content_category: None/Other

category_confidence: high

specificity_confidence: high

reasoning: This paragraph is only a cross-reference incorporating another section by reference and does not itself describe cybersecurity governance, management, processes, third-party risk, incidents, or strategy impacts. Under the rules, cross-references without substantive disclosure are classified as None/Other.

provider: openai

stage: benchmark


reasoning: This paragraph is only a cross-reference to the Risk Factors section and does not describe cybersecurity governance, management, processes, third-party risk, an actual incident, or a materiality assessment. It therefore falls under None/Other.


reasoning: This paragraph is only a cross-reference directing readers to another section for risk discussion and does not itself describe cybersecurity governance, management, processes, third-party risk, incidents, or materiality conclusions.


content_category: Strategy Integration

reasoning: The paragraph primarily provides a materiality assessment, stating that past cybersecurity incidents have not materially affected the company or its financial condition, results of operations, or cash flows. The remaining statements about continued investment and a risk-factor cross-reference are secondary and generic.


reasoning: This paragraph only states a general commitment to protect IT assets, data, intellectual property, and products, without describing any governance structure, management role, cybersecurity process, third-party oversight, incident, or materiality assessment. It is therefore non-substantive boilerplate rather than a disclosure answering one of the core cybersecurity questions.


reasoning: This paragraph is primarily a limitation/disclaimer about cybersecurity risk and a cross-reference to risk factors, rather than a substantive description of governance, management, processes, third-party risk, incidents, or strategy impact. It does not describe any concrete cybersecurity measures or assessments beyond generic boilerplate.


content_category: Board Governance

specificity_confidence: medium

reasoning: The paragraph primarily describes how the Board and Audit Committee oversee cybersecurity risk and how cybersecurity information flows from management to the Board. Although it mentions management participants, the main focus is the board-level oversight structure rather than management organization or program activities.


category_confidence: medium

reasoning: The paragraph primarily provides a materiality-oriented assessment by stating that the company has not experienced any material cyber threats or incidents to date and discussing potential business and financial effects if future incidents occur. The rest of the paragraph is largely generic risk-factor style cautionary language and a cross-reference.


content_category: Third-Party Risk

reasoning: The paragraph primarily describes how the company vets and manages external third-party vendors, making third-party cyber risk oversight the main topic. Although it also includes a generic materiality conclusion and a cross-reference to risk factors, most of the paragraph focuses on vendor risk management.


reasoning: This paragraph provides general background that the company stores and transmits personal information and therefore faces cyber threats, but it does not describe governance, management roles, risk management processes, third-party oversight, a specific incident, or a materiality/business impact assessment. It is primarily contextual risk language rather than substantive cybersecurity disclosure.


reasoning: This paragraph describes the company's exposure to cyber threats and why it may be a target, but it does not explain governance, management roles, risk management processes, third-party oversight, a specific incident, or a materiality conclusion. It is primarily contextual risk framing and speculative threat discussion, so it fits None/Other.


reasoning: The paragraph primarily provides a materiality assessment, stating that the company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect its business, results, or financial condition. The remainder is a cross-reference to risk-factor disclosure rather than describing governance, management, or operational processes.


reasoning: The paragraph primarily describes how cybersecurity information flows to the board and how the board is educated on cybersecurity matters, which is board oversight. Its only qualifying specific fact is the cybersecurity-specific management role of Director - Information Security; the Audit Committee and unnamed external experts are too generic to count.


content_category: Incident Disclosure

reasoning: This paragraph primarily describes a real cybersecurity incident, including when it occurred, the operational disruption, the response, and its effects, which makes Incident Disclosure the best fit. It also includes specific dates and quantified financial impacts, making the disclosure Quantified-Verifiable.


content_category: Risk Management Process

reasoning: The paragraph primarily describes how cybersecurity risk information is gathered and monitored—through threat intelligence, internal security briefings, external sources, and security tool alerts—so it is mainly about the operation of the cybersecurity risk management process. Although management is mentioned, the focus is not on management roles or qualifications but on the monitoring activities themselves.


reasoning: The paragraph describes oversight activities—reviewing regulatory examination reports and monitoring emerging information security risk issues—which most directly answers how cybersecurity is overseen rather than how management operates the program. It contains no qualifying specific roles, committees, dates, numbers, or named frameworks.


content_category: Management Role

reasoning: The paragraph primarily explains how management is organized to address cybersecurity, including team composition, leadership roles, and reporting structure. Although it mentions third parties and security activities, those are secondary to the management organization and qualifications.


reasoning: The paragraph is primarily about how the company manages cybersecurity risks arising from third-party service providers, making Third-Party Risk the best fit. It describes a standard vendor risk process without cybersecurity-specific roles, named firms, dates, numbers, or other qualifying specific facts.


reasoning: This paragraph primarily describes a real cybersecurity incident, including when it occurred, operational disruption, remediation steps, and resulting costs. Because it includes specific dates and a quantified financial impact, it is best classified as Incident Disclosure with Quantified-Verifiable specificity.


reasoning: The paragraph primarily describes the existence of the Bancorp's cybersecurity risk management system, protective safeguards, and incident response policies, which makes it chiefly about what the cybersecurity program does. Although it includes a materiality assessment at the end, that is secondary to the broader description of the risk management program.


reasoning: The paragraph primarily describes the components of the company’s cybersecurity program—risk assessments, security controls support, awareness training, incident response, and vendor-related risk processes—so it is best classified as Risk Management Process. Although third-party risk is mentioned, it is only one element of the broader program rather than the central topic.


reasoning: The paragraph’s most concrete disclosure is the board-level oversight structure, stating that the Board acts through its Cybersecurity Committee to oversee cybersecurity programs and risk management. Although it also mentions enterprise risk management and a no-material-impact statement, the governance structure is the most specific and central element.


reasoning: The paragraph primarily describes which management roles are responsible for cybersecurity risk oversight and management, so it is about management organization rather than board oversight or program activities. It includes cybersecurity-specific leadership roles, making it firm-specific.


reasoning: The paragraph primarily describes how the company is addressing cybersecurity risks posed by third-party service providers, making third-party risk the central topic. It does not include qualifying specific facts such as named programs, committees, roles, firms, dates, or quantified details.


