content_category: None/Other

category_confidence: high

specificity_confidence: high

reasoning: This paragraph describes the company's general IT infrastructure and its importance to operations — it is standard business language about IT systems, data handling, and communications. It contains no substantive cybersecurity disclosure content: no risk management processes, no governance structures, no incident details, and no materiality assessment.

provider: anthropic

generationId: agent-sdk

stage: benchmark

thinking:
Let me classify this paragraph.

This is general business language about IT systems being important to operations. No cybersecurity-specific content.

None/Other, Generic Boilerplate.


content_category: Strategy Integration

reasoning: The paragraph contains an explicit materiality assessment ('not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition'), which per Rule 6 is Strategy Integration regardless of the appended cross-reference to Item 1A Risk Factors. No specific facts from the IS list are present — the language is standard boilerplate materiality disclaimer.

thinking:
Classify this paragraph.

Content: Materiality assessment ("not aware of any cybersecurity incidents that have materially affected...") + cross-reference to Risk Factors.

Per Rule 6 and the codebook: materiality disclaimer → Strategy Integration. The cross-reference doesn't change it.

Specificity: Boilerplate materiality language. No specific facts from the IS list. Generic Boilerplate.


content_category: Risk Management Process

reasoning: The paragraph describes the company's integration of cybersecurity into its enterprise risk management program and mentions annual ERM assessments — all internal process descriptions. No named frameworks, no cybersecurity-specific roles, no firm-specific facts from the IS list; 'ADP' is a company self-reference and 'annual' is a generic cadence, both on the NOT list.

thinking:
Classify this paragraph.

Content: Describes integration of cybersecurity into ERM program, mentions ERM team conducts annual assessment. This is about internal processes.

Category: Risk Management Process - describes ERM integration, risk assessment activities.

Specificity: No named frameworks, no firm-specific facts. "Enterprise risk management" is generic. "Annual" is a generic cadence. "ADP" is a company self-reference (NOT list). No specific facts from the IS list.

→ Generic Boilerplate


reasoning: The paragraph contains an explicit materiality assessment ('cybersecurity incidents have not materially affected our business to date') and references potential impact on 'business strategy, results of operations, or financial condition,' which per Rule 6 makes this Strategy Integration. The cross-reference to Risk Factors and trailing section header ('Cyber Governance') do not change the classification. No firm-specific facts are present — the language is standard boilerplate materiality disclaimer.

thinking:
Let me analyze this paragraph.

The paragraph contains:
1. Generic language about resources devoted to security
2. A materiality assessment: "cybersecurity incidents have not materially affected our business to date"
3. Forward-looking disclaimer about future incidents
4. A cross-reference to Risk Factors
5. "Cyber Governance" appears to be a section header tacked on

The materiality assessment ("cybersecurity incidents have not materially affected our business to date" and "they will not materially affect us, including our business strategy, results of operations, or financial condition") makes this Strategy Integration per Rule 6.

Specificity: No named standards, no firm-specific facts.

The materiality language here is just standard boilerplate—nothing tailored to the company's actual situation.


content_category: Board Governance

reasoning: The paragraph describes the Board's oversight activities: receiving reports from the Committee, annual briefings from management, and presentations from the CISO and security team. The Board is the grammatical subject throughout, making this Board Governance. The CISO mention is the sole IS-list fact, yielding Firm-Specific.

thinking:
Classify this paragraph.

The paragraph discusses the Committee reporting to the Board, the Board receiving briefings from management, and board members receiving presentations from CISO/security team/external experts. The primary subject is the Board and its oversight activities.

Category: Board Governance - the Board is receiving reports, briefings, and presentations about cybersecurity.

Specificity: Let me check facts.
- CISO mentioned → cybersecurity-specific title → IS list → Firm-Specific
- "Audit Committee" equivalent ("The Committee") → generic

- "at least annually" → generic cadence
- "information security team" → not specific
- "external experts" → unnamed

Only one IS fact (CISO) and no QV-eligible facts like dates, dollar amounts, headcounts, named firms, tools, or certifications. This qualifies as Firm-Specific (3).

fact: Chief Information Security Officer (CISO)


reasoning: The paragraph describes the company's internal risk assessment methodology — identifying, assessing, and prioritizing risk through audits, tabletop exercises, penetration testing, and simulations. The Audit Committee mention is a subordinate reporting detail. No named frameworks, named firms, named tools, specific dates, or other IS-list facts are present; 'non-affiliated third party assessor' is unnamed, and practices listed are common/generic.

thinking:
Let me analyze this paragraph.

Content: Describes internal risk management processes - risk assessment, tools used (third-party assessor, internal audit, tabletop exercises, pen testing, vulnerability testing, simulations). Last sentence mentions reporting to Audit Committee.

Category: The dominant content is about the company's internal risk management processes. The Audit Committee mention is subordinate. → Risk Management Process

Specificity: Let me check facts:
- "non-affiliated third party assessor" — unnamed, NOT specific

- "internal audit team" — generic
- "tabletop exercises, penetration and vulnerability testing, and simulations" — common practices, NOT specific
- "Audit Committee of the Board of Directors" — generic governance, NOT specific
- No named frameworks, no named tools, no dates, no numbers

No IS-list facts. No named standards. → Generic Boilerplate (1)


reasoning: The paragraph describes the company's internal cybersecurity incident response procedures—detection, analysis, mitigation, prioritization, escalation criteria, and reporting protocols. Board/committee mentions are subordinate to the process description. No named frameworks, cybersecurity-specific roles, specific dates, or other IS-list facts are present; 'Audit and Finance Committee' is a standard board committee variant, and all other language (severity-based escalation, senior management reporting) is generic.

thinking:
Let me analyze this paragraph.

Content: Describes the company's cybersecurity incident response procedures - detection, analysis, mitigation, prioritization, escalation criteria, and reporting procedures.

Category: This is about internal processes - incident response procedures, escalation framework, reporting procedures. The board/committee mentions are subordinate to the process description. → Risk Management Process

Person-vs-function test: No person is the subject - it's about the program and its procedures.

Specificity: Let me check for specific facts:
- "Audit and Finance Committee" - this is a named committee. Is it non-generic? The codebook says "Audit Committee" is generic.

Looking at the variant name, "Audit and Finance Committee" is essentially the same standard committee, so I'd treat it as generic. There are no frameworks named, no specific dates, no named tools, no named roles like CISO, no specific numbers. The "incident prioritization framework" and "senior management" are both generic terms. No IS-list facts or named standards appear here. → Generic Boilerplate


content_category: Incident Disclosure

reasoning: The paragraph primarily describes a real cybersecurity incident — the March 2021 systems outage, response actions (engaging forensic firms, restoring systems), and operational disruptions (brewery operations, production, shipments). While it includes financial impact ($2.4M costs) and a cross-reference to Risk Factors, the dominant content is the incident narrative and its operational consequences. Three QV-eligible hard facts (specific month/year, dollar amount, fiscal year-end date) exceed the two-fact threshold for Quantified-Verifiable.

thinking:
Let me analyze this paragraph carefully.

Content: Describes a March 2021 cybersecurity incident - systems outage, forensic firms engaged, systems restored, business disruptions (brewery operations, production, shipments), production shift from Q1 to balance of FY2021, $2.4M incremental costs net of insurance, cross-reference to risk factors.

Category: This paragraph describes what happened (incident narrative) AND discusses financial impact ($2.4M costs, insurance recoveries, production shifts). The majority of the paragraph describes the incident itself - what happened, response actions, operational disruptions. The financial detail is one sentence. The cross-reference is noise. → Incident Disclosure

I'm spotting three concrete, verifiable facts here: the March 2021 timing, the $2.4 million cost figure, and the December 31, 2021 date - all of which qualify as quantified-verifiable data points.

fact: March 2021 (incident date)

fact: $2.4 million incremental one-time costs

type: quantified

fact: Year ended December 31, 2021


content_category: Management Role

reasoning: The paragraph is about the CISO as a person — their career history at American Express, prior experience (14 years at a pharma/biotech company), promotion to CISO in 2013, and reporting line to the CIO. This is squarely Management Role per the person-vs-function test. Two QV-eligible hard facts: specific date (2013) and specific duration (14 years).

thinking:
Let me analyze this paragraph.

Content: About the CISO - their responsibilities, background, career history, reporting line. This is clearly about the person.

Category: Management Role - the paragraph is about the CISO's background, career history, reporting line, and qualifications.

Specific facts:
- CISO (cybersecurity-specific title)
- ERMC, ORMC (named non-generic committees)
- TRIS program (named internal program with unique identifier)
- Promotion to CISO role in 2013 (specific date)

- 14 years at a pharmaceutical/biotech company (specific duration)
- Reports to Chief Information Officer (CIO - cybersecurity-specific title)

I'm identifying the quantified-verifiable facts here: the 2013 promotion date and the 14-year tenure both provide concrete, checkable information. That gives me two QV-eligible facts, which means this qualifies as Quantified-Verifiable.

fact: CISO

fact: ERMC (Enterprise Risk Management Committee)

fact: ORMC (Operational Risk Management Committee)

fact: TRIS program

fact: Promotion to CISO role in 2013

fact: 14 years at a pharmaceutical and biotechnology company

fact: Reports to Chief Information Officer (CIO)


category_confidence: medium

reasoning: The paragraph describes a cross-functional management program that evaluates cybersecurity program effectiveness and an executive security council that reviews strategy, policy, and standards enforcement. Applying the person-vs-function test, the paragraph is about what the program and council do (evaluate, review), not about any individual's credentials or background — making it Risk Management Process. The 'executive security council' is a named non-generic committee unique to ADP, triggering Firm-Specific.

thinking:
Classify this paragraph.

Content: Describes a cross-functional management program that evaluates cybersecurity program effectiveness, and an executive security council that reviews strategy, policy, etc.

