content_category: None/Other

category_confidence: high

specificity_confidence: high

reasoning: This paragraph is only a cross-reference directing readers to another section for discussion of potential cybersecurity-related risks. It does not itself describe governance, management, processes, third-party risk, incidents, or business impact assessments.

provider: openai

stage: benchmark


reasoning: This paragraph is only a cross-reference directing readers to the Risk Factors section and does not itself describe cybersecurity governance, management, processes, third-party risk, incidents, or strategy impacts. Under the rules, cross-references like this are classified as None/Other.


reasoning: This paragraph is only a cross-reference to another section of the filing and does not itself describe cybersecurity governance, management, processes, third-party risk, incidents, or strategy impacts. Because it contains no substantive cybersecurity disclosure, it is best classified as None/Other.


reasoning: This paragraph is primarily a cautionary statement and cross-reference to risk factors, not a substantive description of governance, management, processes, third-party risk, incident details, or business impact assessment. It provides no concrete cybersecurity measures beyond generic limitation language.


content_category: Third-Party Risk

specificity_confidence: medium

reasoning: The paragraph is centrally about how the company manages cybersecurity risks arising from third-party service providers, including due diligence, contract review, and ongoing monitoring. Its primary question is vendor cyber risk oversight rather than the broader internal cybersecurity program.


reasoning: This paragraph is a general statement that the company faces cyber threats because it stores and transmits personal information; it does not describe governance, management roles, risk processes, third-party oversight, a specific incident, or a business-impact assessment. It is therefore best treated as non-substantive background risk disclosure.


category_confidence: medium

reasoning: This paragraph is a high-level statement of commitment to protecting IT assets, data, intellectual property, and products, but it does not describe any actual cybersecurity governance, management structure, process, third-party oversight, incident, or business-impact assessment. It is therefore best treated as non-substantive boilerplate rather than a disclosure answering one of the core Item 1C questions.


content_category: Board Governance

reasoning: The paragraph primarily describes how cybersecurity information flows to the board and how the board is educated on cybersecurity topics, which is a board oversight function. The named cybersecurity-related management roles providing these presentations make the disclosure firm-specific.


reasoning: The paragraph primarily describes how the board oversees cybersecurity by stating that the Board, through its Cybersecurity Committee, reviews the company's cybersecurity programs and risk management. Although it also includes a material-impact statement, the dominant disclosure is the board oversight structure.


content_category: Incident Disclosure

reasoning: The paragraph primarily describes a real cybersecurity incident, including when it was disclosed, the operational disruption, response actions, and recovery timeline. Although it also includes financial impact and a materiality conclusion, the dominant focus is what happened and its immediate consequences.


content_category: Strategy Integration

reasoning: The paragraph primarily states management’s conclusion that no cybersecurity incidents have materially affected or are reasonably likely to materially affect the company’s business strategy, results of operations, or financial condition, which is a materiality/business-impact assessment. The rest is a cross-reference to risk-factor disclosure rather than a description of governance, management roles, or cybersecurity processes.


reasoning: The paragraph primarily provides a materiality-oriented assessment, including the statement that the company has not experienced any material cyber threats or incidents to date and that future incidents could materially affect the business. The rest is largely cautionary risk language and a cross-reference, not a description of governance, management structure, or cybersecurity processes.


reasoning: The paragraph primarily describes how the Board and Audit Committee receive and oversee cybersecurity information, including escalation of significant and material matters. Although it mentions the CIO's reporting role, the main purpose is the board-level oversight structure and information flow.


content_category: Risk Management Process

reasoning: The paragraph primarily describes the components of the company's cybersecurity program—risk assessments, security controls, training, incident response, and related processes—so it is best categorized as Risk Management Process. Although it mentions third-party service providers and vendor vetting, those are presented as elements of the broader program rather than the central topic.


reasoning: The paragraph primarily provides a materiality assessment, stating that past cybersecurity incidents have not materially affected the company’s financial position, results of operations, or cash flows, which is Strategy Integration under the materiality rule. The remaining content is generic discussion of continued investment and cross-reference to risk factors rather than a detailed process, governance, or incident description.


reasoning: This paragraph primarily describes an actual cybersecurity incident, including when it occurred, its operational effects, remediation steps, and resulting costs, so it is best classified as Incident Disclosure. It includes externally verifiable facts such as a specific date and a quantified dollar impact, supporting Quantified-Verifiable specificity.


reasoning: The paragraph describes oversight responsibilities—reviewing information security examination reports, regulatory communications, and monitoring emerging information security risk issues—so it primarily answers how governance bodies oversee cybersecurity. It does not identify any named committee, role, framework, date, firm, or other qualifying specific fact.


reasoning: The paragraph primarily describes how cybersecurity risks and incidents are monitored and informed through threat intelligence, internal security briefings, and security-tool alerts, which is chiefly about the operation of the cybersecurity program. Although management is mentioned, the substance is the monitoring process rather than management structure or qualifications.


reasoning: The paragraph primarily describes how the company manages cybersecurity risk from external vendors through a vendor management process, making third-party risk the central topic. Although it ends with a materiality statement, most of the paragraph focuses on vendor vetting and oversight rather than business impact.


content_category: Management Role

reasoning: The paragraph primarily describes how management is organized to handle cybersecurity, including the composition of the cybersecurity function, leadership roles, and reporting lines. Although it mentions use of third parties and security activities, those points are secondary to the management-structure and qualifications focus.


reasoning: The paragraph is centrally about how the company manages cybersecurity risk arising from vendors and other third-party service providers, which makes Third-Party Risk the best fit. It describes a third-party risk monitoring effort and a vendor risk management program, but does not provide firm-unique named roles, committees, systems, dates, or verifiable details.


reasoning: The paragraph primarily describes how the board and its committees oversee cybersecurity, including delegated oversight, reporting flows, and management briefings to board-level bodies. Although several management roles are named, they are presented mainly as part of the board oversight structure rather than to explain management organization.


reasoning: This paragraph primarily describes which management roles are responsible for cybersecurity risk oversight and management, which is a management organization question rather than a board oversight or process description. The named cybersecurity-relevant leadership roles make it company-specific.