reasoning: The paragraph primarily describes management’s organizational structure for cybersecurity, centering on the Enterprise Cybersecurity MRG, its role, and its interaction with the CISO. Although it references escalation to the Audit Committee and Board, the main focus is the management-level committee and how management handles cybersecurity oversight and incident response.


reasoning: This paragraph primarily gives a materiality assessment about whether cybersecurity incidents have affected or are likely to affect the company's operations or financial condition, which fits Strategy Integration. The specific 'as of October 31, 2024' date makes the statement quantified/verifiable.


reasoning: The paragraph primarily describes how the board and its committees oversee cybersecurity, including delegation, reporting flows, and committee-level briefings. Although management roles are mentioned, they are presented mainly as part of the board oversight structure.


reasoning: This paragraph primarily describes how the board and its committees oversee cybersecurity risk, including committee delegation, reporting flows, and board education/exercise involvement. Although it references management reporting and exercises, the central focus is the board governance structure for cybersecurity oversight.


reasoning: The paragraph primarily describes how the company’s cybersecurity program detects and analyzes incidents, including monitoring channels, investigation, and severity assessment. It focuses on operational incident-handling activities rather than board oversight, management qualifications, or third-party vendor governance as the central topic.


reasoning: The paragraph primarily describes how cybersecurity information flows to the board and how the board, through the audit committee and broader reporting structure, oversees cybersecurity. Although management roles are mentioned, they are included mainly to explain the board oversight chain.


reasoning: The paragraph primarily describes how the board and senior leadership are kept informed and engaged in cybersecurity oversight through meetings and exercises led by the CISO, which makes board oversight the central topic. Its specificity rises above boilerplate because it identifies a cybersecurity-specific leadership role (CISO), but it does not include quantified-verifiable facts such as specific dates, headcounts, certifications, or named external firms.


reasoning: The paragraph primarily gives a materiality assessment, stating that cybersecurity breaches have not materially affected the company’s business strategy, results of operations, or financial condition to date. The rest of the paragraph is largely generic risk language and cross-references to risk factors rather than describing governance, management, or program processes.


reasoning: This paragraph is a cross-reference directing the reader to Item 1A risk factors rather than describing cybersecurity governance, management, processes, third-party risk, an actual incident, or a materiality assessment conclusion. Under the rules, cross-references to other sections are classified as None/Other.


reasoning: The paragraph primarily explains how cybersecurity information flows to the board and senior governing bodies, emphasizing oversight through CISO briefings and tabletop exercises. Although it mentions the CISO, the main focus is board-level oversight rather than management qualifications or program activities.


reasoning: The paragraph primarily describes what the company's cybersecurity program does to identify, assess, and manage cyber risk, including controls, training, third-party assessments, and response procedures. Although no firm-specific qualifying facts are provided, it uses clear cybersecurity terminology such as ransomware, malware, phishing, social engineering, and layered protective and detective controls.


reasoning: The paragraph is primarily about how the company manages cybersecurity risks arising from vendors and partners, making third-party oversight the central topic. It describes vendor vetting and monitoring activities, but provides no named roles, committees, frameworks, firms, dates, or other firm-specific verifiable details.


reasoning: The paragraph primarily describes how cybersecurity oversight is delegated by the Board to a board committee and how cybersecurity information flows from management to that committee and back to the full Board. Its most specific qualifying fact is the involvement of the Senior Director of Governance & Information Security, a cybersecurity-specific management role.


reasoning: The paragraph primarily describes how management is organized to handle cybersecurity, including the named security organization, leadership roles, and team structure. Although it mentions third-party supplier risk and product vulnerability work, the dominant focus is on management roles and reporting responsibilities.


reasoning: The paragraph primarily describes the escalation and oversight chain for cybersecurity matters from management to the board, which makes it a board oversight/governance disclosure. Although it mentions management actors, the main point is how significant cybersecurity matters are elevated within the governance structure.


reasoning: The paragraph primarily describes a real past cybersecurity event—the 2017 material incident involving theft of personal information—so it is best categorized as Incident Disclosure, even though it also includes forward-looking risk language. It contains cyber-specific incident terminology, but no qualifying named roles, committees, firms, products, exact dates, or other ✓ IS-list facts.


reasoning: The paragraph primarily states that the trust has no active operations, customers, or sensitive data, rather than describing a substantive cybersecurity governance structure, management role, risk process, third-party risk program, incident, or business impact assessment. For a no-operations entity, this is non-substantive background rather than a real cybersecurity disclosure.


reasoning: The paragraph primarily provides a materiality assessment that no material cybersecurity incidents were known to have impacted the company, which fits Strategy Integration under the SEC materiality rule. Although it also includes general threat and risk-factor language, that content is secondary to the disclosed conclusion about business impact.


reasoning: The paragraph primarily describes how the Board oversees cybersecurity risk through ERM oversight, management reporting, escalation of significant incidents, and use of outside experts. It does not provide qualifying firm-specific roles, named committees, dates, numbers, or other verifiable details.


reasoning: The paragraph primarily provides a materiality and business-impact assessment of cybersecurity incidents, stating that none have had a material adverse effect and discussing potential financial exposure and insurance coverage. Although it mentions incidents generally, it does not describe any specific event, so it is not Incident Disclosure.


reasoning: The paragraph primarily describes an operational cybersecurity activity—reviewing and drilling on a response plan—rather than board oversight or management qualifications. Its main substantive content is about incident-response preparedness, with the named Emergency Incident Response Team adding firm-specific detail.


reasoning: The paragraph primarily describes what the cybersecurity program does to identify, monitor, test, and respond to cyber threats, including use of monitoring tools and penetration testing. It does not focus on board oversight, management structure, vendor oversight as a central topic, or any actual incident.


reasoning: The paragraph primarily describes how the Audit Committee oversees cybersecurity risk through dashboards, briefings, and direct reporting of testing results, which is board-level oversight. While it includes cybersecurity activities like penetration tests, those are mentioned mainly as inputs to the Committee's oversight rather than as the core risk management program description.


