fact: February 2024 - specific date when Board delegated cybersecurity oversight to Audit Committee

reasoning: The paragraph answers 'How does the board oversee cybersecurity?' — describing delegation to the Audit Committee, reporting flows from officers to the committee and full board, and the scope of those briefings. Officers (Interim CFO, Chief Legal Officer) are mentioned in the context of reporting TO the board, making this an oversight-structure description (BG per Rule 1). 'February 2024' is a specific month+year tied to a concrete cybersecurity governance action (delegation of oversight responsibility), which is externally verifiable via board records or proxy filings, elevating to Level 4. Note: Interim CFO and Chief Legal Officer are not cybersecurity-specific titles, and Audit Committee is generic — these do not qualify as firm-specific facts.

thinking:
Let me analyze this paragraph.

Content Category: This describes how the board oversees cybersecurity - delegation to Audit Committee, reporting structure from management to board. The primary question answered is "How does the board oversee cybersecurity?" → Board Governance.

Even though officers are mentioned (Interim CFO, Chief Legal Officer), they appear in the context of reporting TO the board, describing the oversight flow. Per Rule 1, this is BG.

Specificity: Let me scan for facts.
- "February 2024" - specific date tied to delegation of cybersecurity oversight → QV-eligible (specific month+year tied to a cybersecurity fact)

- The other elements like "Interim Chief Financial Officer," "Chief Legal Officer," "Audit Committee," and "Board of Directors" are all generic roles and structures that don't add firm-specific detail.

The key verifiable fact here is "February 2024" - it's a concrete date tied to when the board delegated cybersecurity oversight, something that could be confirmed through board minutes or proxy filings.


content_category: Management Role

fact: threat intelligence

type: quantified

category_confidence: high

specificity_confidence: high

reasoning: The paragraph primarily answers 'how is management organized to handle cybersecurity?' by describing the Head of IT's responsibilities, qualifications, and experience. Person-removal test: removing the role and experience leaves only a thin description of reviewing threat intelligence and receiving updates — the paragraph's substance is the person. 'Over thirty years of experience' is a verifiable lower-bound quantified fact (≥30 years, checkable against a resume), elevating specificity to Level 4.

provider: anthropic

generationId: agent-sdk

stage: benchmark

thinking:
Let me analyze this paragraph.

Content: Describes the Head of IT role, their experience, and what they do (reviews threat intelligence, receives updates from third-party providers).

Category: The paragraph is about who manages cybersecurity (Head of IT), their experience (30+ years), and what they do. Let me apply the person-removal test: Remove "Head of IT", "over thirty years of experience leading information technology teams in the life sciences industry", reporting lines. What remains? "reviews threat intelligence, and receives updates from the Company's third-party providers, to help identify risks from cybersecurity threats." This is somewhat substantive but thin.

The paragraph is primarily about the person's role and qualifications, so it's MR. "Head of IT" isn't a firm-specific cybersecurity title per the codebook, but the "over thirty years of experience" is a quantified fact that counts as QV since it's a lower bound.

Looking at the domain specificity now: "threat intelligence" is clearly cybersecurity-specific, while "life sciences industry" isn't. That gives me a domain term at Level 2 and the quantified experience at Level 4, so the overall classification is Level 4.


content_category: Board Governance

fact: Chief Information Officer (CIO) who also serves as Chief Information Technology Architect & Chief Information Security Officer (CISO)

fact: internal security staff

reasoning: The paragraph primarily answers 'how does the board oversee cybersecurity?' — describing the Committee's quarterly reports, annual briefings, escalation protocols, and reporting to the full Board, all governance-chain oversight structure → BG. The CIO/CISO dual role is a firm-specific organizational detail that elevates to Level 3, but no QV-eligible facts (no specific numbers, dates, named external firms, or verifiable certifications) are present.

thinking:
Let me analyze this paragraph.

Content: Describes how the Committee receives reports from management on cybersecurity risks, quarterly reports, annual briefings, escalation protocols, presentations from CIO/CISO, and reports to the full Board.

Category: This is about how the board (via Committee) oversees cybersecurity - Board Governance (BG). The governance chain and oversight structure is the primary content.

Specificity: Let me scan for facts:
- "quarterly reports" - generic cadence, not QV
- "at least annually" - generic cadence
- CIO, CISO - these are cybersecurity-specific titles → firm-specific (Level 3)

- The named roles of Chief Information Officer and Chief Information Security Officer, plus the organizational detail that the CIO also serves as CISO, are all firm-specific identifiers. Written escalation protocols are mentioned but aren't domain-specific terminology, and external experts are referenced without names or details. No quantifiable facts like specific numbers, dates, named external entities, or certifications appear here.

Level 3.


content_category: Risk Management Process

fact: HITRUST framework

type: framework

fact: SOC2 framework

fact: penetration testing

fact: threat modeling

fact: network firewalls

fact: vulnerability scanners

fact: identity and access management systems

fact: phishing email simulations

fact: NIST framework

fact: access controls

fact: vulnerability assessments

fact: cybersecurity threat intelligence

reasoning: This paragraph is an extensive description of what the cybersecurity program does — risk identification, security tools, training, incident response planning, and insurance — directly answering 'What does the cybersecurity program do?' → RMP. Third-party mentions (vendors, pen testers hired by the company) are subordinate components of the internal program. The paragraph is rich in domain terminology (IDS/IPS, IAM, phishing simulations, penetration testing, vulnerability scanners, HITRUST, SOC2, NIST), but frameworks are referenced as alignment rather than held certifications, no named external entities or specific numbers appear, and no cybersecurity-specific leadership titles are mentioned, keeping it at Level 2.

thinking:
Let me analyze this paragraph carefully.

Content Category: This paragraph describes what the cybersecurity program does - risk assessment methodology, framework references, security tools, training, incident response planning, etc. It answers "What does the cybersecurity program do?" → RMP

Third-party mentions are present but subordinate to the overall program description. The central topic is the company's internal cybersecurity program.

Specificity: Let me scan for facts.

Domain terms (Level 2):
- HITRUST framework
- SOC2 framework
- penetration testing
- threat modeling
- network firewalls
- vulnerability scanners
- intrusion prevention and detection systems (IDS/IPS)

- anti-malware/endpoint protection
- identity and access management (IAM)
- phishing email simulations
- NIST framework
- access controls

Firm-specific (Level 3):
- "quarterly, mandatory training" - generic cadence
- "quarterly phishing email simulations" - generic cadence
- "annual tabletop exercises" - generic cadence
- "Incident Response Plan" based on NIST, HITRUST, SOC2 - named internal program? Generic name though.

QV-eligible (Level 4):
- Third-party service providers conducting pen testing - unnamed, not QV
- "cybersecurity risk insurance" - no specific amount

Looking at the alignment language more carefully—the incident response plan and process comparisons are aligned with these frameworks rather than certified against them, which keeps this at Level 2. I'm not finding any firm-specific details like named leadership roles, committees, or individuals, and there are no QV-eligible facts with specific numbers or external certifications. This is solidly Level 2 with domain terminology.


content_category: Strategy Integration

reasoning: The paragraph states a conclusion about materiality: no breaches have occurred and no cybersecurity risks are 'reasonably likely to have a material effect on our results of operations or financial condition' — this is the SEC's Item 106(b)(2) assessment language, making it SI. No domain terminology, firm-specific facts, or verifiable claims are present; 'year ended September 30, 2024' is reporting-period context and the negative breach assertion is not externally verifiable, so specificity remains Level 1.

thinking:
Let me analyze this paragraph.

Content: This is from a Grayscale crypto trust. It makes a negative assertion about breaches, then discusses materiality.

Category: The paragraph states conclusions about materiality - "no risks from any potential cybersecurity threat...reasonably likely to have a material effect on our results of operations or financial condition." This is a materiality assessment → SI.

Also "There have not been any breaches" is a negative assertion with materiality framing.

Per Rule 5: "Have not experienced any material cybersecurity incidents" → SI. And "reasonably likely to materially affect" → SI.

The specificity here is low—there are no domain-specific details, firm-specific facts, or quantifiable metrics, just boilerplate SEC language and generic entity references. The "no breaches" claim is a self-assertion without verifiable support. This rates as Level 1.


reasoning: The paragraph answers 'How does the board oversee cybersecurity?' — describing board responsibility for oversight, board expertise areas, strategic direction review, and resource allocation. No domain terminology passes the ERM test (all general governance language), no firm-specific cybersecurity roles or named committees beyond the generic 'Board,' and no verifiable facts, so this remains Level 1.

thinking:
Let me analyze this paragraph.

Category: This answers "How does the board oversee cybersecurity?" - Board oversight, board expertise, board reviews strategic direction, board ensures resources allocated. This is BG.

Specificity: Let me scan for facts.
- "The Board" - generic, every company has one
- "diverse expertise on topics including accounting and financial management, corporate governance, global business, technology and innovation, human capital management, ESG, and cybersecurity" - this lists board expertise areas, but these are generic competency areas. The specific list of expertise areas could be considered firm-specific... but actually, listing out broad competency categories isn't really unique to this company.

- "reviews the strategic direction" - generic
- "adequate resources and budget are allocated" - generic

No domain terminology that passes the ERM test. No firm-specific facts like named cybersecurity roles or committees beyond "The Board". No QV facts either. This is all standard governance language that could apply to any company, so it's Level 1 - Generic Boilerplate.


fact: Security Governance Council (SGC)

fact: CISO chairs the SGC

fact: Specific departments listed: Operations, Information Technology, Finance, Internal Audit, Legal, Human Resources and Organizational Development, and Risk Management

reasoning: The paragraph primarily describes how management is organized to handle cybersecurity — the SGC's composition, membership by department, chair (CISO), mission, and reporting lines — making it MR. Person-removal test confirms: removing the CISO, committee structure, and department composition leaves almost no substance. Specificity is Level 3 due to the named committee (SGC), CISO as chair, and specific departmental composition, but no externally verifiable quantified facts push it to Level 4 (quarterly is a generic cadence).

thinking:
Let me analyze this paragraph.

