reasoning: The paragraph opens with an explicit materiality assessment ('not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company'), which per Rule 6 makes this Strategy Integration. The remainder is generic risk language about vulnerabilities and a cross-reference to Risk Factors, neither of which overrides the materiality conclusion. No specific facts from the IS list are present — no named frameworks, roles, dates, tools, or firms.

thinking:
Let me analyze this paragraph.

Content: Starts with a materiality assessment ("not aware of any previous cybersecurity threats that have materially affected..."), then generic risk language about vulnerabilities, then a cross-reference to Risk Factors.

Category: The opening sentence is a clear materiality assessment → Strategy Integration per Rule 6. The rest is generic risk language and a cross-reference, which is noise.

Specificity: No named frameworks, no specific facts from the IS list. Pure boilerplate materiality language.

The paragraph is mostly generic boilerplate with just that one substantive materiality claim at the start.


content_category: Risk Management Process

category_confidence: high

specificity_confidence: high

reasoning: The paragraph describes Vista's internal cybersecurity controls, monitoring, training, backup, and disaster recovery processes — all internal process descriptions making Risk Management Process the dominant category. The third-party SOC 1 Type 2 review is one component of the broader internal program, not the central topic. SOC 1 Type 2 is a named recognized standard triggering Sector-Adapted, but no firm-specific facts from the IS list are present ("management team" is generic, no cybersecurity-specific titles, no named tools/firms/dates).

provider: anthropic

generationId: agent-sdk

stage: benchmark

thinking:
Let me analyze this paragraph from Vista Gold Corp's 10-K filing.

Content: Describes the company's internal controls for cybersecurity, monitoring, training, SOC 1 Type 2 reviews for outsourced systems, and risk mitigation measures.

Category: This is primarily about the company's own internal cybersecurity processes - risk assessment, monitoring, training, controls, backup, disaster recovery. There's a mention of SOC 1 Type 2 for third-party systems, but that's one component of the broader internal program. → Risk Management Process

Specificity: Let me check for specific facts:
- SOC 1, Type 2 - this is a named standard/framework → Sector-Adapted

- The filing lacks cybersecurity-specific titles, named tools, firms, dates, or headcounts, and doesn't reference specific IS list items, so the disclosure remains at a general level despite mentioning the recognized SOC 1 Type 2 standard.

fact: SOC 1, Type 2 reports reviewed for outsourced systems

type: framework


reasoning: The paragraph describes internal cybersecurity processes: phishing simulations, security policies, enterprise-wide training, and testing. 'Executive management' is brief attribution, not the focus; the substantive content is about what the company does (awareness culture, policies, training). No named frameworks, cybersecurity-specific roles, dates, tools, or other IS-list facts are present—phishing simulations and security training are common practices on the NOT list.

thinking:
Let me analyze this paragraph.

Content: Executive management fostering cybersecurity culture through phishing simulations, security policies, training and testing.

Category: This is about internal cybersecurity processes - training, phishing simulations, security policies, testing. The "executive management" mention is brief attribution. The bulk is about what the company does (processes). → Risk Management Process

Specificity: Let me check for specific facts:
- "Executive management" - generic, on the NOT list
- "phishing simulations" - common practice, NOT list
- "security training and testing" - common practice
- No named frameworks, no named roles (CISO etc.), no dates, no numbers, no named tools

- No IS-list facts, no named standards → Generic Boilerplate


reasoning: The paragraph describes the company's own internal security processes — penetration testing, vulnerability assessments, network scans, threat intelligence review, and consulting with third parties. Third parties are mentioned as one component of the internal program, not as the central topic. No named frameworks, tools, firms, dates, or quantified facts appear; all items (penetration testing, vulnerability assessments, unnamed consultants) are common practices or unnamed entities on the NOT list.

thinking:
Classify this paragraph.

Content: describes internal security processes - penetration testing, vulnerability assessments, scans, threat intelligence, consulting with third parties.

Category: Risk Management Process - describes the company's own internal processes. Third parties are mentioned as one component, not the central topic.

Specificity: No named frameworks, no named tools, no named firms, no specific dates, no specific numbers. "third parties" and "cybersecurity consultants" are unnamed. "penetration testing", "vulnerability assessments" are common practices.

This is generic boilerplate—it lacks any distinguishing details that would indicate a specific company, framework, or approach.


content_category: Third-Party Risk

reasoning: The paragraph's central topic is identifying and overseeing cybersecurity risks from third parties, making Third-Party Risk the dominant category. However, it contains no named standards, firm-specific facts, or verifiable details — it is entirely generic language about third-party risk oversight that could apply to any company.


specificity_confidence: medium

reasoning: The paragraph describes internal privacy and data protection processes — privacy impact assessments, data processing activity records, data flow mapping, and regulatory monitoring — all of which are the company's own operational activities, fitting Risk Management Process. The GPO is a named internal organizational unit and the specific team composition (data protection officers, attorneys, privacy specialists) provides firm-specific detail, though no named frameworks, dates, or quantified facts push it to Quantified-Verifiable.

thinking:
Let me analyze this paragraph from Unisys Corp's 10-K filing, Item 1C.

The paragraph describes a "GPO" (Global Privacy Office) and its activities: data protection officers, privacy management software, privacy impact assessments, data processing records, data flow mapping, and regulatory compliance.

This is about internal processes - privacy management specifically. It describes what the GPO does (processes, tools, activities). Even though it mentions "data protection officers, attorneys and privacy specialists," these are generic descriptions of team composition.

Content category: Risk Management Process - describes internal processes for privacy/data protection management.

Now I'm checking the specificity of the details. The GPO is a named internal program, and the team composition of data protection officers, attorneys, and privacy specialists across Unisys does qualify as firm-specific departmental structure. However, the privacy management software is unnamed and generic, and there are no specific frameworks, dates, or tools mentioned that would push this toward higher specificity.

fact: GPO (named internal privacy organization)

fact: Network of data protection officers, attorneys and privacy specialists


reasoning: The CISO is mentioned as attribution ('Under the oversight of...'), but the paragraph's substantive content describes internal processes: risk assessments, security posture evaluation, continuous threat monitoring, IDS, SIEM tools, and threat intelligence. Removing the role attribution, the paragraph still functions as a process description → Risk Management Process. The VP of Information Security/CISO title is a cybersecurity-specific role (one IS-list fact), but no QV-eligible hard facts (no named tools, dates, or numbers), so Firm-Specific.

thinking:
Let me analyze this paragraph.

Content: Describes risk assessments, security posture evaluation, threat monitoring, and deployed monitoring systems. The VP of Information Security/CISO is mentioned as attribution ("Under the oversight of..."), but the paragraph is about what the program does - risk assessments, evaluating security posture, threat monitoring, IDS, SIEM tools, threat intelligence.

Person-vs-function test: Remove "Under the oversight of the Vice President of Information Security who operates as our Chief Information Security Officer ("CISO")" and the paragraph still makes complete sense as a process description. → Risk Management Process.

Now I'm checking the specificity level. There's only one firm-specific fact here—the CISO/VP of Information Security title—which isn't enough to qualify for QV status since that requires at least two facts. The rest is generic: no named frameworks, no specific tools or products, no metrics or dates. This lands it as Firm-Specific.

fact: Vice President of Information Security who operates as CISO


reasoning: The entire paragraph is about managing third-party service providers' cybersecurity risk — lifecycle phases (due diligence, ongoing monitoring, termination), notification requirements, and issue management. This is vendor oversight as the central topic, not a component of internal processes. No named frameworks, specific dates, named firms, tools, or other IS-list facts are present; the description is generic and could apply to any company.

thinking:
Classify this paragraph.

Content: About third-party risk management program - lifecycle phases, vendor notification requirements, issue management. Central topic is vendor oversight.

Category: Third-Party Risk - the entire paragraph is about managing third-party service providers' cyber risk.

Specificity: No named frameworks, no named tools, no specific dates, no numbers. "third-party risk management program" is generic. "phased lifecycle including due diligence and selection, ongoing oversight and monitoring, and termination and exit planning" - describes process but generic. No IS-list facts.

→ Generic Boilerplate (1)


content_category: Strategy Integration

reasoning: The paragraph makes an explicit materiality assessment ('no material cybersecurity incidents' and 'could materially affect their business strategy, results of operations, or financial condition'), which per Rule 6 is Strategy Integration even with the appended cross-reference to Risk Factors. No firm-specific facts are present — company names are self-references (NOT list) and the language is standard boilerplate.

thinking:
Classify this paragraph.

This paragraph has two parts: a materiality assessment ("experienced no material cybersecurity incidents" + "could materially affect") and a cross-reference to Risk Factors.

Per Rule 6 and the codebook: materiality disclaimers → Strategy Integration. The cross-reference appended doesn't change it.

Specificity: No named standards, no firm-specific facts from the IS list. "CMS Energy and Consumers" are company self-references (NOT list). Generic boilerplate materiality language.


reasoning: The paragraph describes the company's engagements with external parties (legal counsel, forensic firms, threat-sharing communities) as components of its own cybersecurity program. These entities serve the company's program rather than being vendors subject to oversight requirements, so this is Risk Management Process per Rule 3. Two named external organizations (H-ISAC, FBI's InfraGard) provide independently verifiable facts, reaching the QV threshold.

thinking:
Let me analyze this paragraph.

Content: Describes third-party engagements - legal counsel, forensic firms, H-ISAC, FBI's InfraGard, security vendors, information sharing communities.

Category: This is about external parties but in service of the company's own cybersecurity program. The paragraph describes engagements with external entities as part of the company's program. Per Rule 3: "External assessor hired to test the company → Risk Management Process (they serve the company)." These engagements serve the company's program. But wait - is vendor oversight the CENTRAL topic? No, this is about the company engaging with external parties for threat intelligence and support, not about imposing requirements ON vendors.