reasoning: The paragraph primarily describes the Trust's cybersecurity measures and operating practices, such as personnel awareness and use of access controls, which fits the question of what the cybersecurity program does. Although third parties are mentioned, the paragraph does not center on oversight of vendor cyber risk, so Third-Party Risk is not the best fit.


reasoning: The paragraph primarily describes an actual cybersecurity incident, including its timing, operational disruption, data exfiltration, costs, and remediation steps, which makes Incident Disclosure the best fit. It contains a specific date tied to the incident, making the disclosure Quantified-Verifiable.


reasoning: The paragraph primarily describes the board-level oversight structure for cybersecurity: the Board delegates oversight to the Audit Committee, management reports upward, and the Audit Committee reports to the full Board. Although it also mentions program activities such as incident logging and third-party risk assessments, those are secondary to the governance chain.


reasoning: The paragraph primarily describes what the company’s incident response process does during and after a cybersecurity incident—containment, remediation, recovery, use of external assistance, escalation, and plan updates. Although it mentions notifying the Board and Audit Committee, that is part of the response workflow rather than the main focus of the paragraph.


reasoning: The paragraph primarily provides a materiality assessment, stating that the company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect its business strategy, results of operations, or financial condition. The rest is a cross-reference to risk factors, which does not change the main purpose.


reasoning: The paragraph primarily provides a materiality-related conclusion about the company’s cybersecurity experience—specifically that no material incident occurred—rather than describing governance, management, or risk processes. The reference to the year ended December 31, 2024 supplies a verifiable date-linked fact.


reasoning: The paragraph primarily describes the company’s processes for assessing, identifying, and managing cybersecurity risks, including risks tied to third-party service providers. Although it mentions committee oversight and reporting to the Audit Committee, those governance details are secondary to the description of the risk management process.


reasoning: The paragraph primarily gives a conclusion about whether cybersecurity issues have materially affected the company’s business, operations, or financial condition, which is a materiality/business-impact assessment. It does not describe governance, management roles, or risk management processes.


reasoning: The paragraph primarily describes how cybersecurity threats and incidents are identified, escalated, assessed, and disclosed through the company's incident response and escalation process. Although it names management roles and groups, those details mainly support the description of the operational response process rather than management organization alone.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from third-party service providers, including due diligence, onboarding reviews, contractual requirements, and incident follow-up. It does not include qualifying firm-specific, quantified, or cybersecurity-domain-specific facts beyond generic vendor risk oversight language.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from third-party service providers, especially during onboarding and assessment. It does not provide qualifying firm-specific, quantified, or cybersecurity-domain-specific facts beyond generic process descriptions.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from third-party service providers, making third-party risk the central topic. It does not include qualifying specific facts such as named vendors, frameworks, committees, roles, dates, or quantified details.


reasoning: The paragraph primarily describes how the board oversees cybersecurity risk through the Audit Committee and management reporting, which is board-level oversight structure. It does not provide qualifying firm-specific or verifiable facts beyond generic governance language.


reasoning: The paragraph primarily describes how the Board, through the Audit Committee, oversees cybersecurity and digital risk by receiving reports on threats, incidents, assessments, and program status. Its main purpose is the board oversight structure rather than management organization or program activities.


reasoning: The paragraph primarily gives a materiality assessment, stating that cybersecurity risks and incidents have not had a material adverse effect on the company to date, which fits Strategy Integration. Although it also lists threat sources and monitoring activities, those serve mainly as context for the business-impact conclusion.


reasoning: The paragraph primarily provides a materiality-oriented assessment of how cybersecurity threats have affected, or could affect, the company’s business and operations, including the statement that no material adverse impact has occurred as of the filing date. Although it briefly mentions governance and internal efforts, the dominant focus is business impact and materiality rather than oversight structure or program mechanics.


reasoning: This paragraph only describes the company's general reliance on technology systems, third-party applications, and sensitive data, without explaining oversight, management roles, cybersecurity processes, vendor risk controls, incident details, or materiality conclusions. It is contextual background rather than a substantive cybersecurity disclosure.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks posed by third-party service providers, including assessments, reassessments, and contractual security requirements. It is not about the broader cyber program generally, but specifically about vendor-related cyber risk oversight.


reasoning: The paragraph primarily gives a materiality assessment that cybersecurity threats have not materially affected and are not reasonably likely to materially affect the company's business, results, or financial condition, which is Strategy Integration. The added statements about updating the information security plan and investing in infrastructure are general and do not change the main focus.


reasoning: The paragraph primarily explains which management roles are accountable for cybersecurity—specifically the CIO and CISO—and what they are responsible for. Although it mentions a risk-based approach and cybersecurity controls, the main focus is management responsibility rather than the program's operational processes.


reasoning: The paragraph primarily describes what the company’s cybersecurity program does to identify, assess, and mitigate cyber risk, including monitoring, software updates, endpoint protection, remote access controls, encryption, and 2FA. Although it mentions integration into overall risk management, the core focus is the operational cybersecurity process rather than governance, management roles, or third-party oversight.


reasoning: The paragraph primarily provides a materiality assessment by stating that prior cybersecurity threats have not materially affected the company's business strategy, results of operations, or financial condition. Although it also includes hypothetical risk language and a cross-reference to risk factors, the core disclosure is the business-impact conclusion.


reasoning: The paragraph primarily describes what the cybersecurity program does operationally—developing tools and processes for identifying, containing, and remediating incidents, plus employee training and phishing tests. Although it mentions the information security team and CSO, those role references are secondary to the program activities.


reasoning: The paragraph is centrally about how the company manages cybersecurity risks arising from suppliers and other third parties, including monitoring, assessments, and contractual provisions. While it uses cybersecurity-specific terms like threat intelligence and security scoring, it does not include firm-specific roles, named systems, vendors, dates, or quantified details.


reasoning: The paragraph primarily describes the company’s cybersecurity program activities and controls—how it identifies, manages, and mitigates cyber risk through technical measures, training, and threat intelligence. Although third-party service providers and consultants are mentioned, the central focus is the overall risk management process rather than vendor oversight specifically.


reasoning: The paragraph primarily describes what the cybersecurity program does operationally—using security controls, assessments, and threat intelligence to protect systems and manage vulnerabilities. It does not focus on board oversight, management structure, third-party risk, or business impact.