Category: This describes the Security Governance Council (SGC) - its composition, membership, chair, meeting cadence, and mission. The primary question is "How is management organized to handle cybersecurity?" - this is about management-level committee structure, membership, and responsibilities. → MR

Person-removal test: Remove CISO, senior leaders, specific department names, committee membership details. What remains? Very little - just that there's a security program and some policies. The substance IS the organizational structure. → MR confirmed.

Specificity:
- CISO → firm-specific (named_role)

- Security Governance Council (SGC) → firm-specific (named_committee)
- The specific departments involved in the council are firm-specific details, and the quarterly meeting schedule is just a generic cadence without particular significance. There are no concrete numbers, dates, external references, or certifications mentioned. → Level 3.


content_category: None/Other

reasoning: This is a cross-reference directing readers to Item 1A Risk Factors, with no substantive cybersecurity disclosure. The 'may materially affect' language points elsewhere rather than stating a conclusion, making this N/O per the cross-reference rule. No domain terminology, firm-specific facts, or verifiable claims.


category_confidence: medium

reasoning: The paragraph primarily describes a commitment to a cybersecurity program and incorporating best practices, answering 'what does the program do?' albeit at the most generic level; the brief mention of board/Audit Committee support is subordinate framing, not the primary content. No domain terminology passes the ERM test ('safeguarding information systems from unauthorized access, use, disclosure, disruption, modification or destruction' is standard business language), 'Audit Committee' and 'Board of Directors' are not firm-specific, and no verifiable facts are present.

thinking:
Let me classify this paragraph.

Content: Generic commitment to safeguarding information, mentions industry best practices, supported by management and Board/Audit Committee.

Category: This is very generic. It mentions both management and board support but doesn't answer any specific question deeply. The primary question it answers is vaguely "what does the program do?" but it's extremely generic. It could also be seen as a general intro. Let me think...

It says "We are committed to safeguarding..." - generic statement. "We aim to incorporate industry best practices throughout our cybersecurity program" - generic RMP. "This program is supported by both management and our Board of Directors, including our Audit Committee" - brief mention of governance.

The bulk of this is about the program itself with just a passing reference to management and board support, so I'd classify it as RMP—answering "what does the cybersecurity program do?"—though it's extremely generic. Looking at specificity: Audit Committee, Board of Directors, management, industry best practices, and the standard CIA triad language are all boilerplate with no firm-specific facts or domain terminology that would pass scrutiny. This is Level 1 - Generic Boilerplate.


fact: Ontrack software solution used to monitor and track risk assessment and cybersecurity incidents

reasoning: The paragraph describes risk monitoring, review processes, and a software tool used for tracking risk assessments and cybersecurity incidents — answering 'what does the program do?' → RMP. The named software product 'Ontrack' is a specific, externally identifiable system, elevating specificity to Level 4.

thinking:
Classify this paragraph.

Content: Describes risk monitoring and review processes, mentions Ontrack software for risk assessment monitoring and cybersecurity incident tracking.

Category: This answers "What does the cybersecurity program do?" - describes monitoring, tracking tools, risk assessment processes. → RMP

Specificity:
- "Ontrack" is a named software product → Level 4 (named external entity/product)

Wait, is Ontrack a named external product or an internal tool? "the Ontrack software solution" - this seems like a named product. Let me consider whether it's externally verifiable.

Ontrack appears to be a GRC/risk management software product, so as a named external entity it qualifies for Level 4.


reasoning: This paragraph is a closing statement about risk management strategies aimed at minimizing breach impact — it answers 'what does the program do?' at the most generic level. No domain terminology, firm-specific facts, or verifiable claims are present; the language is entirely generic boilerplate that could appear in any filing.


reasoning: The paragraph primarily answers how the board oversees cybersecurity, describing the Audit Committee's oversight of cybersecurity risks, ERM integration, and quarterly management updates — all governance-flow content. No domain terminology, firm-specific facts, or verifiable claims are present; 'Audit Committee' exists at every public company, and terms like 'enterprise risk management,' 'quarterly updates,' and 'likelihood of occurrence and potential monetary impact' are general business language.

thinking:
Let me analyze this paragraph.

Content: Describes how the Audit Committee oversees cybersecurity risks through the ERM program, reviews risk assessments, and receives quarterly updates from management. This answers "How does the board oversee cybersecurity?" → Board Governance.

Specificity: Let me scan for facts.
- "Audit Committee" — every public company has one, NOT firm-specific
- "enterprise risk management program" — generic ERM language, Level 1
- "quarterly updates" — generic cadence
- "annually" — generic cadence
- "likelihood of occurrence and potential monetary impact" — general risk management language

- No domain terminology specific to cybersecurity beyond the word itself, no firm-specific details, and nothing that would qualify as a quantifiable value fact.

This is Level 1 - Generic Boilerplate.


reasoning: The paragraph primarily answers how the board oversees cybersecurity: full Board oversight, quarterly reports, escalation process for incidents, and board education — all describing information flow to the board. 'Director of IT' is explicitly listed as NOT firm-specific (general IT title below VP without security qualifier), 'third-party technology experts' are unnamed, 'quarterly' is a generic cadence, and no cybersecurity domain terminology appears (everything is general governance/ERM language like 'oversight,' 'escalation process,' 'compliance with relevant standards').

thinking:
Let me analyze this paragraph.

Content Category: The paragraph primarily answers "How does the board oversee cybersecurity?" - board oversight, quarterly reports, escalation process, board education. The Director of IT is mentioned but in the context of reporting TO the board. This is Board Governance.

Specificity: Let me scan for facts.
- "Director of IT" — this is a general IT title, NOT firm-specific per the codebook ("Head of IT", "IT Manager", "Director of IT" are listed as NOT firm-specific)
- "quarterly Board meeting reports" — generic cadence

- "independent third-party technology experts" — unnamed
- "cybersecurity" mentioned throughout but no domain-specific terminology
- "escalation process" — generic
- No domain terms that pass the ERM test
- No firm-specific facts that survive the filter
- No QV facts

Everything here is generic governance language with no firm-specific details or domain terminology, so this rates as Level 1.


fact: NIST CSF (National Institute of Standards and Technology Cybersecurity Framework)

fact: HIPAA

fact: SOC 2 Type II

fact: confidentiality, integrity, and availability (CIA triad)

reasoning: The paragraph answers 'what does the cybersecurity program do?' by describing framework references used for risk assessment, making it RMP. Multiple named frameworks (NIST CSF, HIPAA, SOC 2 Type II) are domain terminology elevating to Level 2, but the paragraph explicitly disclaims certification ('does not imply that we meet any particular technical standards'), so these remain aspirational references rather than verifiable claims, capping at Level 2.

thinking:
RMP - describes what the program does, frameworks referenced.

Specificity: NIST CSF, HIPAA, SOC 2 Type II are domain terms/frameworks. The paragraph explicitly says "This does not imply that we meet any particular technical standards" - so these are references, not certifications. That makes them Level 2 domain terms, not Level 4 verifiable claims.

Wait - SOX ITGC is more general IT/compliance. NIST CSF, HIPAA, SOC 2 Type II are domain terms.

Level 2.


reasoning: This paragraph is a cross-reference directing readers to Item 1A Risk Factors for cybersecurity risk descriptions, with no substantive cybersecurity disclosure of its own. The quoted risk factor language is generic speculation ('could lead to,' 'could experience') found in virtually any 10-K, not a materiality assessment or program description. N/O always receives Specificity 1.

thinking: Cross-reference paragraph pointing to Item 1A risk factors. No substantive cybersecurity disclosure.


reasoning: The paragraph contains only speculative risk language ('could result in,' 'could lead to,' 'could materially harm') and a cross-reference to Item 1A Risk Factors — no substantive cybersecurity measures, no materiality assessment/conclusion, and no description of what the company actually does. Per Rule 5 (N/O threshold) and the materiality rule ('could have a material adverse effect' is speculation, not an assessment), this is N/O. N/O always receives Level 1.

thinking:
Let me analyze this paragraph.

Content: This discusses potential impacts of IT system damage, cyber-attacks, references Item 1A Risk Factors, and speculative language about cybersecurity incidents potentially harming the company.

Category: This is speculative risk language ("could result in," "could lead to," "could materially harm") with a cross-reference to Item 1A. No actual cybersecurity measures described. No materiality assessment/conclusion. Pure speculation + cross-reference → N/O.

Specificity: N/O → always Level 1.


reasoning: The paragraph opens with a direct materiality assessment ('have not materially affected or are reasonably likely to materially affect') — this is the SEC's Item 106(b)(2) language stating a conclusion about business impact, making it SI. The cyber insurance mention and cross-reference are subordinate. For specificity, the materiality language is standard boilerplate found in most 10-K filings; 'cyber insurance coverage' is a general business concept that passes the ERM test (any risk manager would discuss insurance), not cybersecurity domain terminology; and the cross-reference adds no specific facts. No domain terms, firm-specific facts, or verifiable claims are present.

thinking:
Materiality assessment + insurance + cross-reference.

Category: The paragraph primarily states a conclusion about materiality ("have not...materially affected or are reasonably likely to materially affect us") → SI. There's also cyber insurance and a cross-reference, but the materiality assessment is the lead and primary content.

Specificity:
- "cyber insurance coverage" - this is a firm-specific organizational claim? Actually, mentioning they have cyber insurance is somewhat specific but let me think... "secured cyber insurance coverage" - is this domain terminology or firm-specific? Insurance is general business. "Cyber insurance" specifically... it's a business/financial product, not really domain terminology in the cybersecurity sense.