The title "Third-party Engagement in Connection with our Cybersecurity Program" makes it clear these are external parties supporting the company's own program, not vendors being managed. The specific organizations mentioned—H-ISAC and FBI's InfraGard—are information sharing and threat intelligence resources the company uses, which falls under Risk Management Process rather than Third-Party Risk Management.

Looking at the specificity here, H-ISAC and InfraGard are both named external organizations, which means they count as quantified-verifiable facts. That gives us two named organizations → Quantified-Verifiable.

fact: H-ISAC (Health Information Sharing and Analysis Center)

fact: FBI's InfraGard


reasoning: The paragraph describes the company's own internal cybersecurity controls being tested and audited, with third parties engaged to serve the company's program (assessing risks, identifying vulnerabilities, maintaining compliance). Per Rule 3, external assessors hired to test the company are Risk Management Process. No named frameworks, firms, tools, dates, or cybersecurity-specific roles appear — all entities are generic ('third parties', 'third-party service providers', 'standards and regulatory requirements').

thinking:
Classify this paragraph.

The paragraph describes engaging third parties to assess risks and test cybersecurity controls. The central topic is the company's own internal processes (risk assessment, testing, auditing, compliance) - third parties are mentioned as serving the company's internal program, not as vendors whose security is being overseen.

Category: Risk Management Process (third parties serve the company's internal program per Rule 3)

Specificity: No named frameworks, no named firms, no specific dates, no named tools, no cybersecurity-specific titles. "Third-party service providers" is generic.

The reference to "standards and regulatory requirements" is also generic, which points to Generic Boilerplate.


reasoning: The paragraph describes an internal cross-functional team (CSWAT) and its functions: managing cyber risks, implementing controls, reviewing security and business continuity programs. Applying the person-vs-function test, the content is about what the team does (processes), not about individual qualifications or credentials, so it is Risk Management Process. The named program 'CSWAT' with its unique abbreviation and the specific departmental composition qualify as firm-specific facts, but there are no QV-eligible hard facts (no dates, dollar amounts, headcounts, named third-party firms, or named tools).

thinking:
Let me analyze this paragraph.

Content: Describes the CSWAT team - its composition and what it does (manages risks, implements controls, reviews programs).

Category: This is about an internal team and what it does - processes, risk management, controls. The team composition is mentioned but the bulk is about functions/processes. Person-vs-function test: remove the team name and composition, and you still have process descriptions. → Risk Management Process.

Specificity:
- "Cyber Security Watch Team ("CSWAT")" - named internal program with unique identifier → IS list ✓

- The team pulls from senior leadership across IT, operations, risk, legal and compliance → IS list ✓
- No named frameworks, dates, dollar amounts, named firms or tools

QV check: No hard verifiable facts present. Firm-Specific: Yes - this is a uniquely named internal program with a specific cross-departmental structure.

→ Risk Management Process, Firm-Specific

fact: Cyber Security Watch Team ("CSWAT") — named internal program with unique identifier

fact: Comprised of senior IT, operations, risk, legal and compliance leaders across business segments — specific departmental composition


category_confidence: medium

reasoning: The paragraph briefly mentions a past ransomware incident but its primary communicative purpose is the materiality assessment ('did not have a material impact on our business, operations, or financial condition') and the strategic consequence (accelerating IT initiatives). Per the tiebreaker rule, a brief mention of a past incident plus a materiality conclusion as the main point yields Strategy Integration. 'In 2021' is one specific date, making this Firm-Specific but not QV (only one hard verifiable fact).

thinking:
Let me analyze this paragraph.

It describes a past ransomware attack (incident narrative) AND makes a materiality assessment AND notes strategic impact (accelerated IT initiatives).

The incident description is brief but present: "ransomware attack on our information technology systems" in 2021. Then there's a materiality statement and a strategic consequence.

Category tiebreaker: "Brief mention of a past incident + materiality conclusion as the main point → Strategy Integration." Let me check - the paragraph has roughly equal weight between incident mention and business impact. The first sentence describes what happened (incident). The second sentence is about materiality and strategic response. The main communicative purpose seems to be about the impact/consequence rather than describing the incident itself.

The incident gets minimal coverage while the focus shifts to materiality and how it drove strategic acceleration. That's Strategy Integration. For specificity, I only have the year 2021 as a concrete detail—no dollar amounts, vendor names, or other verifiable facts—so that's Firm-Specific.

fact: In 2021 (date of ransomware attack)


content_category: Board Governance

reasoning: The Risk Committee (a board-level committee) is the grammatical subject and primary actor overseeing cybersecurity, with management committees reporting up to it — this is board/committee oversight structure. Multiple named non-generic committees (Risk Committee, EROC, TSRC, ORC) and the CISO role make this firmly Firm-Specific, but no QV-eligible hard facts (dates, dollars, headcounts, named firms/tools) appear.

thinking:
Let me analyze this paragraph.

Content: Describes the Risk Committee's oversight of cybersecurity, mentions EROC, TSRC, ORC management committees, CISO membership, reporting lines to the Board.

Category: The Risk Committee (a board-level committee) oversees cybersecurity. The paragraph's subject is the Risk Committee and its oversight structure. This is Board Governance - the board committee is the primary actor overseeing cybersecurity through management committees.

Specific facts:
- Risk Committee (named non-generic committee) ✓
- EROC (Enterprise Risk Oversight Committee) - named committee ✓

- TSRC (Technology & Security Risk Committee) - named committee ✓
- ORC (Operational Risk Committee) - named committee ✓
- CISO mentioned as member ✓
- EIM mentioned (seems like a named internal system/program) ✓

No quantifiable metrics present—just named committees and roles. This is firm-specific information (3) given the multiple internal committees and governance structure, but it doesn't meet QV criteria since there are no dates, financial figures, headcounts, third-party vendors, products, or certifications mentioned.

fact: Risk Committee oversees cybersecurity

fact: Enterprise Risk Oversight Committee (EROC)

fact: Technology & Security Risk Committee (TSRC)

fact: Operational Risk Committee (ORC)

fact: CISO is a member of Management Committees


content_category: Management Role

reasoning: The paragraph describes the ITRGC committee and its oversight function, but the dominant content is about the management roles (Director of Enterprise Information Security, Information Security Officer), their reporting lines to the CRO and Board, and crucially their qualifications — 30 and 22 years of experience respectively. The person-vs-function test: the qualifications and experience of the individuals are primary content, making this Management Role. Two QV-eligible hard facts (30 years, 22 years) reach the Quantified-Verifiable threshold.

thinking:
Let me analyze this paragraph carefully.

The paragraph describes multiple things:
1. ITRGC committee and its responsibilities
2. Director of Enterprise Information Security role and responsibilities
3. Information Security Officer role
4. Reporting lines to CRO and Board
5. Years of experience (30 and 22 years)
6. Team certifications

This is a complex paragraph. Let me apply the person-vs-function test.

The paragraph starts with processes (ITRGC committee) but then shifts to describing roles and their qualifications. The last two sentences are clearly about the persons - their years of experience and expertise.

Looking at the full content, there's a mix of governance structure and management roles, but the emphasis is really on the people themselves—their titles, experience levels, and qualifications. The ITRGC committee is mentioned as context, but the paragraph centers on describing the Director and ISO as individuals with specific expertise and reporting relationships. Looking at the specific details now—the ITRGC is a named committee, and the Director of Enterprise Information Security and Information Security Officer are both cybersecurity-specific roles. The Chief Risk Officer isn't on the IS-specific list, so that's a distinction worth noting. The experience numbers (30 and 22 years) are concrete qualifications that count as QV-eligible, while "semi-annual basis" is just a generic cadence. Given that the paragraph emphasizes who these people are and their qualifications over the processes they oversee, Management Role is the right classification.

fact: Information Technology Risk Governance Committee (ITRGC)

fact: Information Security Officer

fact: 30 years of information security experience (Director)

type: quantified

fact: 22 years of information security experience (ISO)


reasoning: The paragraph describes Board-level and Audit Committee oversight of cybersecurity, with the Board and Audit Committee as the grammatical subjects receiving reports. All elements fall on the NOT list: 'Board' and 'Audit Committee' are generic governance, 'annual' and 'quarterly' are generic cadences, and 'top ten enterprise risks' is a descriptive organizational detail rather than a firm-specific fact per the IS list (not a headcount, dollar amount, percentage, or named cybersecurity-specific entity).

thinking:
Let me analyze this paragraph.

Content: Board-level oversight, annual enterprise risk reporting to full Board, quarterly Audit Committee presentations by LiveRamp security team.

Category: Board Governance - the Board and Audit Committee are the primary subjects receiving oversight reports.

Specific facts:
- "enterprise risk team" - generic team reference
- "Board" - generic
- "Audit Committee" - generic (per NOT list)
- "quarterly" - generic cadence
- "annual" - generic cadence
- "top ten enterprise risks" - this is a specific detail about how the company structures its risk reporting

- "LiveRamp security" - company self-reference, not firm-specific

The "top ten" framing is a quantified organizational detail that describes their risk categorization approach, which could qualify as a specific fact, but it's borderline since it's more about their process structure than a concrete metric like headcount or dollar amount. I'm reconsidering whether "top ten enterprise risks" actually qualifies as firm-specific. It's a specific number, but it's describing organizational structure rather than a concrete metric like headcount or dollar amount. The rest of the passage—Board, Audit Committee, quarterly, annual—all fall into generic boilerplate territory. Looking at the actual substance, this seems to be describing standard governance practices that most companies follow, so I'm leaning toward classifying this as Generic Boilerplate overall. I'm reconsidering whether "top ten" is actually specific to this company or just generic boilerplate that many organizations use. Looking at the details again—annual reporting to the full Board, quarterly to the Audit Committee—these are all standard cadences and committees that appear on the NOT list, so none of them qualify as firm-specific. My conclusion is Board Governance, Generic Boilerplate.


reasoning: The paragraph's primary subjects are the Board of Directors and Audit Committee performing risk oversight — receiving materials and updates on cybersecurity. The CIO and CISO are mentioned in a subordinate role (providing updates TO the committee), keeping the board as the primary actor. Two cybersecurity-specific titles (CIO, CISO) qualify as IS-list facts for Firm-Specific, but named roles are not QV-eligible, so specificity stays at Firm-Specific.

thinking:
Let me analyze this paragraph.