Category: This is about management's role in overseeing cybersecurity. The grammatical subjects are "a cross-functional management program" and "members of the executive committee through an executive security council." This describes what management does (reviews strategy, policy, program effectiveness, etc.) - it's about the function/process, not about specific people's credentials.

Person-vs-function test: Remove any person references - the paragraph still describes processes (evaluate effectiveness, review strategy, policy, standards enforcement, cyber issue management). This leans toward Risk Management Process.

The executive security council is a named committee specific to this organization, which suggests a firm-specific fact, but the paragraph focuses on what the council does—evaluate and review—rather than individual qualifications. The person-vs-function test confirms this is about the process itself, not credentials, so it's Risk Management Process.

fact: executive security council


reasoning: The entire paragraph describes the qualifications, credentials, career history, and experience of multiple named roles (CISO, CIO, CRO). This is squarely about the persons, not the function — the person-vs-function test clearly points to Management Role. Multiple QV-eligible hard facts: specific years of experience (35, 17, 30, 30), named certification (CISM) with specific year (2005), and named organization (NACD).

thinking:
Let me analyze this paragraph from Associated Banc-Corp's 10-K filing.

This paragraph is entirely about the people - their qualifications, credentials, experience, career history. This is clearly Management Role.

Specific facts:
- CISO: 35 years experience, 17 years at Associated Bank, undergraduate degree in MIS, CISM certification in 2005
- CIO: undergraduate degree in business management, pursuing master's in cybersecurity, 30 years experience, CTO/CIO of four public companies

- CRO: 30 years banking experience, degree in computer science, CERT Certificate in Cybersecurity Oversight from NACD

I'm identifying the quantified and verifiable facts across all three executives - multiple decades of experience, specific certifications like CISM and CERT, and named organizations like NACD. This clearly qualifies as Quantified-Verifiable with well over 2+ QV facts present.

fact: CISO has over 35 years of experience in IT and Information Security

fact: CISO served as CISO at Associated Bank for 17 years

fact: CISO holds CISM certification obtained in 2005

fact: CIO has over 30 years in information technology

fact: CRO has over 30 years of banking experience

fact: CRO earned CERT Certificate in Cybersecurity Oversight from National Association of Corporate Directors


reasoning: The paragraph describes BD's internal cybersecurity policies, framework alignment, and certification activities — squarely Risk Management Process. It contains multiple QV-eligible hard facts: specific dates (2022 certification, 2025 audit) plus the certification claim itself, easily exceeding the two-fact threshold for Quantified-Verifiable.

thinking:
Let me analyze this paragraph carefully.

Content: Describes BD's alignment with multiple frameworks and standards, certification achievements, and audit activities. This is about the company's internal cybersecurity processes and framework adoption.

Category: Risk Management Process - describes framework adoption, policies, procedures, certification, audits.

Specific facts:
- NIST Cybersecurity Framework 2.0 (framework)
- ISO/IEC 27001:2022 (framework)
- UL 2900-1 Cybersecurity Standard for Medical Devices (framework)

- FDA pre-market/post-market guidance, Section 524B FD&C Act (framework/regulation)
- HSCC Joint Security Plan (JSP) 2.0 (framework)
- ISO/IEC 27001:2022 certification achieved in 2022
- Third-party audit engagement in 2025
- BD Information Security Management System (ISMS) as their named internal program

QV-eligible facts:
- Specific date: 2022 (certification achieved)
- Specific date: 2025 (audit)
- Named frameworks are not QV-eligible

The two specific dates give me two hard verifiable facts that qualify as Quantified-Verifiable.

fact: NIST Cybersecurity Framework 2.0

type: framework

fact: FDA pre-market/post-market guidance under Section 524B of the FD&C Act

fact: Healthcare Sector Coordinating Council (HSCC) Joint Security Plan (JSP) 2.0

fact: In 2022, BD achieved ISO/IEC 27001:2022 certification at the enterprise level

fact: In 2025, BD engaged a third-party auditor for its third annual surveillance audit


reasoning: The paragraph identifies the CIO and SDIS roles, their reporting lines, and then focuses on the SDIS's qualifications — 15+ years of experience, CISSP and CISM certifications, and degree. While responsibilities are mentioned, the primary content is about who the person is and what makes them qualified (person-vs-function test favors Management Role). Three QV-eligible hard facts: specific years of experience, CISSP, and CISM certifications.

thinking:
Let me analyze this paragraph.

The paragraph discusses the CIO and SDIS (Senior Director of Information Security) roles, their reporting lines, responsibilities, and qualifications.

Content Category: The paragraph starts with reporting structure (CIO reports to CEO, SDIS reports to CIO), then describes responsibilities, then focuses on the SDIS's experience, certifications, and education. The person-vs-function test: the paragraph describes both what the SDIS does (processes, policies) AND who they are (experience, certifications, degree). The latter half is clearly about the person's qualifications. The responsibilities section is mixed, but the overall paragraph spends significant text on the person's credentials (15 years experience, CISSP, CISM, degree in IT management).

This looks like a Management Role classification since it's primarily identifying the person in the role and their qualifications. The key facts I'm tracking are the cybersecurity-specific titles (CIO and SDIS), the reporting structure flowing up to the CEO, and the person's credentials—15 years of experience, CISSP and CISM certifications, and an IT management degree. The experience and certifications are what qualify as QV-eligible facts here.

So I'm counting three hard verifiable facts that make this Quantified-Verifiable.

fact: CIO oversees cybersecurity

fact: SDIS (Senior Director of Information Security) reports to CIO

fact: Over 15 years of experience managing IT and cybersecurity

fact: CISSP certification

fact: CISM certification


reasoning: The paragraph describes how management monitors cybersecurity risks through briefings, threat intelligence, and security tools. Although the CISO and Sr. Director of Information Security are named, they serve as attribution for who leads the monitoring function — the substantive content is about the processes (prevention, detection, mitigation, remediation, threat intelligence, security tool alerts). Removing the role titles, the paragraph still describes monitoring processes, passing the person-vs-function test toward Risk Management Process. Two cybersecurity-specific roles from the IS list yield Firm-Specific; neither counts toward QV, so it does not reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

The paragraph describes what the management team does - monitors prevention, detection, mitigation, remediation through various means. The CISO and Sr. Director of Information Security are mentioned as leading the team, but the paragraph is about what they DO (monitor, get briefings, use threat intelligence, get alerts from security tools) - this is about the function/process, not about the persons' qualifications or background.

Person-vs-function test: Remove "led by our CISO and Sr. Director of Information Security" - the paragraph still describes how the management team monitors cybersecurity through briefings, threat intelligence, and security tools.

So this is fundamentally about the process. The CISO and Sr. Director of Information Security are cybersecurity-specific titles that appear on the IS list, and since they're named roles mentioned here, that makes this Firm-Specific. There are no quantifiable details like dates, amounts, headcounts, or specific tool names that would add to the QV score.

fact: CISO

fact: Sr. Director of Information Security


reasoning: The paragraph primarily describes a specific cybersecurity incident — its date, response actions, operational disruption duration, and financial impact — making it Incident Disclosure. The final materiality sentence is secondary to the dominant incident narrative. Multiple hard verifiable facts (specific date, two dollar-range figures, specific duration) easily meet the QV threshold.

thinking:
Let me analyze this paragraph carefully.

Content: Describes a specific cybersecurity incident (June 13, 2023), response actions, operational impact (9 days), financial impact ($80-85M lost revenue, $35-40M operating earnings), plus a materiality assessment at the end.

Category: This is primarily about an incident - it describes what happened, when, response actions, and the financial impact. The last sentence is a materiality disclaimer, but the dominant content is the incident narrative with financial quantification. The financial figures describe the cost/impact of the incident, which per the tiebreaker rules: "Paragraph DESCRIBES what happened in an incident (dates, access, encryption, scope, response actions) → Incident Disclosure." But also: "Paragraph ONLY discusses financial cost, insurance, or materiality of an incident WITHOUT describing the event → Strategy Integration."

The paragraph weaves together the incident narrative with its financial consequences, making them inseparable. The timeline, response actions, and duration form the core, with the financial figures serving as quantification of that impact rather than standalone analysis. The materiality statement is just a closing note. This clearly falls under Incident Disclosure since the event description is what drives the content.

Now I'm checking the specificity—there are four concrete, verifiable facts here: the exact date of June 13, 2023, the revenue loss range of $80-85M, the operating earnings impact of $35-40M, and the nine-day duration. That's well above the threshold for Quantified-Verifiable classification.

fact: lost revenue of approximately $80 million to $85 million

fact: operating earnings of $35 million to $40 million

fact: nine days to resume normal operations


reasoning: The paragraph's primary communicative purpose is an explicit materiality assessment ('have not identified risks...that have materially affected or are reasonably likely to materially affect us, including our operations, results of operations, or financial condition'). The brief acknowledgment of past incidents is subordinate to the materiality conclusion, and the cross-reference to Risk Factors does not change the classification per Rule 6. No named standards, firm-specific facts, or hard verifiable details are present—the language is boilerplate materiality disclosure.

thinking:
Let me analyze this paragraph.

It acknowledges past incidents briefly, then makes a materiality assessment, then points to risk factors. The dominant purpose is the materiality assessment - "have not materially affected or are reasonably likely to materially affect us." Per Rule 6, materiality disclaimers → Strategy Integration. The cross-reference doesn't change this.

Specificity: No named standards, no firm-specific facts from the IS list. The language is boilerplate materiality. → Generic Boilerplate.


reasoning: The paragraph describes the company's internal cybersecurity program — risk assessment methodology, policies, procedures, and controls — squarely fitting Risk Management Process. It contains no named frameworks, no named roles (only generic "management"), no specific dates, tools, or quantified details; "annually" is a generic cadence. Every sentence could be pasted into any company's filing unchanged.

thinking:
Let me analyze this paragraph.