But it is a firm-specific fact about THIS company's posture. Many companies have cyber insurance, so it's not unique, yet it's still a specific organizational claim about what this company has done. The codebook lists "cybersecurity insurance" under SI covers, and it's not classified as domain terminology or firm-specific—it's a general business concept. The materiality statement itself uses standard SEC boilerplate language.

The cross-reference doesn't add substantive content. "Cyber insurance coverage" isn't domain terminology by the ERM test since insurance is a business concept, not a cybersecurity organizational detail like the roles and committees listed in the firm-specific codebook. An ERM professional would naturally discuss insurance, so it fails the ERM test. This is Level 1 generic boilerplate—the materiality language is standard, the insurance mention is generic, and the cross-reference is empty.


reasoning: The paragraph answers 'How does the board oversee cybersecurity?' — describing Board and Audit Committee oversight, reporting flow from the CFO, and update cadences. All entities mentioned (Board, Audit Committee, CFO) are generic governance structures present at every public company; no cybersecurity domain terminology, firm-specific facts, or verifiable claims are present, keeping this at Level 1.

thinking:
Let me classify this paragraph.

Content: Board and Audit Committee oversight of cybersecurity risks, reporting from CFO, update cadence.

Category: Board Governance - clearly answers "How does the board oversee cybersecurity?"

Specificity: Let me scan for facts.
- "Audit Committee" - every public company has one, NOT firm-specific
- "Chief Financial Officer" / CFO - generic governance role, NOT firm-specific
- "independent directors" - generic
- "regular updates," "at least an annual basis" - generic cadences

No domain terminology (no cybersecurity-specific technical terms). No firm-specific facts (CFO is not a cybersecurity-specific title). No QV facts.

This rates as Level 1 - it's purely generic governance language without any firm-specific details or technical depth.


fact: CTO

fact: Vice President of Information Technology and Security

fact: Brendan Hamilton (named individual)

fact: Previously General Manager of Technology at Wayfair

fact: Master of Science in Electrical Engineering from the University of Minnesota

fact: Certified Information Systems Security Professional (CISSP)

fact: Previously Vice President at an international bank with cybersecurity supervisory responsibility

reasoning: The paragraph's primary content is the qualifications, career history, and credentials of two named management figures responsible for cybersecurity — the person-removal test leaves only a shell sentence, confirming MR. Specificity reaches Level 4 via multiple QV-eligible facts: CISSP (verifiable via (ISC)²), named firm Wayfair, and named university (University of Minnesota) with a specific degree.

thinking:
Let me analyze this paragraph.

Content: Describes management roles (CTO and VP of IT Security) with their qualifications, experience, and credentials. The opening mentions "cybersecurity risk assessment and management processes" but the bulk is about WHO these people are.

Person-removal test: Remove names, titles, qualifications, experience → "Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management" — near-nothing remains. → MR

Specific facts:
- CTO (cybersecurity-specific VP+ title) → firm-specific

- Vaidyanathan Raghavan (named individual) → firm-specific
- VP of Information Technology and Security (VP-level with security qualifier) → firm-specific
- Brendan Hamilton (named individual) → firm-specific
- General Manager of Technology at Wayfair (named firm) → QV
- Master of Science in Electrical Engineering from University of Minnesota (named university) → QV
- CISSP certification → QV
- Vice President at an international bank (unnamed) → not QV

Multiple QV facts push this to Level 4.


reasoning: The paragraph answers 'how is management organized?' — it describes the composition of the information systems organization (formal education, relevant experience) and training of IT leaders. Person-removal test: removing references to the team and its qualifications leaves only generic policy development language. Specificity remains Level 1 because no cybersecurity domain terms pass the ERM test, no firm-specific roles (no CISO or VP-level titles named), and 'certifications' is mentioned generically without naming any specific credential (e.g., CISSP).

thinking:
Let me analyze this paragraph.

Content: Describes the information systems organization and management team responsible for cybersecurity policies, their qualifications (formal education or relevant experience), and that leaders receive periodic training including certifications.

Category: This is about how management is organized - who is responsible, their qualifications. Person-removal test: remove person-specific content → "developing and implementing cybersecurity policies" + "periodic training and education on cybersecurity related topics including certifications." The remaining content is thin - it's mostly about the team's composition and qualifications. This leans MR.

Specificity: Let me scan for facts:

- "information systems organization" - not a specific named committee
- "management team" - generic
- "formal education in information technology or cybersecurity" - generic qualification description
- "relevant experience working in information technology and cybersecurity" - generic
- "periodic training and education" - generic cadence
- "certifications" - mentioned generically, no specific certifications named (not CISSP, CISM, etc.)

No domain terminology that passes the ERM test. No firm-specific facts (no named roles at VP+ level, no specific committees). No QV facts. This is Level 1.


content_category: Third-Party Risk

reasoning: The paragraph centrally answers 'how are third-party cyber risks managed?' — it describes vendor types, a tiered vendor management process, security questionnaires, and contractual obligations imposed ON providers, all classic TP markers. Specificity is Level 1 because the language is entirely generic business/ERM vocabulary: 'vendor management process,' 'security questionnaires,' 'contractual obligations' — none of these pass the ERM test as cybersecurity domain terminology. No firm-specific or verifiable facts are present.

thinking: Third-party risk management is the central topic here.


category_confidence: low

reasoning: The paragraph primarily describes how the company manages cybersecurity risk — through third-party consultants and by selecting service providers with cybersecurity programs — making RMP the best fit (Rule 3: third parties hired to serve the company → RMP; third parties as a component of the internal program → RMP). The final sentence is a boilerplate materiality assessment (SI), but the majority of text addresses the company's risk management approach. Specificity is Level 1 because the language is entirely generic: 'identifying, assessing, and managing cybersecurity risks,' 'reliable, reputable service providers,' and the SEC materiality formula contain no domain terminology, firm-specific facts, or verifiable claims.

thinking:
Let me analyze this paragraph.

Content category: This paragraph has three parts:
1. Management works with third parties to help identify/assess/manage cyber risks → could be TP or RMP
2. Company uses third-party service providers and seeks reliable ones with cybersecurity programs → TP
3. Materiality assessment statement → SI

The materiality assessment in the last sentence is a clear SI conclusion ("have materially affected or are reasonably likely to materially affect"). But the first two parts are about third-party risk management.

Let me assess which dominates. The first two sentences discuss how management works with third parties and how they select service providers.

The third sentence is the SEC boilerplate materiality assessment. Looking at the structure more carefully, I see sentence one covers management's use of third-party consulting firms for risk management, sentence two addresses the company's vendor oversight practices, and sentence three delivers the required materiality conclusion. The materiality language is a clear SI marker per Rule 5, but the bulk of the content focuses on third-party relationships. This is genuinely split between TP and SI categories.

When I apply the primary question test, the first two sentences mainly address how third-party cyber risks are managed, while the concluding sentence directly answers whether cybersecurity affects business outcomes. Even though the materiality statement uses exact SEC language, the "most text wins" principle suggests the paragraph leans toward third-party risk management overall. Looking at the materiality assessment, I'm weighing whether the third-party relationships dominate by volume or if the SEC's required materiality conclusion carries more categorical weight. The paragraph spans multiple dimensions—consultants helping with risk assessment, operational vendor oversight, and then the materiality statement—but the core narrative is really about reliance on external parties. Given the text distribution, I'm leaning toward the third-party category as the primary classification, though the materiality conclusion does anchor the significance of these relationships. The paragraph's real weight is in the third-party content—two sentences about how we engage consultants and select vendors with strong cybersecurity practices, followed by a materiality statement. Since the third-party discussion dominates by volume and Rule 3 treats hired assessors as RMP, I'm settling on this being primarily about Risk Management Practices, even though the materiality conclusion tries to wrap it up as Strategy Integration. I'm going back and forth on this, but I think the third-party content dominates the paragraph even though the materiality statement uses exact SEC language. The description of how they manage cybersecurity through consultants and service providers is more substantial than the boilerplate conclusion, so I'm settling on Risk Management Process. Looking at the specificity, everything here is generic—the risk management language, the vendor descriptions, the materiality statement—all Level 1 with no domain-specific terms or firm details. The third-party content takes up roughly 60% of the paragraph while the materiality statement comprises about 40%, so the word count clearly favors the RMP angle. Even though the materiality language mirrors the exact SEC 106(b)(2) phrasing, the sheer volume of generic third-party vendor discussion tips the balance toward Risk Management Program rather than Strategy Integration. I'm settling on RMP with a Specificity level of 1.


fact: Chief Technology Officer

reasoning: The paragraph answers 'how does the board oversee cybersecurity?' — describing the Audit Committee reporting to the full Board, management briefings, and presentations on cybersecurity topics. This is a governance-chain paragraph focused on information flow to the board. The CTO is a firm-specific cybersecurity leadership role (VP+ level), elevating to Level 3, but no quantified or externally verifiable facts are present.

thinking:
Board oversight, briefing structure, information flow to the board.

Category: Board Governance - describes how the board oversees cybersecurity through the Audit Committee and briefings.

Specific facts:
- "Chief Technology Officer" (CTO) - firm-specific named role (VP+ level cybersecurity-relevant title)
- "cyber risk management program" - not domain terminology, generic

No QV facts. CTO is firm-specific → Level 3.


fact: SVP of IT Security

reasoning: The paragraph answers 'how does the board oversee cybersecurity?' — the Audit Committee receives briefings and the SVP of IT Security reports to it quarterly; this describes the oversight/information flow structure, making it BG. The SVP of IT Security is a VP-level cybersecurity-specific title (firm-specific), but the remaining content (risk assessment, risk management, service provider arrangements, test results) uses general business vocabulary that fails the ERM test, keeping specificity at Level 3.

thinking:
Let me analyze this paragraph.