Content: Board/Audit Committee oversight, with CIO and CISO providing updates. The grammatical subject is the Board and Audit Committee - they receive materials, they get updates. The management/CIO/CISO are mentioned as providing updates TO the board/committee.

Category: Board Governance - the board and Audit Committee are the primary subjects performing oversight.

Specificity analysis:
- "Audit Committee" - NOT list (generic governance)
- "Board of Directors" - NOT list
- "Chief Information Officers (CIO)" - IS list (cybersecurity-specific title)

- "Chief Information Security Officers (CISO)" - IS list (cybersecurity-specific title)
- "quarterly updates" - NOT list (generic cadence)
- "annual update" - NOT list (generic cadence)

The two cybersecurity-specific titles are IS-list items, but named roles like CIO and CISO are Firm-Specific rather than QV-eligible, so this falls into the Firm-Specific category.

fact: Chief Information Officers (CIO)


reasoning: The paragraph describes the company's internal cybersecurity processes — controls, monitoring, training, penetration testing, EDR/SIEM usage, vendor oversight, and NIST alignment. While the CIO and Corporate VP titles are mentioned, they serve as attribution for the team composition; the overwhelming substance is about what the department does (function), not who the people are (person). Specificity is Firm-Specific: cybersecurity-specific titles (CIO, Corporate VP IT Infrastructure Operations and Security) are IS-list facts, but no two QV-eligible hard facts are present (no named third-party firms, no named tools/products, no specific dates or dollar amounts).

thinking:
Let me analyze this paragraph carefully.

Content Category: This paragraph describes the company's internal cybersecurity processes, tools, team composition, and methodology. While it mentions the CIO and Corporate VP roles, the paragraph is fundamentally about what the IT department does — its processes, controls, monitoring, tools, and framework alignment. The person-vs-function test: remove the role titles and the paragraph still describes the program comprehensively. → Risk Management Process

Specificity: Let me identify facts:

IS list facts:
- Chief Information Officer (CIO) — cybersecurity-specific title ✓
- Corporate Vice President, IT Infrastructure Operations and Security — cybersecurity-specific title ✓

- PCI attestation — named standard
- SOC reports — named standard
- NIST Framework — named standard
- EDR and SIEM — generic technology categories, not named products
- "managed security service provider" — unnamed, not specific
- "information security consulting company" — unnamed, not specific

QV-eligible facts: The paragraph contains cybersecurity-specific titles (CIO, Corporate VP of IT Infrastructure Operations and Security) as firm-specific facts, plus named standards (NIST, PCI, SOC), but lacks specific dates, dollar amounts, headcounts, named third-party firms, or named products/tools.

The titles themselves aren't QV-eligible, and without named firms, tools, dates, dollar amounts, or headcounts, there aren't two or more hard verifiable facts needed for QV qualification. This lands at Firm-Specific (Level 3).

fact: Chief Information Officer

fact: PCI attestation

fact: SOC reports reviewed for third-party providers

fact: NIST Framework


reasoning: The paragraph describes the company's own internal cybersecurity processes — threat identification, risk evaluation, strategic investments, and participation in threat-sharing forums. All descriptions are generic with no named frameworks, tools, roles, dates, or firm-specific details.

thinking:
Classify this paragraph.

Content: Describes internal processes - identifying threats, detecting attacks, protecting data, evaluating risks, making investments, participating in forums. This is about the company's own internal cybersecurity processes.

Category: Risk Management Process

Specificity: No named frameworks, no named roles, no specific dates, no named tools, no firm-specific facts. "cybersecurity forums" is unnamed. Everything here is generic.

Generic Boilerplate.


reasoning: The paragraph describes the company's internal cybersecurity processes — framework adoption, policy development, protection techniques, cross-functional integration, and employee training — all hallmarks of Risk Management Process. It names four recognized frameworks (NIST, CIS, COBIT, ISO) but contains no firm-specific facts from the IS list (no named roles, dates, tools, headcounts, or certifications), keeping it at Sector-Adapted.

thinking:
Let me analyze this paragraph.

Content: Describes the company's cybersecurity risk management program - frameworks used (NIST, CIS, COBIT, ISO), policies, protection techniques, integration across operations, employee training.

Category: Risk Management Process - describes internal processes, framework adoption, methodologies.

Specificity: Names multiple frameworks (NIST, CIS, COBIT, ISO) - that's Sector-Adapted at minimum. But are there firm-specific facts? Let me check the IS list:
- No cybersecurity-specific titles (CISO, etc.)

- No named committees
- No specific dates
- No named tools/products
- No named firms
- No specific numbers
- No certification claims

The frameworks named (NIST, CIS, COBIT, ISO) trigger Sector-Adapted. The practices described (multifactor authentication, malware defenses, phishing simulations, training) are common practices on the NOT list. No firm-specific facts.

→ Sector-Adapted

fact: NIST framework

fact: CIS framework

fact: COBIT framework

fact: ISO framework


reasoning: The paragraph's primary communicative purpose is about investment and resource allocation in cybersecurity ('continue to invest,' 'growing the core security organization to support business growth efforts'), which ties cybersecurity spending to business strategy. While it mentions improving capabilities and hardening measures, these are framed as investment objectives rather than process descriptions. No named frameworks, roles, dates, tools, or firm-specific details are present — entirely generic language.

thinking:
Classify this paragraph.

Content: Company investing in IT Security to improve capabilities, streamline response, harden measures, grow security organization. This is about resource allocation and investment strategy related to cybersecurity.

Category: This describes investment and resource allocation for cybersecurity - "continue to invest," "growing the core security organization to support business growth." This is about strategic investment in cybersecurity capabilities. Could be Strategy Integration (investment/resource allocation) or Risk Management Process.

The paragraph focuses on investment and growth of the security organization to support business - this leans Strategy Integration (budget, investment, resource allocation). But it also describes improving technical capabilities and hardening measures, which sounds like RMP.

The core of this is resource allocation and organizational growth tied to business strategy, which points to Strategy Integration. While it mentions improving capabilities and hardening measures, the emphasis on investment and scaling the security team to support business growth makes this fundamentally about strategic resource allocation rather than process improvement.

Looking at the specificity: there are no named frameworks, specific metrics, dates, budgets, or defined roles—just generic references to "IT Security" and "core security organization." This is clearly Generic Boilerplate.


reasoning: The paragraph describes the company's cybersecurity risk management program and the frameworks/standards guiding it (NIST, CSA, ISO/IEC), which is squarely about internal processes and framework adoption. It goes beyond merely naming standards by claiming the company maintains ISO/IEC 27001:2013 and 27017:2015 certifications — holding a certification is a firm-specific verifiable fact per the codebook. However, organizational certifications are not QV-eligible (that list specifies individual certifications like CISSP/CISM), so this remains Firm-Specific rather than Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes frameworks guiding their cybersecurity program (NIST, CSA, ISO/IEC), mentions specific certifications they maintain (ISO/IEC 27001:2013, ISO/IEC 27017:2015) and attestations they seek (SOC 2 Type 1 and Type 2). This is about the company's internal risk management processes and framework adoption.

Category: Risk Management Process - describes framework adoption, standards, certifications as part of their risk management program.

Specificity:
- Named frameworks: NIST, CSA, ISO/IEC → Sector-Adapted at minimum

- The maintained certifications (ISO/IEC 27001:2013 and ISO/IEC 27017:2015) are firm-specific facts, while the SOC 2 attestations they're pursuing are just standard references since they haven't achieved them yet.
- For QV eligibility, organizational certifications don't qualify—only individual certifications like CISSP or CISM count. So these ISO certifications are firm-specific but not QV-eligible.

fact: Maintains ISO/IEC 27001:2013 certification

fact: Maintains ISO/IEC 27017:2015 certification


content_category: None/Other

reasoning: This paragraph describes the company's general reliance on IT systems, data storage, and infrastructure in generic terms. It contains no substantive cybersecurity disclosure — no risk management processes, governance structures, incidents, or materiality assessments. It reads as general business context about IT dependence that could apply to virtually any company.

thinking: This paragraph describes general business context about IT systems and data storage. It doesn't contain any cybersecurity-specific disclosure content - no processes, frameworks, governance, incidents, or materiality assessments. It's general business language about IT dependence.


reasoning: The paragraph describes engaging external assessors and consultants to improve the company's own security program, evaluate threats, and perform forensic reviews — these are internal process components per Rule 3 (external assessors hired to serve the company). No named firms, frameworks, dates, or other specific facts are present; 'external assessors and consultants' is generic and unnamed.

thinking:
Classify this paragraph.

Content: Describes engaging external assessors/consultants for security improvement, alignment with best practices, threat evaluation, forensic reviews, and independent assessments. This is about the company's own internal processes that happen to involve external parties as a component. The external parties serve the company's program, not vendor oversight.

Category: Risk Management Process (external assessors hired to test/improve the company = internal process per Rule 3)

Specificity: No named frameworks, no named firms, no specific dates, no named roles, no specific facts. "external assessors and consultants" is on the NOT list.

