecurity terminology. The CISO title and Deputy CISO roles are standard cybersecurity positions, and NIST CSF is an external framework. But the "Cybersecurity Governance Council" is their named internal program, and the reporting line to the EVP of Cloud + AI is their specific organizational structure - those are the firm-specific details that stand out.

Looking at quantifiable facts, there aren't any hard numbers here - no dates, budgets, headcounts, or named third-party vendors. So this doesn't qualify as QV-eligible. But with the internal council name, specific titles, and organizational reporting structure, this is clearly Firm-Specific at level 3.

fact: CISO leads cybersecurity strategy, engineering, and operations

fact: CISO reports to EVP of Cloud + AI

fact: Prior Chief Technology Officer role before joining Microsoft

fact: Cybersecurity Governance Council ("CGC")

fact: CGC comprised of Deputy CISOs

fact: NIST CSF alignment reviewed by CGC


reasoning: This is a pure cross-reference directing readers to the Risk Factors section, with no materiality assessment or substantive cybersecurity disclosure content.


reasoning: This is a blank check company (SPAC) that explicitly states it has no operations and no personnel or processes of its own for cybersecurity. Per the SPAC rule, the absence of a program is not a description of a program. The board oversight mention is perfunctory (reviewing risk factors before SEC filings), and the third-party dependency language is generic risk acknowledgment, not substantive disclosure.

thinking:
Blank check company/SPAC with no operations. Let me analyze.

This is a SPAC explicitly stating no operations. Per the codebook, SPACs with no operations get None/Other. But let me check - this paragraph has more substance than the simple SPAC example. It discusses third-party dependencies and board oversight of risk factors.

However, the codebook is clear: "SPACs and shell companies explicitly stating they have no operations, no cybersecurity program, or no formal processes → None/Other regardless of incidental mentions of board oversight or risk acknowledgment."

The board mention here is perfunctory - reviewing risk factors before SEC filings.

The third-party risk reference is vague and doesn't indicate an actual program in place, so this falls squarely into None/Other with a specificity rating of 1.


reasoning: While the first sentence establishes Board oversight, the dominant content is about the CIO: their quarterly reporting activity, reporting lines (to President/CEO, meetings with CFO and ELT), qualifications (25 years), and supporting team (Director of IT Security, vCISO service). The CIO is the primary actor for most of the paragraph, making this Management Role per the tiebreaker. Specificity is Firm-Specific: multiple IS-list facts (CIO, Director of IT Security, vCISO), but only one QV-eligible hard fact (25 years of experience), falling short of the two needed for Quantified-Verifiable.

thinking:
Let me analyze this paragraph carefully.

Content Category: This paragraph starts with Board oversight but then shifts to describing the CIO - their reporting, qualifications, and team. Let me apply the dominant category test.

- "The Board of Directors is responsible for the oversight" - Board Governance
- "our CIO provides a cybersecurity status report and update to the Board" - This could be Board Governance (briefing cadence) or Management Role (CIO reporting to board)
- "The CIO reports directly to the President and CEO and meets regularly with him, the CFO, and other members of the Executive Leadership Team" - Management Role (reporting lines)

- The CIO's experience and team structure - Management Role (qualifications, team composition)

The opening frames this around Board oversight, but the bulk of the content focuses on the CIO themselves - their reporting relationships, experience level, and the team supporting them. The dominant subject is really the CIO's role and structure rather than Board governance processes.

Looking at the classification rules, when a management role's qualifications and team composition are described, that points to Management Role. The CIO reports to the Board and has 25+ years of IT Operations experience with a Director of IT Security and vCISO support underneath. That's the core of what's being conveyed here.

For specificity, the CIO is on the IS list as a cybersecurity-relevant title, and the Director of IT Security is explicitly cybersecurity-focused.  The vCISO service is a firm-specific arrangement. The "over 25 years" is a specific number that would normally be QV-eligible, but it's the only quantified fact here—everything else (reporting to CEO, quarterly cadence) is generic. So I'm looking at multiple IS-list items but just one QV-eligible fact, which means this falls under Firm-Specific rather than Quantified-Verifiable.

fact: Director of IT Security

fact: virtual Chief Information Security Officer (vCISO) service

fact: over 25 years of experience in IT Operations


reasoning: The paragraph describes the company's internal cybersecurity processes — risk identification, vulnerability testing, penetration testing, and use of third-party vendors as a component of the program. The Risk Management Committee is a named non-generic committee (qualifying as a firm-specific fact), but no second hard verifiable fact (dates, dollar amounts, named firms/tools) is present, so it stays at Firm-Specific rather than Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes internal risk management processes - risk management committee, vulnerability/pen testing, third-party vendors as component.

Category: Risk Management Process - describes internal processes (risk assessment, vulnerability testing, pen testing, vendor usage as component of internal program). The committee and processes are the focus.

Specific facts check:
- "Risk Management Committee" - this is a named committee. Is it on the IS list? "Risk Committee, ERM Committee" are listed as named non-generic committees. "Risk Management Committee" would qualify.
- "InfoSec" - just a term for information security, not a specific fact

- Vulnerability testing and penetration testing are standard practices, not specific facts
- Third-party security vendors are unnamed, so they don't count as specific
- Members with technical expertise is too generic

So the only specific fact here is the Risk Management Committee as a named non-generic committee, making this Firm-Specific. No quantifiable facts like dates, amounts, headcounts, or named entities. Specificity level: 3.

fact: Risk Management Committee


reasoning: While the paragraph opens with board/Audit Committee oversight framing, the CIO is the primary actor throughout (providing updates, chairing the Working Council), and the final portion is entirely about the CIO as a person — tenure, 30+ years of experience, and named universities. The person-vs-function test confirms Management Role: the credentials and background are the primary content. Multiple QV-eligible hard facts: specific tenure date (2023), specific years of experience (30+), and two named universities (SUNY Albany, Harcourt Butler Technological Institute).

thinking:
Let me analyze this paragraph carefully.

Content Category: This paragraph covers multiple topics - board oversight, management roles, and some process mentions. Let me apply the decision rules.