reasoning: The paragraph primarily explains how the board and its committees oversee cybersecurity, including delegation to the Risk Management Committee and Cybersecurity and Technology Subcommittee and the reporting flow from management to the board. Although it mentions management and exercises, the dominant focus is the board-level oversight structure.


reasoning: The paragraph primarily explains how cybersecurity information flows to the board and how the board participates in oversight through CISO briefings and tabletop exercises. Although it mentions the CISO's leadership role, the main focus is the board's oversight structure rather than management organization.


reasoning: The paragraph primarily describes how cybersecurity information flows to the board and how the board oversees cybersecurity through committee and full-board reporting. Although management roles are mentioned, they are presented mainly as part of the board oversight structure.


reasoning: The paragraph primarily describes how cybersecurity oversight flows through the board structure, with responsibility delegated to a board committee and reporting up to the full Board. Its only qualifying specific detail is the firm-specific cybersecurity role of Senior Director of Governance & Information Security.


reasoning: The paragraph primarily provides a materiality assessment: it states that cybersecurity risks or incidents have not had a material adverse effect on the company, which fits Strategy Integration under the materiality rule. The rest of the paragraph is generalized risk framing and cross-reference language rather than a substantive description of governance, management, or risk processes.


reasoning: The paragraph mainly provides general background about the company's data holdings and exposure to cyber threats, but it does not describe board oversight, management roles, a cybersecurity process, third-party risk management, or a specific incident. Its statements about being targeted and potentially being more affected are speculative/contextual rather than a concrete business-impact assessment or program disclosure.


reasoning: This paragraph is a cross-reference to Risk Factors rather than a substantive cybersecurity disclosure. It does not describe governance, management, processes, third-party risk, an actual incident, or a materiality assessment.


reasoning: The paragraph primarily describes how the company detects, investigates, and analyzes cybersecurity incidents, which is about the operation of its cybersecurity program rather than governance or management structure. It uses cybersecurity-specific process language such as automated event detection, security operations monitoring, incident investigation, severity assessment, and evaluation of compromised data sensitivity.


reasoning: The paragraph primarily explains how management is organized to oversee cybersecurity through a named management steering committee, its composition, and its interaction with the CISO. Although it references escalation to the Audit Committee and Board, the main focus is the management-level structure and responsibilities rather than board oversight itself.


reasoning: The paragraph primarily explains how the board, through the Audit Committee, oversees cybersecurity risk and receives information. Although management and third parties are mentioned, their role is mainly to support board-level oversight rather than to describe the cybersecurity program itself.


reasoning: The paragraph primarily describes the Bancorp’s cybersecurity risk management system, including safeguards and policies for protecting information assets and responding to incidents. Although it includes a materiality conclusion and briefly mentions board and management oversight, those points are secondary to the overall description of the cybersecurity program.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity breaches have not materially affected the company’s business strategy, results of operations, or financial condition to date. The remainder is forward-looking risk language and cross-references to risk factors, not a description of governance, management, or cybersecurity processes.


reasoning: The paragraph is centrally about how the company manages cybersecurity risks arising from vendors and partners, which fits Third-Party Risk. It describes generic vendor vetting and monitoring practices without naming any specific roles, standards, systems, firms, dates, or other company-distinct facts.


reasoning: The paragraph primarily describes how IBM management is organized to handle cybersecurity, including the E&TS organization, the CISO, PSIRT, CSIRT, and BISOs and their responsibilities. While it mentions supplier risk and security activities, the main focus is the management structure and reporting responsibilities rather than the underlying process.


reasoning: The paragraph primarily describes the company's incident response process—containment, remediation, recovery, use of forensic support, disclosure engagement, and plan updates. Although it mentions escalation to the Board and Audit Committee, that oversight language is secondary to the operational response activities.


reasoning: The paragraph primarily describes how cybersecurity information flows to the board and senior governing bodies, including direct CISO engagement and oversight-oriented tabletop exercises. Although it identifies the CISO, the main purpose is explaining oversight structure rather than management qualifications or program mechanics.


reasoning: The paragraph primarily describes what the company's cybersecurity program does to identify, monitor, test, and respond to cyber incidents, including use of monitoring tools and penetration testing. Although third-party experts are mentioned, they are described as one component of the broader security program rather than vendor-risk oversight.


reasoning: The paragraph primarily describes a real cybersecurity incident that occurred in 2017 and its nature, which makes Incident Disclosure the best fit. Although it also includes forward-looking risk language, the opening sentence anchors the paragraph in an actual event.


reasoning: This paragraph primarily gives a materiality assessment about whether cybersecurity incidents have affected or are likely to affect the business or financial condition, which fits Strategy Integration under the SEC materiality rule. It does not describe governance, management structure, or risk management activities.


reasoning: The paragraph primarily describes how cybersecurity information flows upward to senior management and ultimately to the Board via the Audit Committee, which is a board oversight structure question. It includes firm-specific governance details through the named CISO role and the named Cybersecurity Executive Steering Body.


reasoning: The paragraph primarily describes what the company's cybersecurity program does to assess and manage cyber risk, including threat types considered, technical controls, third-party assessments, employee training, and response-related procedures. It is not focused on board oversight or management organization, but on operational risk management activities.


reasoning: The paragraph primarily provides a materiality assessment by stating that the company is not aware of any material cybersecurity incidents that have impacted it, which makes Strategy Integration the best fit under the SEC materiality rule. The rest of the paragraph is supporting risk language about potential cyber threats rather than describing governance, management structure, or a concrete incident.


reasoning: The paragraph primarily describes how cybersecurity oversight flows through the Board and Audit Committee, with management reporting upward on risks and mitigation efforts. Although it mentions a management role, the main purpose is the board-level oversight structure.


reasoning: The paragraph primarily describes what the company's cybersecurity program does to identify, mitigate, and monitor cyber risk, including software updates, endpoint protection, remote access controls, and threat monitoring. Although it mentions integration into overall risk management, the focus is on operational cybersecurity measures rather than governance or management roles.


reasoning: The paragraph primarily describes how the Board oversees cybersecurity risk, receives information from management, and is informed of significant incidents, which is board-level oversight. It does not provide qualifying firm-specific or verifiable details such as named committees, named roles, specific experts, frameworks, or concrete metrics.