reasoning: The paragraph primarily describes the company’s cybersecurity activities and controls, including incident response planning, monitoring, insider threat protection, training, and awareness efforts, which makes it a risk management process disclosure. Its main focus is what the cybersecurity program does rather than board oversight or management organization.


reasoning: The paragraph primarily describes how the company manages cybersecurity risk from vendors and supply chain relationships, including screening, ranking, rescreening, and imposed requirements on vendors. Although it briefly mentions cyber insurance, the central topic is third-party oversight.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity threats and prior incidents have not materially affected the company’s business strategy, results of operations, or financial condition. It does not describe governance, management roles, or risk management activities.


reasoning: The paragraph primarily describes how the Board and its Audit Committee oversee cybersecurity, including the information they receive from management and escalation protocols for incidents. While management roles are mentioned, they are presented mainly as part of the Board oversight structure rather than to describe management organization.


reasoning: The paragraph primarily provides a materiality assessment that cybersecurity risks have not materially affected the business or results of operations to date, which falls under Strategy Integration. The remaining statements are generic forward-looking risk language and a cross-reference, not substantive process or governance disclosure.


reasoning: The paragraph primarily describes what the cybersecurity program does, including controls, monitoring, training, testing, and incident readiness, which makes it a Risk Management Process disclosure. Although third-party risk is included, it is only one component of a broader program description rather than the central topic.


reasoning: The paragraph primarily provides a conclusion about the business impact of cybersecurity events—stating that the company has not experienced material impacts from cyberattacks or security incidents—which is a Strategy Integration assessment. The remaining language about evolving threats and improving controls is general and does not outweigh the materiality-focused statement.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk from vendors by imposing security, insurance, and incident-reporting requirements on third-party providers. It does not include qualifying firm-specific roles, named firms, dates, numbers, or sufficiently distinctive cybersecurity facts beyond generic vendor-risk controls.


reasoning: Although the paragraph mentions the Enterprise Cybersecurity team and its qualifications, the primary focus is on what the cybersecurity function does: using threat intelligence, internal tools, network monitoring, and vulnerability scanning to identify and manage cyber risk. The certifications and named threat-intelligence sources make the disclosure more specific and externally verifiable.


reasoning: The paragraph primarily provides the company's assessment of whether cybersecurity incidents and threats have materially affected, or are reasonably likely to materially affect, its business strategy, results of operations, or financial condition. The rest is general cautionary language and a risk-factor cross-reference rather than a description of governance, management, or operational processes.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity threats, including a previously disclosed incident, have materially affected the company and are reasonably likely to materially affect business strategy, results of operations, or financial condition. It does not describe the incident itself or any specific cybersecurity processes.


reasoning: This paragraph primarily describes general cybersecurity threat landscape and speculative risk exposure rather than the company's governance, management structure, risk management process, third-party oversight, a real incident, or a materiality conclusion. It contains no qualifying specific facts beyond generic references to cyber risk, phishing, ransomware, and nation-state threats.


reasoning: The paragraph primarily describes how the company's cybersecurity process operates: monitoring, detection, escalation, evaluation, mitigation, and remediation of threats and incidents. Although it mentions the CIO and CISO, the focus is on the operational workflow of the cybersecurity program rather than management qualifications or board oversight.


reasoning: The paragraph primarily describes an oversight/reporting structure in which a committee receives cybersecurity updates from the CISO, which is most consistent with governance. The named CISO and named committee make the disclosure firm-specific, even though the cadence and report topics are otherwise fairly standard.


reasoning: The paragraph primarily describes an actual cybersecurity incident, including when it occurred and its immediate consequences, which makes it an Incident Disclosure. Its month-and-year timing is a verifiable specific date, supporting Quantified-Verifiable specificity.


reasoning: The paragraph primarily describes the company's cybersecurity program activities, including detection, containment, response, training, third-party risk measures, and incident response processes. Although it includes management qualifications and roles, those details support a broader description of how the cybersecurity program operates rather than serving as the main focus.


reasoning: This paragraph primarily describes management-level committee structure, leadership, composition, and reporting lines for cybersecurity-related governance rather than board oversight or operational security activities. The named committees, CISO leadership, and the approximately 20-department composition make it management organization content with verifiable specificity.


reasoning: The paragraph primarily describes the existence of cybersecurity-related policies, procedures, and systems to identify and address risks, which is a risk management process topic. It does not provide firm-specific roles, committees, frameworks, tools, dates, or other qualifying specific facts.


reasoning: The paragraph primarily describes an actual cybersecurity incident, including its nature (ransomware), operational impact, response, recovery, and aftermath, which makes Incident Disclosure the best fit. Although it also includes materiality conclusions and remediation steps, those are presented in the context of the specific incident.


reasoning: The paragraph primarily provides a materiality-related assessment by stating that no material cybersecurity incidents have occurred in the last three fiscal years, which fits Strategy Integration under the SEC materiality rule. The cross-reference to a separate risk factor is secondary and does not add substantive program, governance, or incident-detail content.


reasoning: The paragraph primarily describes the purpose of the cybersecurity program and governance in managing security and risk—namely alignment with business objectives, regulatory compliance, and leadership goals—rather than board oversight structure or management roles. It does not include concrete process details, named roles, committees, frameworks, or other specific facts.


reasoning: The paragraph primarily describes how the board, through its Risk Committee, oversees cybersecurity risk and receives information from management. Although it references elements of the risk program, the main focus is the board oversight structure and reporting flow.


reasoning: The paragraph primarily describes an actual cybersecurity incident and the ongoing investigation into it, which makes Incident Disclosure the best fit. Although it also includes a materiality conclusion, the incident description is the dominant subject.


reasoning: The paragraph primarily describes what the cybersecurity program does—its protective controls, training, and threat-focused security measures—rather than board oversight or management structure. It uses clear cybersecurity terminology such as defense in depth, encryption, data loss prevention, phishing, malware, and social engineering, but does not include qualifying firm-specific or verifiable facts.


reasoning: This paragraph primarily describes which management leaders oversee cybersecurity and their qualifications, so it is about management organization rather than board oversight or program activities. The named cybersecurity-related roles and the quantified experience level make the disclosure Quantified-Verifiable.


