fact: phishing sites

fact: security posture

reasoning: The paragraph primarily describes a real cybersecurity incident involving phishing attacks on the online banking platform, fitting Incident Disclosure. It includes domain-specific terms like 'phishing sites' and 'security posture,' which demonstrate cybersecurity expertise, elevating specificity to Domain-Adapted.


content_category: None/Other

category_confidence: high

specificity_confidence: high

reasoning: The paragraph primarily describes external regulatory requirements and SEC rules, which does not directly answer any substantive question about the company's cybersecurity practices, governance, or incidents, making it None/Other. As a None/Other paragraph, it is assigned Generic Boilerplate specificity per the instruction that such paragraphs always receive this level.

provider: xiaomi

stage: benchmark


content_category: Strategy Integration

reasoning: The paragraph states a conclusion that cybersecurity threats have not materially affected the business, which directly answers how cybersecurity impacts business outcomes, fitting Strategy Integration. It contains no specific facts, using only generic language without domain expertise, firm-specific details, or verifiable claims, resulting in Generic Boilerplate specificity.


content_category: Board Governance

fact: One member of our audit committee earned the NACD's CERT Certificate in Cybersecurity Oversight in 2023.

reasoning: The paragraph describes board and audit committee oversight of cybersecurity, including update frequencies and incident communication procedures, which directly answers how the board oversees cybersecurity (Board Governance). It contains a verifiable fact about a board member earning a specific certification in 2023, making the specificity Quantified-Verifiable.


reasoning: This paragraph is a cross-reference to Item 1A for risk factors and contains no substantive cybersecurity disclosure, fitting None/Other. It lacks any specific facts about cybersecurity practices, roles, or incidents, resulting in Generic Boilerplate specificity.


content_category: Management Role

fact: 19 years of experience in technology risk management

fact: 11 years with the Company (or its affiliates)

fact: SANS Global Information Security Leader certification

fact: Certified Information Systems Auditor certification

reasoning: The paragraph focuses on the CIO's responsibilities, qualifications, and team structure, answering how management is organized for cybersecurity (Management Role). Specificity is Level 4 due to verifiable facts: specific years of experience and named certifications.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a materiality conclusion (SI), but it contains no specific facts about cybersecurity practices, incidents, or verifiable claims, using only generic language and a non-verifiable assertion.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a conclusion that no material impacts have occurred or are likely, which aligns with Strategy Integration. It contains no specific facts—only a generic negative assertion and a cross-reference—resulting in Generic Boilerplate specificity.


reasoning: This paragraph primarily answers how the board oversees cybersecurity through the Audit Committee's receipt of information and briefings, fitting Board Governance. It lacks any specific facts such as domain expertise, firm-specific details, or verifiable claims, making it generic boilerplate.


content_category: Third-Party Risk

reasoning: The paragraph focuses on managing cybersecurity risks from third-party service providers through risk assessments and oversight, directly answering the Third-Party Risk question. It contains no domain-specific terminology, firm-specific details, or verifiable facts, making it generic boilerplate.


fact: Franchisees, licensees, or other counterparties are responsible for information security at properties not owned, leased, or managed by Marriott

fact: Required to comply with Marriott brand standards relating to information security

fact: Obligation to report relevant information security incidents to Marriott

reasoning: The paragraph primarily answers how third-party cyber risks are managed by detailing franchisee and licensee obligations under Marriott's specific brand standards, which are firm-specific facts but lack quantified or verifiable details.


fact: mentions specific threat types: malware and computer virus attacks

specificity_confidence: medium

reasoning: The paragraph primarily answers how cybersecurity affects the business by concluding that risks have not materially affected it to date, which is a materiality assessment fitting Strategy Integration. Specificity is Domain-Adapted because the mention of 'malware and computer virus attacks' demonstrates basic cybersecurity domain knowledge, passing the ERM test for Level 2.


reasoning: The paragraph describes quarterly updates to the Audit Committee or Board on cybersecurity risks and activities, which is a board oversight structure, so it is Board Governance. It uses generic language with no specific, verifiable, or firm-unique facts, making it Generic Boilerplate.