reasoning: The paragraph primarily describes an operational cybersecurity preparedness activity—reviewing and drilling on a response plan—rather than board oversight or management qualifications. It also includes a company-specific organizational detail by naming the Emergency Incident Response Team.


reasoning: The paragraph primarily explains the oversight chain for cybersecurity risk: risks are reviewed by the ERM Committee and then reported to the Audit Committee. Although it mentions risk assessment and third-party SOC1 reviews, the central focus is governance and how cyber risk information flows upward.


reasoning: The paragraph primarily describes an actual cybersecurity incident, including when it occurred, what happened, and its operational and data impacts, with some follow-on remediation detail. Because it includes a specific date tied to a real incident, it reaches Quantified-Verifiable specificity.


reasoning: The paragraph primarily gives a materiality and business-impact assessment: it states that no cybersecurity incidents have had a material adverse effect and discusses potential financial exposure and insurance coverage. It does not meaningfully describe governance, management structure, or the cybersecurity program itself.


reasoning: The paragraph does not describe cybersecurity governance, management, processes, third-party risk, incidents, or strategy impact; it primarily states that the trust has no active operations, customers, or sensitive data. For a no-operations entity, this is non-substantive contextual language rather than a cybersecurity program disclosure.


reasoning: The paragraph primarily describes what the cybersecurity program does on an operational basis: incident identification, containment, remediation, consultant support, employee training, and phishing tests. Although management roles are mentioned, they serve mainly as context for describing the company’s cybersecurity activities rather than its organizational structure.


reasoning: The paragraph primarily states Seaboard's assessment that cybersecurity threats have not materially affected and are not reasonably likely to materially affect its business strategy, results of operations, or financial condition, which is a Strategy Integration conclusion under the materiality rule. The remaining references to updating an information security plan and making investments are generic and secondary.


reasoning: The paragraph primarily states a conclusion about whether cybersecurity issues have materially affected the company’s business, operations, or financial condition, which is a Strategy Integration assessment. It does not describe governance, management roles, or cybersecurity processes.


reasoning: The paragraph is primarily about how the company manages cybersecurity risks posed by third-party service providers, including risk assessments, reassessments, and contractual security requirements. Although it contains no firm-unique or externally verifiable facts, it uses cybersecurity-specific third-party risk management concepts beyond generic boilerplate.


reasoning: The paragraph primarily states management’s materiality conclusion that no known cybersecurity incidents have materially affected, or are reasonably likely to materially affect, the company’s business strategy, results of operations, or financial condition. The cross-reference to Item 1A is secondary and does not change the paragraph’s main function.


reasoning: This paragraph provides general background about the company's reliance on technology systems, third-party applications, and sensitive data, but it does not describe governance, management roles, cybersecurity processes, third-party risk oversight, a specific incident, or a materiality/business-impact assessment. It is contextual risk framing rather than substantive cybersecurity disclosure.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from third-party service providers, including due diligence, onboarding assessments, renewal reviews, and provider security requirements. Its focus is vendor-related cyber oversight rather than the company’s internal cyber program or governance structure.


reasoning: The paragraph primarily describes operational cybersecurity measures and program activities, including incident response planning, security monitoring, insider threat detection, preparedness exercises, and employee awareness training. While it uses cybersecurity-specific terminology, the 24/7 security operations center and insider threat protection program make it more company-specific than generic process disclosure.


reasoning: The paragraph primarily explains how the company addresses cybersecurity risks arising from third-party service providers, making third-party risk the central topic. It describes a general vendor assessment practice without naming firms, roles, frameworks, tools, or other company-specific details.


reasoning: The paragraph primarily describes the Trust’s cybersecurity measures and practices, such as isolated workstations, password/passphrase controls, and two-factor or independent authorizations, which makes it a description of the cybersecurity program’s operation. Although third parties are mentioned, the focus is not on managing vendor risk but on the Trust’s overall protective processes.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk from vendors and supply chain partners, making Third-Party Risk the best fit. Although it briefly mentions cyber insurance, most of the paragraph is focused on vendor screening, ranking, rescreening, and sourcing restrictions.


reasoning: The paragraph primarily describes how the company's cybersecurity program detects, escalates, evaluates, and responds to threats and incidents. Although several roles and teams are named, those people are described mainly as part of the incident handling and escalation process rather than as a management-org chart.


reasoning: The paragraph is centrally about how the company manages cybersecurity risk arising from suppliers and other third parties, including supplier assessments, monitoring, and contractual protections. It describes third-party oversight activities rather than internal program governance or a specific incident.


reasoning: The paragraph primarily explains how the board oversees cybersecurity through the Audit Committee and what information it receives from management. Although it mentions management reporting and program topics, the main focus is the board-level oversight structure and information flow.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk from third-party service providers, especially during onboarding and risk assessment, so Third-Party Risk is the best fit. Although it describes a vendor-risk process, it uses largely generic risk-management language without firm-specific, domain-distinct, or externally verifiable details.


reasoning: The paragraph primarily explains which management officials are responsible for cybersecurity and how responsibility is allocated between the CIO and CISO. Although it briefly mentions a risk-based approach and cybersecurity controls, the core content is management organization and responsibility.


reasoning: The paragraph primarily explains how the Board oversees cybersecurity, including information flows from management to the Board and escalation of incidents. Its specificity is firm-specific because it names cybersecurity leadership roles and a company-specific oversight mechanism (a cybersecurity dashboard tied in part to TSA compliance), but does not provide externally verifiable numbers, dates, or certifications.


reasoning: The paragraph primarily describes what the company's cybersecurity program does: its risk management approach, technical safeguards, threat monitoring support, and employee training. Although third-party service providers and consultants are mentioned, they are components of the broader cybersecurity program rather than the central focus.


reasoning: The paragraph primarily provides a materiality assessment, stating that prior cybersecurity threats have not materially affected the company's business strategy, results of operations, or financial condition. The rest of the paragraph is largely generic forward-looking risk language and a cross-reference to risk factors.


reasoning: The paragraph primarily describes what the cybersecurity program does—deploying technical safeguards and improving them through assessments and threat intelligence—so it fits Risk Management Process. It uses cybersecurity-specific terminology like network segmentation, endpoint protection, and threat intelligence, but provides no firm-unique or externally verifiable facts.