This lands in Generic Boilerplate.


reasoning: The paragraph describes the company's internal cybersecurity risk management program — enterprise risk assessment, strategies, processes, monitoring, training, insurance, and external assessments. This is squarely about the company's own processes and methodology, making it Risk Management Process. It names NIST CSF and CMMI as frameworks but contains no firm-specific facts from the IS list (no cybersecurity-specific titles, no named tools/firms, no dates, no headcounts), so it remains Sector-Adapted rather than Firm-Specific.

thinking:
Let me analyze this paragraph from Scotts Miracle-Gro's 10-K filing.

Content: Describes their cybersecurity risk management program - enterprise risk assessment identified cyber as significant, they developed processes aligned with NIST CSF, lists various security activities (monitoring, IR, access management, training, insurance, external assessments, maturity reviews using CMMI).

Category: This is about the company's internal cybersecurity processes and methodology. The paragraph describes what the program does. → Risk Management Process

Specificity:
- Names NIST CSF framework → Sector-Adapted at minimum

- Also references CMMI for maturity assessments, another named framework
- Mentions cybersecurity insurance but without details
- No firm-specific facts like named roles, dates, tools, vendors, or headcounts - just generic practices like monitoring, incident response, and training

Both frameworks are named but there's no information-security-specific details that would push this higher. → Sector-Adapted (2)

fact: NIST CSF (National Institute of Standards and Technology Cybersecurity Framework)

fact: Capability Maturity Model Integration (CMMI) framework


reasoning: The board enterprise risk committee and cybersecurity subcommittee are the grammatical subjects performing oversight actions (reviewing summaries, engaging with management). The CISO is mentioned as someone the board engages with, but the board remains the primary actor. The cybersecurity subcommittee (a non-generic named committee) and CISO (cybersecurity-specific title) are both IS-list facts, but neither qualifies as QV-eligible, so specificity is Firm-Specific.

thinking:
Let me analyze this paragraph.

Content: Board enterprise risk committee, cybersecurity subcommittee reviews summaries, board engages with CISO, material cybersecurity risks considered in board discussions.

Category: Board Governance - the board and its committees are the primary actors overseeing cybersecurity.

Specific facts:
- "cybersecurity subcommittee" - named non-generic committee ✓
- "CISO" - cybersecurity-specific title ✓

QV check: No dates, dollar amounts, headcounts, named third-party firms, named tools. So not QV.

This hits Firm-Specific since I've got two IS-list facts with the named subcommittee and CISO role, though neither qualifies as quantifiable.

fact: cybersecurity subcommittee

fact: CISO


reasoning: The paragraph's primary subject is the VP of IT and Security/CIO — describing their experience (25 years), reporting line (to SVP and General Counsel), and incident-related responsibilities. While the latter half describes incident communication processes, the grammatical subject throughout is the management role holder, and the paragraph opens with the person's qualifications and reporting structure, making Management Role the dominant category. Specificity is Firm-Specific: the CIO title is a cybersecurity-specific role (IS list) and '25 years' is one QV-eligible fact, but only one QV-eligible fact does not reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph carefully.

The paragraph describes the VP of IT and Security/CIO - their experience, reporting lines, and responsibilities regarding cybersecurity incidents.

Content Category: This is a mixed paragraph. Let me apply the person-vs-function test.

The first sentence is about the person: "over 25 years of information technology and security experience" and reporting line to General Counsel. That's Management Role content.

The rest describes what the role does - informing CEO about incidents, managing incidents using standard processes, communicating with officers, notifying the Board. This is more about the function/process.

But the grammatical subject throughout is "The Vice President of IT and Security and CIO" - the person is the primary actor. The paragraph tells us about the person's qualifications (25 years experience), reporting line (to SVP/General Counsel), and then describes their responsibilities.

The core focus here is establishing this management role and its place in the organizational structure. Even though incident management processes are mentioned, they're really just illustrating what this particular person is responsible for. The title itself is cybersecurity-specific with the CIO designation, and the experience threshold is concrete. This fits Management Role.

Looking at what qualifies as quantified-verifiable: the "over 25 years" of experience counts as a specific number, but that's just one fact. The CIO title is from the IS list but doesn't count toward QV. Since I need two QV-eligible facts to reach Quantified-Verifiable status and I only have one, this lands in Firm-Specific.

fact: Vice President of Information Technology and Security and CIO


reasoning: The paragraph describes the company's approach to cybersecurity risk management and ERM integration, which are internal processes. However, it contains no named frameworks, roles, tools, or firm-specific details — it is entirely generic boilerplate that could appear in any filing.


reasoning: The paragraph describes Tredegar's internal cybersecurity program and its risk-based approach to preventing and mitigating vulnerabilities, with third parties mentioned as one component rather than the central topic. No named frameworks, specific roles, dates, or verifiable facts are present — 'Cybersecurity Program' is a generic program name per the NOT list, and the description is boilerplate language applicable to any company.

thinking:
Let me analyze this paragraph.

Content: Describes Tredegar's Cybersecurity Program using a risk-based approach, designed to prevent/identify/investigate/resolve/mitigate vulnerabilities, both internally and with third-party service providers.

Category: This is about the company's internal cybersecurity program and processes. Third parties are mentioned as a component, not the central topic. → Risk Management Process

Specificity: Let me check for specific facts:
- "Tredegar's Cybersecurity Program (the 'Program')" - this is a named internal program but does it have a unique identifier? It's just called "Cybersecurity Program" which is generic per the NOT list.

- "third-party service providers" - generic, on NOT list
- "risk-based approach" - generic
- No frameworks named, no specific roles, no dates, no numbers.

After filtering: no specific facts remain. → Generic Boilerplate


reasoning: The paragraph describes the company's internal ERM integration process — identifying, prioritizing, assessing, monitoring, and mitigating cybersecurity risks, plus a cost-benefit improvement roadmap. No named frameworks, no named roles from the IS list, no specific dates, numbers, or tools. The language is entirely generic and could apply to any company.

thinking:
Classify this paragraph.

Content: Describes integration of cybersecurity into ERM, risk identification/assessment/monitoring process, reporting to leaders, improvement roadmap. This is about internal processes.

Category: Risk Management Process - describes the company's own internal processes for managing cyber risk.

Specificity: No named frameworks, no named roles (just "business and governance leaders"), no specific facts from the IS list. Generic description of ERM integration. → Generic Boilerplate (1)


reasoning: The paragraph contains an explicit materiality assessment ('have not...materially impaired our operations or financial standing'), making it Strategy Integration per Rule 6. The appended cross-reference to Risk Factors does not change the classification. No specific facts are present — boilerplate materiality language with generic cross-reference.


reasoning: The paragraph describes the company's internal cybersecurity policy and the control domains it covers (access management, network security, incident response, etc.). This is squarely about the company's own internal processes. Despite the lengthy enumeration of security domains, every item listed is a common practice that could appear in any company's filing — no named frameworks, no named tools, no specific roles, dates, or quantified facts appear.

thinking:
This paragraph describes the company's internal cybersecurity policies and the areas they cover. Let me classify it.

Content: Describes the company's information systems and cyber security policy, listing many control domains. This is about internal processes/policies.

Category: Risk Management Process - describes internal policies, standards, controls, and management responsibilities across many domains.

Specificity: Let me check for specific facts. The paragraph lists many common security practices but doesn't name any frameworks (NIST, ISO), no specific roles beyond generic "management," no dates, no named tools, no named firms. Everything listed is generic security domains that any company could have. No IS-list items present.

This looks like generic boilerplate language.


reasoning: The paragraph is about the person filling the CISO role — their title, years of experience, and career background across multiple industries. The person-vs-function test confirms this: the primary content is who the person is and what qualifies them, not what the program does. Two QV-eligible facts: CISO (cybersecurity-specific role) and 'more than 20 years' (specific quantified experience).

thinking:
Let me analyze this paragraph.

The paragraph is about the CISO - their title, experience, background, and responsibilities. It's primarily about the person.

Person-vs-function test: If I remove the CISO's title and credentials, what remains? "Our cybersecurity program is led by [someone] who is responsible for identifying, assessing, and managing our collective information security and technology risks." The first sentence has some function description, but the bulk of the paragraph is about the person's experience and background.

Content category: Management Role

Specific facts:
- "senior vice president, chief information security officer" - named_role (CISO is cybersecurity-specific)

- "more than 20 years of experience" - a quantified timeframe

Looking at what's verifiable here: the 20 years is the only metric I can actually check, but it's vague without specific dates or certifications. The CISO title is firm-specific and not something I can independently verify. So this falls under Firm-Specific rather than Quantified-Verifiable.

fact: Senior Vice President, Chief Information Security Officer (CISO)

fact: More than 20 years of experience in information security and technology


reasoning: The paragraph describes management-level organizational structures for cybersecurity oversight: a named Executive Cybersecurity Steering Committee and designated local Information Security Officers. Per the codebook, management committees responsible for cybersecurity fall under Management Role. The content is about organizational structure (who oversees what, committee composition, role designations) rather than individual credentials (which would be stronger Management Role) or specific processes/tools/frameworks (which would be Risk Management Process). Specificity is Firm-Specific due to the named non-generic committee and cybersecurity-specific ISO role, but no two QV-eligible hard facts are present.

thinking:
Let me analyze this paragraph.

Content: Describes an Executive Cybersecurity Steering Committee, its composition, meeting cadence, and local Information Security Officers at business units with certification processes.

Category: This is about management-level oversight structures. The Cybersecurity Committee is a management committee (not a board committee). Local Information Security Officers are management roles. But the paragraph is more about the organizational structure and processes than about any individual person's credentials.

The person-vs-function test: This paragraph describes organizational structures and processes (committee meets quarterly, business units designate ISOs, annual certification process). It's about the function/structure, not about individual people's credentials.

The codebook defines Management Role as covering management committees responsible for cybersecurity, and this paragraph describes exactly that—the organizational structure and oversight mechanisms for how management oversees cybersecurity across the company. This fits Management Role.