Content: Describes the company's internal cybersecurity program - risk assessment, policies, procedures, controls. No specific person, no board, no vendors, no incident, no materiality assessment.

Category: Risk Management Process - clearly about internal processes.

Specificity: No named frameworks, no named roles (just "management" which is generic), no specific dates, no named tools, no numbers. "Annually" is a generic cadence. Everything here is generic boilerplate.


reasoning: The paragraph describes the Board of Directors' oversight of cybersecurity risk and delegation to the Audit Committee, with the board/committee as the grammatical subject. No firm-specific facts are present — 'Board of Directors' and 'Audit Committee' are generic governance structures per the NOT list.


reasoning: The paragraph's primary communicative purpose is describing the management committee structure responsible for cybersecurity oversight — ORMC, ERMC, their chairs, escalation paths, and reporting channels. The grammatical subjects are management committees, and the content focuses on organizational structure and reporting lines rather than processes/tools (which would be RMP) or board-level oversight (which would be Board Governance). Multiple named non-generic committees (ORMC, ERMC) with unique identifiers establish Firm-Specific, but no QV-eligible hard facts (dates, dollar amounts, named third-party firms, named tools) reach the two-fact threshold for Quantified-Verifiable.

thinking:
Let me analyze this paragraph from American Express's 10-K filing.

Content Category: This paragraph describes management committees responsible for cybersecurity risk oversight. The grammatical subjects are management committees (ORMC, ERMC). It describes their roles, governance structure, and reporting/escalation processes. This is about management's role in cybersecurity oversight - the committees, their chairs, and how they operate.

Actually, let me think more carefully. The paragraph describes:
- Internal management committees overseeing cyber risk
- ORMC chaired by Chief Operational Risk Officer - oversight of infosec risk management
- Activities: identify, measure, manage, monitor, report

- Escalation to ERMC (chaired by Chief Risk Officer) or Board
- Reporting channels for management

The primary actors are management committees. This is about the management structure for cybersecurity oversight. The person-vs-function test: this is about the organizational structure and committees, not about individual persons' credentials. But it's also not purely about processes/tools - it's about WHO oversees.

Management Role covers "management committees responsible for cybersecurity." The key markers include "management committee." The paragraph is about the management committee structure and reporting lines, not about individual qualifications. This fits squarely within Management Role since it's describing the organizational hierarchy and escalation pathways for cybersecurity governance.

Looking at the specificity markers: ORMC and ERMC are named non-generic committees, and the Chief Risk Officer is identified by role title. There are no QV-eligible facts like dates, dollar amounts, or named third-party vendors. This is clearly a Management Role classification - the content centers on committee structure, reporting lines, and escalation procedures rather than individual credentials or operational processes.

fact: Operational Risk Management Committee (ORMC)

fact: Enterprise Risk Management Committee (ERMC)

fact: Chief Operational Risk Officer chairs ORMC

fact: Risk Committee receives annual report


reasoning: The paragraph describes how board-level committees (Audit Committee, QRC) receive cybersecurity updates and how incidents are escalated to the Board — the communicative purpose is the board's oversight information flow. While CIO/CISO/VP are grammatical subjects, they act in service of describing the board's oversight mechanisms, and the second sentence explicitly frames board-level escalation processes. Multiple cybersecurity-specific roles (CIO, CISO, VP of Product Security) and a named non-generic committee (QRC) provide firm-specific facts, but none are QV-eligible (no dates, dollar amounts, headcounts, named firms, or named tools).

thinking:
Let me analyze this paragraph.

Content: Describes CIO, CISO providing updates to Audit Committee, VP of Product Security to QRC, multiple times per year. Topics include cybersecurity risk management, third-party assessments, etc. Also mentions escalation processes to the Board.

Category: The primary actors are CIO/CISO/VP reporting TO board committees. The board/committees are receiving the updates. The paragraph is about the flow of information to the board - briefing cadence and topics. Per Rule 2: "Management role reports TO the board" → Management Role. But wait - the frame is about the Audit Committee and QRC receiving updates. Let me re-read.

The grammatical subjects are the management roles providing updates, but I'm noticing the real focus here is on the board's oversight mechanisms—how the committees stay informed about cybersecurity matters. There's a tension between treating this as a management reporting activity versus a board governance structure, and the communicative intent seems to lean toward the latter.

Looking at the second sentence about escalation processes reinforces this: the paragraph is fundamentally describing how information flows to the board and board committees, not just what management does. The tiebreaker tips toward Board Governance since the board's information channels are the main point, even though management roles are the grammatical subjects.

For specificity, the CIO, CISO, and VP of Product Security are all cybersecurity-specific titles that count as IS facts, and the QRC appears to be a named committee rather than a generic one.

Checking against QV criteria: these are all named roles and committees, not quantifiable facts like dates, dollar amounts, or headcounts. With multiple IS facts but no QV-eligible facts reaching the threshold of two, this lands in Firm-Specific.

fact: CIO

fact: VP of Product Security

fact: QRC (Quality and Regulatory Committee)


specificity_confidence: medium

reasoning: The paragraph describes an internal process — annual review of the Cybersecurity Policy — making it about the function, not about any person's credentials. The named departmental composition (Information Security team + Legal Department) provides a firm-specific organizational detail beyond generic boilerplate, but no named frameworks or multiple hard verifiable facts are present.

thinking:
Classify this paragraph.

Content: The Information Security team, with Legal Department support, annually reviews the Cybersecurity Policy.

Category: This is about an internal process (reviewing a policy). The Information Security team is mentioned but as a team performing a function, not about a person's credentials. → Risk Management Process.

Specificity: Let me check facts:
- "Information Security team" - this is a specific team/department composition? It's a named team but fairly generic. Actually, looking at the IS list: "Specific team/department compositions: 'Legal, Compliance, and Finance'" - The paragraph mentions "Information Security team, with support from our Legal Department" - this names specific departments involved.

The composition of "Information Security team" plus "Legal Department" does match the pattern of specific departmental combinations like those on the IS list, so this qualifies as Firm-Specific (3). Though "Information Security team" itself is a fairly standard title, the named collaboration between these two departments makes it specific enough. "Cybersecurity Policy" and "annually" are both generic descriptors, but the departmental composition is what pushes this toward firm-specific classification.

fact: Information Security team with Legal Department support (specific departmental composition)


reasoning: The paragraph describes the company's own internal processes for evaluating and maturing its cybersecurity program — self-evaluations, vulnerability management, audits, and external assessments. Third parties (DCMA, CMMC assessors) are mentioned as components serving the company's assessment needs, not as vendor oversight. Contains firm-specific facts (named InfoSec team, named external evaluator DCMA, CMMC/DoD RMF frameworks) but only one QV-eligible hard fact (DCMA as a named external organization), so it does not reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes how the company evaluates and improves its cybersecurity program - self-evaluations, monitoring, vulnerability management, audits, third-party maturity assessments, and external evaluations by DCMA and CMMC assessors. Also mentions DoD risk management framework compliance.

Category: This is about the company's own internal processes for assessing and improving their cybersecurity program. Third parties are mentioned but as components serving the company's assessment needs. → Risk Management Process

Specific facts:
- "InfoSec" - this is a named internal team/department (firm-specific)

- "DCMA" (U.S. Defense Contract Management Agency) - a named government agency conducting external evaluations
- "CMMC" (Cybersecurity Maturity Model Certification) - a named standard and assessment framework
- "DoD risk management framework" - a named compliance framework

For QV purposes, DCMA counts as a named external organization even though it's governmental rather than commercial, and both CMMC and DoD RMF are named frameworks that factor into their assessment approach. CMMC is a framework so it doesn't count toward QV—that's Sector-Adapted territory. DCMA as a named external organization is my one QV-eligible fact, which puts this at Firm-Specific level with multiple firm-specific details but just that single QV fact.

fact: InfoSec team regularly assesses program effectiveness

fact: U.S. Defense Contract Management Agency (DCMA) evaluates their program

fact: CMMC Third Party Assessment Organization evaluates their program

fact: Cybersecurity Maturity Model Certification (CMMC)

fact: DoD risk management framework


reasoning: The paragraph contains an explicit materiality assessment ('have not materially affected us, including our business strategy, results of operations or financial condition'), making it Strategy Integration per Rule 6. The appended cross-reference to Risk Factors does not change the classification. No firm-specific facts from the IS list are present — the language is standard boilerplate materiality disclaimer.

thinking:
Classify this paragraph.

This contains a materiality assessment ("have not materially affected us, including our business strategy, results of operations or financial condition") → Strategy Integration per Rule 6.

Specificity: No named standards, no firm-specific facts from the IS list. The cross-reference to a specific heading name is just a company self-reference. → Generic Boilerplate.


reasoning: The paragraph primarily narrates an actual cybersecurity incident — the November 2022 attack, its operational impact, PII exposure, containment/response actions, and resulting litigation. While insurance coverage and litigation outcomes are mentioned, the dominant communicative purpose is describing what happened and the company's response. Multiple QV-eligible hard facts: specific dates (November 2022, January 2024), specific count (5 lawsuits), and named court venue.

thinking:
Let me analyze this paragraph from 1st Franklin Financial Corp's 10-K filing.

This paragraph describes a specific cybersecurity incident from November 2022, including details about the attack, its impact, response actions, litigation, and insurance coverage.

Content Category: This is primarily about an actual cybersecurity incident - what happened, when, scope, response. There's also litigation and insurance info, but the dominant content is the incident narrative.