The paragraph starts with board oversight (Board + Audit Committee), then describes CIO's briefing cadence to the board, then describes a Working Council, then mentions a CISO, then gives the CIO's background/credentials/education.

The dominant content: There's a mix of Board Governance and Management Role. Let me assess what takes up the most text:
- Board/Audit Committee oversight + briefing cadence: ~2 sentences
- Working Council (management structure): ~1 sentence

- CISO mention: ~1 sentence
- CIO's personal background, tenure, experience, education: ~3 sentences

The latter half is clearly about the CIO as a person - tenure ("since 2023"), experience ("more than 30 years"), education (named universities). This is Management Role content.

But the opening is about board oversight. The paragraph is mixed. What's the dominant purpose?

Looking at the overall structure: the paragraph starts with board oversight framing but then pivots to management structure and the CIO's personal qualifications. The management/person content occupies more text. But the opening frame is about oversight.

Actually, re-reading: the first few sentences describe the CIO reporting TO the board - which establishes the reporting relationship, then the rest details who's involved in that structure and the CIO's credentials. The paragraph is fundamentally about the governance structure and who leads it, with the CIO's qualifications serving as supporting detail for why they're in that role.

I think Management Role is dominant here - the CIO is the primary actor throughout, and the latter portion extensively covers the person's background and credentials. The governance framing is really just context for the management structure.

Now I need to identify the specific facts: CIO tenure since 2023, 30+ years of experience, education from named universities, reporting structure to board and Audit Committee, CISO reporting relationship, and the Working Council chaired by the CIO.

I'm seeing multiple quantified-verifiable elements here - the specific date, the years of experience, and the named institutions all qualify. That's well above the threshold, so this should be categorized as Quantified-Verifiable.

fact: Chief Information Security Officer (CISO)

fact: Working Council including CFO, Chief Human Resources and Communications Officer, and Chief Legal and Administrative Officer

fact: CIO has served since 2023

fact: More than 30 years of experience in IT leadership roles

fact: Master's in Business Administration in Information Systems from The State University of New York at Albany

fact: Bachelor's degree in electrical engineering from Harcourt Butler Technological Institute, Kanpur, India

fact: NIST posture


reasoning: The paragraph opens with the CISO's qualifications (20 years of experience, certifications) and is structured around the people — the CISO and CDO — their credentials, responsibilities, and reporting lines (CISO → CDO → Audit Committee/Board). While process activities are mentioned, they are framed as what the CISO 'is responsible for,' making the person the primary subject. Specificity is Firm-Specific: 'over 20 years of experience' is one QV-eligible fact and the cybersecurity-specific roles (CISO, CDO) are IS-list facts, but only one QV-eligible hard fact exists, falling short of the two needed for Quantified-Verifiable.

thinking:
Let me analyze this paragraph carefully.

The paragraph covers:
1. CISO's experience and qualifications (20 years, certifications)
2. CISO's responsibilities (day-to-day risk management)
3. Reporting line: CISO → CDO
4. CDO's responsibilities
5. Management updates to Audit Committee and Board

Primary content: The paragraph starts with the CISO's qualifications, then describes what the CISO does, then the reporting structure. Let me apply the person-vs-function test.

If I remove the person's credentials and title, the paragraph still describes processes (risk management activities, monitoring, mitigation).

The opening focuses on the person's background and credentials, but the bulk of the content actually describes the CISO's functional responsibilities and how they fit into the management structure—reporting to the CDO, who then updates the board. So this is fundamentally about the management hierarchy and the roles within it, not just a biographical sketch of the CISO.

Looking at what qualifies as specific and verifiable: the "over 20 years of experience" is a concrete number that would count as QV-eligible, while the CISO and CDO titles themselves are named roles but not necessarily QV-eligible on their own. The industry certifications are too vague to be useful without specifics.

Since there's only one QV-eligible fact here, this falls into the Firm-Specific category rather than QV.

fact: over 20 years of experience

fact: Chief Digital Officer (CDO)


reasoning: The paragraph's central topic is oversight of third-party service providers — identifying, assessing, and managing vendor cybersecurity risks through a structured lifecycle. This is squarely Third-Party Risk. Despite describing five vendor lifecycle stages, these are standard vendor management phases (planning, due diligence, onboarding, monitoring, offboarding) found across many programs. 'Third-Party Risk Management Program' is a generic program name per the NOT list, no named frameworks/standards, no cybersecurity-specific roles, no dates, numbers, or named firms appear — yielding Generic Boilerplate.

thinking:
Classify this paragraph about Ansys's Third-Party Risk Management Program.

Content: Central topic is vendor/supplier oversight - the Third-Party Risk Management Program. This is about requirements imposed on vendors and how the company manages third-party risk. → Third-Party Risk

Specificity: Let me check for specific facts.
- "Third-Party Risk Management Program and Policy" - generic program name, not a unique identifier
- "five stages: planning, due diligence, contracting/onboarding, ongoing monitoring and termination/off-boarding" - this describes a specific structure

The five named stages are organizational detail specific to this company's program.

The five stages themselves—planning, due diligence, contracting/onboarding, ongoing monitoring, and termination/off-boarding—follow standard vendor lifecycle patterns without referencing named frameworks, specific roles, dates, numbers, or external firms. While the structure reflects this company's approach, the stages are generic enough that they don't constitute firm-specific details.


reasoning: The paragraph describes the Sponsor's approach to identifying, assessing, and mitigating cybersecurity threats — internal risk management processes. While it mentions a 'Cybersecurity Policies and Procedures Plan,' this is a generic program name without a distinguishing abbreviation or unique identifier, and 'industry standards and best practices' names no specific framework. All language is boilerplate that could apply to any fund.

thinking:
Let me analyze this paragraph.

Content: The "Sponsor" recognizes importance of managing cyber risks and has implemented a "Cybersecurity Policies and Procedures Plan for the Funds." This describes the company's approach to risk management processes.

Category: Risk Management Process - describes identifying, assessing, mitigating cybersecurity threats. The subject is "The Sponsor" not a board or specific management person. It's about the program/function.

Specificity: Let me check for specific facts:
- "Cybersecurity Policies and Procedures Plan for the Funds" - this is a named internal program. But does it have a unique identifier? It's somewhat generic but has a specific name.