Looking at the specificity markers: the committee and Information Security Officer role are named and cybersecurity-specific, making this firm-specific information. There aren't enough hard verifiable facts like dates or headcounts to qualify as QV, so this lands as Firm-Specific Management Role.

fact: Executive Cybersecurity Steering Committee ('Cybersecurity Committee')

fact: local Information Security Officer at each business unit


reasoning: The management team is the grammatical subject throughout, and the paragraph describes their role in the cybersecurity oversight chain — what briefings they receive and how they report upward to the Board/Audit Committee. This is about management's position and responsibilities in the oversight structure rather than internal processes, tools, or frameworks (Risk Management Process) or the board's own actions (Board Governance). However, no individual credentials or qualifications are described, making this a borderline case. The Disclosure Committee is a non-generic named committee, triggering Firm-Specific; no QV-eligible hard facts are present.

thinking:
Let me analyze this paragraph.

Content: Management team supervises cybersecurity efforts, receives briefings from Information Security team and Disclosure Committee, provides quarterly updates to Board/Audit Committee.

Category: The grammatical subject is "our management team" throughout. But what is the paragraph about? It describes what the management team does - supervises efforts, receives briefings, provides updates. This is about the management function rather than the person's credentials/background.

Applying the person-vs-function test: If I remove "our management team" and replace with "the Company," the paragraph still describes processes. But wait - it's not really about the processes themselves (risk assessment, frameworks, tools), it's about the management structure and oversight flow. The management team is the subject performing actions related to oversight.

So the real question is whether this fits Management Role or Risk Management Process. The paragraph focuses on what the management team does—supervises, receives briefings, provides updates—rather than who they are or their qualifications. It's describing the oversight function itself, which leans toward Risk Management Process, but the Management Role category explicitly covers "management committees responsible for cybersecurity," and this paragraph is fundamentally about how that committee operates. the oversight chain.

Actually, looking more carefully: the paragraph describes the management team's role in the oversight structure - receiving briefings, providing updates to the board. This is about organizational structure and information flow, which is Management Role territory (reporting lines, management committees).

Wait, but there are no named cybersecurity-specific roles. "Management team" is generic. The paragraph describes the flow of information: internal security team → management → board. The primary focus is on management's position in the oversight chain.

I think this is Management Role - the management team is the subject, and the paragraph describes their responsibilities and reporting relationships. But it's borderline with Risk Management Process.

Actually, re-reading the codebook: "Management Role covers: management committees responsible for cybersecurity." The management team here is described as responsible for oversight of the cybersecurity program, and the paragraph details their briefing inputs and reporting outputs. This fits Management Role.

Now I'm checking the specificity markers. "Security team" is a generic internal designation rather than a cybersecurity-specific title like CISO. The "Disclosure Committee" stands out as a named, non-generic committee - it's not a standard one like Audit Committee, so that's firm-specific. The "quarterly" cadence is generic, but "in alternating quarters" describing how they brief the Board versus the Audit Committee is a firm-specific organizational detail.

So this is Management Role (2) with Firm-Specific (3) specificity due to the Disclosure Committee and the alternating quarterly briefing structure.

fact: Disclosure Committee


reasoning: The paragraph's dominant topic is oversight of third-party providers: due diligence processes, security posture evaluations, and contractual requirements imposed on vendors processing customer data. The opening sentence about vulnerability/penetration assessments is a minor component. Named standards (SOC reports, ISO certifications) elevate beyond boilerplate, but no firm-specific facts are present.

thinking:
Let me analyze this paragraph.

Content: Describes vulnerability/penetration assessments by independent third party, due diligence for third-party providers, risk assessments of third parties (SOC reports, ISO certifications, questionnaires), contractual requirements for third parties.

Category: The first sentence mentions internal assessments (Risk Management Process), but the bulk of the paragraph is about third-party provider oversight - due diligence, risk assessments of vendors, contractual requirements imposed on them. Third-Party Risk is the dominant category.

Specificity: Let me check for specific facts:
- "independent third party" - unnamed, not specific

- SOC reports, ISO certifications - named standards → Sector-Adapted
- No firm-specific facts from the IS list
- No cybersecurity-specific titles, no named committees, no dates, no named firms/tools

Decision test: Names recognized standards (SOC, ISO) → Sector-Adapted (2)

fact: SOC reports

fact: ISO certifications


reasoning: The paragraph describes a committee (implied board committee) receiving reports from management on cybersecurity risks and incidents. The committee is the grammatical subject receiving oversight information, making this Board Governance. No specific facts from the IS list are present — 'the Committee' is generic governance language, 'management' is generic, and 'regular' is a vague cadence.


reasoning: The paragraph describes reporting processes and ERM integration via the internal audit function. While the Chief Security and Trust Officer is named as the subject of the first sentence, the substantive content is about what the function does (reporting on risks, integrating into ERM, auditing controls) rather than who the person is. Applying the person-vs-function test, the paragraph still makes sense if the role title is replaced with 'the Company.' The unique CSTO title is a firm-specific fact but is the only qualifying fact, so specificity is Firm-Specific.

thinking:
Let me analyze this paragraph.

The paragraph has two parts:
1. "The Chief Security and Trust Officer provides regular reports on the status of cybersecurity risks, priorities, and focus areas to our executive leadership team."
2. "In addition, information on cybersecurity risks is further integrated into our broader enterprise risk management program through our internal audit function, which incorporates such information in regular audits of our cybersecurity and data protection controls and processes."

Category analysis:
- The first sentence mentions "Chief Security and Trust Officer" - this is a cybersecurity-specific role. But is the paragraph about the person or about the function? The paragraph describes what this role does (provides reports) and how cybersecurity is integrated into ERM.

If I remove the CSTO title and replace it with "The Company," the core message stays intact — the organization provides regular reports and integrates cybersecurity into its enterprise risk management through internal audits. The CSTO is really just the vehicle for these processes, not the focus. The dominant content here is about the reporting cadence and how cybersecurity feeds into the broader risk management framework, which points to Risk Management Process.

Looking at specificity, the only concrete detail is "Chief Security and Trust Officer" — that's a particular job title variant. Everything else (executive leadership team, enterprise risk management program, internal audit function, regular reporting) is generic language. That single firm-specific fact puts this at level 3, and there are no QV-eligible facts like dates, amounts, headcounts, or named entities.

fact: Chief Security and Trust Officer


reasoning: The paragraph describes the company's own internal product cybersecurity risk assessment and management processes within a named business segment (E-Systems), aligned with ISO 21434. This is squarely about the company's internal processes and framework adoption. Multiple firm-specific facts exist (named business unit, certification claim, specific year), but only one QV-eligible hard fact (the 2023 date), so it reaches Firm-Specific rather than Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes product cybersecurity risk assessment processes within E-Systems business, alignment with customer requirements and industry standards including ISO 21434, and certification received in 2023.

Category: This is about the company's own internal processes - risk assessment, management processes, alignment with standards. → Risk Management Process

Specificity analysis:
- "E-Systems business" - named internal business unit/segment → firm-specific
- "ISO 21434" - named standard → at least Sector-Adapted
- "ISO 21434 Road Vehicle Cybersecurity Engineering certification in 2023" - certification claim + date → certification is firm-specific, "in 2023" is a specific date

- Now checking whether this qualifies for QV: the specific date and certification claim are both firm-specific facts, and the codebook lists certification claims like "We maintain ISO 27001 certification" as firm-specific. The certification itself appears to be organizational rather than individual-level, so I need to determine if it meets QV-eligible criteria.

Looking at the QV-eligible facts: "in 2023" counts as a specific date, but ISO 21434 is an organizational certification, not an individual one. That leaves just one QV-eligible fact—the date. The E-Systems business segment and the ISO 21434 framework are specific firm facts, but they don't meet the QV threshold. So this is Risk Management Process, Firm-Specific, with only one QV-eligible fact and multiple IS facts.

fact: E-Systems business segment has dedicated product cybersecurity processes

fact: ISO 21434 control framework for road vehicle cybersecurity engineering

fact: Received ISO 21434 Road Vehicle Cybersecurity Engineering certification

fact: Certification received in 2023


reasoning: The paragraph is framed by the Audit Committee's oversight: it directs the CIO/SIRT, receives reports, meets with the CIO annually, and reports to the Board. While CIO expertise and qualifications are mentioned, they are subordinate to the Audit Committee's directing and oversight chain (Audit Committee → Board). Per Case 5, the opening clause sets the frame as Board Governance. Specificity is Firm-Specific due to the CIO (cybersecurity-specific title on the IS list) and SIRT (named internal team), but no two QV-eligible hard facts are present (NIST/ISO/COBIT/ITIL are frameworks, not QV-eligible; cadences are generic).

thinking:
Let me analyze this paragraph carefully.

The paragraph covers multiple topics: Audit Committee direction, CIO and SIRT monitoring, expertise descriptions, reporting to Audit Committee, and Board oversight. Let me determine the dominant category.

Primary actors: Audit Committee directs, CIO and SIRT monitor/report, Board addresses issues through committee.

The paragraph has a mix of Board Governance and Management Role elements. Let me apply the decision rules.