fact: Risk and Governance Committee

fact: Head of Information Technology

fact: Head of Information Technology holds CISSP certification

fact: Head of Information Technology reports to Chief Financial Officer

reasoning: The paragraph primarily describes the board's delegation of cybersecurity oversight to a committee and the management reporting chain, fitting the Board Governance category; it includes a verifiable CISSP certification, elevating specificity to Quantified-Verifiable.


reasoning: The paragraph is a cross-reference to a risk factor in Item 1A and does not describe any cybersecurity measures, governance, incidents, or strategies, fitting 'None/Other'. It contains no specific facts—only generic risk language and a reference—resulting in 'Generic Boilerplate' specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a materiality conclusion (that risks have not materially affected and are not likely to materially affect business outcomes), which aligns with Strategy Integration. It contains no specific, verifiable, or firm-unique facts—only generic assertions and cross-references—resulting in Generic Boilerplate specificity.


reasoning: The paragraph states a conclusion on materiality impact ('have not been materially affected'), which directly answers how cybersecurity affects business outcomes, fitting Strategy Integration. It contains no specific facts—only generic assertions and a cross-reference—resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating that threats have not materially affected the company, which is a Strategy Integration assessment. It contains no specific facts, relying on generic materiality language and a cross-reference, resulting in Generic Boilerplate specificity.


reasoning: The paragraph directly answers how third-party cyber risks are managed by describing vendor security assessments and ongoing monitoring, making Third-Party Risk the primary category. It contains no specific facts, using generic risk management language that does not demonstrate cybersecurity expertise or provide verifiable details, resulting in Generic Boilerplate specificity.


fact: penetration testing firms

fact: forensic investigators

fact: security documentation reviews

fact: security questionnaires

fact: security audits

fact: cybersecurity management consultants

fact: cybersecurity software providers

reasoning: The paragraph centers on managing cybersecurity risks from third-party providers through assessments and contractual obligations, directly answering how third-party cyber risks are managed. It demonstrates cybersecurity domain expertise with specific practices like penetration testing and security audits, but contains no firm-specific or verifiable facts, resulting in Domain-Adapted specificity.


reasoning: This paragraph is a forward-looking statement about incident disclosure policy, not describing any substantive cybersecurity governance, management, or processes, so it fits 'None/Other.' It contains no specific facts, domain-adapted terms, or verifiable claims, making it generic boilerplate.


reasoning: The paragraph directly states a conclusion about the material impact of cybersecurity risks on business strategy and operations, which aligns with Strategy Integration. It contains no specific facts about cybersecurity practices, incidents, or firm details, relying instead on generic materiality assertions and cross-references, resulting in Generic Boilerplate specificity.


reasoning: This paragraph primarily answers how the board oversees cybersecurity, detailing board responsibility, reporting lines, and Audit Committee interaction, fitting Board Governance. It contains no specific facts beyond generic oversight language, with no domain terms, firm-specific details, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph focuses on the audit committee receiving reports on cybersecurity from management, which directly addresses board oversight (Board Governance). It contains no specific facts, domain-adapted terms, or verifiable claims, relying on generic language about periodic reports and processes, resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes board and audit committee oversight of cybersecurity, directly answering how the board oversees cybersecurity, so it is Board Governance. It uses generic oversight language with no specific, firm-unique, or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: This paragraph primarily answers how cybersecurity affects the business by making a backward-looking materiality assessment (no material incidents and immaterial expenses), which aligns with Strategy Integration. It contains no specific facts demonstrating domain expertise, firm-specific details, or verifiable claims, relying solely on generic negative assertions, resulting in Generic Boilerplate specificity.


content_category: Risk Management Process

reasoning: The paragraph primarily answers what the cybersecurity program aims to do (maintain business continuity, protect data), fitting Risk Management Process. It contains no domain-specific terms, firm-specific details, or verifiable facts, resulting in Generic Boilerplate specificity.