The program name is borderline—it's tailored to this entity but lacks a distinguishing abbreviation or unique identifier that would meet the codebook threshold, so I'm ruling it out as not sufficiently specific. There are no named frameworks referenced, no specific facts from the IS list, and just generic company self-references, which makes this Generic Boilerplate.


reasoning: The paragraph opens with an explicit materiality assessment ('not aware of having experienced any prior material data breaches, regulatory non-compliance incidents, or cyber security incidents'), which per Rule 6 makes it Strategy Integration even though it also contains hypothetical risk language and a cross-reference to Risk Factors. The content is entirely boilerplate with no named entities, frameworks, dates, or firm-specific facts.

thinking:
Let me analyze this paragraph.

Content: States no prior material incidents, discusses hypothetical future impacts, lists potential consequences, cross-references Risk Factors.

The paragraph contains a materiality assessment ("we are not aware of having experienced any prior material data breaches...") combined with hypothetical risk language and a cross-reference.

The key question: is the materiality assessment enough to make this Strategy Integration? The paragraph explicitly assesses that no material incidents have occurred - this is a materiality conclusion. Per Rule 6 and the codebook, materiality assessments → Strategy Integration even if boilerplate.

Specificity: No named standards, no firm-specific facts.

But looking at the overall structure and language, this reads as generic boilerplate without meaningful firm-specific content or analysis.


reasoning: This is a borderline Management Role vs. Risk Management Process paragraph. The opening establishes the CIO as primary subject with specific credentials (12 years experience, 7 years tenure), and the paragraph identifies the Director of Information Security and Compliance and the Security Council structure — all focused on WHO manages cybersecurity. While later sentences describe process activities (monitoring, third-party engagement), the primary communicative purpose is establishing the management structure and the CIO's qualifications. Two QV-eligible hard facts (12 years experience + 7 years tenure) reach the Quantified-Verifiable threshold.

thinking:
Let me analyze this paragraph carefully.

Content Category: This paragraph describes the CIO's role, their experience, the Security Council, and what the information security team does. Let me apply the person-vs-function test.

The paragraph starts with the CIO's responsibility and experience (Management Role signals), but then shifts to describing the Security Council, policies, risk management plan execution, monitoring, and third-party engagement (Risk Management Process signals).

Applying the person-vs-function test: If I remove the CIO's name/title/credentials, the paragraph still describes the Security Council, policies, risk management plan, monitoring tools, third-party partners.

The CIO's background—12 years in the field, 7 with the company—and their position within the reporting structure represent meaningful Management Role content, but the bulk of the paragraph focuses on how the Security Council operates, the processes they oversee, and their advisory relationships. The dominant thread is really about organizational structure and the processes being executed.

Let me reconsider though. There's substantial detail about who's managing this—the CIO's credentials, the Director of Information Security and Compliance, the Security Council's composition. That's pointing toward Management Role rather than just process description. If I strip away the titles and experience, the paragraph still functions as a process description, which suggests Risk Management Process is the right categorization. But the emphasis on leadership experience and organizational hierarchy is pulling it toward Management Role. Looking at the specifics here, the CIO's credentials and the named roles—Director of Information Security and Compliance, the Security Council structure—these are really the core of what's being communicated. The process details about executing plans and third-party engagement feel secondary to establishing who's accountable and what their qualifications are. So Management Role is the right call. I'm checking off the specificity markers: cybersecurity-specific titles, quantified experience metrics, and named organizational structures all qualify.

fact: Chief Information Officer (CIO)

fact: over 12 years of experience leading information security functions

fact: over seven years with the Company

fact: Security Council (named non-generic committee)


reasoning: The Board is the grammatical subject throughout — it oversees strategy, appoints a director, receives briefings, participates in exercises, and reviews assessments. All details are generic: 'quarterly' is a generic cadence, 'a director' is unnamed and not a cybersecurity-specific title, 'third-party cybersecurity assessments' are unnamed, and exercises like simulated incident response are common practices. No named frameworks, specific roles, dates, or verifiable facts appear.

thinking:
Let me analyze this paragraph.

Content: Board oversees cybersecurity strategy, appoints a director, quarterly briefings, board participates in exercises, reviews third-party assessments.

Category: Board Governance - the Board is the grammatical subject throughout.

Specificity: Let me check facts:
- "Board" - generic governance, NOT list
- "quarterly basis" - generic cadence, NOT list
- "simulated cyber incident response and crisis management exercises" - common practices
- "third-party cybersecurity assessments" - unnamed entities

No named frameworks, no named roles (cybersecurity-specific), no dates, no numbers.

The director appointment language is vague and lacks any cybersecurity-specific title or credentials, which further confirms this is generic boilerplate rather than substantive governance detail.

→ Generic Boilerplate (1)


reasoning: The paragraph's primary communicative purpose is describing the company's cybersecurity program approach — regulatory compliance and framework adoption — making it Risk Management Process. The Board/management mention is a brief commitment statement, not substantive governance disclosure. It names NIST CSF and ISO 27001 as guiding frameworks but contains no firm-specific facts (no cybersecurity-specific roles, no specific dates, numbers, or named tools), placing it at Sector-Adapted.

thinking:
Let me analyze this paragraph.

Content: Describes cybersecurity risks facing the company, mentions Board and executive management commitment, regulatory compliance, and frameworks (NIST CSF, ISO 27001).

Category: This is a mixed paragraph. It starts with generic risk language, mentions Board and management commitment briefly, discusses regulatory compliance, and names frameworks. The dominant content is about the company's risk management approach - compliance with regulations and use of frameworks. The Board mention is brief ("committed to devoting resources"). This is primarily about the company's cybersecurity program approach → Risk Management Process.