reasoning: The paragraph primarily describes how cybersecurity risk is incorporated into the company’s overall risk management approach by stating it is managed as part of enterprise risk management programs. Although it also includes a cross-reference to Item 7, the only substantive cybersecurity content is this high-level ERM integration statement.


reasoning: This paragraph primarily describes an actual cybersecurity incident, including its source, affected data, response, and operational impact, so it is best classified as Incident Disclosure. It is Quantified-Verifiable because it includes named external entities and systems such as Progress Software Corporation and MOVEit Transfer.


reasoning: This paragraph does not describe an actual cybersecurity governance structure, management role, risk management process, or incident. It is a general statement about potential consequences of system failures or breaches, including those involving third-party vendors, without explaining any concrete cybersecurity practices or assessments.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk from suppliers, vendors, and other third parties by imposing contractual security and data-use requirements. It does not include any qualifying specific facts such as named vendors, committees, roles, frameworks, dates, or quantified details.


reasoning: The paragraph primarily describes actual cybersecurity incidents that occurred, including their nature and an example involving a vendor compromise. Although it ends with a materiality conclusion, most of the paragraph focuses on what happened, so Incident Disclosure is the best fit.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity attacks have not been material to the company's operations or financial condition to date. The rest of the paragraph is general risk language and a cross-reference to risk factors, not a description of governance, management, or risk management processes.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity threats and prior incidents have not materially affected and are not reasonably likely to materially affect the company. The remaining language is cautionary and cross-referential, not a description of governance, management, or risk processes.


reasoning: The paragraph primarily explains who in management is responsible for cybersecurity-related activities and why they are qualified, focusing on reporting lines, responsibilities, and experience rather than the mechanics of the cybersecurity program itself. It includes multiple specific, externally checkable details such as named roles, named individuals, committees, and quantified years of employment and experience.


reasoning: The paragraph primarily describes management's organization and leadership by identifying the CISO as the responsible executive and detailing his qualifications and experience. It is not mainly about board oversight or the cybersecurity program's processes, but about who leads the function and why he is qualified.


reasoning: The paragraph primarily provides a materiality-oriented assessment that cybersecurity threats are reasonably likely to materially affect the company’s business strategy, results of operations, or financial condition, which fits Strategy Integration. The remaining language is general cautionary and cross-referential, without substantive program, governance, or incident-specific detail.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks from vendors and other third-party service providers, making third-party risk the central topic. It describes generic vendor assessment and contractual requirements but includes no qualifying firm-specific roles, names, dates, numbers, or verifiable details.


reasoning: The paragraph primarily gives a materiality assessment, stating that no cybersecurity breaches were identified that materially affected or were reasonably likely to materially affect the company’s business, results, or financial condition. The rest is a cross-reference to risk factors rather than a description of governance, management, or risk management processes.


reasoning: The paragraph primarily describes how the Audit Committee oversees cybersecurity through reports, direct engagement with management, and receipt of audit and assessment results. Although management roles are mentioned, the main purpose is the board-level oversight structure rather than management organization or program operations.


reasoning: The paragraph primarily describes the existence and purpose of the company's cybersecurity risk management program as part of managing cyber risks, rather than board oversight, management structure, or a specific incident. Although much of the language is high-level and risk-oriented, it still centers on the company's cybersecurity program and its role in safeguarding data and systems.


reasoning: The paragraph primarily explains how management is organized to lead cybersecurity, emphasizing the Senior Manager's leadership role, reporting line, experience, and management reporting structure. Although it mentions program activities, those are secondary to describing who is responsible and how management handles oversight.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from third-party service providers, making third-party risk the central topic. It does so in generic terms without naming specific vendors, committees, frameworks, tools, or verifiable details.


reasoning: The paragraph primarily describes how the Board and its Audit Committee oversee cybersecurity, including reporting and escalation to the Board. The only qualifying specific fact is the involvement of the Vice President of Cybersecurity in those management briefings.


reasoning: The paragraph primarily explains which management roles lead cybersecurity and why those leaders are qualified, which makes it a Management Role disclosure. Although it mentions incident monitoring and the incident response plan, those activity references are secondary to the description of leadership responsibility and credentials.


reasoning: The paragraph primarily describes how the company manages cybersecurity risks posed by vendors and service providers, making third-party oversight the central topic. It includes firm-specific organizational facts through the named Vendor Management Committee and Vendor Management team.


reasoning: The paragraph primarily explains how the company evaluates and oversees cybersecurity risks associated with third-party service providers, making third-party risk the central topic. It remains generic because it provides no named vendors, specific contractual controls, standards, systems, dates, or other qualifying firm-specific facts.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from vendors and service providers, making third-party risk the central topic. Its most specific qualifying fact is the named TPRM program; the remaining discussion is largely standard vendor due diligence and monitoring language.


reasoning: This paragraph primarily describes a real cybersecurity incident involving Change Healthcare, including the date, response steps, and operational effects, which makes Incident Disclosure the best fit. Although it also includes a materiality conclusion, the incident narrative dominates the paragraph.


reasoning: The paragraph primarily discusses cybersecurity risk arising from third-party card transaction counterparties and other service providers, including the company’s security assessments of higher-risk vendors. Although it opens with a material-impact statement and mentions prior incidents, the bulk of the paragraph focuses on vendor-related exposure and oversight.


reasoning: The paragraph primarily provides a materiality and business-impact assessment, stating that cybersecurity threats and incidents have not materially affected results to date while noting effects on business strategy and processes. The rest of the paragraph is largely cautionary language about potential future impacts rather than describing governance, management structure, or specific risk-management activities.


reasoning: The paragraph primarily describes how cybersecurity risk oversight flows through the Board and Audit Committee, making board oversight the central topic. Although it mentions management responsibility, the emphasis is on the Board’s direct oversight and committee reporting structure.


reasoning: This paragraph primarily describes which management roles handle cybersecurity and why they are qualified to do so, focusing on responsibilities, reporting structure, and prior experience rather than the cybersecurity program’s activities. It includes quantified experience information, which makes the disclosure Quantified-Verifiable.