reasoning: The paragraph describes an actual cybersecurity incident, including when it occurred and its immediate consequences, so it primarily answers what happened in the incident. The cross-reference to Risk Factors is secondary to the incident description.


reasoning: The paragraph primarily describes what VF’s cybersecurity program does: securing information, detecting and responding to incidents, managing third-party risk, training personnel, maintaining an incident response plan, and using outside providers. Although it includes management qualifications and roles, those details are supporting context rather than the main focus.


reasoning: The paragraph primarily describes how the Board, through the Audit Committee, oversees cybersecurity and receives information from management, which is a board oversight structure. Although it also mentions elements of the cyber risk program, those details are secondary to the governance chain.


reasoning: The paragraph primarily states a conclusion about whether cybersecurity threats or prior incidents have materially affected the company’s business strategy, results of operations, or financial condition, which is a Strategy Integration assessment. It provides no cybersecurity-specific operational detail or firm-specific/verifiable facts.


reasoning: The paragraph primarily provides a materiality-style assessment that the company did not experience a material cybersecurity incident during the covered period, which fits Strategy Integration under the SEC-specific rule for such conclusions. The remaining language is forward-looking cautionary text and a cross-reference, not a description of governance, management, or risk-management activities.


reasoning: The paragraph primarily describes what the company's cybersecurity program does: its control approach, framework alignment, monitoring, testing, training, identity controls, endpoint protections, and third-party oversight activities. Although third-party risk is mentioned, it is only one component of a broader cybersecurity program description, so Risk Management Process is the best fit.


reasoning: The paragraph primarily provides a materiality-oriented assessment that the company has not experienced a cybersecurity threat or incident with a material adverse impact as of the filing date, which fits Strategy Integration under the negative-assertion rule. Although it also mentions general risk management and threat activity, those points are framed around potential business and operational impacts rather than describing a specific program or incident.


reasoning: The paragraph primarily states a conclusion about the business impact of cybersecurity risks—namely that, to date, they have not materially affected the company—so it fits Strategy Integration under the materiality-assessment rule. The remaining language is forward-looking cautionary language and a risk-factor cross-reference, not a description of governance, management, or risk processes.


reasoning: This paragraph is a general statement about the existence of cyber threats and industry risk trends, not a description of the company's governance, management structure, risk management process, third-party oversight, incident, or business-impact assessment. It is speculative/background disclosure rather than substantive Item 1C program detail.


reasoning: The paragraph primarily functions as a cross-reference, directing the reader to Item 7 and stating only at a high level that cybersecurity risk is part of enterprise risk management. It does not meaningfully describe board oversight, management structure, or specific cybersecurity processes.


reasoning: The paragraph primarily states a conclusion about the business impact of cybersecurity events—namely that the company has not experienced material impacts from cyberattacks or security incidents—which fits Strategy Integration under the materiality rule. The remaining language is general commitment and vigilance language, not a description of governance, management structure, or specific risk processes.


reasoning: The paragraph primarily explains how management is organized to handle cybersecurity by detailing specific executives' roles, reporting lines, and qualifications. Although it references updates to the Board's Risk Committee, the focus is on management responsibilities and expertise rather than board oversight.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk from vendors and service providers, making third-party oversight the central topic. Its reference to SOC 1 audits reflects cybersecurity/compliance domain knowledge, but it does not provide firm-unique or externally verifiable facts such as named vendors, dates, or specific quantitative details.


reasoning: The paragraph primarily explains how the company's cybersecurity program operates when threats or incidents are identified, including detection, escalation, evaluation, mitigation, and remediation workflow. Although it names management roles and teams, those details mainly support the description of the incident-handling process rather than management organization itself.


reasoning: The paragraph primarily describes actual cybersecurity incidents that occurred, including their nature, affected data, and a specific third-party incident involving MOVEit Transfer. Although it ends with a materiality conclusion, the dominant focus is on what happened, making Incident Disclosure the best fit.


reasoning: The paragraph primarily describes the company’s cybersecurity measures and program elements—policies, procedures, and systems used to identify and address cybersecurity risks—rather than board oversight or management structure. Its use of cybersecurity-specific concepts such as confidentiality, integrity, and availability makes it more than pure boilerplate, but it contains no firm-unique or externally verifiable facts.


reasoning: The paragraph primarily describes an oversight and reporting structure in which a committee receives cybersecurity updates from the CISO, which most directly answers how cybersecurity oversight is governed. It is firm-specific because it identifies a specific committee acronym (RCSC) and the CISO reporting relationship, but it does not provide externally verifiable dates, numbers, or named outside entities.


reasoning: This paragraph primarily describes an actual cybersecurity incident, including its nature (ransomware), timing, response, recovery, and stated impact, which makes Incident Disclosure the best fit. Although it also includes materiality and remediation statements, the real-event narrative is the central focus.


reasoning: This paragraph is a high-level statement about the importance of cybersecurity governance and alignment with business objectives, but it does not actually describe board oversight, management roles, or concrete cybersecurity processes. It is therefore best treated as generic introductory language rather than a substantive disclosure in one of the core categories.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk arising from vendors by imposing security, insurance, and incident-reporting requirements on third-party providers. Although it contains cybersecurity-specific vendor controls, it does not provide clearly firm-unique or externally verifiable facts.


reasoning: This paragraph primarily describes management-level cybersecurity organization: named committees, who chairs them, their composition, and reporting lines. It is not board oversight, since the focus is on management committees and leadership structure rather than the board’s governance role.


reasoning: The paragraph does not describe an actual cybersecurity process, governance structure, or incident; it only states general dependence on secure transaction processing and hypothetical consequences of failures or breaches. Because it is speculative and non-substantive, it fits None/Other rather than a core disclosure category.


reasoning: The paragraph primarily states the business and financial materiality of cybersecurity threats, including that they have materially affected the company and are reasonably likely to materially affect business strategy, results of operations, or financial condition. It does not describe governance, management structure, or operational cybersecurity processes.


reasoning: The paragraph primarily provides a materiality assessment of how cybersecurity incidents and threats have affected, or could affect, the company's business strategy, results of operations, and financial condition. Although it references risk management processes and a Risk Factors cross-reference, the central purpose is the SEC-required business impact assessment.