Actually, let me reconsider. The paragraph covers:
- Incident description (November 2022 attack, affected operations, PII access)
- Response actions (contained, restored, notifications)

- Remediation efforts
- Litigation details (five lawsuits filed in the Northern District of Georgia, later consolidated and dismissed in January 2024)
- Insurance coverage

The dominant content is the incident narrative and its aftermath. The litigation and insurance are consequences but the paragraph is primarily describing what happened. → Incident Disclosure

Specificity:
- "November 2022" - specific date
- "five (5) putative class action lawsuits" - specific number
- "United States District Court in the Northern District of Georgia" - named court
- "January 2024" - specific date
- PII of employees, customers, investors - specific scope

QV-eligible facts: November 2022 (specific date), January 2024 (specific date)

The five lawsuits represent quantified, verifiable facts that meet the threshold for Quantified-Verifiable classification.

fact: November 2022 cyber-attack

fact: Five (5) putative class action lawsuits

fact: January 2024 administrative dismissal


reasoning: The paragraph describes Humana's internal cybersecurity processes — risk assessments, external assessor engagement, and compliance with laws — making it Risk Management Process. No named frameworks, firms, tools, dates, specific roles, or other IS-list facts are present; 'independent auditor or other external assessors' is unnamed, 'Federal and state laws' names no specific regulation, and 'at least annually' is a generic cadence.

thinking:
Let me analyze this paragraph.

Content: Describes internal cybersecurity processes - risk-based approach, risk assessments, engaging external assessors, compliance with laws. The external assessors serve the company (Rule 3). This is about the company's own internal processes.

Category: Risk Management Process

Specificity: No named frameworks, no named firms, no specific dates, no specific roles. "Independent auditor or other external assessors" is unnamed. "Federal and state laws" - no specific laws named. "At least annually" is generic cadence. "Protected health information and personally identifiable information" - generic terms. No IS-list facts found.

This looks like generic boilerplate language.


reasoning: The paragraph describes Ford's internal incident response processes — triage, escalation criteria, management committee involvement, and reporting chain. The CISO and Chief Enterprise Technology Officer are mentioned as part of the escalation workflow, not to describe their qualifications or background; applying the person-vs-function test, the paragraph is about the process, not the people. Two cybersecurity-specific roles (CISO, CETO) place this at Firm-Specific, but named roles are not QV-eligible so it does not reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph from Ford Motor Co's 10-K filing.

Content: Describes incident response processes - triage, management committees, third-party advisors, escalation chain (CISO → CETO and General Counsel).

Category: This is about the company's internal incident response processes. The CISO, CETO, and General Counsel are mentioned but as part of describing the escalation process, not about the persons themselves. Person-vs-function test: remove the titles and it still describes an IR process. → Risk Management Process

Specificity:

I'm identifying the roles mentioned here - CETO and CISO are cybersecurity-specific titles that are firm-specific, but named roles don't qualify toward the QV threshold. The other elements like management committees and third-party advisors are too generic, and there are no quantifiable facts like dates, dollar amounts, or headcounts present.

fact: Chief Enterprise Technology Officer

fact: Chief Information Security Officer


reasoning: The Board and Audit Committee are the grammatical subjects throughout, delegating oversight and receiving updates — classic Board Governance. Two cybersecurity-specific leadership titles (CIDO, Senior Director Global IT Security) are firm-specific facts, but named roles don't count toward QV, so this stays at Firm-Specific.

thinking:
Let me analyze this paragraph.

Content: Board delegates cyber oversight to Audit Committee, quarterly updates, full board gets periodic updates from CIDO or Senior Director, Global IT Security.

Category: Board Governance - the board and Audit Committee are the primary subjects performing oversight actions.

Specificity: Let me check for specific facts.
- "Audit Committee" - NOT list (generic governance)
- "CIDO" - This is a cybersecurity-specific title (Chief Information Digital Officer?) - IS list
- "Senior Director, Global IT Security" - This is a cybersecurity-specific title - IS list
- "quarterly" - NOT list (generic cadence)

The two named roles here—CIDO and Senior Director, Global IT Security—are firm-specific positions, but since named roles don't qualify for QV eligibility, this falls into the Firm-Specific category.

fact: CIDO (Chief Information and Digital Officer)

fact: Senior Director, Global IT Security


reasoning: The paragraph briefly references the 2017 incident in one sentence, then pivots to hypothetical future compromises and their potential consequences (litigation, regulatory fines, material adverse effect on financial condition). The dominant communicative purpose is assessing potential business/financial impact of cyber risk, fitting 'brief mention of a past incident + materiality/impact language as the main point → Strategy Integration.' The specific year 2017 is one hard verifiable fact, yielding Firm-Specific.

thinking:
Let me analyze this paragraph from Equifax's 10-K Item 1C filing.

The paragraph references the 2017 incident briefly, then shifts to hypothetical future compromises and their potential consequences. The dominant purpose is discussing potential business/financial impact of cyber risks.

The 2017 incident reference is brief - one sentence. The rest is hypothetical risk language about future incidents and their potential material adverse effects.

This is a mix: brief incident reference + strategy/materiality language. Per the tiebreakers: "Brief mention of a past incident + materiality conclusion as the main point → Strategy Integration."

Actually, I need to reconsider the materiality language here. It's forward-looking and hypothetical ("could have a material adverse effect") rather than an explicit assessment of past events. This reads more like standard risk factor language discussing potential future business impact. The materiality language isn't assessing whether past incidents have materially affected the company, but rather whether hypothetical future compromises could materially affect it. That distinction matters for the classification.

Looking at the dominant content, it's really about potential financial consequences—litigation, fines, material adverse effects on the business. The 2017 incident is just context. This fits Strategy Integration because it's explicitly connecting cyber risk to business and financial impact.

On specificity, I see one hard fact: the 2017 date. The reference to specific geographies (U.S., Canadian, U.K. consumers) is somewhat specific but not a verifiable fact from the QV list. With just one concrete fact, this would be Firm-Specific.

fact: In 2017 (specific date of referenced incident)


reasoning: The paragraph's framing and dominant content describe the company's cybersecurity risk management program — what it includes (technical controls, policy enforcement, monitoring, training, third-party services) and how it fits into ERM. The CTO/CISO mentions serve as attribution for who runs the program rather than being about the persons themselves, though the CTO experience sentence is a Management Role element making this a borderline case. Applying the person-vs-function test: removing titles and credentials, the paragraph still describes a coherent process. Specificity is Firm-Specific: CTO and CISO are cybersecurity-specific roles (IS-list items), and 'over twenty years' is one QV-eligible fact, but only one hard verifiable fact prevents reaching Quantified-Verifiable.

thinking:
Let me analyze this paragraph carefully.

Content Category: This paragraph describes the cybersecurity risk management program but also mentions the CTO and CISO roles. Let me apply the person-vs-function test.

The paragraph mentions:
- CTO oversees CISO and a dedicated team
- CTO oversees efforts to prevent, detect, mitigate, remediate
- The program includes technical controls, policy enforcement, monitoring, training, contractual arrangements, tools, third-party services
- CTO has over twenty years of experience

The bulk of the paragraph describes what the program does and what the CTO oversees (processes). But there's also credential info about the CTO ("over twenty years of extensive experience").

Looking at the structure more carefully, I see the paragraph is primarily focused on the risk management process itself—what it encompasses and how it operates—with the CTO and CISO mentioned as the people responsible for overseeing it. The experience credential is just one sentence at the end, so while there's a Management Role element present, the dominant content is really about the program's components and processes rather than the individuals running it. The management elements are actually more prominent than I initially thought—three out of five sentences focus on the CTO's oversight role, reporting structure, and qualifications. But applying the person-vs-function test, the core content still describes a cybersecurity program with specific controls and processes, even if I strip away the titles and credentials. This is genuinely borderline, though I'm leaning toward Risk Management Process as dominant since the paragraph frames itself around describing the program rather than the people running it.

Looking at what qualifies as a QV-eligible fact: the "over twenty years of experience" is specific enough, but CTO and CISO are just named roles that don't count toward the threshold. That leaves me with one QV-eligible fact, which means this doesn't meet the Q classification.

Since there are IS facts present—the cybersecurity-specific titles and credentials—I'm classifying this as Firm-Specific.

fact: Chief Technology Officer (CTO)

fact: Chief Information Security Officer (CISO)

fact: CTO has over twenty years of experience


reasoning: The paragraph's primary communicative purpose is explaining the board's governance choice — the full Board oversees risk management rather than delegating to a specific committee. The CRO's reporting line to the Board is subordinate detail supporting the board oversight structure. No cybersecurity-specific titles appear (Chief Risk Officer is a general corporate role, not on the IS list), no named frameworks, dates, or other specific facts — all references are generic governance language.

thinking:
Let me analyze this paragraph.

The paragraph discusses both board oversight and management roles. The board is mentioned as responsible for overseeing risk management, and the Chief Risk Officer (CRO) is described with reporting lines.

Key question: Is the primary subject the board or management?

The paragraph starts by explaining the board's approach (no specific committee, full board oversees), then shifts to the CRO's role and reporting. The opening frame is about the board's governance structure choice. But the CRO is the subject for most sentences.

Wait - "Chief Risk Officer" is NOT on the cybersecurity-specific titles list (CISO, CTO, CIO, VP of IT/Security, etc.).

The CRO is a general corporate role handling broad risk management rather than cybersecurity specifically. Even though this appears in Item 1C, the focus is on the board's decision to keep risk oversight at the full board level rather than delegating to a committee, with the CRO reporting directly to that board structure. This is fundamentally about how the board has organized its governance model.

Looking at the specifics: the board of directors, the chief risk officer, and internal audit are all generic corporate functions without any cybersecurity-specific details, frameworks, dates, numbers, or named firms. Once I filter out the generic governance language, there's nothing substantive left—this is boilerplate disclosure.


reasoning: The paragraph describes the company's cybersecurity risk management processes through a bulleted list of program components (risk assessments, incident response team, incident response plan, third-party providers). The CISO mention is one bullet in a list of process elements — applying the person-vs-function test, the paragraph is about what the program includes, not about the person's credentials. One QV-eligible fact (25 years of experience) plus one IS-list fact (CISO title) yields Firm-Specific but not Quantified-Verifiable (needs two QV-eligible facts).

thinking:
Let me analyze this paragraph.