content_category: Incident Disclosure

fact: Change Healthcare, a subsidiary of UnitedHealth Group, experienced a cybersecurity incident

fact: Bioventus uses Change Healthcare for processing claims related to its EXOGEN device

fact: The incident caused disruptions to Bioventus's patient billing and collections processes

fact: UnitedHealth Group is still investigating the incident as of the filing date

reasoning: The paragraph primarily describes a specific cybersecurity incident involving Change Healthcare, detailing its impact on Bioventus's operations, which fits Incident Disclosure. It contains verifiable facts such as named companies (Change Healthcare, UnitedHealth Group) and a specific product (EXOGEN device), making it Quantified-Verifiable.


reasoning: This paragraph is a meta-description of the cybersecurity overview section, not answering any substantive cybersecurity question, so it falls under None/Other. It contains no specific facts—only generic language like 'structured overview' and 'proactive approach'—resulting in Generic Boilerplate specificity.


reasoning: This paragraph is a cross-reference to Item 1A for additional cybersecurity risk information and contains no substantive disclosure, fitting 'None/Other'. It lacks any specific facts, making it generic boilerplate at Level 1.


fact: Chief Risk Officer

reasoning: The paragraph primarily answers how cybersecurity risk management is integrated into the overall enterprise risk management program, which aligns with the Risk Management Process category. It contains a firm-specific fact—the Chief Risk Officer overseeing the program—elevating specificity to Firm-Specific.


fact: In September 2022, network intrusion at Rockstar Games with access to early development footage for Grand Theft Auto

fact: In September 2022, unauthorized access to 2K Games vendor platform credentials leading to malicious link sent to players

reasoning: The paragraph primarily describes specific cybersecurity incidents that occurred in September 2022, answering 'What happened?' with verifiable details such as dates and event specifics, making it Incident Disclosure at Quantified-Verifiable level.


fact: over 20 years of cybersecurity experience

fact: last 10 years in leadership positions

fact: associations with ARCYBER, ISSA, FIRST

fact: certifications including GSTRT, CISSP, CCSP

fact: third-party vendor certifications including CISSP-ISSAP, CGEIT, CDPSE, CEH

reasoning: The paragraph primarily describes management roles and qualifications for cybersecurity, fitting Management Role. It contains verifiable facts such as specific years of experience and certifications, resulting in Quantified-Verifiable specificity.


reasoning: This paragraph primarily answers how cybersecurity affects the business by stating a negative conclusion that no incidents have interrupted operations or breached systems, which is a materiality assessment under Strategy Integration. It contains no verifiable, firm-specific, or domain-adapted facts, making it Generic Boilerplate.


reasoning: The paragraph primarily answers how the board oversees cybersecurity through the Audit Committee's responsibilities, fitting Board Governance. It contains no specific facts, domain expertise, firm-specific details, or verifiable claims, consisting entirely of generic oversight language.


reasoning: The paragraph centrally addresses how third-party cyber risks are managed by describing engagement with external service providers for cybersecurity efforts. It contains no specific facts, such as named providers, quantifiable details, or domain-specific terms that demonstrate expertise, resulting in Generic Boilerplate.


fact: vendor risk assessments

fact: review of the vendor's security program

reasoning: The paragraph directly addresses how third-party cyber risks are managed through a dedicated program, making Third-Party Risk the primary category. It demonstrates cybersecurity domain expertise with terms like 'vendor risk assessments' and 'review of the vendor's security program,' but lacks firm-specific or verifiable details, resulting in Level 2 specificity.


fact: defense in depth and zero trust based controls

fact: cybersecurity management and incident training

fact: phishing email simulations

fact: cyber risk management and quantification system

reasoning: The paragraph describes cybersecurity program activities like risk assessment, controls, and training, fitting Risk Management Process. It contains domain-specific terms such as 'defense in depth' and 'phishing email simulations' that demonstrate cybersecurity expertise, but lacks firm-specific or verifiable facts, so specificity is Domain-Adapted.