Category: This describes how the board (Audit Committee) oversees cybersecurity - briefing frequency, what information flows to the board, reporting structure. The SVP of IT Security reporting to the Audit Committee is describing the oversight flow. This is Board Governance.

Specificity: Let me scan for facts:
- "SVP of IT Security" - VP-level cybersecurity role → firm-specific (Level 3)
- "at least once each calendar year" - generic cadence
- "quarterly" - generic cadence
- "Audit Committee" - every company has one, not firm-specific

The report content list (risk assessment, risk management, control decisions, service provider arrangements, test results, security incidents) - these are general business terms, not domain terminology.

The SVP of IT Security role is what makes this Level 3 - that's the distinguishing detail.


reasoning: The paragraph answers 'how does the board oversee cybersecurity?' by describing the Audit Committee's oversight role and responsibilities for cybersecurity risk review — classic BG. All elements (Board, Audit Committee, risk assessment, risk management, regular review of policies) are generic governance language found at every public company with no domain terminology, firm-specific facts, or verifiable claims.

thinking:
Let me analyze this paragraph.

Content: Describes board-level oversight via Audit Committee, their responsibilities regarding cybersecurity risk review.

Category: This answers "How does the board oversee cybersecurity?" → Board Governance

Specificity: Let me scan for facts:
- "Board" / "Audit Committee" — every public company has these, NOT firm-specific
- "risk assessment and risk management" — generic ERM language, Level 1
- "cybersecurity and other information technology risk and privacy" — just topics, not domain terminology
- No domain terms, no firm-specific facts, no QV facts

This is generic boilerplate describing board oversight.


reasoning: This paragraph is a cross-reference directing readers to Item 1A Risk Factors for cybersecurity risk information. It uses speculative language ('may materially affect') pointing elsewhere rather than stating a materiality conclusion, making it N/O per the cross-reference rule. No substantive cybersecurity disclosure is present — just a pointer and a quoted risk factor title.


fact: penetration testing

fact: CIS Critical Security Controls

reasoning: This multi-topic paragraph covers the company's cybersecurity program activities (third-party assessments serving the company, penetration testing, incident response plan, simulated incidents), vendor oversight, and a materiality assessment. RMP content dominates by text volume — the primary question answered is 'what does the cybersecurity program do?' The third parties in the first section are hired to serve the company's program (→ RMP per Rule 3), and the materiality conclusion is subordinate. Domain terms like 'penetration testing' and 'CIS Critical Security Controls' elevate to Level 2, but no firm-specific roles, named external firms, verifiable certifications, or hard numbers push higher.

thinking:
Let me analyze this paragraph from NEOGEN CORP's 10-K filing.

This is a dense paragraph covering multiple topics. Let me break it down:

1. Third-party engagements (consultants, auditors) to assist the company's own program → RMP (third parties serving the company)
2. Penetration testing, quarterly cybersecurity briefings with outside counsel, annual assessment → RMP
3. Policies to monitor third-party service providers with access to sensitive data → TP
4. Selection/oversight of providers includes diligence reviews, contractual protections, CIS Critical Security Controls → TP
5. Detection and minimizing impact of incidents → RMP

6. Written incident response plan and testing through simulated incidents → RMP
7. Materiality assessment stating no cybersecurity risks have materially affected or are reasonably likely to materially affect the company → SI
8. Past incidents used to improve the program → RMP/SI

Looking at the distribution, RMP dominates with content on third-party engagements, penetration testing, incident response planning and testing, plus lessons learned from prior incidents. TP covers the monitoring and oversight of third-party providers. SI appears mainly in the materiality statement, though it connects to how past incidents inform the program.

By text volume, RMP takes up roughly 60%, TP about 20%, and SI around 20%. The paragraph fundamentally describes what the cybersecurity program does, making RMP the primary category. The specificity includes penetration testing and CIS Critical Security Controls as domain-level terms, with incident response plan being more generic.


reasoning: This paragraph is introductory framing about the importance of cybersecurity and the threat landscape. While it names specific threat types (ransomware, denial-of-service, nation-state actors), it does not describe any actual cybersecurity measure, process, governance structure, or assessment — it merely states that cybersecurity is important and that incidents could be harmful. The 'could materially adversely affect' language is speculation (every 10-K says this), not a materiality assessment, so it does not qualify as SI. None/Other paragraphs always receive Specificity 1.

thinking:
Let me analyze this paragraph.

Content: This is an introductory paragraph about cybersecurity importance. It mentions the company recognizes importance of cybersecurity, describes types of threats they face, mentions potential impact, and states the need for vigilance.

Category: What question does this primarily answer? It's not really answering any of the six substantive questions directly. It's more of a general framing/introduction. However, it does mention specific threat types (ransomware, denial-of-service, APT/nation-state actors). The "could materially adversely affect" language is speculation, not an assessment → NOT SI.

This is just introductory boilerplate without describing any actual cybersecurity measures, processes, board oversight, management roles, incidents, or third-party risk management. The speculation about potential adverse effects is standard 10-K language and doesn't constitute substantive disclosure, so this falls under N/O per Rule 5/6. The codebook is clear that measures or processes need to be described for substantive categories, and this paragraph only frames the importance of cybersecurity and lists threat types without detailing any actual measures. So None/Other with Specificity 1 is the right call.


reasoning: The paragraph answers 'How does the board oversee cybersecurity?' by describing delegation from the board to the audit committee for cybersecurity risk oversight. No domain terminology, no firm-specific facts (Board of Directors and Audit Committee exist at every public company), and no verifiable claims — remains Level 1.


reasoning: The paragraph states a materiality conclusion ('have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us') — this is both a backward-looking and forward-looking assessment, making it SI. No domain terminology, firm-specific facts, or verifiable claims are present; the language is pure boilerplate that any company could use unchanged.


reasoning: The paragraph centrally answers 'how are third-party cyber risks managed?' — it describes supplier risk assessments and due diligence procedures imposed on IT vendors who handle data. Specificity is Level 1 because the language is entirely generic business/ERM vocabulary (risk assessments, periodic due diligence, suppliers) with no cybersecurity domain terminology, no firm-specific details, and no verifiable facts.

thinking:
Classify this paragraph about SS&C Technologies' IT supplier risk assessments.

Category: This is about managing third-party/vendor cyber risks - assessing suppliers, due diligence on vendors who handle data. Central topic is vendor oversight → Third-Party Risk.

Specificity: Let me scan for facts.
- "information technology supplier risk assessments" - generic process description
- "periodic basis" - generic cadence
- "access, handle, transmit, process or store personal information or other customer data" - describes data handling but generic language
- "due diligence procedures" - generic

No domain terminology (no specific security terms like SOC 2, encryption, etc.), no firm-specific facts, no QV facts.

The language here reads like standard ERM boilerplate—nothing that distinguishes this company's approach or reveals any concrete details about their actual vendor management practices.


reasoning: The paragraph answers 'how is management organized to handle cybersecurity?' by detailing the division of responsibilities between the Senior Director of IT and General Counsel — hiring, budgets, incident preparation, process approval. Person-removal test collapses the paragraph. No domain terminology passes the ERM test (terms like 'risk management strategy,' 'security assessments,' and 'cybersecurity processes' are generic business language), 'Senior Director of IT' is a Director-level title without a security qualifier (not firm-specific), and 'General Counsel' exists at every company, so specificity remains Level 1.

thinking:
Let me analyze this paragraph.

Category: This describes management roles and responsibilities - who does what. The Senior Director of IT and General Counsel have their responsibilities listed. Person-removal test: remove all person-specific content → very little remains. This is MR.

Specificity:
- "Senior Director of IT" — this is a Director-level title without a security qualifier. Per the codebook, "Director of IT" is NOT firm-specific. "Senior Director of IT" similarly lacks a security qualifier.
- "General Counsel" — NOT firm-specific (generic governance role)

- The activities listed—hiring personnel, integrating cybersecurity risk into risk management, communicating priorities, approving budgets, preparing for incidents, approving processes, reviewing security assessments—are all generic business functions with no specialized domain terminology. "Security assessments" is broad enough that a non-security ERM professional would recognize it as a standard risk assessment practice, not a specific cybersecurity technique. This is Level 1.


reasoning: The paragraph answers 'how is management organized?' by identifying the CTO and IT Manager as responsible for cybersecurity, describing their supervisory scope over internal personnel and external consultants. Person-removal test leaves only generic program language ('assessing and managing risks, supervises personnel and consultants'), confirming MR. CTO is a firm-specific cybersecurity leadership role (VP+ level); 'IT Manager' is explicitly not firm-specific, and 'external cybersecurity consultants' are unnamed, so Level 3 on CTO alone.

thinking:
Let me analyze this paragraph.

Category: The paragraph answers "How is management organized to handle cybersecurity?" - it describes who is responsible (CTO and IT Manager), their responsibilities (assessing and managing risks, supervising personnel and consultants). Person-removal test: remove "management team, including the CTO and IT Manager" and "team" references → "assessing and managing our material risks from cybersecurity threats... overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants." This describes general program responsibilities but is thin. The primary content is about who holds responsibility and what they oversee. → MR

Now I'm checking the specificity level. The CTO is a cybersecurity-specific leadership role at the VP+ level, which makes it firm-specific, while the IT Manager is generic and not firm-specific. The external consultants are unnamed and generic. There's no specialized domain terminology beyond standard risk management language and no quantifiable facts. → Firm-Specific (Level 3) based on the CTO designation.


fact: penetration tests

reasoning: Person-removal test: removing generic 'Management' references leaves substantive program activities (cybersecurity policies and procedures, testing incident response plans, vendor-conducted penetration tests), so RMP wins over MR. 'Penetration tests' is domain terminology that passes the ERM test, elevating specificity to Level 2; other terms (incident response plan, policies and procedures) are on the NOT-domain list.

thinking:
Let me analyze this paragraph.