reasoning: The paragraph primarily describes the company's cybersecurity program activities and controls, including defense-in-depth, encryption, data loss prevention, and employee security awareness training. It is not focused on board oversight or management roles, so Risk Management Process is the best fit.


reasoning: This paragraph primarily describes which management roles oversee cybersecurity and the qualifications of those leaders, which makes it a management organization disclosure rather than a program-process description. The named leadership positions and quantified experience level drive the specificity upward.


reasoning: The paragraph primarily provides a materiality-related assessment by stating that cybersecurity threats are discussed in terms of potential effects on the business and that no material cybersecurity incidents have occurred in the last three fiscal years. Although it includes a numeric time period, the core disclosure is a company-specific negative assertion rather than a clearly externally verifiable fact.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks from vendors and supply-chain service providers, making third-party oversight the central topic. It describes cyber assessments, contractual security obligations, and incident notification requirements, which are cybersecurity-specific practices but not firm-unique or externally verifiable facts.


reasoning: The paragraph primarily describes what the cybersecurity program does—using threat intelligence, internal tools, network monitoring, and vulnerability scanning to identify and respond to cyber risk. Although it mentions the team's qualifications, the substantive focus is on cybersecurity activities rather than management structure.


reasoning: This paragraph describes a real cybersecurity incident, including its source, affected data, response steps, and operational impact, so Incident Disclosure is the primary category. It includes externally checkable facts such as the named firm/product involved and a quantified statement that this was the only materially affecting cybersecurity incident in 2023.


reasoning: The paragraph primarily describes how the Audit Committee oversees cybersecurity, including its direct engagement with management and receipt of reporting on cyber risk topics and audit results. Although it mentions management roles and program activities, the main purpose is the board-level oversight structure and information flow.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks posed by vendors and service providers, making third-party risk the central topic. It includes firm-specific organizational details through the named Vendor Management Committee and Vendor Management team.


specificity_confidence: low

reasoning: The paragraph primarily describes the existence and purpose of the company’s cybersecurity risk management program and how it fits within enterprise risk management. Although it mentions potential business impacts and service providers, those points are contextual rather than the central focus.


reasoning: The paragraph primarily describes what the company's cybersecurity program does: protecting information, assessing and managing cybersecurity threats, addressing third-party risk, and responding to incidents. Although third-party risk is mentioned, it is only one component of the broader security program rather than the central topic.


reasoning: This paragraph primarily explains how management is organized to handle cybersecurity by identifying the CISO as the responsible leader and describing his responsibilities and qualifications. The focus is on the role and experience of management, not on board oversight or the operational details of the cybersecurity program itself.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity threats and prior incidents have not materially affected and are not reasonably likely to materially affect the company, which fits Strategy Integration under the materiality rule. The rest of the paragraph is forward-looking impact language and a risk-factor cross-reference, not a description of governance, management, or operational processes.


reasoning: This paragraph primarily explains how the company manages cybersecurity risk arising from suppliers, vendors, and other third parties, making Third-Party Risk the best fit. It describes vendor contractual security requirements and data-use restrictions, which are cybersecurity-specific practices, but it does not include firm-unique or externally verifiable details.


reasoning: The paragraph primarily explains how the board, through its Risk Committee, oversees cybersecurity risk, including reporting and approval flows. Although it mentions risk management activities, the dominant focus is the board oversight structure rather than the operation of the cybersecurity program itself.


reasoning: The paragraph primarily describes an actual cybersecurity incident, including its disclosure date, ongoing investigation, and suspected threat actors, which makes Incident Disclosure the best fit. Although it also includes a materiality statement, the incident description is the dominant focus.


reasoning: The paragraph primarily provides a materiality assessment, stating that the company is not aware of cybersecurity breaches that materially affected or are reasonably likely to materially affect its business, results, or financial condition. The rest is a cross-reference to broader risk-factor disclosure, so Strategy Integration is the best fit.


reasoning: The paragraph primarily states a conclusion about how cybersecurity threats could affect the company's business strategy, results of operations, or financial condition, which fits Strategy Integration under the materiality rule. It does not describe governance, management roles, or concrete cybersecurity processes, and it contains no qualifying company-specific or verifiable facts.


reasoning: The paragraph primarily gives a materiality assessment, stating that cybersecurity threats have not been material to the company's operations or financial condition to date, which fits Strategy Integration under the materiality rule. The rest is generic risk language and a cross-reference to risk factors rather than describing governance, management, or program activities.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from vendors and service providers, making third-party risk the central topic. The named TPRM program is a company-specific organizational detail that elevates the disclosure above generic process language.


reasoning: The paragraph primarily gives a materiality assessment of how cybersecurity threats and incidents have affected, and could affect, the company's business strategy, results of operations, and financial condition. Its discussion of security measures and investments is secondary to that business-impact framing.


reasoning: The paragraph primarily describes a real cybersecurity-related event involving Change Healthcare, the company’s response, and the operational effects of that event. Although it ends with a materiality conclusion, the incident narrative and response details are the dominant focus.


reasoning: This paragraph primarily describes a real cybersecurity incident involving Change Healthcare, including notification date, the company's response, the status of its own systems, and operational effects. Although it ends with a materiality assessment, the incident narrative and response details are the dominant focus.


reasoning: The paragraph is primarily about cybersecurity risks arising from card-processing counterparties and other third-party service providers, including the company's assessment of higher-risk vendors. Although it briefly notes past incidents and lack of material impact, the central focus is third-party exposure rather than incident details or overall strategy impact.


reasoning: The paragraph is centrally about how the company evaluates and oversees cybersecurity risk posed by third-party service providers, including vendor selection, contractual requirements, and review of providers' cybersecurity practices. It does not primarily describe internal governance or a specific incident.


reasoning: The paragraph primarily describes how board-level committees oversee cybersecurity-related matters and coordinate review responsibilities, which is board oversight rather than management operations or risk process detail. The committees mentioned are generic board committees and the disclosure does not provide firm-specific or verifiable cybersecurity details.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from third-party service providers, making third-party risk the central topic. While it includes cybersecurity-relevant practices such as pre-engagement and periodic risk assessments, it does not provide firm-unique or externally verifiable details.