Looking at the structure:
1. "At the direction of the Audit Committee, the CIO and SIRT monitor..." - Board directing, but CIO/SIRT doing

2. "The Company's CIO, together with other members of the SIRT, bring a wealth of expertise..." - This is about the people's qualifications
3. "The CIO prepares reports... for the Audit Committee" - CIO reporting to board committee
4. "At least annually, the Audit Committee meets with the CIO" - Board governance cadence
5. "The Audit Committee reports to the Board..." - Board governance chain

The dominant theme here is the Board's oversight structure and governance chain. While the CIO's expertise is mentioned, the paragraph primarily frames how the Audit Committee directs and oversees the CIO and SIRT's work, with regular reporting flowing back to the Board. The governance relationships and cadence are what tie the paragraph together. So I'm checking the specificity of the facts here. The CIO is a cybersecurity-specific role that qualifies for the IS list, and SIRT is a named internal team. NIST, ISO, COBIT, and ITIL are all established frameworks, which pushes this toward firm-specific territory. There aren't any hard verifiable facts like dates, dollar amounts, or headcounts that would make this QV-eligible, so this lands in Firm-Specific (3).

fact: CIO (Chief Information Officer) as cybersecurity-specific leadership role

fact: SIRT (Security Incident Response Team) as named internal team


reasoning: The paragraph describes the company's internal cybersecurity program: framework alignment, layered security controls, vendor risk as a component of the program, and employee training. Third-party risk is mentioned but as one element of the broader internal program, not the central topic. It names NIST 800 but contains no firm-specific facts beyond that—all controls listed (MFA, endpoint security, encryption, etc.) are common practices on the NOT list.

thinking:
Let me analyze this paragraph from Franklin Covey's 10-K filing.

Content: Describes their cybersecurity program alignment with NIST 800, layered security controls, third-party risk management, and training.

Category: This is primarily about the company's internal cybersecurity processes - framework adoption, security controls, monitoring, vendor oversight as a component, training. Third-party is mentioned but as one component. → Risk Management Process

Specificity: Named framework (NIST 800) → at least Sector-Adapted. Any firm-specific facts? The paragraph lists many security controls but they're all common practices.

Looking at what's missing here - no specific roles, dates, tools, or headcounts mentioned, just the NIST 800 standard reference and generic control descriptions. This lands at Sector-Adapted level.

fact: NIST 800 Cybersecurity Framework


reasoning: The paragraph identifies specific cybersecurity leadership personnel (CISO and Director of IT Security, Risk and Compliance), their combined experience, and their areas of expertise — this is about the people and their qualifications, not about what the program does. While it lists areas of expertise (threat assessments, incident response, etc.), these serve to describe the individuals' backgrounds rather than the company's processes. Specificity is Firm-Specific: multiple IS-list facts (CISO, Director of IT Security, named ISC committee, 20 years), but only one QV-eligible hard fact (20 years), falling short of the two needed for Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

The paragraph describes the ISC (Information Security Committee) members - specifically the CISO and Director of IT Security, Risk and Compliance, their combined experience, and areas of expertise.

Content Category: This is about the people - their roles, qualifications, and experience. The person-vs-function test: the paragraph tells us WHO these people are (CISO, Director of IT Security), their combined experience (20 years), and their areas of expertise. It's about the persons' qualifications. → Management Role

Specific facts:
- CISO (cybersecurity-specific title) → named_role

- Director of IT Security, Risk and Compliance (cybersecurity-specific title) → named_role
- Combined 20 years of experience → quantified

Now checking QV eligibility: the 20 years is a specific number that qualifies, but named roles don't. That gives me just one QV-eligible fact, and I need at least two. No third-party firms, specific dates, dollar amounts, tools, or certifications mentioned. This falls short of QV requirements, so it's Firm-Specific.

fact: Chief Information Security Officer (CISO)

fact: ISC (Information Security Committee) membership

fact: Combined 20 years of risk management experience


reasoning: The paragraph's primary communicative purpose is the company's approach to managing cybersecurity risks from third parties — vendors, service providers, and external users of its systems. While the first two sentences describe using third parties to assist the company's own cybersecurity (which leans RMP), the dominant and culminating point is the risk-based process for overseeing third-party cybersecurity risks. No named firms, tools, standards, dates, or specific numbers are provided — all references are generic ('cybersecurity consultants', 'penetration testing firms', 'third-party providers').

thinking:
Let me analyze this paragraph.

Content: Discusses use of third-party providers for business functions and cybersecurity assistance, and maintains a risk-based approach to oversee cybersecurity risks from third parties.

Category: This is about third-party risk management. The central topic is oversight of external parties - both using them for cybersecurity help and managing risks they present. The last sentence especially focuses on vendor/supplier risk oversight.

Actually, let me reconsider. The paragraph has two parts:
1. Using third-party providers for cybersecurity functions (external assessors hired to test/help the company → Risk Management Process per Rule 3)

2. Risk-based approach to oversee cybersecurity risks from third parties (vendor oversight → Third-Party Risk)

The paragraph spans both categories. The first two sentences describe hiring external help for the company's security program, while the third sentence shifts to overseeing risks that third parties themselves present. The dominant theme is third-party relationships overall, with the last sentence being the longest and most substantive, focusing on vendor oversight. Per Rule 3, the distinction is clear: external assessors hired to serve the company's needs fall under Risk Management Process, while requirements imposed on vendors fall under Third-Party Risk. The first part of this paragraph leans toward the former.

Actually, looking at it again: the paragraph consistently frames third parties as the central concern throughout—first as service providers, then as entities whose risks need managing. The last sentence is unambiguously about Third-Party Risk, and that's the paragraph's primary communicative purpose. I'm assigning this to Third-Party Risk.

On specificity: there are no named standards, firms, dates, or numbers. Everything uses generic language like "third-party providers" and "cybersecurity consultants." This is Generic Boilerplate.


reasoning: The paragraph describes a step-by-step incident response escalation process — from CISO activation of the CIRT through materiality determination to board notification. Although many roles are named, the paragraph is about the function (what happens when an incident occurs) rather than any person's credentials or background, making it Risk Management Process per the person-vs-function test. Multiple firm-specific facts (CISO, CIO, named CIRT program, named BTTC committee, specific departmental composition of the materiality committee) place it at Firm-Specific, but no two QV-eligible hard facts (dates, dollar amounts, headcounts, named third-party firms, named tools) are present.

thinking:
Let me analyze this paragraph carefully.

Content: This describes the incident response escalation process - what happens when a cybersecurity incident is suspected. It covers CISO activating CIRT, escalation chain, materiality determination committee, and board notification.

Category: This is primarily about the company's internal incident response process - the escalation workflow, committee convening, materiality determination. While it mentions many roles and committees, the paragraph is describing a PROCESS (what happens step by step when an incident occurs), not describing WHO a person is. This is Risk Management Process.

Specific facts:
- CISO (cybersecurity-specific title) ✓

- CIO (cybersecurity-specific title) ✓
- "Cyber Incident Response Team" ("CIRT") - named internal program with unique identifier ✓
- Business Technology and Transformation Committee ("BTTC") - named non-generic committee ✓
- Chief Financial and Risk Officer - not standard, but this is a C-suite variant
- Senior Vice President of Investor Relations - generic
- Chief Accounting Officer - generic

Now I'm checking for hard verifiable facts like dates, dollar amounts, headcounts, named third-party firms, products, certifications, or years of experience - none are present. This gives me multiple specific facts to work with.

The firm-specific elements (CISO, CIO, CIRT as a named program, and BTTC as a non-generic committee) point to Firm-Specific classification, though there aren't enough quantifiable facts to reach the higher threshold.

fact: CISO (Chief Information Security Officer)

fact: CIO (Chief Information Officer)

fact: Cyber Incident Response Team ("CIRT") — named internal program with unique abbreviation

fact: Business Technology and Transformation Committee ("BTTC") — non-generic named committee

fact: Established materiality determination committee composed of General Counsel, Chief Financial and Risk Officer, SVP of Investor Relations, and Chief Accounting Officer


content_category: Incident Disclosure

reasoning: The paragraph describes an actual cybersecurity incident — the MOVEit vendor breach affecting Umpqua Bank customers — with timeline, scope, compromised data types, and notification actions. Multiple hard verifiable facts (specific dates, named product MOVEit, exact customer count of 429,252) far exceed the two-fact QV threshold.

thinking:
Incident disclosure with multiple verifiable facts.

Content: Describes MOVEit incident via vendor, dates, scope, response actions.

Category: Incident Disclosure - describes what happened, when, scope, response.

Specific facts:
- June 21, 2023 (date)
- Umpqua Bank (subsidiary name - company self-reference, NOT list)
- MOVEit (named product/tool)
- June 22, 2023 (date)
- August 2023 (date)
- 429,252 customers (specific number)

QV: dates + named product + specific number = well more than 2 hard verifiable facts → Quantified-Verifiable

fact: MOVEit filesharing software

fact: August 2023

fact: 429,252 affected customers


reasoning: The paragraph describes engaging third-party experts to perform risk assessments alongside the internal audit team — these external assessors serve the company's own risk assessment process (Rule 3: external assessors hired to test the company → Risk Management Process, not Third-Party Risk). No named firms, frameworks, dates, or other specific facts are present; 'third-party industry experts' and 'internal audit team' are generic, and 'the Program and the Plan' lack distinguishing identifiers.

thinking:
Classify this paragraph.

Content: Company engages third-party experts to work with internal audit team on risk assessments.

Category: This is about third-party engagement for risk assessment purposes. The third parties serve the company's own risk assessment process - they're hired to assess the company, not vendors being overseen. Per Rule 3: "External assessor hired to test the company → Risk Management Process." So this is Risk Management Process.

Specificity: No named frameworks, no named firms ("third-party industry experts" is generic), no specific dates, no numbers. "Internal audit team" is generic. "the Program and the Plan" - these seem like named internal programs but without unique identifiers beyond generic capitalization.

Looking at "the Program" and "the Plan" more closely, they're just capitalized generic terms without distinguishing names or abbreviations, so they don't meet the threshold for specific named programs. There are no IS-list facts present, which means this falls into Generic Boilerplate.


reasoning: The paragraph makes an explicit materiality assessment ('not aware of any risks from cybersecurity threats that have materially affected the Company, including our business strategy, results of operations, or financial condition'), which is Strategy Integration per Rule 6. The appended cross-reference to Risk Factors does not change the classification. No firm-specific facts are present; the materiality language is boilerplate.

thinking:
Materiality assessment + cross-reference. Per Rule 6, the materiality assessment is the substantive content → Strategy Integration. The cross-reference doesn't change that.