reasoning: This paragraph primarily describes a real cybersecurity-related event involving Change Healthcare, including when it occurred, what happened, and the company’s response and operational impact. Although it ends with a materiality conclusion, the incident narrative is the dominant focus.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk from third-party service providers, including audit requirements and review of provider controls. It is not mainly about the company's internal cybersecurity program or board/management structure.


reasoning: This paragraph primarily describes who within management is responsible for cybersecurity and why that person and team are qualified, which fits Management Role. It focuses on leadership responsibility, reporting relationships, and credentials rather than describing the cybersecurity program's processes.


reasoning: The paragraph primarily describes what the company's cybersecurity program does: protecting information, assessing and managing cybersecurity threats, addressing third-party risk, and responding to security incidents. Although it mentions the CSO, the focus is on program activities and scope rather than management structure or board oversight.


reasoning: This paragraph primarily describes how board committees oversee cybersecurity-related matters and coordinate their review responsibilities, which is board-level governance. The only qualifying specificity is the mention of the Risk Committee; the Audit Committee and general oversight language are otherwise boilerplate.


reasoning: The paragraph primarily provides management’s assessment of whether cybersecurity threats and incidents have materially affected the company’s business strategy, results of operations, and financial condition, which squarely fits Strategy Integration. Although it mentions investments and insurance, those points are framed as business impact and materiality discussion rather than describing the cybersecurity program itself.


reasoning: The paragraph primarily describes how the board, through the Audit Committee, oversees cybersecurity risk, which is a board oversight structure question. It does not include qualifying firm-specific or verifiable facts, and the language is standard governance boilerplate.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from vendors and service providers, making third-party risk the central topic. While it includes cyber-specific concepts such as cybersecurity due diligence and external monitoring of supplier posture, it does not provide firm-specific named roles, committees, dates, vendors, or quantified details.


reasoning: The paragraph primarily describes what the company's cybersecurity program does operationally—its incident response planning, testing, and response coordination—rather than board oversight, management qualifications, or a specific incident. Its details remain generic because it references only standard plans, teams, and outside experts without naming specific roles, frameworks, vendors, dates, or other qualifying facts.


reasoning: The paragraph primarily states management's conclusion that cybersecurity threats have not materially affected and are not reasonably likely to materially affect the company's business strategy, financial condition, or results of operations, which is a materiality/business-impact assessment. The cross-reference to Risk Factors is secondary.


reasoning: This paragraph primarily describes how the board and its committees oversee cybersecurity, including delegation to the Corporate Risk Committee and reporting from management to the board. The presence of cybersecurity-specific roles and a named non-generic board committee makes it firm-specific.


reasoning: The paragraph primarily describes how the Board and its Audit Committee oversee cybersecurity risk through reviews, incident reporting, and briefings from management. It does not contain qualifying firm-specific or verifiable facts under the annotation rules because the committee named is generic, the cadence is generic, and the officer title referenced is not a cybersecurity-specific role.


reasoning: The paragraph primarily describes how management is organized to oversee cybersecurity, including the composition and responsibilities of the CCMT. Although it mentions communications to the Board and Audit Committee, the main focus is management-level roles and structure rather than board oversight.


reasoning: The paragraph describes an actual cybersecurity event that occurred to the company—a ransomware attack—and its immediate consequence, so it primarily answers what happened rather than how cybersecurity is governed or managed. Although it includes a materiality statement, the incident itself is the dominant focus.


reasoning: The paragraph primarily describes how the company manages cybersecurity risks arising from IT vendors, business partners, and service providers, making third-party risk the central topic. It uses cybersecurity-relevant concepts such as security assessments and third-party security controls, but does not include qualifying firm-specific or verifiable facts.


reasoning: This paragraph is a cross-reference directing readers to Item 1A Risk Factors rather than providing a substantive cybersecurity governance, management, process, incident, or materiality assessment disclosure itself. Under the rules, cross-references of this kind are classified as None/Other.


reasoning: The paragraph primarily describes a component of the company’s cybersecurity program—using external assessors and consultants to evaluate threats, conduct assessments, and support forensic review activities. Although third parties are mentioned, they are described as service providers supporting the internal security program, so this is Risk Management Process rather than Third-Party Risk.


reasoning: The paragraph primarily describes the governance and escalation structure for cybersecurity risk oversight, culminating in how management committees and the board are positioned to oversee cyber risk. While it includes management committees and roles, the main purpose is to explain oversight architecture rather than day-to-day program activities.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks posed by third-party service providers by requiring security measures and assessing those providers' security frameworks. It is not about the company's internal cyber program generally, but specifically about vendor-related cyber oversight.


reasoning: The paragraph primarily provides a materiality assessment, stating that prior cybersecurity incidents, including the August 2023 incident, have not materially affected the company. Although it references a real incident, the dominant question answered is the impact on the business rather than the incident details themselves.


reasoning: The paragraph primarily explains management’s cybersecurity leadership structure and the qualifications of the executive responsible for cybersecurity. Although it mentions implementing policies and responding to incidents, the main focus is the role and experience of the Chief Security and Trust Officer.


reasoning: The paragraph primarily gives a materiality assessment about whether cybersecurity threats or incidents have affected the company’s business, results, or financial condition, which fits Strategy Integration. Although it includes a cross-reference to risk factors, the core disclosure is the dated conclusion of no material effect.


reasoning: The paragraph primarily describes how the Board is informed about and oversees cybersecurity through direct briefings and education, which is a board oversight function. Its only qualifying specific fact is the involvement of the CISO, a cybersecurity-specific role.


reasoning: This paragraph does not provide a substantive cybersecurity assessment or process; it only cross-references risk factor disclosures elsewhere in the filing. Under the rules, cross-references about potential material effects belong in None/Other.


reasoning: The paragraph primarily describes how the Board and Audit Committee oversee cybersecurity, including the reporting they receive and escalation of incidents, which makes Board Governance the best fit. It includes firm-specific organizational details such as the CIO, Vice President of Information Security, and the Information Technology Senior Leadership Team, but no quantified or externally verifiable facts.