Now I'm checking the specificity level. The paragraph references NIST CSF and ISO 27001, which are established frameworks, so that puts it at Sector-Adapted minimum. Looking for firm-specific details—there's no mention of named committees, specific dates, particular tools, or metrics. The Board and executive management references are generic governance language without any distinguishing details. This lands at Sector-Adapted (2).

fact: National Institute of Standards and Technology Cybersecurity Framework (NIST CSF)

fact: International Organization Standardization 27001 (ISO 27001)


reasoning: The paragraph describes the company's internal cybersecurity strategy, risk management processes, controls (MFA, Zero Trust), and framework adoption — all squarely Risk Management Process. It names PCI DSS and CIS Critical Security Controls as recognized standards, reaching Sector-Adapted, but contains no firm-specific facts from the IS list (no named roles, specific dates, headcounts, named tools, or named third-party firms) to reach Firm-Specific.

thinking:
Let me analyze this paragraph from Hibbett Inc's 10-K filing.

Content: Describes the company's cybersecurity strategy, risk management processes, controls, frameworks adopted. This is clearly about internal processes and methodology.

Category: Risk Management Process - describes internal processes, controls, frameworks, monitoring, training, tools.

Specificity: Names PCI DSS and CIS Critical Security Controls - these are recognized standards → at least Sector-Adapted. Also mentions "Zero Trust" and "Multi-factor authentication" - these are common practices. Let me check for firm-specific facts.

IS list check:

- No cybersecurity-specific titles (CISO, etc.)
- No named committees
- No specific dates
- No named tools/products
- No named firms
- No specific numbers
- PCI DSS and CIS Critical Security Controls are named frameworks → Sector-Adapted
- "Zero Trust" and "Multi-factor authentication" are common practices, not firm-specific

The disclosure references industry-standard frameworks like PCI DSS and CIS Critical Security Controls, which makes it Sector-Adapted, but contains no firm-specific details like named personnel, committees, dates, or proprietary tools.

fact: Payment Card Industry Data Security Standard (PCI DSS)

fact: CIS Critical Security Controls Cybersecurity Framework


reasoning: The paragraph describes board-level cybersecurity expertise and oversight, with the board and a board committee as the grammatical subjects. The Technology & Cybersecurity Committee is a named non-generic committee (not a standard Audit Committee), qualifying as a firm-specific fact. No second QV-eligible hard fact exists to reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: About the board's cybersecurity expertise - mentions Technology & Cybersecurity Committee, director backgrounds, training sessions. The board/committee is the subject.

Category: Board Governance - discusses board-level expertise and committee composition.

Specificity:
- "Technology & Cybersecurity Committee" - this is a named non-generic committee → Firm-Specific (IS list)
- No QV-eligible facts (no dates, dollars, headcounts, named firms, named tools, named certs)

- This lands in the Firm-Specific category.

fact: Technology & Cybersecurity Committee


reasoning: The Board and Audit Committee are the grammatical subjects overseeing cybersecurity risk management, making this Board Governance. No firm-specific facts are present — 'Board' and 'Audit Committee' are on the NOT list, and the description of ensuring management has processes in place is generic language applicable to any public company.

thinking:
Board/committee oversight paragraph. Board and Audit Committee are subjects. This is Board Governance.

Specific facts: "Audit Committee" is generic (on the NOT list). No cybersecurity-specific roles, no named frameworks, no dates, no numbers.

Specificity: Generic Boilerplate.


reasoning: The paragraph's primary communicative purpose is a materiality assessment — explicitly stating that cybersecurity risks 'have not materially affected the Company, our business strategy, our results of operations or our financial condition.' Per Rule 6, this is Strategy Integration even though it includes generic threat language and a cross-reference to Risk Factors. No named frameworks, firm-specific facts, or verifiable details are present beyond boilerplate language.

thinking: Materiality assessment is the dominant content here.


reasoning: The paragraph does not itself make a materiality conclusion — it directs the reader to the Risk Factors section where such an assessment is provided ('In our Risk Factors, we describe whether and how...'). This is a cross-reference to another filing section rather than a standalone materiality assessment. Per the codebook, only pure cross-references with no materiality conclusion are None/Other, and this paragraph states no conclusion of its own.

thinking:
Classify this paragraph.

It references Risk Factors and includes a materiality assessment framing. But let me look carefully - does it make a materiality conclusion, or just point elsewhere?

"we describe whether and how risks... have materially affected or are reasonably likely to materially affect us" - this is pointing to Risk Factors for the materiality assessment. It doesn't actually make the conclusion here. It's a cross-reference saying "go look at Risk Factors for our materiality assessment."

This is a borderline case. Per the codebook: "A cross-reference to Risk Factors appended to a materiality assessment does not change the classification." But here, the paragraph itself doesn't contain a materiality conclusion - it says the materiality discussion is IN the Risk Factors section. It's essentially a pure cross-reference.

Comparing this to the codebook examples, it's structured like the pure cross-reference case - "For additional information about risks... see Part I, Item 1A, 'Risk Factors'" - rather than the Strategy Integration example that actually states a conclusion. The paragraph directs readers to Risk Factors for the assessment without making any conclusion itself, so this falls into None/Other with Specificity 1.


reasoning: The paragraph describes an actual cybersecurity incident: unauthorized activity detected, incident response plan activated, systems taken offline, and operational disruption. While the final sentences discuss financial impact (reduced sales, increased costs), the dominant content is the incident narrative—what happened, containment actions, and restoration. The only hard verifiable fact is the specific time period ('fourth quarter of fiscal 2025'); everything else uses generic language ('certain systems', 'incident response plan', no named firms or tools), yielding one fact and thus Firm-Specific.

thinking:
Let me analyze this paragraph carefully.

The paragraph describes a cybersecurity incident - unauthorized activity detected, response actions taken, and impact on operations. It covers both what happened (incident narrative) and business impact (reduced sales, increased costs).

Content category: This is primarily about what happened in an incident - detection, response actions, containment, systems taken offline, operational disruption. The last sentence discusses financial impact but the dominant content is the incident narrative. → Incident Disclosure

Specificity: Let me check for facts:
- "fourth quarter of fiscal 2025" - specific date period → yes, specific date
- "Cybersecurity Incident" - named internal program with unique identifier? It's just a label for the incident, not really a program name.