Category: The paragraph describes what management does regarding cybersecurity. Let me apply the person-removal test. Remove "Management" references - what remains? "preparation of cybersecurity policies and procedures, testing of incident response plans, engagement of vendors to conduct penetration tests" and "cybersecurity incident response efforts... helping direct our response to cybersecurity incidents."

After removing person-specific content, there's still substantive program description (policies, procedures, testing incident response plans, penetration tests). But the paragraph is structured around what management DOES - their involvement and participation. The primary question answered is "How is management organized to handle cybersecurity?" - describing management's role in the program.

Reconsidering the test more carefully: if I strip away the management involvement language, I'm left with concrete program elements like policies, procedures, incident response testing, and penetration testing. Yet the core focus remains on management's role and participation rather than the program itself. The paragraph fundamentally answers how management is organized for cybersecurity, not what the cybersecurity program entails. Applying the person-removal test strictly, I'd strip out the management involvement language and what remains is substantive program content about preventing, detecting, and mitigating incidents through policies, procedures, incident response testing, and vendor penetration tests. That points toward RMP. But "Management" here is generic rather than a specific role or person, and the paragraph is really describing management's oversight function rather than the program's actual activities. The codebook's MR category focuses on who's responsible and how things are organized, which is what this is actually doing—it's explaining that management oversees these efforts without naming specific roles or qualifications.

Looking at the specificity level, "penetration tests" is a domain term at Level 2, while the rest stays generic at Level 1. And since vendors are conducting the penetration tests as part of the company's program, that's third-party involvement supporting the program itself, which fits RMP under Rule 3.


reasoning: The paragraph answers 'How does the board oversee cybersecurity?' — describing how the Board receives reports from management on cybersecurity risks and incidents, which is classic board oversight. No domain terminology, no firm-specific facts (Board and management are generic), and no verifiable claims — all language could appear in any company's filing unchanged.


reasoning: The paragraph states a backward-looking materiality conclusion ('have not identified any cybersecurity threat or incident that has materially affected') and a forward-looking assessment ('reasonably likely to materially affect us'), making it SI per the materiality assessment rule. All remaining language is generic investment/controls language and a cross-reference to Item 1A. No domain terminology, firm-specific facts, or verifiable claims are present — the negative materiality assertion is a self-reported claim about absence, not externally verifiable.

thinking:
Let me analyze this paragraph.

The paragraph has three parts:
1. A materiality assessment - "have not identified any cybersecurity threat or incident that has materially affected" + "reasonably likely to materially affect us"
2. Generic investment language about cybersecurity
3. A cross-reference to Item 1A

The primary question answered: "How does cybersecurity affect the business or finances?" - This is a materiality assessment (SI).

The first sentence contains both a backward-looking negative assertion AND a forward-looking "reasonably likely to materially affect" assessment. Per Rule 5, these are SI.

The second and third sentences are mostly boilerplate—generic language about cybersecurity and resiliency, plus a cross-reference—but the core content is the materiality assessment. Scanning for specifics, I see only materiality language and generic terms like "networks," "internal controls," and "systems and infrastructure," with no domain-specific facts or firm-specific details. The timeframe "since the beginning of the last fiscal year" is vague, and the negative assertion itself isn't verifiable.

This is Level 1 boilerplate.


fact: phishing attacks

fact: malware infections

reasoning: The paragraph states a materiality conclusion ('We do not believe that these attempts, if successful, would have resulted in a material adverse effect on our business, financial condition, or results of operations'), which is an assessment of how cybersecurity affects the business → SI. While it mentions actual attempted incidents, those serve as context for the materiality assessment rather than describing what happened in detail. Domain terms 'phishing attacks' and 'malware infections' (specific threat types) elevate specificity to Level 2, but no firm-specific or verifiable facts are present.

thinking:
Let me analyze this paragraph.

Content: Discusses risk of cyber incidents, mentions past attempts (phishing, malware, unauthorized access), states belief these wouldn't have material effect, and cross-references Item 1A.

Category: This is tricky. It mentions actual attempts (phishing attacks, malware infections, unauthorized access attempts) but frames them as non-material. The materiality conclusion ("We do not believe that these attempts, if successful, would have resulted in a material adverse effect") is a Strategy Integration assessment. But the paragraph also describes actual events. Let me think about what question this primarily answers.

The paragraph structure:
1. Risk acknowledgment (generic)

2. Actual events described - the company has experienced these attempts
3. Specific types - phishing, malware, unauthorized access
4. Materiality framing - none of these would have caused material harm
5. Ongoing monitoring and diligence
6. Cross-reference to Item 1A

The key issue here is that while incidents are mentioned, they're unsuccessful and presented through a materiality lens rather than as reportable events. The paragraph is really addressing how cybersecurity risks affect the business overall, not detailing what actually happened. Since the attempts were unsuccessful and deemed immaterial, this leans toward Strategy Integration rather than incident disclosure.

Looking at specificity: phishing and malware are domain-specific threat types that show some technical knowledge, but the materiality conclusion and the conditional framing ("if successful, would have resulted") are standard boilerplate. The cross-reference to Item 1A is just a pointer, not additional detail. So this lands at Level 2 for domain terminology, but the overall disclosure is more about risk assessment than incident specifics.


fact: NIST Framework

reasoning: The paragraph answers 'what does the cybersecurity program do?' by describing a layered governance structure, framework adoption, and security tools/policies for vulnerability and incident management — all program activities, making it RMP. The NIST Framework reference is domain terminology elevating to Level 2, but the remaining language ('security tools and policies,' 'monitoring and detection tools,' 'identify, escalate, investigate, resolve') is generic ERM-level vocabulary with no firm-specific or verifiable facts.

thinking:
Let me analyze this paragraph.

Content: Describes a layered governance structure, NIST Framework adoption, security tools and policies for protecting networks. This answers "What does the cybersecurity program do?" → RMP.

Specificity:
- "NIST Framework" → domain terminology (Level 2)
- "monitoring and detection tools" → borderline, but generic
- "layered governance structure" → generic
- No firm-specific facts, no QV facts.

Level 2 based on NIST Framework reference.


reasoning: The paragraph centrally answers 'how are third-party cyber risks managed?' — it describes due diligence on third parties, selection/oversight considerations, and ongoing monitoring of vendor risks, making TP the clear category. No domain terminology passes the ERM test (terms like 'due diligence,' 'cybersecurity safeguards,' and 'continually monitor' are generic business language any ERM professional would use), no firm-specific facts, and no verifiable claims, so specificity remains Level 1.

thinking:
Let me classify this paragraph.

Category: This is about how third-party cyber risks are managed - vendor oversight is the central topic. → Third-Party Risk

Specificity: Let me scan for facts.
- "due diligence on third parties" - generic business language
- "cybersecurity safeguards" - generic
- "continually monitor cybersecurity threat risks" - generic monitoring language

No domain terminology that passes the ERM test. No firm-specific facts. No QV facts. This is generic language about vendor oversight that any company could write.

The classification is Level 1 - it's all boilerplate language without any concrete details or company-specific information.


fact: National Institute of Standards and Technology (NIST) framework referenced

fact: International Organization for Standardization (ISO) framework referenced

fact: confidentiality, security and availability (CIA triad language)

reasoning: While the paragraph opens with Board oversight, the bulk of the text describes the cybersecurity program's integration with ERM, its framework basis (NIST, ISO), and its general approach to managing cyber risks — answering 'what does the program do?' (RMP). Specificity is Level 2: NIST and ISO are named cybersecurity frameworks (domain terminology) but are referenced as alignment rather than certifications held, and no firm-specific or verifiable facts are present.

thinking:
Let me analyze this paragraph.

Content: Board oversight mention, ERM integration, frameworks (NIST, ISO), general approach description.

Category: The paragraph starts with Board oversight but quickly moves to describing the program's integration with ERM and frameworks. The "what question" test - it answers multiple questions but the bulk is about what the program does (RMP). The Board mention is brief framing, then it describes program integration with ERM, framework basis, and general approach.

Primary question: "What does the cybersecurity program do?" → RMP

Specificity:
- "National Institute of Standards and Technology" = NIST → domain term (Level 2)

- ISO and the CIA triad are also standard domain terminology, not firm-specific details. The paragraph references these frameworks as the basis for the program rather than claiming any particular certification, which keeps this at Level 2 rather than moving it higher. There are no named roles beyond generic Board references and no quantifiable facts.

Level 2.


reasoning: The paragraph states a materiality conclusion — incidents 'have not had a material impact' and are 'not reasonably likely to materially affect' operations — which is the SEC's Item 106(b)(2) assessment language, making this SI. No domain terminology passes the ERM test ('directed attacks,' 'loss, misuse or theft of personal information' are general business language), 'Topper Group' is a subsidiary self-reference (not firm-specific), and the negative materiality assertion is not externally verifiable, so specificity remains Level 1.

thinking:
Let me analyze this paragraph.

Content: Describes directed attacks on systems, states no material impact to date, states not reasonably likely to materially affect operations, and cross-references Risk Factors.

Category: The paragraph primarily states a conclusion about materiality - "have not had a material impact" and "not reasonably likely to materially affect." This is a materiality assessment → Strategy Integration (SI).

There's also mention of actual incidents ("periodically experience directed attacks") but the frame is about materiality assessment, not describing what happened in detail.

Specificity: Let me scan for facts.
- "directed attacks intended to lead to interruptions and delays" - general description

- References to Topper Group employees and subsidiaries are just self-references, not firm-specific per the codebook
- The materiality assertions are negative self-assessments without external verification
- Cross-reference to Risk Factors section doesn't add substantive content here
- Language like "directed attacks," "loss, misuse or theft of personal information," and "cyber security attacks" is generic business terminology that doesn't meet the ERM test
- No firm-specific cybersecurity infrastructure details like CISO roles, named committees, or governance structures
- No quantifiable or verifiable facts

This is Level 1 - Generic Boilerplate.