reasoning: The paragraph primarily provides a materiality assessment and conclusion that cybersecurity threats have not materially affected the company's operations or financial position, which fits Strategy Integration. Although it mentions an Incident Response Team, that serves as supporting context rather than the main point.


reasoning: The paragraph primarily describes how management is organized for cybersecurity, focusing on the CISO’s leadership, qualifications, and the composition of the supporting team. Although it also references incident response activities, those are secondary to the management-structure description.


reasoning: This paragraph is an introductory statement about the importance of cybersecurity and the purpose of the disclosure, not a substantive description of governance, management, processes, third-party risk, incidents, or business impact. It contains no cybersecurity-specific facts or concrete program details.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk arising from third parties, specifically acquisition targets, through security due diligence, testing, and remediation requirements. It is not about general program operations overall, but about third-party-related risk handling as the central topic.


reasoning: This paragraph is primarily a forward-looking risk statement about potential adverse effects of cybersecurity failures or vendor breaches, not a description of governance, management roles, processes, third-party oversight, or an actual incident. It uses generic hypothetical impact language without substantive cybersecurity-specific measures or firm-specific details.


reasoning: The paragraph primarily describes management's cybersecurity leadership structure, focusing on the CISO's responsibility, qualifications, certification, and reporting line. Although it references board committee review and approval, those governance details are secondary to the discussion of management organization and credentials.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from third-party service providers, making third-party risk the central topic. It does not include qualifying firm-specific or verifiable facts such as named roles, named committees, specific vendors, frameworks, dates, or quantified details.


reasoning: The paragraph primarily describes the company’s cybersecurity program activities and controls—monitoring, threat detection, defensive technologies, assessments, and employee training—rather than board oversight or management structure. It uses cybersecurity-specific terminology such as alignment with the NIST Cybersecurity Framework, multi-factor authentication, intrusion prevention/detection, encryption, and patching, but does not provide qualifying firm-specific or verifiable facts.


reasoning: The paragraph primarily provides a materiality assessment: it states that no known cybersecurity threats or incidents had a material impact in the last fiscal year and that ongoing cyber risks could reasonably be likely to materially affect the company. The reference to Risk Factors is secondary and does not change the main focus from business impact assessment.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from vendors and other third-party service providers, making Third-Party Risk the best fit. It gives only generic descriptions of assessments, information requests, and monitoring, without named vendors, tools, frameworks, roles, or other qualifying specific facts.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from third-party service providers, including vendor assessments and ongoing monitoring. Its most specific qualifying detail is the identified internal team composition involved in the third-party risk assessment process.


reasoning: This paragraph primarily describes management’s cybersecurity leadership structure, responsibilities, reporting context, and the qualifications of the CSO. It is not focused on board oversight or the underlying cybersecurity processes themselves.


reasoning: This paragraph primarily describes management's cybersecurity-related organizational structure and responsibilities, centered on the CIO's role, reporting relationship, and qualifications. It does not focus on board oversight or the details of the cybersecurity program itself.


reasoning: This paragraph is primarily about how the company evaluates and manages cybersecurity risks posed by third-party vendors, making Third-Party Risk the best fit. It describes vendor due diligence and review of vendors' security practices, but does not include qualifying firm-specific, quantified, or clearly domain-specific facts under the rubric.


reasoning: The paragraph primarily describes management-level responsibility and qualifications by identifying who serves on the ISC and summarizing their relevant experience. Although it mentions cybersecurity activities, those are presented as areas of experience rather than as the company’s risk management process.


reasoning: The paragraph primarily provides a materiality-related assessment, stating that there have been no material cybersecurity incidents to date, which fits Strategy Integration under the materiality rule. The remaining statements are generic cautionary language and a cross-reference to risk factors, not incident-specific disclosure.


reasoning: The paragraph primarily describes how cybersecurity risk assessment is incorporated into the company's broader risk management process and what areas are reviewed annually. Although it mentions the Audit Committee's oversight of ERM, that is secondary to the description of the risk management process itself.


reasoning: The paragraph primarily explains how the company evaluates and monitors cybersecurity risk arising from vendors and service providers, making third-party risk the central topic. It describes due diligence, third-party assessments, and monitoring of provider incidents, but does so in generic terms without firm-specific roles, named programs, dates, vendors, or verifiable details.


reasoning: The paragraph primarily describes the board-level oversight structure for cybersecurity and related IT/data risks, including the board’s role and the audit committee’s delegated review responsibility. The remaining details are either generic governance language or not sufficiently cybersecurity-specific to change the primary focus.


reasoning: The paragraph primarily gives the company’s materiality assessment that cybersecurity threats and prior incidents have not materially affected, and are not reasonably likely to materially affect, the business, results, or financial condition. The remaining language is generic cautionary and cross-reference text rather than substantive process, governance, or incident detail.


reasoning: This paragraph is a hypothetical risk statement about possible harms from cybersecurity attacks, not a description of governance, management, processes, third-party risk, an actual incident, or a materiality conclusion. It uses generic speculative language ('could') without substantive cybersecurity program details.


reasoning: This paragraph describes a general enterprise risk management role—a Chief Risk Officer providing broader risk oversight—without substantive cybersecurity-specific oversight, management organization, or program details. Because it is not meaningfully cyber-specific, it falls outside the substantive cybersecurity categories.


reasoning: The paragraph primarily describes who in management is responsible for cybersecurity and the CIO’s oversight role and experience, which fits Management Role. It does not materially describe the underlying cybersecurity processes or controls beyond assigning responsibility.


reasoning: The paragraph primarily provides a materiality-oriented assessment by stating that the company has not experienced any recent material cybersecurity incidents and discussing whether future incidents could materially affect the business, results, or financial condition. The rest is largely cautionary and cross-referential language rather than describing governance, management, or risk processes.


reasoning: This paragraph primarily describes a real cybersecurity incident, including what happened, what data was affected, and the timing of notifications and response. It includes multiple verifiable details such as specific dates, a named software product, and the number of affected customers.


reasoning: This paragraph is a biography of a human resources executive and does not describe cybersecurity governance, management, risk processes, third-party risk, incidents, or cyber-related strategy impacts. Because it contains no substantive cybersecurity disclosure, it is classified as None/Other.