- No named firms, no named tools, no dollar amounts, no headcounts

The only hard verifiable fact here is the specific date reference. "Incident response plan" is generic language, and "certain systems" is deliberately vague, so those don't count as firm-specific facts. That leaves me with just the fiscal period as a concrete detail → Firm-Specific (3)

fact: fourth quarter of fiscal 2025


reasoning: The paragraph describes Penske's internal cybersecurity processes: training, phishing simulations, vulnerability scanning, patching, access controls, incident response plan, and 24/7 managed security operations. The person-vs-function test confirms this is about the program, not any individual. The named departmental composition of the cross-functional response team (IT, information security, finance, risk management, investor relations, legal) is a firm-specific fact, but no named frameworks, tools, firms, or second hard verifiable fact pushes it to QV.

thinking:
Let me analyze this paragraph from Penske Automotive Group's 10-K filing.

Content: Describes their Information Security Program - training, phishing simulations, business continuity, access controls, MFA, incident response plan, cross-functional response team, vulnerability scanning, 24/7 managed security, patching program, user access controls, acceptable use policy.

Category: This is clearly about the company's internal cybersecurity processes. The cross-functional team composition is mentioned but it's part of describing the program. → Risk Management Process

Specificity: Let me check for specific facts:
- "Information Security Program" - generic program name

- The cross-functional response team with specific departments listed (information technology, information security, finance, risk management, investor relations and legal teams) - this is a concrete detail about their organizational structure that qualifies as a specific fact for the IS list
- MFA, phishing simulations, vulnerability scanning, and patching are standard industry practices, so they don't count as specific facts
- The 24/7 outsourced managed security service is mentioned but without naming the vendor or providing other distinguishing details
- No named frameworks, tools, dates, dollar amounts, or external firms are referenced

So I've identified one specific fact: the departmental composition of their incident response team.

fact: Cross-functional response team comprising information technology, information security, finance, risk management, investor relations and legal teams


reasoning: The paragraph describes Logitech's security capability and its two components (cybersecurity and product security), which is a description of the company's own internal security program structure. No named frameworks, specific roles, dates, tools, or other IS-list facts are present — the language (confidentiality, integrity, availability) is standard CIA triad boilerplate applicable to any company.

thinking:
Let me analyze this paragraph.

Content: Describes Logitech's security capability at a high level - protecting confidentiality, integrity, availability. Mentions cybersecurity and product security as two components. This is about the company's internal security processes/program.

Category: Risk Management Process - describes the company's own security capability and its components.

Specificity: No named frameworks, no specific roles, no dates, no numbers. "Confidentiality, integrity, availability" is standard CIA triad language. The distinction between cybersecurity and product security is somewhat structural but very generic. No IS-list facts present.

This looks like generic boilerplate language that any company could use to describe their security posture without providing substantive detail.


reasoning: The paragraph is primarily about the people filling cybersecurity leadership roles — the ISO, CIO, and their teams — focusing on their qualifications, credentials, and experience rather than describing what the program does. Multiple QV-eligible hard facts are present: specific combined years of experience (50+), a named certification (ISACA CISA), and a quantified headcount of credentialed team members (two with master's degrees).

thinking:
Let me analyze this paragraph carefully.

The paragraph describes management roles and their qualifications. Let me apply the person-vs-function test.

The paragraph talks about:
- ISO (Information Security Officer) under Chief Risk Officer - leads the program
- IT Department has a dedicated cybersecurity team under CIO
- Team members' combined experience (50+ years)
- Specific certifications: ISACA CISA
- Two team members with master's degrees in cybersecurity

This is about the people - their qualifications, credentials, experience, team composition. It's telling us WHO these people are and what makes them qualified. This is Management Role.

Now I'm identifying which specific facts could qualify as quantified values. The team's combined experience measured in years, the CISA certification as a named credential, and the count of team members with advanced degrees are all concrete, measurable details that could support the QV category.

fact: ISO (Information Security Officer)

fact: Chief Information Officer

fact: over 50 years of combined experience

fact: ISACA Certified Information Systems Auditor certification

fact: two team members each with a master's degree in cybersecurity


reasoning: The paragraph's central topic is oversight of third-party vendors — vendor assessment, selection criteria, access controls, data handling requirements, and data return/deletion mandates. These are all requirements imposed ON vendors, making this Third-Party Risk. No named standards, frameworks, tools, firms, dates, or quantified facts appear; every phrase ('strict protocols,' 'relevant privacy regulations,' 'high standards') is generic and could apply to any company.

thinking:
Classify this paragraph.

Content: About vendor/supplier security oversight - requirements imposed ON vendors, vendor selection criteria, access controls for vendors, data handling requirements. Central topic is third-party vendor oversight.

Category: Third-Party Risk

Specificity: No named frameworks, no named vendors, no specific dates, no numbers. No cybersecurity-specific roles. No named standards. Everything is generic - "potential vendors", "strict protocols", "relevant privacy regulations".

Generic Boilerplate.


reasoning: The paragraph describes the company's post-incident review process — reassessing the cybersecurity program, identifying adjustments, and reporting upward. The primary content is about internal processes (what the company does after an incident), not board oversight or an actual incident. The Audit Committee and senior management are mentioned only as reporting destinations, not as primary actors. No named frameworks, cybersecurity-specific roles, dates, or other IS-list facts are present; 'Audit Committee' and 'senior management' are on the NOT list.

thinking:
Classify this paragraph.

Content: Post-incident reassessment process - reassess effectiveness, identify adjustments, report to senior management and Audit Committee.

Category: This describes an internal process (post-incident review cycle). The Audit Committee is mentioned as a reporting destination, not as the primary actor. The paragraph is about what the company does after an incident - reassessing, adjusting, reporting. This is Risk Management Process.

Specificity: Let me check for specific facts.
- "Audit Committee" - on the NOT list (generic governance)
- "incident response team" - generic/unnamed

- "senior management" - generic
- No named frameworks, no dates, no specific tools, no named roles from the IS list

No IS-list facts, no named standards → Generic Boilerplate.


reasoning: The Board and Audit Committee are the grammatical subjects receiving reports on cybersecurity risks, making this Board Governance. All elements are on the NOT list: 'Board', 'Audit Committee', 'management', 'quarterly', and generic descriptions of report topics — no cybersecurity-specific roles, named frameworks, dates, or firm-specific facts.

thinking:
Classify this paragraph.