Specificity: No named standards, no firm-specific facts from the IS list. Generic boilerplate materiality language.


reasoning: The paragraph primarily describes a specific cybersecurity incident — the MOVEit security incident in May 2023 — including timeline, containment actions, scope (no customer data compromised), and forensic confirmation. The closing materiality sentence is subordinate to the incident narrative. Two QV-eligible hard facts: specific date (May 2023) and named product (MOVEit).

thinking:
Let me analyze this paragraph.

Content: Describes a specific cybersecurity incident (MOVEit security incident in May 2023 at Umpqua Bank), response actions, forensic investigation, and concludes with a materiality assessment.

Category: This describes what happened in an incident - timing, response, scope, forensic engagement, and impact. The materiality statement at the end is subordinate to the incident narrative. → Incident Disclosure

Specific facts:
- "May 2023" - specific date
- "MOVEit" - named product/system
- "Umpqua Bank" - company self-reference (NOT list)

- "independent forensics firm" - unnamed (NOT list)

The materiality conclusion at the end is part of the incident narrative context.

Specificity:
- Specific date: May 2023 ✓ (QV-eligible)
- Named product: MOVEit ✓ (QV-eligible)
- That's 2 hard verifiable facts → Quantified-Verifiable

fact: MOVEit


reasoning: The paragraph describes internal cybersecurity controls, vulnerability management, and a security awareness training program. The VP of Information Security is mentioned as attribution for who maintains the program, but the substantive content is about what the program does (controls, training, testing) — applying the person-vs-function test, this is about the function. The VP of Information Security is a cybersecurity-specific title (✓ IS list) granting Firm-Specific, but no second QV-eligible hard fact exists to reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph from Asure Software's 10-K filing.

Content: Describes internal security controls, vulnerability management, security awareness program, training. The VP of Information Security is mentioned as designing the Security Awareness Program. The bulk of the paragraph is about what the program does - controls, training, testing.

Category: This is primarily about the company's internal cybersecurity processes - controls, risk treatments, security awareness training. The VP of Information Security is mentioned briefly as attribution for who maintains the program. Applying the person-vs-function test: remove "our VP of Information Security" and the paragraph still describes the program fully. → Risk Management Process.

Now checking the specificity of the terms mentioned. The VP title is clearly cybersecurity-specific and qualifies. The Security Awareness Program itself is fairly generic despite having a formal name—it's not a unique identifier like a proprietary system would be. The Security Operations team is just a standard functional name. The controls referenced are general security practices without distinctive naming.

So the only firm-specific element here is the VP of Information Security role, which makes this Firm-Specific (3). For quantifiable verification, I don't have any hard facts like dates, dollar amounts, headcounts, or named tools—just a job title—so this doesn't meet the QV threshold.

This falls under Risk Management Process with a Firm-Specific classification.

fact: VP of Information Security designs, implements, and maintains the Security Awareness Program


reasoning: The paragraph primarily describes how Honda's cybersecurity risk assessment and reporting process works — supervisory divisions conduct assessments, report through the Risk Management Committee to the Risk Management Officer, who monitors responses. While the Risk Management Officer's qualifications are briefly mentioned, the dominant content is the organizational process and flow of risk management activities. Applying the person-vs-function test, removing the officer's title leaves the process description intact. Specificity is Firm-Specific: 64 members is a specific headcount (one QV-eligible fact) and the named divisions (Quality Innovation Operations, Corporate Administration Operations) and Risk Management Committee are IS-list facts, but only one QV-eligible hard fact prevents reaching Quantified-Verifiable.

thinking:
Let me analyze this paragraph carefully.

Content: Describes Honda's cybersecurity supervisory divisions conducting risk assessments, reporting to Risk Management Officer through Risk Management Committee. Mentions 64 members, their experience, specific divisions (Quality Innovation Operations and Corporate Administration Operations), and the Risk Management Officer's role.

Category: This is about management structure and processes. The paragraph describes who does what - the cybersecurity supervisory divisions, the Risk Management Officer, and the Risk Management Committee.

Person-vs-function test: The paragraph mentions the Risk Management Officer but focuses more on the organizational structure and process (risk assessments, reporting, monitoring).

The core purpose here is explaining how risk management actually operates within the company—who performs the assessments, the reporting chain, and the oversight mechanisms. While it touches on team composition and the Officer's qualifications, the dominant thread is the process itself and the organizational framework supporting it.

Looking at what qualifies as quantifiable and verifiable facts: the 64-member headcount is concrete and measurable, but the specific division names are organizational details rather than quantifiable metrics. The Risk Management Committee is a named entity that appears on the IS list, so that's relevant, but I need to focus on what's actually countable and verifiable here.

Since only the headcount of 64 members meets the QV threshold and I need at least two QV-eligible facts for that classification, this falls short. However, the Risk Management Committee as a named non-generic committee, combined with the specific division compositions and the member count, gives me three distinct IS facts—enough to classify this as Firm-Specific.

fact: Risk Management Committee

fact: 64 members in cybersecurity supervisory divisions

fact: Quality Innovation Operations and Corporate Administration Operations divisions


reasoning: The Audit Committee is the grammatical subject throughout, describing its oversight activities: meeting with management, reviewing cybersecurity information, and reporting to the Board. This is classic board-committee oversight disclosure. All elements are generic — Audit Committee, Board of Directors, 'quarterly,' 'management,' and listed practices (training, risk assessments, incident response plans) are all on the NOT list with no firm-specific or named-standard content.

thinking:
Let me analyze this paragraph.

Content: The Audit Committee meets with management to assess cybersecurity risks, receives various types of cybersecurity information, and reports to the Board quarterly.

Category: The grammatical subject is the Audit Committee (a board committee). It describes what the committee does - meets with management, reviews cybersecurity data, reports to the Board. This is Board Governance.

Specificity: Let me check the facts:
- "Audit Committee" - on the NOT list (generic governance)
- "Board of Directors" - on the NOT list
- "quarterly basis" - generic cadence, on the NOT list

- "management" - generic, on the NOT list
- Various practices listed (training programs, risk assessments, etc.) - common practices

No named frameworks, no cybersecurity-specific roles, no specific dates, no named tools or firms. Everything here is generic boilerplate.


reasoning: The paragraph opens with Mr. Daly and team credentials but the dominant content describes what the cybersecurity team does — monitoring, vulnerability scans, penetration tests, threat intelligence, incident escalation protocols — all process/function descriptions. Applying the person-vs-function test: removing Mr. Daly's name and title, the paragraph still fully describes cybersecurity processes, making it Risk Management Process rather than Management Role. Specificity reaches Quantified-Verifiable with two hard verifiable facts: named CISSP certifications and named GIAC certification from the SANS Institute (a named external institution).

thinking:
Let me analyze this paragraph.

Content: Describes Mr. Daly's team, their certifications, what the team does (monitors, evaluates, vulnerability scans, pen tests, threat intelligence), tools and methodologies, incident escalation to Mr. Daly, and Mr. Daly being informed about the program.

Category: The paragraph mentions Mr. Daly but the bulk is about what the cybersecurity team DOES - monitoring, scanning, pen testing, threat intelligence, tools, incident assessment. Apply the person-vs-function test: if I remove "Mr. Daly" references, the paragraph still describes processes. But wait - the paragraph also describes team credentials (CISSP, GIAC from SANS Institute).

The opening mentions the team's credentials, but the dominant content focuses on what they actually do—the monitoring, scanning, testing, and threat intelligence activities. Even if I strip away Mr. Daly's name, the core remains a description of processes and functions, so this falls under Risk Management Process.

For the specifics: CISSP and GIAC from SANS are named certifications, which makes them quantified-verifiable facts. But here's the question—these certifications belong to team members, not to a specific named individual, and the codebook criteria for QV-eligible certifications seems to apply to individuals rather than teams collectively.

fact: CISSP credentials held by team members

fact: Global Information Assurance Certification from the SANS Institute


reasoning: The paragraph is about the people leading cybersecurity — their collective experience, named individuals (Mr. Madigan, Mr. James), and their academic credentials. This passes the person-vs-function test: remove the people and qualifications and nothing substantive remains. Specificity is Firm-Specific: 'over 60 years' is one QV-eligible fact (years of experience), but the named degrees lack named universities (explicitly excluded from QV), so only one hard verifiable fact exists — not enough for Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

The paragraph discusses the InfoSec Leadership Team, their collective experience (60+ years), and names two individuals (Mr. Madigan, Mr. James) with their specific degrees.

Content category: This is about the people - their qualifications, experience, credentials. The person-vs-function test: the paragraph tells us about WHO these people are (experience, degrees). Remove the people and credentials, and there's barely anything left. → Management Role.

Specificity: Let me count facts.
- "InfoSec Leadership Team" - named team/role (IS list)

- "collectively over 60 years" - quantified experience (QV-eligible)
- "Mr. Madigan" and "Mr. James" - named individuals (not QV-eligible on their own)
- Their degrees are specific but lack university names, so they don't qualify as named third-party credentials

So I'm looking at one QV-eligible fact here: the 60+ years of combined experience. The named individuals and their degrees add detail but don't meet the quantification threshold.