reasoning: The paragraph primarily explains who within management leads cybersecurity and why they are qualified, focusing on the CIO’s experience and the cybersecurity team’s credentials. Although it mentions some program activities, the dominant purpose is management organization and qualifications rather than the broader risk management process.


reasoning: This paragraph is only a cross-reference directing the reader to Item 1A for discussion of cybersecurity risks, rather than providing substantive disclosure about governance, management, processes, third-party risk, incidents, or strategy impact. Under the rules, cross-references like this are classified as None/Other.


reasoning: The paragraph primarily explains how management is organized to oversee cybersecurity, emphasizing the IT Security team’s leadership, reporting structure, and the qualifications of the Director and Vice President. Although it mentions cybersecurity activities, the dominant focus is on roles, experience, and credentials rather than the operational security program itself.


reasoning: The paragraph primarily describes what the company’s cybersecurity program does, including assessments, training, phishing tests, incident response, backups, and related controls. Although it mentions third-party assessments and cyber insurance, those are components of the broader cybersecurity risk management program rather than the paragraph’s central focus.


reasoning: The paragraph primarily describes how the company manages cybersecurity risk arising from third-party service providers, including onboarding, due diligence, security requirements, and review of hosted applications. While it includes cybersecurity-specific terminology and references SOC 2 and ISO 27001, it does not identify firm-unique roles, committees, dates, named vendors, or verifiable quantitative details.


reasoning: The paragraph primarily provides a materiality-related conclusion about cybersecurity incidents and notes cybersecurity insurance, which fits Strategy Integration. Although it also mentions threats and general protective efforts, those are secondary to the stated business-impact assessment.


reasoning: The paragraph primarily describes what the cybersecurity program does—monitoring systems, using security measures, conducting audits, and responding to incidents—rather than focusing on board oversight or management qualifications. The references to the SVP IT are secondary to the description of operational cybersecurity activities.


reasoning: This paragraph primarily describes how management is organized to address cybersecurity, focusing on the roles, responsibilities, and qualifications of the CRO, CIO, and CISO. Its emphasis is on leadership experience and reporting responsibilities rather than on the operational cybersecurity program itself.


reasoning: The paragraph primarily describes a real cybersecurity incident, including when the company was notified, the outside entity involved, and resulting litigation and regulatory inquiries. Because it includes a specific date and a named external firm, it is Quantified-Verifiable.


reasoning: The paragraph primarily describes how the board oversees cybersecurity, including committee-level oversight and escalation in the event of a material incident. Its main focus is the board governance structure rather than management organization or operational cybersecurity processes.


reasoning: The paragraph primarily describes how management is organized to handle cybersecurity, focusing on the Head of Global IT, the IT Security Team, and their responsibilities and qualifications. Although it mentions acquisition-target diligence, the dominant emphasis is on management roles, experience, and team capabilities.


reasoning: The paragraph primarily describes an actual cybersecurity event, including what happened, what systems were affected, investigation findings, and the outcome. Although it notes the incident was not material, the dominant purpose is disclosure of the incident itself rather than a general business-impact assessment.


reasoning: The paragraph is primarily a high-level cautionary statement about cyber risks and a cross-reference to Risk Factors, rather than a substantive description of board oversight, management structure, or a concrete cybersecurity process. Its references to systems and programs are too generic to constitute a meaningful risk-management-process disclosure under the annotation rules.


reasoning: This paragraph is an executive biography describing business leadership roles and career history, not cybersecurity governance, management, risk processes, third-party risk, incident details, or cyber-related strategy impacts. Because it contains no substantive cybersecurity disclosure, it falls under None/Other.


reasoning: The paragraph primarily describes how the company’s cybersecurity program is carried out using external support for incident response, assessments, and infrastructure maintenance. Although it mentions evaluating third-party providers, vendor oversight is not the central topic; the main focus is the company’s cyber risk management activities.


reasoning: The paragraph primarily provides a backward-looking assessment that the company has not experienced any material adverse events from a security breach or cyber-attack, which fits Strategy Integration under the materiality/impact rule. The remaining language is largely generic risk discussion about possible operational consequences rather than a description of governance, management, or specific cybersecurity processes.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk arising from third parties, especially service providers, by imposing security control requirements and assessing compliance. Although it mentions threat intelligence services, the central focus is vendor-related cyber risk oversight.


reasoning: This paragraph primarily describes an actual cybersecurity incident, including when it occurred, what happened, the response taken, and the operational effects. Although it notes no material financial impact, the dominant focus is the incident itself rather than broader business strategy or risk management.


reasoning: The paragraph describes actions being taken in connection with an actual cybersecurity-related matter, including engagement with law enforcement and customer remediation measures, so it is primarily incident-focused. The two-year duration of identity protection services is a specific, verifiable detail that elevates specificity.


reasoning: The paragraph primarily describes the governance chain for cybersecurity incidents: the Cyber ERM Committee reports incidents to the Audit Committee and Board so they can assess materiality and disclosure obligations. Although it mentions a management committee, the main purpose is explaining board-level oversight and information flow.


reasoning: The paragraph primarily explains the company's cybersecurity oversight structure across board and management layers, making board governance the central topic. It includes firm-specific organizational details such as the CTO, Risk Committee, Technology Leadership Centre, and Controlling Department, but no quantified or externally verifiable facts.


reasoning: The paragraph is primarily about how the company oversees cybersecurity risks posed by vendors and other service providers, making third-party risk the central topic. It describes generic oversight measures for third parties without providing qualifying specific facts such as named vendors, frameworks, teams, or verifiable details.


reasoning: The paragraph primarily explains that cybersecurity-related risks are incorporated into the company’s ERM and audit planning process, which is a description of risk management process rather than board oversight or management organization. Although the Audit Committee is mentioned, the central focus is ERM-based risk evaluation and audit planning.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from vendors and external platforms, making third-party risk the central topic. Although it lists control types such as diligence, contractual obligations, and monitoring, it does not include qualifying firm-specific or verifiable facts.


reasoning: The paragraph primarily describes the oversight chain and information flow from the Risk Committee to management and the Board regarding cybersecurity risk controls, which fits board governance. It includes firm-specific organizational details through the named Risk Committee and the named Incident Management and Information Security Plan.