Content: Describes processes for assessing, identifying, and managing cybersecurity risks. Lists bullet points including CISO role, risk assessment, incident response team, incident response plan, and third-party providers.

Category: This is primarily about the company's internal cybersecurity processes. The CISO is mentioned but as part of a list of process components - the person-vs-function test says this is about what the program includes, not about the person. → Risk Management Process

Specificity:
- CISO with "over 25 years of experience" → named cybersecurity role (IS list) + specific number (QV-eligible: "over 25 years")

- The "over 25 years" qualifier is a specific number that counts as QV-eligible, while the CISO role itself is on the IS list but doesn't independently qualify for QV. So I'm looking at one QV-eligible fact here.

→ Firm-Specific (CISO role + 25 years experience, with one QV-eligible hard fact)

fact: over 25 years of experience


reasoning: The paragraph describes the company's internal cybersecurity processes — automated monitoring, incident response policy, team structure, and security awareness training. The VP of Infrastructure and Security is mentioned as attribution for who oversees the policy, but the substantive content is about processes and procedures (person-vs-function test: remove the title and the paragraph still describes the program). Two IS-list facts (cybersecurity-specific VP role and specific departmental composition) establish Firm-Specific, but neither qualifies as QV-eligible.

thinking:
Let me analyze this paragraph.

Content: Describes internal cybersecurity processes - monitoring, incident response policy, team composition, training. The VP Infrastructure is mentioned but the paragraph is about what the program does, not about the person.

Category: Risk Management Process. The paragraph describes internal processes (monitoring, incident response policy, training). The VP Infrastructure is mentioned as attribution. Applying the person-vs-function test: remove the VP title and the paragraph still describes processes.

Specificity: Let me check for specific facts:
- "Vice President of Infrastructure and Security" - this is a cybersecurity-specific title → IS list ✓

- "Incident Response Policy" - generic program name → NOT list
- "members from legal, human resources, finance" - specific team/department compositions → IS list ✓
- "Information Technology team" - generic
- "periodic information security awareness training" - generic practice

So I have two IS facts: VP of Infrastructure and Security (cybersecurity-specific role) and specific departmental composition (legal, human resources, finance). For QV: VP role is named_role (not QV-eligible). Department composition is not QV-eligible. No dates, dollar amounts, headcounts, named firms, named tools, named certifications. So not QV.

Looking at the firm information, I'm seeing three specific items to evaluate.

fact: Vice President of Infrastructure and Security ("VP Infrastructure")

fact: Incident Response team may consist of members from legal, human resources, finance or other functions


reasoning: The paragraph contains an explicit materiality assessment ('has not been materially affected by a cybersecurity breach') and forward-looking language about potential material effects on business strategy, results of operations, and financial condition — making it Strategy Integration per Rule 6. The extensive cross-references to Item 1A Risk Factors do not change the classification since a materiality conclusion is present. No firm-specific facts from the IS list appear; the language is boilerplate materiality and generic risk factor titles.

thinking:
Let me analyze this paragraph from Lincoln National Corp's 10-K filing.

The paragraph contains:
1. A materiality assessment: "has not been materially affected by a cybersecurity breach"
2. Forward-looking risk language about potential material effects
3. Multiple cross-references to Item 1A Risk Factors

Per Rule 6 and the codebook, any paragraph with an explicit materiality assessment is Strategy Integration, even with cross-references appended.

Specificity: The materiality assessment is boilerplate. No named frameworks, no firm-specific facts from the IS list. The cross-references are to generic risk factor titles. → Generic Boilerplate.


reasoning: Despite the 'Role of Management' header, the paragraph describes what the program does (three lines of defense model, monitoring, assessing, responding) rather than who the person is (no credentials, no named roles, no reporting lines). Applying the person-vs-function test: removing 'Management' and replacing with 'the Company' still makes sense. The 'three lines of defense' is a common governance concept, not a named framework or firm-specific fact.


reasoning: The paragraph describes an actual cybersecurity incident: unauthorized network access, encryption of applications, and file exfiltration, along with immediate response actions. This is squarely Incident Disclosure. The specific date (February 3, 2025) is the only hard verifiable fact; 'third-party cybersecurity experts' is unnamed (NOT list) and 'incident response plan' is a generic program name, so only one QV-eligible fact exists, yielding Firm-Specific rather than Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes a specific cybersecurity incident - date, what happened, response actions. This is clearly Incident Disclosure.

Specific facts:
- "February 3, 2025" - specific date
- "encrypted critical applications" - describes what happened but not a named tool
- "exfiltrated certain files" - generic
- "third-party cybersecurity experts" - unnamed, NOT list
- "Cyber Incident" - named internal program with unique identifier? It's just a label for the incident.

QV check: Only one hard verifiable fact (the specific date).

The third-party experts aren't named, and there are no specific firm names, tools, or dollar amounts mentioned. "Incident response plan" is just a generic program name, and "Cyber Incident" is simply how they're labeling the event itself. With only that one concrete date to verify, this falls into Firm-Specific at Level 3.

fact: February 3, 2025


reasoning: The paragraph names CIO and CISO roles but the vast majority of content describes what the InfoSec program encompasses — its components (Cyber Fusion Center, Infrastructure Security, IAM, etc.), governance committees, framework alignment, training, and tools. Removing the role titles, the paragraph still reads as a comprehensive process description, so it fails the person-vs-function test for Management Role. Multiple firm-specific facts (named committees, Cyber Fusion Center, CISO/CIO roles) but no two QV-eligible hard facts (no dates, dollar amounts, headcounts, named third-party firms, or named products).

thinking:
Let me analyze this paragraph from IFF's 10-K filing.

This is a dense paragraph covering multiple topics. Let me identify the dominant category.

The paragraph describes:
1. CIO's responsibilities (brief)
2. CISO leads InfoSec under CIO guidance - reporting structure
3. Detailed description of what InfoSec includes (Cyber Fusion Center, Infrastructure Security, network segmentation, firewalls, IDS/IPS, IAM, Application Security, Data Security, InfoSec GRC)

4. InfoSec Steering Committee and InfoSec Governance Review Board
5. Alignment to NIST CSF
6. Employee training program
7. Security tools used

The person-vs-function test shows that while the CIO and CISO are mentioned, the bulk of the content focuses on what the program does—its structure, components, frameworks, committees, training, and tools. Even without the titles, this reads as a process and program description. So this falls under Risk Management Process.

For specificity, both CIO and CISO are cybersecurity-specific titles according to the codebook, making them IS facts.

Now I'm checking what counts as QV-eligible. Named roles, committees, frameworks, and internal programs don't qualify. There are no specific dates, dollar amounts, headcounts, named third-party vendors, named products, or individual certifications mentioned. The tools referenced are generic categories rather than named products. So I'm looking at multiple IS facts here, but nothing that pushes toward QV.

fact: CIO responsible for IT strategy including cybersecurity

fact: CISO leads Information Security under CIO guidance

fact: Cyber Fusion Center

fact: InfoSec Steering Committee comprised of senior leaders from all corporate functions and business units

fact: InfoSec Governance Review Board comprised of IT and InfoSec leadership

fact: ERM Committee

fact: NIST Cybersecurity Framework


reasoning: The paragraph describes the company's own internal cybersecurity processes — assessments, audits, third-party expertise, threat intelligence, and employee training. This is squarely Risk Management Process. The acronym 'CIST' is a named internal team with a distinguishing identifier unique to this company, qualifying as Firm-Specific, but there is only one such fact so it does not reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes internal audits, third-party expertise, threat intelligence feeds, a team called "CIST", employee training. This is about the company's own internal cybersecurity processes.

Category: Risk Management Process - describes internal processes, assessments, testing, training.

Specific facts:
- "CIST" - this appears to be a named internal team/program with a unique identifier (Cybersecurity Incident... Something Team?)

Wait, let me re-read: "supplement and enhance our CIST of cybersecurity professionals" - CIST seems like a named internal team acronym.

So CIST is the only specific named element here—everything else like third-party expertise, threat intelligence feeds, and training programs are generic references. That makes CIST firm-specific, but since there's just one concrete fact, this doesn't qualify as QV.

fact: CIST (named internal cybersecurity team with unique identifier)


reasoning: The paragraph's primary communicative purpose is to describe the governance chain through which cybersecurity risk oversight flows up to the Board Risk Committee, which is identified as 'primarily responsible for overseeing risk management, including risks associated with cybersecurity.' While management reporting lines (CISO → CRO → Risk Management Council) are detailed, they serve to explain how information reaches the board-level oversight body. Specificity is Firm-Specific due to the CISO role, the named Board Risk Committee (non-generic), and the Risk Management Council, but no QV-eligible hard facts (dates, dollar amounts, headcounts, named firms/tools) are present.

thinking:
Let me analyze this paragraph carefully.

The paragraph describes:
1. Information Security Department reports to CISO, then to Chief Risk Officer
2. Results reported to Risk Management Council quarterly, shared with Board Risk Committee
3. Board Risk Committee oversees risk management including cybersecurity
4. Chief Risk Officer reports to Risk Management Council (comprised of senior leadership)
5. Cross-reference to MD&A

This paragraph covers reporting lines, committee structures, and oversight. It's a mix of management reporting structure and board governance. Let me apply the tiebreaker rules.

The paragraph has multiple subjects: Information Security Department, Board Risk Committee, Chief Risk Officer.

The Board Risk Committee is described as "primarily responsible for overseeing risk management, including risks associated with cybersecurity." But there's also significant management reporting structure content.

The dominant theme seems to be the reporting chain from management up to the board. The Board Risk Committee is mentioned as the oversight body, but much of the paragraph is about the reporting structure - how information flows from the Information Security Department → CISO → CRO → Risk Management Council → Board Risk Committee.