That puts this in the Firm-Specific category rather than QV.

fact: InfoSec Leadership Team

fact: collectively over 60 years of prior work experience

fact: Mr. Madigan - MBA in Information Technology Management

fact: Mr. James - MS in Information Security and Assurance


reasoning: The paragraph's primary content is the organizational structure and people behind the cybersecurity program: the CISO's qualifications and reporting line to the CRO, the composition of the ERM Committee, the CRO's experience, the Incident Response Team's composition chaired by the CISO, and board member expertise. While process elements are present (remediation, compliance, IR Plan purpose), they are subordinate to explaining who holds what role and how the management structure is organized. One QV-eligible fact (three independent directors) but not two, so Firm-Specific based on multiple IS-list items (CISO, CTO, named non-generic committees).

thinking:
Let me analyze this paragraph from Dime Community Bancshares' 10-K Item 1C filing.

This is a dense paragraph covering multiple topics. Let me break it down:

1. CISO reporting to CRO, Enterprise Risk Management Committee (CEO, CFO, CTO), Enterprise Risk Committee of the Board
2. Board members with cybersecurity expertise
3. CISO's experience and certifications (unnamed)
4. CISO oversees proactive initiatives, remediation, compliance, DR/BC/IR

5. CRO leads the Risk Management function with a cross-functional team of internal and external information security professionals
6. Incident Response Team chaired by the CISO with executive management participation, designed to execute the Incident Response Plan

The paragraph is really describing the organizational structure and governance framework for cybersecurity—who reports to whom, what committees oversee the program, and how the company has structured its incident response capabilities. It's mixing governance roles with operational responsibilities, showing that cybersecurity oversight flows through multiple levels from the board down through executive committees to the CISO and their teams. The specificity check confirms this is Management Role - the CISO and CRO titles are cybersecurity-specific, the named committees are concrete rather than generic, and the focus is clearly on who holds what position and how they're organized rather than what processes they execute.

For quantifiable verification, I only have one hard fact: the three independent directors mentioned as a headcount. The certifications and experience descriptions are too vague to count as verifiable. That leaves me with multiple firm-specific facts - the CISO, CTO, and the two named committees - which puts this solidly in the Firm-Specific category.

Looking at the content more holistically, while there's board governance material present, the main focus is really on the management structure and roles, particularly around the CISO and the risk committees. So Management Role is the right categorization here.

fact: Chief Information Security Officer (CISO)

fact: CTO (member of ERM Committee)

fact: Enterprise Risk Management Committee (CEO, CFO, CTO among others)

fact: Enterprise Risk Committee of the Board

fact: three independent directors on Enterprise Risk Committee


reasoning: The paragraph describes how FTI's client-facing cybersecurity consultants advise internal teams, brief executives on threat intelligence, and provide supplemental incident response services — all internal cybersecurity processes. No named frameworks, cybersecurity-specific titles, dates, tools, or third-party firms appear; references to 'external consultants' are unnamed, and the company's own name is not a specific fact per the codebook.

thinking:
Let me analyze this paragraph from FTI Consulting's 10-K filing.

The paragraph describes how FTI's client-facing cybersecurity consulting practice feeds back into the company's own security posture. It's about internal processes - how the company leverages its own cybersecurity consultants to improve its security.

Content category: This is about the company's internal cybersecurity processes - how they use their consulting experts to advise internal teams, brief executives, and provide incident response. This is Risk Management Process.

Specificity: Let me check for specific facts:
- No named frameworks, no specific dates, no dollar amounts, no named tools, no named third-party firms

- The language is generic throughout - "cybersecurity and information security experts," "external consultants," unnamed executives and directors
- No cybersecurity-specific titles like CISO or CTO mentioned
- While FTI's consulting practice feeding into their own security is somewhat distinctive to the company, the disclosure itself lacks the specific details, named standards, tools, or dates that would make it substantive rather than boilerplate.

This falls into Generic Boilerplate.


reasoning: The paragraph describes what the InfoSec Leadership Team does operationally — monitoring prevention, mitigation, detection, remediation, and managing incident response and disclosure processes. Applying the person-vs-function test: remove the team name and the paragraph still describes processes (incident response plan, disclosure controls). No qualifications, credentials, or backgrounds are discussed, so this is about the function, not the people. 'InfoSec Leadership Team' is a cybersecurity-specific named team qualifying as a firm-specific fact, but all remaining content (incident response plan, disclosure controls, material incident language) is generic boilerplate.

thinking:
Let me analyze this paragraph.

Content: Describes the InfoSec Leadership Team's role in monitoring cybersecurity incidents and the process for disclosing material incidents. This is about internal processes - incident response, risk management, disclosure controls.

Category: The "InfoSec Leadership Team" is the subject, but the paragraph describes what the team does functionally (monitors prevention, mitigation, detection, remediation; manages incident response plan; disclosure controls). This is about the function/process, not about the people. Applying the person-vs-function test: remove the team name and it's still a process description. → Risk Management Process.

Now I'm reconsidering whether "InfoSec Leadership Team" itself might be a management role designation. But the paragraph focuses on operational activities rather than qualifications or credentials, so the person-vs-function test still points to the process. For specificity, "InfoSec Leadership Team" is a named cybersecurity-specific team that doesn't appear on the exclusion list, which could make it firm-specific. However, there's only one potentially QV-eligible fact here—the team name itself—and I need to verify whether it actually qualifies as firm-specific under the criteria.


reasoning: The paragraph contains a materiality assessment ('will not materially affect us, including our business strategy, results of operations, or financial condition'), which per Rule 6 makes it Strategy Integration even though it also includes a cross-reference to Risk Factors. No firm-specific facts, named frameworks, or verifiable details are present — all language is generic boilerplate.

thinking:
Let me analyze this paragraph.

Content: Discusses limitations of policies, acknowledges no recent material incidents, notes industry risks, and includes a materiality disclaimer with cross-reference.

Category: The paragraph contains a materiality assessment ("will not materially affect us, including our business strategy, results of operations, or financial condition"). Per Rule 6, this is Strategy Integration. The cross-reference doesn't change that.

Specificity: No named frameworks, no firm-specific facts from the IS list. Generic language throughout. → Generic Boilerplate.


reasoning: The paragraph describes a specific cybersecurity incident — its timing, operational scope (IT infrastructure, business applications, order processing, logistics, billing systems), and consequences. While it also includes financial impact language and a materiality conclusion, the dominant content is the incident's operational impact and scope, which the Incident Disclosure definition explicitly covers ('descriptions of affected data/systems scope or operational impact of a disclosed incident'). Two QV-eligible hard facts: the specific incident date (September 23, 2023) and a specific fiscal period for impact (first quarter of fiscal 2024).

thinking:
Let me analyze this paragraph from Johnson Controls International's 10-K filing.

Content: Describes a specific cybersecurity incident - date, impact on operations, financial effects, and materiality assessment.

Category analysis: This paragraph describes what happened (incident on September 23, 2023), its operational impact (disruptions, lost revenues, billing system issues), and concludes with a materiality assessment. The dominant content is the incident narrative and its consequences. However, there's a mix - the paragraph describes the incident AND discusses financial/business impact AND makes a materiality assessment.

Looking at the tiebreakers:
- "Paragraph DESCRIBES what happened in an incident (dates, access, encryption, scope, response actions) → Incident Disclosure"

- "Paragraph ONLY discusses financial cost, insurance, or materiality of an incident WITHOUT describing the event → Strategy Integration"

This paragraph does both - it describes what happened AND discusses financial impact. The first two sentences describe the incident itself. The middle sentences discuss business/financial impact (lost revenues, billing disruptions, cash flow). The final sentence is a materiality assessment.

Given the dominant category rule - the paragraph starts with incident description but the bulk is about financial/business impact. Let me count: ~2 sentences on incident description, ~3 sentences on financial impact and materiality. The financial/strategic impact seems to dominate.

Actually, re-reading: the paragraph describes the incident's operational and financial consequences in detail. The incident description is paired with its business consequences throughout, making this fundamentally about how the incident affected operations and finances rather than just narrating what happened technically.

Per the tiebreaker: "Mixed: 'We detected X... at a cost of $Y' → Assign based on which is dominant — if cost is one sentence in a paragraph about the incident → Incident Disclosure"

Here the financial impact spans multiple sentences with a materiality conclusion at the end. The paragraph's primary purpose is assessing business and financial impact rather than explaining what technically occurred. The incident itself is briefly noted (weekend of Sept 23, internal IT infrastructure), while the focus shifts to revenues, expenses, billing systems, cash flows, and insurance recoveries. This leans toward Strategy Integration.

But wait — the operational disruptions to order processing, logistics, and billing systems describe the incident's scope and operational impact, which falls under Incident Disclosure per the category definition. The paragraph does describe what happened and its scope, not just the financial consequences.

Re-reading the tiebreaker: if the paragraph describes what happened (dates, scope, affected systems, response) it's Incident Disclosure; if it only discusses financial cost and materiality without describing the event itself, it's Strategy Integration. This one does describe the incident and its operational scope, even though financial language dominates. The disruptions to business applications are part of that scope description.

The materiality conclusion feels like the main takeaway for Item 1C, but the incident description spans multiple sentences with operational details — it's more than just a brief mention. I'm categorizing this as Incident Disclosure since the paragraph describes what happened, the operational impact, and the response, with materiality as a concluding element rather than the primary point.

Now checking specificity: the weekend of September 23, 2023 is a specific date that qualifies for QV eligibility, and the first quarter of fiscal 2024 is a specific time period.

Looking at what counts as hard verifiable facts — September 23, 2023 is clearly a specific date, but "first quarter of fiscal 2024" and "full year fiscal 2024" are fiscal period references rather than independently verifiable calendar dates. So I have one clear specific date, with the fiscal references serving more as context.

fact: Weekend of September 23, 2023

fact: First quarter of fiscal 2024 (billing disruption timing)


reasoning: The paragraph contains an explicit materiality assessment ('have not materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition'), making it Strategy Integration per Rule 6. The cross-reference to Item 1A Risk Factors does not change the classification. No firm-specific facts are present — the language is standard boilerplate.