The phrasing throughout relies entirely on general business language—terms like "directed attacks," "interruptions and delays," and "loss, misuse or theft" are standard risk disclosure language, not specialized cybersecurity domain terminology that would pass the ERM threshold.


reasoning: The first sentence states a backward-looking and forward-looking materiality conclusion ('have not...materially affected or are reasonably likely to materially affect'), making this SI per the materiality assessment rule. The remaining text is speculation ('could have a material impact') and a cross-reference, both subordinate to the assessment. No domain terminology, firm-specific facts, or verifiable claims are present—the negative materiality assertion is a self-reported claim about absence, not externally verifiable—so specificity remains Level 1.

thinking:
Let me analyze this paragraph.

Content: Materiality assessment (backward-looking + forward-looking), then speculation, then cross-reference.

Category: The first sentence states a conclusion about materiality - "have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect" - this is SI per Rule 5. The rest is speculation and cross-reference, which are subordinate.

Specificity: Let me scan for facts.
- "have not materially affected...are not reasonably likely to materially affect" - this is a negative self-assertion, not externally verifiable

- No domain terminology, no firm-specific facts, no QV facts, and the "Item 1A. Risk Factors" cross-reference adds nothing substantive - this is just generic boilerplate materiality language. Level 1.


fact: ISO 27001 certification

fact: second ISO 27001 certification (verifiable external certification claim)

reasoning: The paragraph answers 'what does the cybersecurity program do?' by describing controls review, external testing, employee training, and third-party assessments — all program activities (third parties serve the company's own program → RMP, not TP). Specificity reaches Level 4 because 'obtained our second ISO 27001 certification' is an externally verifiable claim (certification body records) with a specific quantity ('second').

thinking:
Let me analyze this paragraph.

Content: Describes cybersecurity controls review, external testing, employee training, third-party assessments, and ISO 27001 certification.

Category: "What does the cybersecurity program do?" → RMP. The paragraph describes activities: testing, training, leveraging third parties to assess security. The third parties here serve the company's own program (Rule 3 → RMP, not TP).

Specificity: Let me scan for facts.
- "external parties" testing → unnamed, not QV
- "annual basis" → generic cadence
- "online training modules" → generic

- "third-party service providers" → unnamed
- "ISO 27001 certification" → "obtained our second ISO 27001 certification" → This is a verifiable claim (they hold the certification, verifiable via certification body). → QV
- "second" → quantified (specific number of certifications)

So Level 4 due to "obtained our second ISO 27001 certification" — verifiable external certification claim. ISO 27001 is a named standard, and since we have the quantified verifiable claim, the level is 4.


reasoning: The second sentence states a backward-looking materiality conclusion ('have not experienced any cybersecurity incidents which have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition'), making this SI per Rule 5. The first sentence is a cross-reference but is subordinate to the assessment. For specificity, 'last three fiscal years' is a soft timeframe, the negative assertion is not externally verifiable, and there is no domain terminology or firm-specific detail—pure boilerplate materiality language.

thinking:
Let me analyze this paragraph.

The paragraph has two parts:
1. A cross-reference to another section about cybersecurity risks
2. A statement that they haven't experienced material cybersecurity incidents in the last three fiscal years

For category: The second sentence is a materiality assessment - "we have not experienced any cybersecurity incidents which have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition." This is a backward-looking materiality conclusion → SI per Rule 5.

The first sentence is a cross-reference, which would be N/O on its own.

But the second sentence IS the materiality assessment itself, so the cross-reference is just supporting it. Looking at the specificity now: the timeframe is soft, the assertion is negative and self-reported rather than externally verified, and there's no domain-specific or firm-specific facts here. This is standard boilerplate materiality language, so it's Level 1.


reasoning: The paragraph centrally answers 'how are third-party cyber risks managed?' — describing vendor due diligence, contractual requirements imposed on vendors for incident reporting and insurance coverage, making it clearly TP. No domain terminology passes the ERM test (vendor due diligence, contractual clauses, and insurance are general business/risk management concepts), no firm-specific facts, and no verifiable claims.


fact: Chief Information Consultant

specificity_confidence: medium

reasoning: The paragraph describes the governance chain for cybersecurity risk: Chief Information Consultant → management → CFO → Audit Committee → Board. While it opens with ERM integration language, the organizing purpose is how cybersecurity risk information flows upward to the board, making BG the best fit. 'Chief Information Consultant' is an unusual, firm-distinguishing title (not a standard role like CFO or Audit Committee), elevating specificity to Level 3.

thinking:
Let me analyze this paragraph.

Category: This paragraph describes how cybersecurity risk management is integrated into overall risk processes, mentions the Chief Information Consultant working with management, and the CFO evaluating risks and reporting to the Audit Committee.

The primary question: It's a mix. It describes risk management integration, but also governance flow (CFO → Audit Committee → Board). The "assessment and management of material risks" framing plus the reporting chain makes this about oversight structure. But let me think more carefully.

The paragraph covers: (1) integration of cyber risk into overall risk management, (2) Chief Information Consultant works with management to prioritize and mitigate, (3) CFO evaluates material risks and reports to Audit Committee.

Actually, I'm seeing this as primarily a governance structure paragraph—it's really about how information flows up the chain from management through the CFO to the Audit Committee. But when I strip away the governance roles and reporting lines, what's left is fairly generic language about integrating cyber risk into overall processes. So this paragraph is doing double duty: it's establishing the oversight structure while also touching on risk management processes, though the governance chain seems to be the main point. The paragraph really hinges on whether the primary purpose is describing risk management processes or the oversight structure itself. The governance chain from CFO to Audit Committee is definitely the culmination, but the opening frames this as integration into risk management processes, and most of the substance is about how the Chief Information Consultant and management actually assess and mitigate risks. I think RMP is the better fit here since the core framing is about the risk management work itself, even though the reporting structure to the board is present.

Now I'm examining the specificity of the roles mentioned. "Chief Information Consultant" stands out as an unusual title—it's not a standard CISO or typical cybersecurity role, so it reads as firm-specific organizational detail. The CFO and Audit Committee are generic titles that every public company has, and the risk management language is standard. So the only potentially firm-specific element is that unusual Chief Information Consultant title, which at the C-level adjacent tier would qualify.


fact: Global Director of IT over 30 years of experience in IT roles

fact: Over 20 years of experience as an IT Director

fact: CFO has over 10 years of experience in risk management

reasoning: The paragraph answers 'how is management organized to handle cybersecurity?' by describing who is responsible (Global Director of IT, CEO, CFO), their responsibilities, and their qualifications. The person-removal test leaves almost nothing — this is squarely MR. Specificity reaches Level 4 because of multiple lower-bound experience figures ('over 30 years,' 'over 20 years,' 'over 10 years') which are verifiable against resumes/public records.

thinking:
Let me analyze this paragraph.

Category: This is about management's organizational role - who is responsible, their qualifications, experience. Person-removal test: remove all person-specific content and almost nothing remains. → MR

Specificity:
- "Global Director of IT" - this is a Director-level IT title without a security qualifier, so per the codebook "Director of IT" is NOT firm-specific
- "CEO and CFO" - generic roles, not firm-specific
- "over 30 years of experience" - quantified, verifiable (lower bound ≥ 30)

- "over 20 years of experience as an IT Director" - quantified, verifiable
- "over 10 years of experience" - quantified, verifiable

These are all hard numbers with lower bounds → QV Level 4.


fact: NIST Cybersecurity Framework (NIST CSF)

fact: NIST CSF principles: Identify, Protect, Detect, Respond, and Recover

reasoning: The paragraph describes the company's cybersecurity program and its alignment with NIST CSF, directly answering 'what does the program do?' → RMP. It references NIST CSF as a guiding framework (not a certification claim), which is domain terminology elevating to Level 2, but the explicit disclaimer ('does not imply we meet any particular technical standards') prevents a Level 4 verifiable certification claim. No firm-specific facts push it to Level 3.

thinking:
Classify this paragraph.

Category: It answers "What does the cybersecurity program do?" - describes their program, framework adoption, methodology. RMP.

Specificity: NIST CSF is named standard → domain term (Level 2). The five principles (Identify, Protect, Detect, Respond, Recover) are part of NIST CSF. "Aligned with" not "certified" so Level 2, not Level 4. No firm-specific facts beyond generic program description. No QV facts.

This lands at Level 2 specificity.


reasoning: The paragraph describes the company's cybersecurity measures at a high level ('safeguard systems, networks, data from unauthorized access, disruption, or misuse'), answering 'what does the program do?' but only in the most generic terms. No domain terminology, firm-specific facts, or verifiable claims are present — 'integrity, confidentiality, and availability' is the CIA triad but expressed here as general business language, and all other language (safeguard, unauthorized access, disruption) would appear in any generic ERM document.


reasoning: The paragraph answers 'how does the board oversee cybersecurity?' — the board has ultimate oversight and the executive leadership team presents on cyber risks to the board. Specificity is Level 1 because all terms are generic ERM language (board of directors, executive leadership team, risk management policies, material risks); no domain terminology, firm-specific facts, or verifiable claims are present.

thinking:
Let me classify this paragraph.

Category: This describes how the board oversees risk, including cybersecurity. The board has "ultimate oversight" and the executive leadership team "presents to the board" on risks including cybersecurity. This answers "How does the board oversee cybersecurity?" → Board Governance.