reasoning: The paragraph describes the evaluation and enhancement activities of the information security program, such as reviews by experts and engagement with external parties, which aligns with Risk Management Process. It contains no specific facts like tools, frameworks, or verifiable details, making it generic boilerplate.


reasoning: This paragraph is a cross-reference to risk factors and does not provide any substantive cybersecurity disclosure, so it is classified as None/Other. It contains no specific facts about cybersecurity, only generic references, resulting in Generic Boilerplate specificity.


fact: SOC2 report evaluations

fact: cybersecurity insurance

reasoning: The paragraph focuses on managing cybersecurity risks from third-party service providers through due diligence, centralized registry, and SOC2 evaluations, directly answering the Third-Party Risk question. Specificity is elevated to Level 2 by domain-specific terms like SOC2 and cybersecurity insurance, which demonstrate cybersecurity expertise beyond generic risk management.


reasoning: The paragraph primarily answers whether cybersecurity incidents have materially affected the company or could in the future, which is a materiality assessment fitting Strategy Integration. It contains only generic statements about cybersecurity risks and a non-verifiable negative assertion about incidents, with no specific, domain-adapted, or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a materiality assessment (past incidents not material, future ones could be), which aligns with Strategy Integration. It contains no specific facts, using generic boilerplate language without cybersecurity domain expertise or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph directly assesses whether cybersecurity risks have materially affected or are likely to materially affect the business, which is a core Strategy Integration question. It contains no specific facts such as verifiable claims, firm-specific details, or domain-adapted terms beyond generic risk descriptions and cross-references, making it Generic Boilerplate.


fact: ISO 27001 framework

fact: least-privilege principle

fact: phishing awareness exercises

fact: security-by-design principles

reasoning: The paragraph describes cybersecurity program activities like framework adoption, access control, and employee training, fitting Risk Management Process. Specificity is Domain-Adapted due to domain-specific terms such as ISO 27001, least-privilege, and security-by-design, which demonstrate cybersecurity expertise.


reasoning: The paragraph answers 'What does the cybersecurity program do?' by describing the integration of cybersecurity risk into overall risk management and a multi-faceted approach involving third-party assessments and internal reviews, fitting Risk Management Process. It contains no specific, verifiable facts—only generic risk management language—resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers what the cybersecurity program does by describing monitoring and incident response activities, aligning with Risk Management Process. It contains no specific facts, domain-adapted terms, or verifiable details, making it generic boilerplate.


reasoning: The paragraph primarily answers how management is organized to handle cybersecurity by describing executive management's oversight responsibility, fitting Management Role. It contains no specific facts, only generic statements about risk oversight and responsibility, resulting in Generic Boilerplate specificity.


fact: forensic investigation

reasoning: The paragraph describes an actual cybersecurity incident, including its nature and resolution, directly answering 'What happened?' for Incident Disclosure. It contains the domain-specific term 'forensic investigation,' which demonstrates cybersecurity expertise and elevates specificity to Level 2, but lacks firm-specific or verifiable details.


fact: CISO (firm-specific role title)

fact: at least annually (verifiable lower bound on reporting frequency)

reasoning: This paragraph primarily answers how the board oversees cybersecurity through delegation to the Audit Committee and reporting from the CISO, fitting Board Governance. Specificity is Level 4 because it contains the verifiable claim of 'at least annual' reporting frequency, which sets a checkable threshold.


fact: November 2023 incident date

reasoning: The paragraph primarily answers 'What happened in a cybersecurity incident?' by detailing a real event in November 2023, including detection, response, and remediation, making it Incident Disclosure. The specific date is a verifiable fact, elevating specificity to Level 4.


reasoning: The paragraph primarily answers how third-party cyber risks are managed through security assessments and ongoing reviews, making 'Third-Party Risk' the dominant category despite a secondary materiality statement. It contains no specific facts, using only generic language without domain expertise or verifiable claims, resulting in Generic Boilerplate specificity.