Looking at Rule 2: Board vs Management - The Board Risk Committee is mentioned but the paragraph spends more text on the management reporting chain. The grammatical subjects are mixed. This is primarily about the organizational structure and reporting lines rather than purely board oversight or purely management credentials. The paragraph traces the flow of cybersecurity information and oversight responsibilities through multiple layers, from the security department up through executive leadership to board-level governance. structure and how cybersecurity risk information flows. The Board Risk Committee gets a sentence about being primarily responsible. But the CISO, CRO, Risk Management Council, and their reporting relationships take up more space.

Given the person-vs-function test: this isn't about any person's credentials - it's about organizational structure and reporting. But it's not really about processes/tools either. It's about governance structure.

The primary actor shifts. Let me look at what dominates:
- Sentence 1: Info Security Dept → CISO → CRO (management reporting chain)
- Sentence 2: Results reported to Risk Management Council quarterly, shared with Board Risk Committee
- Sentence 3: Board Risk Committee oversees risk management
- Sentence 4: CRO reports to Risk Management Council (senior leadership)
- Sentence 5: Cross-reference

This is a governance paragraph describing the oversight structure. The Board Risk Committee is "primarily responsible for overseeing" - that's a board governance statement. But much of it is about management reporting lines. The management reporting structure is detailed but ultimately serves to explain how information reaches the board, with the Board Risk Committee as the ultimate oversight body. So Board Governance is the dominant category here. For specificity, the CISO is a cybersecurity-specific title that belongs on the IS list, though the Chief Risk Officer isn't explicitly listed there. I'm seeing that this document qualifies as Firm-Specific because it contains multiple IS facts—the CISO role, Board Risk Committee, and Risk Management Council—but lacks the quantifiable verifiable facts needed to reach a higher classification level.

fact: CISO (Chief Information Security Officer)

fact: Board Risk Committee

fact: Risk Management Council


reasoning: The paragraph frames cybersecurity as critical to business objectives and digital strategy, and notes that threats 'could materially adversely affect our operations, performance and results'—linking cyber risk to business impact. However, it describes no specific processes, governance structures, or incidents; it is entirely generic risk-framing language that could apply to any large company, with no named frameworks, roles, dates, or firm-specific facts.

thinking:
Let me analyze this paragraph from Caterpillar's 10-K Item 1C filing.

Content: General statement about cybersecurity threats - ransomware, denial-of-service, advanced adversaries, supply chain risks. No specific incident, no process description, no board/management details.

This is generic risk language. It mentions third parties but only as risk context, not vendor oversight. No materiality assessment conclusion. No specific processes described.

This is essentially general business language about cyber threats. It could be None/Other or Strategy Integration or Risk Management Process.

Looking more carefully: it acknowledges cybersecurity threats and their potential impact.

The language about "materially adversely affect" is forward-looking and hypothetical—it's describing potential third-party risks rather than assessing whether actual incidents have impacted the company. This reads as risk acknowledgment rather than a formal materiality conclusion, and it lacks any description of actual governance structures, specific programs, or processes. It's introductory risk framing without the substance of how the company actually manages these threats. it frames cybersecurity as a business-level concern affecting operations, which aligns with Strategy Integration. But the paragraph doesn't actually describe any strategy, process, or governance—it's just acknowledging that threats exist and matter. I'm leaning toward None/Other since there's no substantive disclosure beyond generic risk acknowledgment. The paragraph's main purpose is framing cybersecurity as strategically important and acknowledging potential threats, so it fits **Strategy Integration** since it connects cybersecurity to business objectives and mentions material adverse effects on operations—though the language is hypothetical and generic rather than specific.


reasoning: The paragraph describes the company's internal security awareness and training processes — phishing tests, mandatory training, remedial training for non-compliant employees, and periodic updates. These are all common practices on the IS-NOT list (security awareness training, phishing simulations). No named frameworks, cybersecurity-specific roles, tools, dates, or other firm-specific facts are present.

thinking:
Let me classify this paragraph.

Content: Describes security awareness and training program - phishing tests, mandatory training, periodic updates. This is about internal processes.

Category: Risk Management Process - describes internal cybersecurity processes (training, phishing tests, awareness program).

Specificity: Let me check for specific facts.
- No named frameworks/standards
- No cybersecurity-specific titles (CISO, CIO, etc.)
- No named committees, tools, firms
- No dates, dollar amounts, headcounts
- "Professional-level employees" - not specific
- "regular basis" - generic cadence

- Phishing tests and security awareness training are standard practices without any firm-specific details. → Generic Boilerplate (1)


reasoning: The paragraph contains an explicit materiality assessment ('not aware of any risks from cybersecurity threats that have materially affected... our Company, business strategy, or financial results'), which per Rule 6 makes it Strategy Integration. The appended cross-reference to Risk Factors does not change the classification. The language is boilerplate with no named entities, dates, or firm-specific facts.

thinking: Materiality assessment + cross-reference. Rule 6 says materiality disclaimers → Strategy Integration.


content_category: Third-Party Risk

reasoning: The paragraph's central topic is oversight of vendors, service providers, and third parties — describing risk assessments conducted on them and compliance monitoring imposed on them. Despite the subheading and detail, it contains no named standards, no firm-specific facts from the IS list (no named roles, tools, firms, dates, or headcounts), and uses only generic language ('annual assessments,' 'ongoing monitoring,' 'risk-weighted security assessments') that could apply to any company.

thinking:
Classify this paragraph.

Content: About third-party risk management - vendor oversight, security assessments, monitoring, compliance with standards. Central topic is vendor oversight.

Category: Third-Party Risk

Specificity: No named frameworks, no named tools, no specific dates, no headcounts. "risk-weighted security assessments" - not a named standard. "annual assessments" - generic cadence. No firm-specific facts from the IS list.

Generic Boilerplate.


reasoning: The CISO is the grammatical subject performing the primary action (informing the Steering Body), making this about the management role's reporting lines rather than board oversight. The paragraph describes the upward reporting chain: CISO → Cybersecurity Executive Steering Body → Audit Committee. Contains two IS-list facts (CISO title and named non-generic committee 'Cybersecurity Executive Steering Body'), but neither is QV-eligible, so specificity is Firm-Specific.

thinking:
Let me analyze this paragraph.

The paragraph describes reporting lines: CISO reports to a Cybersecurity Executive Steering Body, and significant matters are elevated to the Audit Committee.

Category: The heading says "Reporting to Board of Directors" but the content is about the CISO reporting to a steering body, which then elevates to the Audit Committee. The CISO is the grammatical subject performing the reporting action. But the paragraph is really about the reporting chain - CISO → Steering Body → Audit Committee. This is about management reporting structure, with the CISO as the primary actor reporting upward.

The CISO is clearly the primary actor in this reporting chain, so I'm leaning toward Management Role as the category. Even though board governance is involved, the dominant focus is on the CISO's reporting responsibilities and how information flows upward through the organizational structure.

Now I'm checking the specificity: the CISO title and the Cybersecurity Executive Steering Body are both named, organization-specific elements that count toward the IS list, while the Audit Committee reference doesn't. That gives me two IS facts, which means this falls into Firm-Specific territory rather than qualifying for QV.

fact: CISO

fact: Cybersecurity Executive Steering Body


reasoning: This is a generic introductory statement asserting that cybersecurity is important to the business. It contains no substantive disclosure about governance, management, processes, incidents, or strategy — it simply states that effective cybersecurity measures are critical, which could appear unchanged in any company's filing.

thinking:
Classify this paragraph.

This is a generic statement about cybersecurity being important. No specific facts, no frameworks, no named roles.

Content: Generic statement that cybersecurity is important to the business. No processes, no governance, no incidents described.

This could be Strategy Integration (linking cyber to business success) or None/Other (generic introductory language). It's really just an introductory statement with no substantive disclosure content. It doesn't make a materiality assessment. It's general business language mentioning cybersecurity.

Actually, it's borderline. It mentions "confidentiality, integrity and availability" which is standard CIA triad language, and talks about securing information systems.

The language about "establishing, executing and sustaining effective cybersecurity measures" sounds like it could reference their program, but it's too vague to constitute a real process description. Applying Rule 5, this only qualifies as None/Other if there's truly no substantive cybersecurity disclosure—and while this paragraph is thin on detail, it does acknowledge their cybersecurity efforts. I'm leaning toward None/Other since it lacks any meaningful governance, process, or materiality assessment.


reasoning: The paragraph primarily describes an actual cybersecurity incident — its timing, nature (operational disruption, data exfiltration), response actions, and remediation changes — making Incident Disclosure the dominant category. Financial impact (costs, lost revenues) and ongoing risk language are subordinate to the incident narrative. Specificity is Firm-Specific based on the specific date (April 2022), but only one QV-eligible hard fact prevents Quantified-Verifiable; no named firms, tools, dollar amounts, or headcounts are provided.

thinking:
Let me analyze this paragraph from Tenet Healthcare's 10-K filing.

Content: Describes a past cybersecurity incident (April 2022), its impact (disrupted hospital operations, data exfiltration, costs), remediation actions, and ongoing risk.

Category: This is primarily about an actual incident - it describes what happened, when, the impact, and response. But it also discusses remediation changes and ongoing risk. The dominant content is the incident narrative and its aftermath.

Wait - let me reconsider. The paragraph starts with the incident, then discusses costs/business impact, then remediation changes, then ongoing risk.

The incident narrative is clearly the anchor here, with the financial impact and remediation efforts supporting that core disclosure. The specific date of April 2022 qualifies for QV eligibility, though the other details like "hospital operations" and the data exfiltration are described in generic terms rather than with named products or systems. This is Incident Disclosure.