The paragraph is about the Board and Audit Committee receiving reports on cybersecurity risks. The grammatical subjects are "The Board and Audit Committee" - this is board-level oversight of cyber risk, including briefing cadence.

Content category: Board Governance

Specificity: Let me check the facts.
- "Board and Audit Committee" - generic governance (NOT list)
- "quarterly" - generic cadence (NOT list)
- "management" - generic (NOT list)
- No named frameworks, no specific roles (CISO etc.), no dates, no named tools

No IS-list facts.

Since there are no named standards referenced, this falls into generic boilerplate.


reasoning: The paragraph's primary communicative purpose is describing the company's comprehensive cybersecurity risk management approach — policies, standards, processes, and resource investment. Board and Audit Committee mentions are brief framing ('actively involved in oversight'), and the SSG members are described in terms of program structure, not personal credentials (person-vs-function test → function). The named Security Steering Group with its acronym is a firm-specific internal program, and CISO/VP of Cloud Technology are specific roles, but no QV-eligible hard facts (dates, dollar amounts, headcounts, named third-party firms, named tools) are present.

thinking:
Let me analyze this paragraph from Pegasystems Inc's 10-K filing.

Content: This is an introductory/overview paragraph that touches multiple topics - board oversight, management involvement, risk management program, and the Security Steering Group. The dominant content is about the company's comprehensive approach to cybersecurity risk management processes.

Let me apply the person-vs-function test: The paragraph mentions CISO, Chief Product Officer, VP of Cloud Technology as members of the SSG, but it's describing the program structure, not the people's credentials. So this is Risk Management Process.

Actually, let me reconsider. The paragraph touches Board Governance (Board and Audit Committee oversight), Management Role (SSG members), and Risk Management Process (policies, standards, processes).

The core focus here is really on how the company structures its cybersecurity oversight—the policies, standards, and processes that make up the program itself. The board and committee are mentioned as part of the governance framework, and the SSG members are identified by their roles within that framework rather than their individual qualifications. This is fundamentally about the Risk Management Process. Looking at what qualifies as an IS fact, the Security Steering Group is a named internal program with a specific identifier, and the CISO is a cybersecurity-specific title, so those count. The Chief Product Officer and Vice President of Cloud Technology are generic roles not on the IS list.

fact: Security Steering Group ('SSG') — named internal program with unique identifier

fact: Chief Information Security Officer ('CISO')

fact: Vice President of Cloud Technology


reasoning: The paragraph's primary subject is the FE Board and its committees (Audit Committee, Operations and Safety Oversight Committee) overseeing cybersecurity risk. The CISO mention is subordinate—describing who reports to the board, not the person's qualifications. Multiple firm-specific facts (non-generic Operations and Safety Oversight Committee, specific year 2022, CISO role) establish Firm-Specific, but only one QV-eligible hard fact (2022 date), so it does not reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph from FirstEnergy Corp's 10-K filing.

Content Category: This is primarily about Board/committee oversight of cybersecurity. The board and its committees are the grammatical subjects throughout. The CISO is mentioned briefly as reporting to the committees, but the paragraph is about the board's oversight structure.

→ Board Governance

Specificity: Let me check for specific facts:
- "Operations and Safety Oversight Committee" — named non-generic committee ✓
- "since 2022" — specific date ✓
- "CISO" — cybersecurity-specific title ✓

- Only the 2022 date qualifies as a QV-eligible fact, while the committee names and CISO title are firm-specific details. This gives me multiple firm-specific facts but just one quantifiable date, so this falls into the Firm-Specific category.

fact: Operations and Safety Oversight Committee delegated cyber oversight

fact: since 2022, FE Board delegated oversight authority

fact: CISO regularly reports to committees and full Board


reasoning: The paragraph contains an explicit materiality assessment ('have not been materially impacted... business strategy, results of operations or financial condition'), which per Rule 6 makes it Strategy Integration even though it includes a cross-reference to Risk Factors. No specific facts from the IS list are present — the language is boilerplate materiality disclaimer.

thinking: Materiality assessment paragraph with cross-reference.


reasoning: The paragraph opens with an explicit materiality assessment ('risks from cybersecurity threats have not materially affected us') and follows with a forward-looking disclaimer about potential future impact. Per Rule 6, any paragraph that assesses whether cybersecurity risks have 'materially affected' the company is Strategy Integration. No named frameworks, roles, dates, or firm-specific facts are present.

thinking:
Classify this paragraph.

The paragraph has two parts: (1) a materiality assessment ("risks from cybersecurity threats have not materially affected us") and (2) a forward-looking risk statement. The materiality assessment makes this Strategy Integration per Rule 6.

Specificity: No named standards, no firm-specific facts. Generic boilerplate.


reasoning: The paragraph describes the company's internal cybersecurity processes: IT operations, enhanced detection and response capabilities, periodic risk assessments, control implementation, and third-party risk identification. Third-party mentions are components of the broader internal program, not the central topic. No named frameworks, tools, firms, dates, cybersecurity-specific roles, or quantified facts appear — all descriptions use generic language ('periodic,' 'as appropriate,' 'managed extended detection and response') that could apply to any company.

thinking:
Let me analyze this paragraph from Stoneridge Inc's 10-K filing.

Content: Describes IT function managing operations, enhanced security capabilities (workstation, server, email, network monitoring with managed XDR), periodic risk assessments, risk mitigation controls, third-party engagement, and third-party risk processes.

Category: This is about the company's internal cybersecurity processes - risk assessments, controls, monitoring, XDR capabilities. Third-party mentions are components of the broader program, not the central topic. The paragraph is about what the program does (function), not about a person. → Risk Management Process

Specificity: Looking at the details here, I see managed extended detection and response mentioned as a general capability rather than a specific product, and the rest is described in generic terms - no named frameworks, tools, firms, dates, or numbers. The IT function and security practices are all standard industry language without any distinctive facts. → Generic Boilerplate


reasoning: The paragraph is dominated by a detailed incident narrative: specific dates of notification, system suspension, phased restoration, and resumption of operations involving a named third-party (CDK) and named systems (DMS, CRM). The trailing materiality language and cross-reference are subordinate to the incident description. Multiple specific dates plus the named firm CDK easily satisfy the two-fact QV threshold.

thinking:
Let me analyze this paragraph carefully.