reasoning: The paragraph primarily describes how the board and its committee oversee cybersecurity, including the flow of updates from management to the Audit Committee and full Board. The only qualifying specific fact is the involvement of a VP-level cybersecurity role; the rest is largely generic governance cadence and escalation language.


reasoning: The paragraph primarily states management’s conclusions about whether cybersecurity threats and incidents have materially affected, or could materially affect, the company’s business strategy, results of operations, and financial condition, which is Strategy Integration under the materiality rule. Although it references investments and insurance, those points are framed as business impact and resource allocation rather than describing the cybersecurity program itself.


reasoning: The paragraph primarily describes how cybersecurity risk oversight flows through the board, including direct board oversight and reporting to the Audit Committee, which makes board oversight the central topic. Although it mentions management responsibility through the CIO, that role supports the broader governance structure described.


reasoning: This paragraph primarily describes which management roles are responsible for cybersecurity and the qualifications and experience of those leaders. It focuses on management organization and credentials rather than the operational details of the cybersecurity program itself.


reasoning: The paragraph primarily provides a conclusion about whether cybersecurity threats have materially affected or are reasonably likely to materially affect the company’s business strategy, financial condition, or results of operations, which is a Strategy Integration assessment. The cross-reference to Risk Factors does not change the main focus.


reasoning: The paragraph primarily explains how cybersecurity oversight flows through the board structure, including reporting to the Board and Audit Committee and escalation of incidents to those bodies. Although management roles are mentioned, they are described mainly to show the governance chain supporting board oversight.


reasoning: The paragraph primarily describes who in management is responsible for cybersecurity and why that person and team are qualified, which fits Management Role. It focuses on management leadership, reporting coordination, and credentials rather than the underlying cybersecurity processes themselves.


reasoning: The paragraph primarily explains which management leaders are responsible for cybersecurity and what qualifications they bring, which makes it a management organization and leadership disclosure. Although it mentions monitoring and incident response activities, those details are presented as part of the CDO's and CISO's roles rather than as a standalone description of the cybersecurity program.


reasoning: This paragraph is a cross-reference directing readers to Item 1A Risk Factors rather than providing substantive cybersecurity governance, management, process, incident, or strategy disclosure itself. Its primary function is incorporation by reference, which falls under None/Other.


reasoning: The paragraph primarily describes how the board, through the Audit Committee, oversees cybersecurity risk, which is a board oversight structure question. It does not provide cybersecurity-specific operational detail or qualifying firm-specific facts beyond generic governance references.


reasoning: The paragraph is primarily about how the company manages cybersecurity risks arising from vendors and service providers, making third-party risk the central topic. It describes vendor due diligence and ongoing supplier reviews using cybersecurity-specific terminology, but does not provide clearly firm-unique or externally verifiable facts.


reasoning: The paragraph primarily describes how the Board and its Audit Committee oversee cybersecurity risk through management reporting and incident briefings, which is board-level oversight. Although it references cybersecurity topics, the disclosure is framed in generic governance terms without qualifying firm-specific or verifiable cybersecurity facts.


reasoning: The paragraph primarily describes a component of the company's cybersecurity program—using external assessors and consultants for threat evaluation, forensic reviews, and independent security assessments—so it is about how the program operates. Although third parties are mentioned, they are engaged to support the company's internal security activities rather than to manage vendor risk.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from vendors, service providers, and business partners, making third-party risk the central topic. It describes concrete third-party oversight activities such as pre-onboarding security assessments, reassessments, control tracking, and remediation, but does not include firm-unique or externally verifiable facts.


reasoning: The paragraph primarily describes what the company's cybersecurity program does: incident response planning, updating protocols, testing through simulations, and handling security events. Although much of the language is standard, the reference to shipboard and shoreside employees makes the disclosure company-specific.


reasoning: Although the paragraph mentions a real incident, its primary purpose is to assess business impact, stating that prior cybersecurity incidents, including the August 2023 incident, have not materially affected the company and could materially affect business strategy, results of operations, or financial condition in the future. That makes the materiality/business-impact framing more central than the incident description itself.


reasoning: The paragraph primarily explains who in management leads cybersecurity, their reporting line, qualifications, and responsibility structure. Although it mentions program activities such as identifying and responding to cyber risks, those details are presented in the context of management responsibility rather than the process itself.


reasoning: The paragraph primarily describes how management is organized to handle cybersecurity, focusing on the CCMT's composition and its responsibilities in incident oversight and communications. Although the Board and Audit Committee are mentioned as stakeholders to be informed, the main thrust is management structure and role allocation rather than board oversight.


reasoning: This paragraph primarily describes how the board and its committees oversee cybersecurity, including which board committee is responsible and how management reports upward. Although management roles are mentioned, they are presented mainly as part of the board oversight and information-flow structure.


reasoning: The paragraph primarily describes a real cybersecurity incident that occurred, including its nature and timing, which makes Incident Disclosure the best fit. Although it also states the incident was not material, the main focus is the occurrence of the ransomware attack and its immediate aftermath.


reasoning: The paragraph primarily describes how management is organized to lead cybersecurity, emphasizing the CIO's role, experience, and the supporting cybersecurity team's qualifications. Although it briefly mentions program activities, the focus is on who manages cybersecurity and why they are qualified to do so.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk arising from third-party service providers by requiring them to maintain security measures and by assessing their security frameworks. It is not about Tredegar’s internal program generally, but specifically about vendor-related cyber oversight.


reasoning: The paragraph primarily describes how the Board is informed about and oversees cybersecurity matters, including direct reporting from management and director education. The mention of the CISO is a firm-specific governance detail, while the rest is general board oversight context.


reasoning: This paragraph is a high-level introductory statement about the importance of cybersecurity and the purpose of the disclosure, without describing any actual governance, management, process, incident, or strategy assessment. It therefore does not substantively answer one of the Item 1C category questions.


reasoning: The paragraph primarily provides a materiality assessment about whether cybersecurity threats or prior incidents have materially affected the company, which fits Strategy Integration under the SEC materiality rule. The cross-reference to Risk Factors is secondary to that assessment.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk arising from third parties—specifically acquisition targets—through security due diligence, testing, remediation expectations, and contractual protections. It uses cybersecurity-specific risk management concepts, but does not provide firm-unique named roles, committees, programs, dates, or verifiable facts.