Specificity: Let me scan for facts.
- "board of directors" — generic, every company has one
- "executive leadership team" — generic
- "information technology and cybersecurity" — just the topic, not domain terminology

- "risk management policies and strategies" — generic ERM language
- "material risks" — generic

No domain terminology, no firm-specific facts, no QV facts. Level 1.


reasoning: This is a generic introductory statement about the company's commitment to cybersecurity. It does not answer any of the six substantive questions — it describes no board oversight, management roles, program activities, third-party risk management, incidents, or materiality assessments. It contains no domain terminology, firm-specific facts, or verifiable claims.


reasoning: The paragraph primarily answers 'how does the board oversee cybersecurity?' — the Audit Committee's oversight role, its review of management presentations, and its reporting to the Board dominate the first four sentences. The COO and Senior Director of IT content describes management's role but is subordinate to the governance-chain structure (Board ← Audit Committee ← COO). For specificity, 'Audit Committee' exists at every public company, COO is a generic executive title (not cybersecurity-specific), 'Senior Director of Information Technology' lacks a security qualifier, and 'third-party consultants' / 'external legal counsel' are unnamed. No domain terminology passes the ERM test — 'information security,' 'risk mitigation,' and 'cybersecurity risk' are general business language.

thinking:
Let me analyze this paragraph.

Category: This describes the Audit Committee's oversight role and how information flows to the board, plus management's role. The primary question answered is "How does the board oversee cybersecurity?" — the Audit Committee's oversight responsibilities dominate. But there's also significant management content (COO, Senior Director of IT).

Let me count: ~3 sentences about the Audit Committee/Board oversight, ~2 sentences about the COO's role. The first half is clearly BG. The second half describes management organization. BG dominates slightly, and the governance-chain default applies.

Now I'm checking the specificity. The Audit Committee, COO, and Senior Director of Information Technology are all generic roles without firm-specific identifiers. The third-party consultants and external legal counsel are unnamed. The language uses standard cybersecurity terminology like "cybersecurity risk" and "information security," but nothing here is unique to this company — it's all standard governance structure and terminology.

This stays at Level 1.


reasoning: This is a cross-reference directing readers to Item 1A Risk Factors for cybersecurity risk information. It contains no substantive cybersecurity disclosure itself, making it N/O with Level 1 specificity.


reasoning: The paragraph states a backward-looking and forward-looking materiality conclusion ('have not materially affected' and 'not reasonably likely to materially affect'), making it SI per Rule 5. The cross-reference to Item 1A is subordinate to the materiality assessment. No domain terminology, firm-specific facts, or verifiable claims are present — the language is standard boilerplate materiality language found in many filings.


reasoning: The paragraph answers 'how does the board oversee cybersecurity?' by describing delegation from the board to the Audit Committee and its oversight of management's cybersecurity strategy — a classic governance-chain paragraph. Specificity is Level 1 because all entities mentioned (Board of Directors, Audit Committee, management) are generic governance structures present at every public company, with no domain terminology, firm-specific facts, or verifiable claims.

thinking:
Classify this paragraph.

Category: "How does the board oversee cybersecurity?" → Board Governance. Board delegates to Audit Committee, Audit Committee oversees management's implementation. This is oversight structure.

Specificity: Let me scan for facts.
- "board of directors" — generic, every company has one
- "Audit Committee" — generic, every public company has one
- "cybersecurity risk management strategy" — generic language

No domain terminology (no specific security practices/tools/frameworks). No firm-specific facts (Audit Committee is explicitly NOT firm-specific per codebook). No QV facts.

This lands at Level 1 — it's purely generic governance structure with no specificity.


fact: Mr. Lee — named individual providing cybersecurity updates to the board

reasoning: The paragraph answers 'how does the board oversee cybersecurity?' by describing the flow of information from Mr. Lee to the Board and Audit Committee, making it a governance-chain paragraph (BG). 'Mr. Lee' is a named individual in a cybersecurity reporting context, which is firm-specific (Level 3); 'Board of Directors' and 'Audit Committee' are generic governance structures present at every public company and do not elevate specificity.

thinking:
Classify this paragraph.

Content: Mr. Lee provides periodic updates on cybersecurity incidents and threats to the Board and Audit Committee as incidents arise.

Category: This describes how information flows to the board - "How does the board oversee cybersecurity?" → Board Governance. Mr. Lee is mentioned but the purpose is describing the reporting/oversight structure.

Specificity:
- "Mr. Lee" - named individual in cybersecurity context → firm-specific (Level 3)
- "Audit Committee" - NOT firm-specific (every company has one)

- "Board of Directors" - NOT firm-specific

The named individual reference pushes this to Level 3.


reasoning: This paragraph is a general statement of intent about taking cybersecurity seriously but does not answer any of the six substantive questions — it describes no board oversight, management structure, program activities, third-party processes, incidents, or materiality assessments. No domain terminology, firm-specific facts, or verifiable claims are present.


reasoning: This paragraph is a cross-reference directing readers to Item 1A Risk Factors for cybersecurity risk descriptions — it answers none of the six substantive questions and provides no actual cybersecurity disclosure. The 'may materially affect' language points elsewhere rather than stating a materiality conclusion, confirming N/O. No domain terminology, firm-specific facts, or verifiable claims are present.

thinking: Cross-reference to risk factors section, no substantive cybersecurity disclosure.


fact: GDPR

reasoning: The paragraph primarily answers 'what does the cybersecurity program do?' — describing the program's basis on frameworks, tools/processes for threat identification, and mitigation strategies. Named frameworks (ISO 27001, NIST 800-53, GDPR) are domain terminology elevating to Level 2, but the program is described as 'based on' these frameworks rather than claiming certification, so they remain domain terms. No firm-specific or verifiable facts are present — references to management and the board are incidental, and third-party vendors are mentioned as part of the internal program (not as a central topic).


reasoning: The paragraph states both a backward-looking materiality conclusion ('have not materially affected') and a forward-looking assessment ('not reasonably likely to materially affect'), which are SEC Item 106(b)(2) materiality assessments → SI. The language is standard boilerplate found in virtually every 10-K filing with no domain terminology, firm-specific facts, or verifiable claims.


reasoning: This is a blank check/SPAC company explicitly stating it has no operations and no cybersecurity personnel or processes of its own. Per the codebook, SPACs with no real program receive N/O. The language is entirely generic with no domain terminology, firm-specific facts, or verifiable claims.


fact: Chief Information Security Officer (CISO) chairs the committee

fact: Information security risk committee

reasoning: The paragraph's primary content is how management is organized: an information security risk committee chaired by the CISO, its composition (employees and executive management), and its purpose (coordinate direction, current state, security risks, governance). Person-removal test: removing the CISO and committee structure leaves only a thin shell about 'internal reporting' and a truncated mention of program focus areas — the substance collapses, confirming MR. The CISO role and the named non-generic committee elevate specificity to Level 3.

thinking:
Let me analyze this paragraph.

Content: Describes internal reporting to senior leadership monthly, an information security risk committee chaired by CISO, comprised of employees and executive management, and mentions the cybersecurity program focuses on key areas.

Category: This has elements of both MR and RMP. Let me apply the person-removal test. Remove CISO, committee structure, membership → what remains? "cybersecurity risk management process that includes internal reporting... on a monthly basis" and "cybersecurity program focuses on key areas: Collaboration." Not much substantive program description remains - the core content is about the committee structure, who chairs it, its composition, and its purpose (coordinate and communicate direction, current state, security risks).

The primary focus here is really about how the organization structures its management of cybersecurity—specifically the committee setup, who's involved, and what they oversee. That points to MR rather than RMP. The specifics like "CISO" and "information security risk committee" are firm-specific and named elements that reinforce this is about organizational structure.


reasoning: The first sentence states a materiality conclusion ('not aware of any cybersecurity threats that have materially affected or are likely to affect us, including our business strategy, results of operations or financial condition'), which is both a backward-looking and forward-looking assessment → SI per the materiality rule. The second sentence is speculation and the third is a cross-reference, both subordinate. No domain terminology, firm-specific facts, or verifiable claims appear — pure boilerplate materiality language.

thinking:
Let me analyze this paragraph.

Content: States no material cybersecurity threats have affected them, speculates about future incidents, cross-references Item 1A.

Category: The first sentence states a conclusion about materiality - "not aware of any cybersecurity threats that have materially affected or are likely to affect us" - this is a backward-looking + forward-looking materiality assessment → SI. The second sentence is speculation ("could have"). The third is a cross-reference. The materiality assessment in sentence 1 dominates.

Specificity: Let me check for facts. "Have materially affected or are likely to affect us, including our business strategy, results of operations or financial condition" - this is a materiality assessment but it's generic boilerplate language.

There's no domain-specific terminology, no company-specific facts, and no quantifiable details here. The cross-reference to Item 1A is just a pointer to other content. This is Level 1 material - generic disclosure language without substantive detail.


reasoning: The paragraph describes the flow of information from the executive team to the Board and audit committee regarding cybersecurity — a governance-chain paragraph answering 'how does the board oversee cybersecurity?' No domain terminology, firm-specific facts, or verifiable claims are present; 'executive team,' 'Board,' 'audit committee,' and 'regular updates' are all generic terms found at any public company.

thinking:
Let me analyze this paragraph.

Category: This describes the executive team providing updates to the Board/audit committee. The primary question answered is "How does the board oversee cybersecurity?" — it's about the flow of information to the board and audit committee oversight. This is a governance-chain paragraph (Management → Board), describing oversight structure → BG.

Specificity: Let me scan for facts:
- "executive team" — generic management reference, not firm-specific
- "Board" / "audit committee" — every public company has these, NOT firm-specific
- "regular updates" — generic cadence
- "industry standards" — generic

- No domain terminology, no firm-specific facts, no QV facts

This is Level 1 - Generic Boilerplate.


fact: vulnerability management

reasoning: The paragraph primarily answers 'how is management organized to handle cybersecurity?' — describing the Principal Accounting Officer's role in receiving reports, working with the incident response team, and assessing materiality. Person-removal test: removing the PAO and management references leaves thin process scaffolding ('escalate... reports on status... mitigate and remediate... assess materiality'), confirming MR. Note: Principal Accounting Officer is not a cybersecurity-specific title (like CFO, it exists at every company), so it does not qualify as firm-specific. 'Vulnerability management' is a domain term elevating specificity to Level 2.

thinking:
Let me analyze this paragraph.