This describes the CDK cybersecurity incident in detail - dates, systems affected, timeline of restoration, and business impact.

Content Category: This is primarily an Incident Disclosure. The paragraph describes what happened: CDK notified them, systems were suspended, timeline of restoration. There's also some Strategy Integration at the end (business impact, materiality language), but the dominant content is the incident narrative.

Specific facts:
- June 19, 2024 (specific date)
- CDK (named third-party firm)
- DMS, CRM (named systems)

- June 26, 2024 (specific date)
- June 30, 2024 (specific date)
- July 31, 2024 (specific date)

Multiple specific dates and named systems across the incident timeline make this clearly Quantified-Verifiable with well over 2 hard verifiable facts.

fact: June 19, 2024 — CDK notified of cybersecurity incident

fact: CDK — named third-party provider

fact: dealer management system (DMS)

fact: customer relationship management system (CRM)

fact: June 26, 2024 — CDK began restoring access

fact: June 30, 2024 — resumed processing transactions in DMS

fact: July 31, 2024 — regained access to all Affected Systems


reasoning: The paragraph describes the company's internal cybersecurity processes: threat assessments, monitoring, protective measures (firewalls, segmentation, virus scanning), incident response planning, and employee training. Third parties are mentioned as one component of internal processes, not as the central topic. No named frameworks, tools, firms, roles, dates, or specific numbers appear — all practices described (penetration testing, phishing testing, firewalls, system monitoring) are generic and could apply to any company.

thinking:
Let me analyze this paragraph.

Content: Describes internal cybersecurity processes - threat identification, assessments, penetration testing, monitoring, protective measures (firewalls, segmentation, etc.), incident response plan, employee training. Third parties mentioned as one component of internal processes.

Category: Risk Management Process - describes the company's own internal processes, tools, and methodologies.

Specificity: Let me check for specific facts:
- No named frameworks (NIST, ISO, etc.)
- No cybersecurity-specific titles
- No named committees

- No specific dates
- No named tools/products
- No named third-party firms ("third-party cybersecurity experts" is generic)
- No specific numbers
- Practices mentioned are all generic: penetration testing, phishing testing, firewalls, system segmentation, monitoring, virus scanning

This is Generic Boilerplate - no named standards, no firm-specific facts.


reasoning: The paragraph opens with an explicit materiality assessment ('has not materially affected or is reasonably likely to materially affect... business strategy, results of operations or financial position'), which per Rule 6 is Strategy Integration regardless of the appended cross-reference to Risk Factors. The remaining content about investing in cybersecurity and enhancing controls is generic, and no named frameworks, roles, dates, or firm-specific facts appear.

thinking:
Classify this paragraph.

The paragraph contains:
1. A materiality assessment ("has not materially affected or is reasonably likely to materially affect... business strategy, results of operations or financial position") → Strategy Integration per Rule 6
2. General investment in cybersecurity language
3. Cross-reference to Risk Factors

The dominant content is the materiality disclaimer. Per the codebook, materiality assessments → Strategy Integration even if boilerplate.

Specificity: No named frameworks, no specific facts from the IS list. Generic boilerplate language throughout.

This is generic boilerplate.


reasoning: This is a continuation of a lettered list describing topics reviewed as part of board/committee oversight (capabilities of personnel, cybersecurity strategy, resource allocation). The items listed are oversight agenda topics, indicating board governance, though the fragment lacks an explicit grammatical subject. No named frameworks, roles, dates, or firm-specific facts are present — entirely generic oversight language.

thinking:
Classify this paragraph.

This describes what the board/committee reviews - capabilities of personnel, strategy, priorities, resources. The grammatical subject performing oversight isn't explicitly stated but this appears to be a list of items that a board or committee oversees (given the lettered list format g. and h.).

Category: Board Governance - this is listing topics that the board/committee reviews as part of oversight.

Specificity: No named frameworks, no specific facts from the IS list. "cyber and data privacy personnel" is generic. "cybersecurity infrastructure" is generic. This is boilerplate language about oversight topics.

So this is generic boilerplate - standard oversight language without specific details or frameworks.


reasoning: The paragraph describes the company's internal cybersecurity risk management measures — policies, controls, tools, and practices — making it squarely Risk Management Process. Despite its length, every item listed (incident response plan, vulnerability management policy, penetration testing, employee training, cyber insurance, vendor risk management program, etc.) consists of common/generic security practices that appear on the NOT list. No named frameworks, named tools, named firms, specific dates, or quantified facts are present; 'security standards/certifications' is mentioned but none are named.

thinking:
Let me analyze this paragraph from Leatt Corp's 10-K filing.

Content: This describes the company's internal cybersecurity processes - technical, physical, organizational measures. It's a long list of security practices.

Category: Risk Management Process - clearly about internal processes, tools, methodologies.

Specificity: Let me check for specific facts. The paragraph lists many common practices (penetration testing, vulnerability scanning, etc.) but doesn't name any frameworks (NIST, ISO), specific tools, specific roles, dates, or firms. Everything listed is generic: "incident response plan", "vulnerability management policy", "disaster recovery/business continuity plans", "penetration testing", "cyber insurance", "vendor risk management program" - all on the NOT list or common practices.

The references to "Information Assets" and "security standards/certifications" are company terminology but remain vague and unnamed. No specific frameworks, certifications, or firm-specific details emerge - this is generic boilerplate language.


reasoning: The paragraph's primary subjects are the CyTOC (a named, non-generic board committee) and the full Board, describing how they receive cybersecurity briefings, updates on key metrics, and ERM risk communications. The CISO and management report TO the committee, making this Board Governance. The CyTOC is a firm-specific named committee and CISO is a cybersecurity-specific role, but neither qualifies as QV-eligible, so specificity is Firm-Specific.

thinking:
Let me analyze this paragraph from FedEx's 10-K filing.

Content: This describes the CyTOC (a named committee) receiving updates from the CISO, topics covered, briefing cadence, and how information flows to the full Board. The primary subject is the CyTOC (a board-level committee) and the Board receiving cybersecurity updates.