reasoning: The paragraph primarily describes the company's cybersecurity oversight structure, including how risks are escalated and reviewed through management committees and up to the board, which fits Board Governance. Its named committees and named technology/risk leadership roles make it company-specific, but it includes no externally verifiable quantitative facts.


reasoning: The paragraph primarily describes what the cybersecurity program does: monitoring threats, escalating potential incidents, deploying technical controls, testing defenses, and training employees. Although it mentions senior management and a third-party security operations center, the focus is on operational cybersecurity processes rather than governance or management structure.


reasoning: This paragraph is primarily a cross-reference to risk factor disclosures in another section rather than a substantive cybersecurity disclosure. Although it mentions material effects from cybersecurity threats, it does not provide an actual assessment, process, incident description, or governance detail here.


reasoning: The paragraph is centrally about how the company manages cybersecurity risks from vendors and third-party hosted applications, including onboarding, due diligence, contractual/security requirements, and ongoing reviews. While it includes cybersecurity-specific concepts and references SOC 2 and ISO 27001, it does not provide firm-unique or externally verifiable facts about UCB's own organization or certifications.


reasoning: The paragraph primarily explains how management is organized to handle cybersecurity by describing the CISO’s leadership, qualifications, and the composition of the supporting team. Although it also mentions incident response activities and reporting to senior leadership and the Audit Committee, those points are secondary to the management-organization focus.


reasoning: The paragraph primarily describes management's cybersecurity leadership structure: the CISO's responsibilities, qualifications, certification, and reporting line. Although it mentions board-level review and approval, those details are secondary to explaining how management is organized to handle cybersecurity.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from vendors and other third-party service providers, making third-party risk the central topic. It includes a company-specific organizational detail about which internal teams participate in the vendor risk assessment process.


reasoning: The paragraph primarily provides a materiality assessment, stating that no cybersecurity threats or incidents had a material impact in the last fiscal year and that certain risks are reasonably likely to materially affect the company if realized. The cross-reference to Risk Factors is secondary to that business-impact assessment.


reasoning: The paragraph primarily addresses materiality assessment and concludes that cybersecurity threats have not materially affected the bank’s operations or financial position, which fits Strategy Integration under the materiality rule. Although it mentions an incident response team, that serves as supporting context rather than the main focus.


reasoning: The paragraph primarily explains management’s cybersecurity leadership structure, responsibilities, reporting line, and qualifications, which makes it a Management Role disclosure. Although it briefly mentions protective and incident response activities, those are framed through the responsibilities of the Chief Security and Trust Officer rather than as a standalone program description.


reasoning: The paragraph primarily provides a materiality assessment, stating that the company has not experienced any material cybersecurity incidents to date and addressing potential effects on business strategy, results of operations, and financial condition. Although it also includes forward-looking risk language, the central disclosure is the business-impact/materiality conclusion.


reasoning: This paragraph primarily describes management's cybersecurity leadership structure, responsibilities, and qualifications, centered on the CSO role rather than the board or the security program's processes. It includes verifiable specifics about the roleholder's tenure since 2018 and quantified experience.


reasoning: The paragraph primarily describes management's cybersecurity organization, including the CIO's reporting relationship, responsibilities, and qualifications. Its focus is on who in management handles cybersecurity rather than on the underlying cybersecurity processes themselves.


reasoning: The paragraph primarily describes how management is organized to lead cybersecurity, including reporting lines, leadership responsibilities, and the qualifications of the relevant IT/security leaders. While it briefly references cybersecurity activities, the emphasis is on who leads the function and what credentials and experience those leaders have.


reasoning: This paragraph is primarily a generic cautionary statement about potential adverse effects of cybersecurity failures and vendor system breaches, rather than a substantive description of governance, management, processes, third-party oversight, or an actual incident. Its brief reference to having implemented cybersecurity measures is non-specific and merely points back to prior disclosure.


reasoning: The paragraph primarily describes how management is organized to handle cybersecurity by identifying specific management participants and their qualifications. Its focus is on who is responsible and their experience, rather than on the company’s cybersecurity processes themselves.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from third-party vendors, especially through vendor due diligence and review of vendors' information security practices. Its focus is vendor-related cyber risk rather than the broader internal cybersecurity program.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from vendors and business partners, making third-party oversight the central topic. It uses cybersecurity-specific concepts such as third-party risk assessments and monitoring incidents involving service providers, but provides no company-unique or externally verifiable details.


reasoning: The paragraph primarily explains how the company evaluates and monitors cybersecurity risk arising from vendors and other external parties before and during engagement. Its focus is on third-party due diligence, risk assessments, and monitoring of service providers rather than the company’s broader internal cybersecurity program.


reasoning: This paragraph is an executive biography about the Senior Vice President and Chief Human Resources Officer and does not describe cybersecurity governance, management, processes, third-party risk, incidents, or strategy impact. Because it is non-cybersecurity content, it falls under None/Other.


reasoning: This paragraph is an executive biographical description focused on Mr. Smith’s business roles, career history, and appointment dates, not on cybersecurity oversight, management, processes, incidents, third-party risk, or strategy impact. Because it contains no substantive cybersecurity disclosure, it falls under None/Other.


reasoning: The paragraph primarily describes a management role—the Chief Risk Officer—and that person's oversight responsibility within the company's broader risk management structure. It does not meaningfully describe board oversight, a cybersecurity process, or any cyber-specific activity.


reasoning: The paragraph primarily describes what the cybersecurity program does: monitoring systems, using security measures and audits, tracking threats, and maintaining an incident response plan. Although it names the SVP IT, the substance is the operation of cybersecurity processes rather than management qualifications or reporting structure.


reasoning: The paragraph primarily explains how management is organized to handle cybersecurity, focusing on the Chief Information Officer's responsibility and qualifications rather than detailing the cybersecurity program's operational processes. The named CIO role is a firm-specific organizational fact.


reasoning: This paragraph is a cross-reference directing the reader to Item 1A for discussion of cybersecurity risks rather than describing governance, management, processes, third-party risk measures, incidents, or strategy impacts. Under the rules, pure cross-references are classified as None/Other.


reasoning: The paragraph primarily provides a materiality-oriented assessment that the company has not experienced recent material cybersecurity incidents and that future incidents could materially affect its business strategy, results of operations, or financial condition. The rest is largely cautionary and cross-referential language rather than a description of governance, management, or risk-management processes.