Looking at what's actually verifiable: April 2022 is the only hard fact I can pin down. There are no named firms, no specific tools mentioned, no dollar amounts, and no headcount data. That single date gives me one QV-eligible fact, making this Firm-Specific at level 3 for specificity.

fact: April 2022 cybersecurity incident


reasoning: The Audit Committee is the grammatical subject throughout, performing oversight actions: overseeing risk management, receiving briefings, and discussing cybersecurity with the CISO. The CISO mention is subordinate attribution within a board oversight paragraph. The CISO title is a firm-specific fact (cybersecurity-specific role on the IS list), but Audit Committee and generic cadences ('regular,' 'periodically') do not qualify, yielding one IS fact → Firm-Specific.

thinking:
Let me analyze this paragraph.

Content: The Audit Committee is the grammatical subject throughout. It oversees cybersecurity risk management, receives briefings, receives incident info, and discusses with the CISO. This is clearly Board Governance.

Specificity: Let me check the facts:
- "Audit Committee" — on the NOT list (generic governance)
- "CISO" — on the IS list (cybersecurity-specific title)
- No specific dates, dollar amounts, headcounts, named firms, named tools

One IS fact (CISO) → Firm-Specific (3)

No second QV-eligible fact, so not Quantified-Verifiable.

fact: Chief Information Security Officer (CISO)


reasoning: The paragraph is split between management role identification and board governance, but the most distinctive content is the identification of the cybersecurity leadership team (CTO, VP of IT and Station Operations, Senior Director of IT Security and Compliance) and their collective experience. The board oversight portions (quarterly briefings, enterprise risk assessment, director expertise) are substantial but more generic. Per the person-vs-function test, the paragraph describes who the leadership team is and their qualifications ('decades of experience,' 'relevant certifications') rather than specific processes they run. Specificity is Firm-Specific due to cybersecurity-specific named roles (CTO, Senior Director of IT Security), but no QV-eligible facts are present — 'decades of experience' is vague, and cadences like 'quarterly' are on the NOT list.

thinking:
Let me analyze this paragraph carefully.

The paragraph covers multiple topics: management roles, board governance, and some risk management. Let me determine the dominant category.

Content breakdown:
- "protecting our systems and data... is a priority for our leadership and Board of Directors" - general intro
- "Our cybersecurity team is overseen at a high level by our Senior Vice President and Chief Technology Officer, who is directly supported by our Vice President of IT and Station Operations and our Senior Director of IT Security and Compliance." - Management Role (names specific roles)

- "This leadership team has decades of experience leading cybersecurity oversight" - Management Role (credentials)
- "Team members who support our information security program have relevant educational, industry experience, and technical certifications." - Management Role (generic credentials)
- "The technical leadership team provides quarterly and annual cybersecurity updates to our Board of Directors, briefing the Board on our cyber program, industry trends and risks, and any incidents" - This is about management reporting TO the board - could be Board Governance or Management Role
- "Directors with experience in cybersecurity and technology play crucial roles..." - Board Governance
- "The Board oversees our annual enterprise risk assessment..." - Board Governance

The first half emphasizes the qualifications and structure of our cybersecurity leadership, while the second half shifts to describing the Board's oversight responsibilities and involvement in risk management decisions. The board gets mentioned throughout the paragraph too—it opens with them, then management briefs them quarterly and annually, and the directors themselves have cybersecurity expertise and oversee enterprise risk assessment. Counting it out, management roles and experience take up about half, while board governance and oversight make up the other half. It's genuinely balanced between the two categories.

Looking at what's most distinctive though: the specific role titles—SVP/CTO, VP of IT and Station Operations, Senior Director of IT Security and Compliance—are the concrete details that stand out. The board portions are more general descriptions of oversight. So I'm leaning toward Management Role as the primary category, since the management team identification is what carries the most specific content.

Now checking what counts as firm-specific facts: I've got the CTO and Senior Director of IT Security roles named explicitly, which are firm-specific. The other details like "decades of experience" and "quarterly and annual" cadences are too vague to be quantifiable. So this lands at Firm-Specific (3) for specificity, and there aren't enough quantifiable facts to meet the QV threshold.


reasoning: The paragraph's primary content is the CISO's organizational structure and reporting lines — who reports to whom, how the Information Security organization is structured, and how information flows upward. The CISO is the grammatical subject in most sentences, and the content centers on reporting relationships (CISO→CIO→Senior Management Committee, CISO→Audit Committee), making this Management Role per Rule 2. While Audit Committee reporting is mentioned, it is framed from the CISO's perspective as the actor doing the reporting. Multiple firm-specific facts (CISO, CIO, four divisions, Senior Management Committee) but only one QV-eligible fact (four divisions), so Firm-Specific rather than Quantified-Verifiable.

thinking:
Let me analyze this paragraph carefully.

The paragraph describes the organizational structure of the Information Security team, reporting lines, and how information flows to the board. Let me break it down:

1. CISO leads Information Security organization
2. Four divisions report to CISO
3. CISO reports to CIO
4. CIO is member of Senior Management Committee
5. CISO reports indirectly to Audit Committee
6. Biannually, CISO reports to Audit Committee
7. Internal Audit team reports to Audit Committee
8. Chief Compliance Officer reports privacy risk indicators quarterly

**Content Category:** This is a mixed paragraph.

I'm noticing the content centers on the CISO's role and reporting relationships—both upward to the CIO and the Audit Committee, and downward to the four divisions. The CISO is the primary actor throughout, making this fundamentally about management structure and organizational hierarchy rather than board governance specifically.

Now I'm checking which details qualify as quantifiable facts: the "four divisions" is a concrete organizational number, while the committee names and cadences are too generic to count. The CISO and CIO titles are firm-specific but don't meet the quantifiable threshold.

fact: CIO is a member of the Senior Management Committee

fact: Four divisions of the Information Security team

fact: Senior Management Committee


reasoning: This paragraph is generic risk factor language describing hypothetical cybersecurity threats and their potential consequences ('may be affected,' 'may be vulnerable,' 'could result in losses'). It contains no substantive cybersecurity disclosure — no description of processes, governance, incidents, or materiality assessments. It could be pasted into virtually any public company's filing unchanged.

thinking:
This is generic risk factor language about cybersecurity threats. No actual incident, no specific processes, no named frameworks, no firm-specific facts. It's hypothetical risk language discussing what could happen.

This is essentially general risk language - "may be affected," "may be vulnerable," "could result in losses." No materiality assessment conclusion, no specific disclosure content. This reads like risk factor boilerplate.

None/Other - no substantive cybersecurity disclosure. It's generic risk language about potential threats. No specific facts.


reasoning: The paragraph describes the mechanism by which the Board receives cybersecurity oversight briefings — the CIO and General Counsel meet with the Board to review key cybersecurity program areas. While management roles are the grammatical subjects, the primary communicative purpose is to describe the Board's oversight structure (what topics it is briefed on). CIO is a cybersecurity-specific title on the IS list, triggering Firm-Specific; General Counsel is generic C-suite and 'regularly' is a generic cadence, so no second QV-eligible fact exists.

thinking:
Let me analyze this paragraph carefully.

The paragraph describes the CIO and General Counsel meeting with the Board to review various cybersecurity topics.

Category: The grammatical subjects are "Our Chief Information Officer and General Counsel" - they are management roles meeting WITH the board. The paragraph describes what they report on to the board. This is about the reporting/briefing relationship between management and the board.

Who is the primary actor? The CIO and General Counsel "meet regularly with the Board... to review relevant areas." The management roles are the grammatical subjects performing the action. But the content is about what gets reported TO the board - this is a briefing/oversight structure.

I'm weighing whether this is primarily about the management roles briefing the board or the board's oversight mechanism. The CIO and General Counsel are grammatically the ones taking action, but the real purpose seems to be establishing how the board receives and reviews cybersecurity information from management. I think this falls under Board Governance because it's describing the board's oversight structure, even though management initiates the briefings.

Now I'm checking the specificity criteria—the CIO is a cybersecurity-specific title that would go on the IS list, while General Counsel is a generic C-suite role that wouldn't. The cadence is described generically as "regularly," and the Board of Directors isn't a specific list item either.

The bullet points about monitoring, testing, training, and incident response are common practices rather than specific facts, and the cybersecurity insurance mention is also generic. With only the CIO as a firm-specific fact and no quantifiable details like dates, amounts, or named tools, this lands at Firm-Specific level 3.

fact: Chief Information Officer


reasoning: The paragraph is about the CSO as a person — their reporting lines, tenure, prior industry experience, and committee membership. It passes the person-vs-function test: removing the person's credentials and background would gut the paragraph. Two QV-eligible hard facts: 'more than 11 years' and 'over 10 years' are specific durations of experience.

thinking:
Let me analyze this paragraph carefully.

The paragraph is about the CSO - their responsibilities, reporting lines, experience, and committee membership. This is primarily about the person (who they are, their background, reporting structure).

Content Category: Management Role - The paragraph is about the CSO as a person: their tenure (11+ years), prior experience (10+ years in banking), reporting lines (to CFO, updates to CEO and Technology Committee), and committee membership.

Specific facts:
- CSO (Chief Security Officer) - cybersecurity-specific title
- Technology Committee - named non-generic committee
- More than 11 years at Progressive - specific duration

- Over 10 years of cybersecurity experience in banking - specific duration
- Management Risk Committee - named non-generic committee
- Reports to CFO - reporting line (CFO is generic C-suite though)

I'm seeing two quantified facts here - the 11+ years tenure and the 10+ years of prior banking experience - which makes this Quantified-Verifiable.

fact: Chief Security Officer (CSO)

fact: Technology Committee

fact: Management Risk Committee

fact: more than 11 years in this capacity at Progressive

fact: over 10 years of cybersecurity experience in banking industry


reasoning: The paragraph opens by identifying the CISO and CIDO, describes their qualifications (15+ years experience each), and details reporting lines from CISO→CIDO→Audit Committee→Board. While the paragraph also contains Board Governance elements (Audit Committee updates, Board oversight) and Risk Management Process elements (GRC team, third-party risk, program evaluation), the dominant communicative purpose is establishing who manages cybersecurity, their credentials, and how information flows upward — Management Role content. Specificity is Firm-Specific: CISO and CIDO are cybersecurity-specific roles (IS list), and '15 years' is a specific number, but only one QV-eligible hard fact (years of experience), insufficient for Quantified-Verifiable.

thinking:
This is a long, complex paragraph that covers multiple topics. Let me analyze it carefully.