Category: Board Governance - The CyTOC and Board are the primary subjects receiving briefings and oversight. The CISO is mentioned as reporting TO the committee.

Specific facts:
- CyTOC (named non-generic committee - Cybersecurity Technology Oversight Committee) → IS list

- CISO → IS list (cybersecurity-specific title)
- Audit and Finance Committee is a variant of Audit Committee, which is on the NOT list

Looking at the QV eligibility: CyTOC and CISO are firm-specific named items without any dates, dollar amounts, headcounts, named firms, tools, or certifications to qualify them. This is firm-specific disclosure with no quantifiable facts.

fact: CyTOC (Cybersecurity Technology Oversight Committee — named non-generic board committee)

fact: CISO (cybersecurity-specific role reporting to the committee)


reasoning: The paragraph describes the company's own internal cybersecurity processes—assessing, identifying, and managing risks through controls, technologies, and methods—making Risk Management Process the dominant category. Third-party risk is mentioned as one component of the broader program, not as the central topic (Rule 3). No named frameworks, tools, roles, dates, or any firm-specific facts are present; the entire paragraph uses generic language that could apply to any company.

thinking:
Let me analyze this paragraph.

Content: Describes the company's internal processes for cybersecurity risk management - assessing, identifying, managing risks, various controls and technologies. Also mentions a third-party security program as one component. The primary focus is on the company's own internal processes.

Category: Risk Management Process - the paragraph is about the company's own internal cybersecurity processes. Third-party risk is mentioned but as one component of the broader program (Rule 3).

Specificity: Let me check for specific facts:
- No named frameworks, no named tools, no named roles, no specific dates, no numbers, no named firms

- "third-party security program" is a generic program name
- Everything relies on generic language: "processes," "mechanisms," "controls," "technologies"

This is Generic Boilerplate (1).


reasoning: The paragraph's grammatical subject throughout is the VP of IT and their support team — describing their reporting responsibilities, coordination duties, and qualifications (25+ years of experience). While sentences about coordinating incident response and reporting to the Board touch on function, the paragraph's primary communicative purpose is establishing who holds the role, what they are responsible for, and their credentials, making it Management Role. One QV-eligible fact (25 years) plus one IS-list role (VP of IT) yields Firm-Specific but not Quantified-Verifiable (needs two QV-eligible facts).

thinking:
Let me analyze this paragraph carefully.

The paragraph discusses the VP of Information Technology's reporting responsibility, their coordination of incident response, and their experience. Let me apply the person-vs-function test.

Content: The paragraph mentions:
1. VP of IT and support team have reporting responsibility to executive leadership and Board
2. They coordinate response/remediation of incidents and report on security program status
3. Board receives regular reports from management
4. VP of IT has 25+ years of experience

This is a mixed paragraph. Let me apply the person-vs-function test. The paragraph has both function elements (coordinating response, reporting on program status) and person elements (25 years of experience). The reporting lines and coordination duties are about the function, but the last sentence is about the person's qualifications.

Looking at the structure more closely, the VP of IT is the primary subject throughout—they're responsible for coordinating incidents and reporting on the security program, with their 25+ years of experience establishing credibility for the role. This points toward Management Role as the dominant category, since the focus is on the VP's position in the organization and what they're accountable for. Looking at the IS list, "VP of IT/Security" is there, so "VP of Information Technology" qualifies as a named role trigger. That gives me one Firm-Specific fact. For the experience qualification, "more than 25 years" is a specific number that counts as QV-eligible, but that's only one QV fact when I need two. So this falls into Firm-Specific with a single QV fact, which doesn't meet the QV threshold.

fact: VP of Information Technology

fact: more than 25 years of experience in IT infrastructure, cybersecurity operations, and software engineering


reasoning: The paragraph's primary content identifies two cybersecurity management roles (CISO and UScellular SVP of IT) and describes their qualifications (over 20 years of experience, domains of expertise, continuing education). While it also touches on incident response process and ends with a materiality disclaimer, the opening framing and dominant content concern who the responsible persons are and what makes them qualified. Only one QV-eligible fact (20 years of experience) exists; the named roles are firm-specific but not QV-eligible, so specificity is Firm-Specific rather than Quantified-Verifiable.

thinking:
Let me analyze this paragraph carefully.

The paragraph covers multiple topics:
1. CISO and UScellular SVP of IT identified as responsible for cybersecurity
2. Their experience (over 20 years each)
3. Management's continuing education
4. Incident response process involving CFO and general counsel
5. Materiality assessment statement

Let me apply the dominant category test. The paragraph starts by identifying two management roles and their experience, then describes incident response processes, then ends with a materiality disclaimer.

Person-vs-function test: The paragraph names specific roles (CISO, SVP of IT) and describes their experience ("over twenty years of experience at the company, encompassing network engineering, information technology and cyber security").

Looking at the structure, the opening sentences focus on who manages cybersecurity and their qualifications, while the later sentences shift into process descriptions and disclaimers. The dominant content is clearly about the people themselves and their background—that's what the paragraph leads with and emphasizes. The incident response process and materiality statement feel secondary to establishing management's credentials.

Now I'm evaluating which facts are actually quantifiable and verifiable. The CISO role and SVP of IT title are specific positions, but the real substantive detail here is the "over twenty years of experience"—that's a concrete, measurable qualification. The other roles are more generic titles without the specificity that would make them stand out as particularly notable facts.

fact: Chief Information Security Officer (CISO)

fact: UScellular Senior Vice President of Information Technology

fact: Over twenty years of experience at the company


reasoning: The paragraph contains an explicit materiality assessment ('such risks have not materially affected us, including our business strategy, results of operations or financial condition'), making it Strategy Integration per Rule 6. The appended cross-reference to Risk Factors does not change the classification. No firm-specific facts from the IS list are present — the language is standard boilerplate materiality disclaimer.

thinking:
Materiality assessment present → Strategy Integration. Cross-reference appended doesn't change it per Rule 6.

Specificity: No named standards, no firm-specific facts from the IS list. Boilerplate materiality language.