reasoning: The paragraph primarily describes how cybersecurity risk assessment is incorporated into the company's broader risk management process and what areas are reviewed each year. Although it mentions the Audit Committee, that sentence is ancillary to the main description of the risk management process.


reasoning: The paragraph primarily provides the company's materiality assessment that cybersecurity threats and prior incidents have not materially affected, and are not reasonably likely to materially affect, its business strategy, results of operations, or financial condition. The remaining language is generic cautionary and cross-reference text rather than a description of governance, management, or process.


reasoning: This paragraph describes a real cybersecurity event, including its timing, affected data, scope, and customer notification steps, so it primarily answers what happened in the incident. The presence of specific dates, the named MOVEit software, and the exact number of affected customers makes it quantified and externally verifiable.


reasoning: The paragraph primarily explains how the company identifies and manages cybersecurity risks arising from third-party service providers, making third-party risk the central topic. Although it mentions a dedicated department and coordination with IT, those details are generic organizational descriptions rather than qualifying company-specific or verifiable cybersecurity facts.


reasoning: This paragraph primarily describes an actual cybersecurity incident, including its timing, affected systems, investigation findings, and outcome. Although it notes the incident was not material, the dominant focus is the event itself rather than broader business impact assessment.


reasoning: The paragraph primarily describes a real cybersecurity event, including when the company was notified, who experienced the incident, and the resulting litigation and regulatory matters. Because it includes a specific date and a named external firm, it contains externally verifiable facts.


reasoning: This paragraph primarily describes how the board oversees cybersecurity, including delegation of oversight and how management reports incidents upward. Its central focus is the board-level governance structure rather than management operations or program activities.


reasoning: The paragraph primarily describes what the company’s cybersecurity program does: the frameworks it draws from and the operational controls, training, testing, response, and resilience activities it includes. Although third-party risk is mentioned, it appears only as one component of the broader cybersecurity program.


reasoning: This paragraph is a generic forward-looking risk statement about possible consequences of cybersecurity attacks, not a description of governance, management, processes, third-party risk, strategy assessment, or an actual incident. It contains no substantive cybersecurity program details or company-specific facts.


reasoning: The paragraph primarily describes an actual cybersecurity incident, including when it occurred, what happened, response actions, operational disruption, and resolution. Although it also notes lack of material financial impact, the dominant focus is the incident itself and its immediate consequences.


reasoning: The paragraph primarily describes how the company’s cybersecurity program operates by using external parties for incident response, cybersecurity assessments, and infrastructure support. Although it mentions evaluating and monitoring service providers, third-party oversight is secondary to the broader description of cybersecurity risk management activities.


reasoning: The paragraph primarily provides a materiality-oriented assessment of cybersecurity's impact, including the explicit statement that no material cybersecurity incidents had occurred as of a specific date and noting cyber insurance coverage. Although it mentions threats and policies, those points are secondary to the business-impact and materiality framing.


reasoning: The paragraph primarily describes how cybersecurity-related information flows to the Board and audit committee and how those bodies oversee related risks, which is board-level oversight. Although it mentions internal structures and an employee portal, those details do not provide qualifying cybersecurity-specific facts under the rubric and the disclosure remains largely generic governance language.


reasoning: The paragraph primarily describes that the company maintains systems and programs intended to mitigate cybersecurity incidents and updates them as threats evolve, which fits the company's cybersecurity risk management process. However, the disclosure is highly general and mostly boilerplate, with no cybersecurity-specific operational detail or firm-specific facts.


reasoning: This paragraph primarily describes management leadership roles, responsibilities, and qualifications for cybersecurity oversight rather than the underlying security program activities. Its focus is on who manages cybersecurity and what experience they bring, which fits Management Role.


reasoning: The paragraph primarily gives a business-impact/materiality assessment by stating that the company has not experienced material adverse events from cyber breaches to date and describing how such failures could affect operations and financial reporting. It does not meaningfully describe governance, management organization, or a cybersecurity process.


reasoning: The paragraph primarily describes the role of the Risk Committee in providing assurance up to management and the Board, which makes the management oversight structure the main point. It also references a specific internal cybersecurity plan, giving the disclosure a firm-specific element.


reasoning: The paragraph primarily describes the governance chain for cybersecurity incidents, especially how incidents are reported to the Audit Committee and Board so they can assess materiality and disclosure obligations. Although it mentions a management committee, the main focus is board-level oversight and information flow.


reasoning: The paragraph describes post-incident response and consequences tied to a real cybersecurity event, including regulator/law-enforcement engagement, litigation, and customer remediation. Its focus is what happened and how the company responded, which fits Incident Disclosure.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks posed by third parties, especially service providers, through required security controls and compliance assessments. Although it mentions threat intelligence services, the central focus is third-party oversight.


reasoning: The paragraph primarily explains how management is organized to handle cybersecurity by describing the IT Security Team's responsibilities, the Head of Global IT's experience, and the team's qualifications. Although it mentions acquisition-target diligence, that activity is presented as part of management's role rather than as a standalone risk-management or third-party-risk process.


reasoning: The paragraph primarily explains how cybersecurity-related risks are incorporated into the company's ERM and audit planning process, which is a risk management activity rather than a description of board oversight or management qualifications. Although the Audit Committee is mentioned, the central focus is the integration of cyber risk into ERM and the risk-based audit plan.


reasoning: The paragraph is centrally about how the company oversees cybersecurity risks arising from vendors and service providers, including reviews and contractual safeguards, so Third-Party Risk is the best fit. It does not include qualifying firm-specific or externally verifiable facts, and its language remains fairly general rather than using distinctly technical cybersecurity terminology.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from vendors and external platforms, making third-party risk the central topic. It includes cybersecurity-specific third-party oversight practices such as diligence, contractual requirements, monitoring, and SOC Reports, but does not provide a company-unique role, committee, firm, date, or verifiable quantitative fact sufficient for a higher specificity level.


reasoning: The paragraph primarily describes the cybersecurity oversight structure across management, board committees, and control functions, which makes it a board-governance disclosure rather than a description of operational security activities. Its main purpose is to explain how oversight is organized through the three-lines-of-defense model.