The paragraph covers:
1. CISO and CIDO roles, their experience (>15 years each)
2. Reporting structure (CISO → CIDO → Audit Committee, CEO, exec team)
3. Board oversight
4. Program evaluation
5. Third-party engagement
6. GRC team tracking incidents and third-party risk

The primary subject shifts throughout. Let me apply the dominant category test.

The paragraph starts with the CISO and CIDO - their roles and experience (Management Role). Then it describes reporting lines.

Looking at the distribution, the reporting structure and governance oversight dominate the content by volume. The CISO and CIDO credentials establish credibility, but the bulk of the paragraph focuses on how information flows through the organization—from the GRC team up through the CIDO to the Audit Committee and board, with program evaluation and vendor risk management woven throughout. This is fundamentally about governance architecture rather than individual credentials. but the paragraph structure itself—opening with the CISO and CIDO, then moving through their reporting relationships—suggests Management Role is the primary category. The board oversight elements feel secondary to the main focus on who's responsible and how they're organized. board sections describe what the board receives rather than what the board does proactively.

I'll classify this as Management Role since the CISO and CIDO are the primary actors throughout, their qualifications are described, and the reporting lines are detailed. The board content is subordinate (receiving reports rather than directing).

Actually, let me reconsider again. The person-vs-function test: much of this paragraph describes what the program does (risk assessment, threat detection, incident response, training, third-party risk management). If I removed the CISO/CIDO titles and experience, there's still substantial content about processes.

Hmm, but the paragraph does dedicate significant space to who the CISO and CIDO are (their experience), their reporting relationships, and the flow of information. The reporting structure IS the primary organizational content.

I think Management Role is correct as the dominant category. The paragraph's primary purpose is to describe who manages cybersecurity (CISO, CIDO), their qualifications, and how information flows from them to leadership. Now I'm checking the specificity of the facts here—the CISO and CIDO are named roles, and there's a specific number for their experience (over 15 years). The named roles themselves aren't QV-eligible, but the years of experience could be. Since I'm only seeing one QV-eligible fact across both individuals, this falls into Firm-Specific rather than QV.

fact: Chief Information and Digital Officer (CIDO)

fact: Each have over 15 years of prior work experience


reasoning: The paragraph describes an actual cybersecurity incident — unauthorized access detected on a specific date, operational impact (production delays, delayed shipments), response actions, and completed recovery. Multiple specific dates (December 30, 2022; January 6, 2023; February 10, 2023) constitute two or more hard verifiable facts, reaching Quantified-Verifiable. 'Cyber security experts' is unnamed and does not count.

thinking:
Let me analyze this paragraph from SIFCO Industries' 10-K filing.

Content: Describes a specific cybersecurity incident - unauthorized access detected December 30, 2022, production delays, investigation, data recovery completed. This is clearly Incident Disclosure.

Specific facts:
- Forms 8-K filed January 6, 2023 and February 10, 2023 (specific dates)
- December 30, 2022 (specific date of incident)
- "domestic operations were impacted" - operational impact description

QV check: specific dates (December 30, 2022; January 6, 2023; February 10, 2023) = multiple hard verifiable facts.

The cybersecurity experts mentioned are unnamed and generic with no specific firms or tools identified, but the three concrete dates across the incident and filings give me solid quantified-verifiable facts to work with.

fact: Unauthorized access discovered December 30, 2022


reasoning: The paragraph is entirely about the people — the CISO's experience and prior roles, the cybersecurity team's collective credentials, and executive backgrounds. This is squarely Management Role under the person-vs-function test. Multiple QV-eligible hard facts: specific years of experience (20+, 100+, 25+) and numerous named professional certifications (CISSP, GIAC, CCSP, CISA, Microsoft Cybersecurity Architect Expert, CDFE) easily exceed the two-fact threshold.

thinking:
Let me analyze this paragraph from Pentair plc's 10-K filing.

Content: This paragraph describes the CISO's experience, background, and qualifications, then the cybersecurity team's collective experience and certifications, then briefly mentions CEO/CFO/GC experience. The primary focus is on the people - who they are, their credentials, experience, and qualifications.

Category: Management Role - the paragraph is about the persons (CISO, cybersecurity team members, executives) and their qualifications, credentials, experience. The person-vs-function test: this is clearly about the people, not about processes.

The paragraph is packed with specific, verifiable credentials: the CISO holds a cybersecurity-specific title with over 20 years of experience, the team collectively brings over 100 years of experience, and they hold multiple named certifications including CISSP, GIAC Security Essentials, CCSP, CISA, Microsoft Cybersecurity Architect Expert, and CDFE. The executives mentioned also bring over 25 years of experience to their respective roles.

However, I'm noticing that CEO, CFO, and General Counsel positions fall outside the qualified vendor criteria, so those titles alone won't count toward the requirement. But the CISO and their certifications definitely meet the Quantified-Verifiable threshold—with 20+ years of documented experience plus multiple named industry certifications, that's easily two or more hard verifiable facts.

fact: CISO title

fact: over 20 years of cybersecurity and technology experience

fact: over 100 years of combined cybersecurity experience on the team

fact: CISSP certification

fact: GIAC Security Essentials certification

fact: Certified Cloud Security Professional (CCSP)

fact: Certified Information Systems Auditor (CISA)

fact: Microsoft Cybersecurity Architect Expert certification

fact: Certified Digital Forensics Examiner certification

fact: over 25 years of experience for each named executive


reasoning: The paragraph describes the company's own internal cybersecurity processes — ERM integration, IT infrastructure evaluations, compliance audits, and aligning cybersecurity with business objectives. No named frameworks, no named roles, no specific dates or numbers; 'cybersecurity experts' is generic and unnamed. All language could apply to any company unchanged.

thinking:
Classify this paragraph.

Content: Describes integrating cybersecurity into ERM, evaluations of IT infrastructure, compliance audits, aligning goals. Mentions working with "cybersecurity experts" (unnamed). This is about internal processes.

Category: Risk Management Process - describes the company's own internal processes for managing cyber risk.

Specificity: No named frameworks, no named roles, no named firms ("cybersecurity experts" is generic), no dates, no numbers. Everything here is generic. → Generic Boilerplate.


reasoning: The paragraph is framed by Board/Audit Committee oversight (sentences 1, 4, 5) with management roles described as subordinate to that oversight structure. The Board and Audit Committee are the primary grammatical subjects opening and closing the paragraph, making Board Governance dominant over Management Role. CIO is a cybersecurity-specific title on the IS list, elevating specificity to Firm-Specific, but no second QV-eligible fact exists to reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Board oversight + management roles. The paragraph starts with Board/Audit Committee oversight, then discusses CIO, General Counsel, and management's role, then returns to Board/Audit Committee receiving updates.

Category: The Board is the primary frame - it opens and closes the paragraph. The management mentions are subordinate to the board oversight structure. But there's significant content about management too. Let me look at the dominant topic.

- Sentence 1: Board/Audit Committee oversight → Board Governance

- Sentence 2: CIO, General Counsel, management responsibility → Management Role
- Sentence 3: Management has sufficient knowledge → Management Role
- Sentence 4: Board/Audit Committee receive updates → Board Governance
- Sentence 5: Audit Committee receives assessment results → Board Governance

Three sentences focus on the Board, two on Management. The overall framing emphasizes Board oversight with management responsibilities described within that context. → Board Governance

Specificity:
- "Board of Directors" - NOT list
- "Audit Committee" - NOT list
- "Chief Information Officer" - IS list (CIO is cybersecurity-specific title)
- "General Counsel" - NOT list
- No named individuals

, frameworks, dates, numbers, or firms

The CIO reference falls under the firm-specific category, and since it's a named role rather than a QV-eligible fact, this is classified as Firm-Specific.

fact: Chief Information Officer


reasoning: The paragraph describes internal compliance processes (disclosure procedures and controls, insider trading compliance programs) that address cybersecurity incidents from a securities law perspective. While these are legal/compliance processes rather than technical cybersecurity processes, they represent the company's internal procedures for managing cybersecurity-related obligations. No named frameworks, roles, dates, or firm-specific details are present — every public company subject to SEC rules maintains similar disclosure controls and trading compliance programs.

thinking:
Let me analyze this paragraph from Northern Trust's 10-K filing.

The paragraph discusses disclosure procedures related to cybersecurity incidents and compliance programs for insider trading restrictions related to material nonpublic information from cyber incidents.

This is about internal controls/compliance around disclosure obligations and trading restrictions - not about the cybersecurity program itself, not about board governance, not about management roles.

This feels like Risk Management Process (internal compliance processes related to cyber) or Strategy Integration (how cyber integrates with broader business/legal obligations) or None/Other.

Actually, this is about disclosure controls and insider trading compliance - these are legal/regulatory compliance procedures, not cybersecurity risk management processes per se.

The key distinction here is that this describes how the company manages the disclosure and trading implications of cyber incidents rather than the incident response or prevention mechanisms themselves. It's fundamentally about securities law compliance procedures that reference cybersecurity, which makes it more of a general corporate governance matter than substantive cybersecurity disclosure. I'm leaning toward None/Other since this covers disclosure controls and trading restrictions rather than describing any actual cybersecurity process or framework. This is really generic SEC compliance boilerplate—the kind of standard disclosure and trading restriction language every public company includes. They mention having disclosure controls and compliance programs that touch on cybersecurity incidents, but there's nothing specific about how they actually manage cybersecurity risk. It's corporate governance language, not a description of actual security processes or frameworks. I'll classify this as Risk Management Process with Generic Boilerplate since it does reference internal processes around cybersecurity, just without any real substance or company-specific details.