Category: This describes management's role in cybersecurity - the Principal Accounting Officer receives reports, works with incident response team, assesses materiality. The primary question answered is "How is management organized to handle cybersecurity?" - describing escalation to management, reporting lines, and responsibilities.

But let me consider: could this be RMP? Person-removal test: Remove "Principal Accounting Officer" and "members of management" - what remains? "cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents...

After stripping out the specific roles, the core content is still fundamentally about who receives reports and who coordinates with the incident response team - the Principal Accounting Officer and their responsibilities are central to what's being described. This is management-focused rather than process-focused.

Also, "Principal Accounting Officer" is a standard financial title, not firm-specific, so it doesn't trigger RMP on that basis. The domain term "vulnerability management" is present, but the paragraph's emphasis remains on the management structure and reporting relationships rather than the technical processes themselves.

So this lands as MR, Level 2, with the domain terminology being "vulnerability management."


reasoning: The opening sentence states a materiality conclusion ('not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition'), which is both a backward-looking and forward-looking assessment → SI. The remaining text is generic speculation ('could,' 'may') and a vague insurance mention. No domain terminology, firm-specific facts, or verifiable claims appear anywhere in the paragraph, so specificity remains Level 1.

thinking:
Let me analyze this paragraph.

Content: First sentence is a materiality assessment (backward-looking and forward-looking). Then speculation about threats, then insurance mention.

Category: The first sentence is a clear materiality assessment → SI. The rest is speculation/generic risk language. SI dominates.

Specificity: Let me scan for facts.
- "materially affected or are reasonably likely to materially affect" - this is the SEC's required language, not a domain term or firm-specific fact
- "insurance" - generic mention
- No domain terms, no firm-specific facts, no QV facts

Level 1.


reasoning: The paragraph states a materiality conclusion using SEC Item 106(b)(2) language ('have materially affected, or are reasonably likely to materially affect... business strategy, operational results, and financial condition'), making it SI per the materiality assessment rule. No domain terminology, firm-specific facts, or verifiable claims are present — all language is generic boilerplate that could appear in any filing unchanged.

thinking:
Let me analyze this paragraph.

Content: Two parts - (1) ongoing assessment of cybersecurity risk impact, (2) materiality conclusion stating no material affect.

Category: The second sentence is a clear materiality assessment - "have materially affected, or are reasonably likely to materially affect" - this is SI per Rule 5.

Specificity: Let me scan for facts:
- "ongoing basis" - generic
- "reporting period" - generic
- The materiality conclusion language is boilerplate SEC language
- No domain terms, no firm-specific facts, no QV facts

Level 1.


reasoning: Launch Two Acquisition Corp. is a SPAC with no operations and no cybersecurity program ('lack sufficient resources', 'without significant investments in data security protection'). Per the SPAC rule, companies with no real program receive N/O regardless of incidental mentions. The 'could have material adverse consequences' is speculation (not an assessment), and the negative incident assertion exists in a no-program context. No domain terminology, firm-specific facts, or verifiable claims elevate specificity above Level 1.

thinking:
SPAC company, no operations, no program.

Let me analyze: "early-stage company without significant investments in data security protection", "lack sufficient resources", "We have not encountered any cybersecurity incidents since our Initial Public Offering" - this is a SPAC with no real cybersecurity program.

Per the codebook: "SPACs and no-operations companies with no real program → N/O"

But wait - there's a materiality-like statement: "could have material adverse consequences" - but that's speculation ("could have"), not an assessment. And "We have not encountered any cybersecurity incidents" - but this is a SPAC context.

This fits the SPAC rule clearly: N/O with a Specificity score of 1.


fact: Senior Vice President – Technology Solutions

fact: over four years in role

fact: more than 25 years of experience in information technology roles

fact: more than ten years with the Company

reasoning: The paragraph opens and closes with audit committee oversight of cybersecurity and describes the governance chain (audit committee → SVP → program), defaulting to BG per the governance-chain rule. Management details (SVP role, qualifications) are embedded within the oversight structure description. Specificity reaches Level 4 because the SVP's tenure and experience are stated as verifiable lower bounds ('over four years,' 'more than 25 years,' 'more than ten years').

thinking:
Let me analyze this paragraph.

Content Category: This paragraph covers both board governance (audit committee oversight) and management role (SVP Technology Solutions, qualifications, reporting lines). Let me apply the primary test.

The paragraph answers multiple questions:
- "How does the board oversee cybersecurity?" - audit committee oversight, semi-annual reporting
- "How is management organized?" - SVP Technology Solutions role, experience, reporting to President

It's genuinely split. Let me assess text proportion. Sentences:
1. Audit committee oversight responsibility - BG

2. SVP Technology Solutions day-to-day management, reports to President - MR
3. SVP experience/tenure - MR
4. Audit committee oversees, management reports semi-annually - BG

Roughly equal split between BG and MR. The governance-chain rule says these default to BG when describing oversight structure. This paragraph describes the full oversight chain (Board → Committee → SVP → Program). I'd lean BG but it's close. Actually, the MR content (qualifications, years of experience, reporting to President) is substantial. Let me count more carefully—three of four sentences touch on management role and qualifications, while only two directly address board oversight. That tips it toward MR.

But wait, the paragraph's structure matters here. It opens with audit committee responsibility and closes with semi-annual reporting requirements. The SVP details are sandwiched in the middle as supporting context for the oversight relationship. The governance-chain rule applies when the primary framing is about oversight, and that's what bookends this passage. I'm going with BG.

Now I'm checking the specific qualifications and tenure metrics. The "over four years," "more than 25 years," and "more than ten years" all qualify as hard number lower bounds under the codebook, making them QV-eligible. The semi-annual cadence is just standard reporting frequency, not quantitative. The President reference isn't firm-specific. So I'm looking at Level 4 for the quantitative content here.


reasoning: The paragraph is general context-setting about technology reliance and a textbook definition of information security; it does not describe any actual cybersecurity measures, program activities, governance structure, or materiality assessment — it merely acknowledges that cyber threats exist. While 'denial of service attacks' and 'cyber intrusions' are domain terms, the paragraph contains no substantive disclosure answering any of the six category questions, so it is N/O with mandatory Specificity 1.

thinking:
Let me classify this paragraph.

Content: General language about relying on digital technology, mentions cyber threats generically, defines information security in general terms.

Category: This doesn't really answer any of the six substantive questions directly. It's general context about technology reliance and a generic definition of information security. No specific program details, no board oversight, no management roles, no incidents, no materiality assessment. Could be RMP if it described actual measures, but it's just framing. However, it does mention "denial of service attacks" which is a domain term, and "cyber intrusions" - but let me check if this is substantive enough for a category.

Actually, the paragraph acknowledges cyber risks and defines information security, but it doesn't describe what the company actually does to address them. That definition of information security is just boilerplate language, not a description of their program. This feels like N/O—no substantive cybersecurity disclosure. It's borderline, but without describing any actual measures or controls, it doesn't meet the threshold for a substantive category.


fact: Senior Director - Information Security

fact: over 15 years' experience in IT and cybersecurity

fact: information security architecture

fact: CISO Academy Workshop

reasoning: The paragraph is entirely about the qualifications, experience, education, and credentials of the Senior Director - Information Security; person-removal test leaves nothing substantive, confirming MR. Multiple QV-eligible facts: 'over 15 years' (verifiable lower bound), named university (Ohio Wesleyan University), and a verifiable certification (Information Systems Auditor) drive Level 4.

thinking:
Let me analyze this paragraph.

Content: Describes qualifications, experience, and credentials of the Senior Director - Information Security. This is about who the person is, their background, education, and certifications.

Category: Management Role (MR) - This is about qualifications, credentials, career history of a cybersecurity leadership role. Person-removal test: remove all person-specific content and nearly nothing remains.

Specificity: Let me scan for facts.
- "Senior Director - Information Security" - firm-specific cybersecurity role (Director-level with security qualifier)
- "over 15 years' experience" - quantified, lower bound, verifiable

- "over 15 years' experience in auditing information security" - another quantified fact
- "CISO Academy Workshop" - named program, externally verifiable training
- "BA in math and computer science from Ohio Wesleyan University" - named university, verifiable
- "Information Systems Auditor certification" - likely CISA (Certified Information Systems Auditor), verifiable via ISACA
- "information security architecture" - domain term

Multiple quantified and verifiable facts across education, certifications, and specialized experience → Level 4.


fact: ISO (Information Security Officer)

fact: CISO

reasoning: The paragraph primarily answers how the board oversees cybersecurity — the audit committee's oversight role, regular reporting to the Board, and the incident escalation path to the audit committee based on materiality. The ISO and CISO are cybersecurity-specific leadership titles that qualify as firm-specific facts, elevating to Level 3; no QV-eligible facts (no specific numbers, dates, named external firms, or certifications) are present.

thinking:
Let me analyze this paragraph.

Category: This describes how the board/audit committee oversees cybersecurity, including reporting flows. The governance chain (Board → Audit Committee → officers) is the primary structure. The incident reporting chain describes how information flows TO the board. This answers "How does the board oversee cybersecurity?" → Board Governance.

Specific facts:
- ISO (Information Security Officer) - firm-specific cybersecurity role
- CISO - firm-specific cybersecurity role
- Senior Vice President, General Counsel & Compliance Officer - SVP level title
- CEO, CFO - generic, not firm-specific

- The ISO and CISO are the firm-specific roles here, making this Level 3 specificity with no quantitative or external reference facts.