fact: The Business Continuity Institute (BCI)

fact: Disaster Recovery Institute International (DRII)

fact: International Organization for Standardization (ISO) 22301

fact: business impact analyses

fact: risk assessments

fact: continuity strategies

fact: tabletop exercises

reasoning: The paragraph primarily answers 'What does the cybersecurity program do?' by detailing business resilience processes like risk assessments and exercises, fitting Risk Management Process. It demonstrates cybersecurity expertise through domain-specific terms such as BCI, DRII, ISO 22301, and tabletop exercises, elevating specificity to Level 2.


reasoning: The paragraph primarily answers whether cybersecurity has materially affected the business by stating no material incidents have occurred, which is a materiality assessment under Strategy Integration. It contains no specific facts—only generic policy review language, a negative assertion, and a cross-reference—so specificity is Generic Boilerplate.


reasoning: The paragraph is a generic statement of cybersecurity commitment without describing any specific governance, processes, or incidents, fitting None/Other. No specific facts, domain terms, or verifiable claims are present, making it Generic Boilerplate.


reasoning: The paragraph primarily answers what the cybersecurity program does by describing a framework for threat identification and mitigation, fitting Risk Management Process. It contains no specific facts, domain-adapted terms, or verifiable claims, making it generic boilerplate.


reasoning: The paragraph directly answers how third-party cyber risks are managed by describing a review process for IT service providers' cybersecurity measures, but it contains no specific, verifiable, or firm-unique facts, making it generic boilerplate at Level 1.


fact: SOC 1 report

fact: SOC 2 report

reasoning: The paragraph centers on managing third-party cyber risks through vendor evaluation and SOC report requirements, making Third-Party Risk the primary category. Specificity is Domain-Adapted because it references SOC 1 and SOC 2 reports, which are cybersecurity-specific standards demonstrating domain expertise.


reasoning: The paragraph states conclusions about the material impact of cybersecurity threats and incidents on the business, which directly answers the Strategy Integration question. It contains no specific facts, domain-adapted terms, firm-specific details, or verifiable claims, resulting in Generic Boilerplate specificity.


fact: firewalls

fact: intrusion detection/prevention systems (IDS/IPS)

fact: data loss prevention (DLP) solutions

fact: antivirus

fact: anti-malware

fact: Mobile Device Management solutions

fact: principle of least privilege

fact: encryption at rest and in transit

fact: security awareness training

reasoning: The paragraph describes specific cybersecurity program activities like network security with IDS/IPS and DLP, endpoint controls, and encryption, directly answering what the program does, so it is Risk Management Process. Specificity is Domain-Adapted because it uses cybersecurity-specific terminology (e.g., IDS/IPS, least privilege) that demonstrates domain expertise, but lacks firm-specific or verifiable details.


reasoning: The paragraph primarily describes the incident response process, which is a core activity of the cybersecurity program, aligning with Risk Management Process. It uses generic terms like 'Incident Response Team' and standard procedural steps without any firm-specific details, verifiable facts, or domain-specific expertise beyond basic incident response concepts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity could materially affect the business and includes a negative assertion about past incidents, aligning with Strategy Integration. It contains no specific, verifiable, or firm-unique facts, using generic risk language that does not demonstrate domain expertise or provide quantifiable details.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating no material incidents have occurred and discussing ongoing risk mitigation, which aligns with Strategy Integration. It contains no specific facts—only generic statements about threats, investments, and a negative self-assertion that is not verifiable—resulting in Generic Boilerplate specificity.


fact: January 2020

fact: more than 20 years of experience

fact: President and CEO

fact: leads information security team

fact: reports directly to Board of Directors

reasoning: The paragraph focuses on management organization for cybersecurity, with the CEO leading the team and reporting to the Board, fitting Management Role. It contains verifiable facts such as the specific date 'January 2020' and the CEO's 'more than 20 years of experience,' elevating specificity to Quantified-Verifiable.


reasoning: The paragraph centers on managing cybersecurity risks from third-party vendors through annual assessments and security requirements, fitting Third-Party Risk. However, it contains only generic process descriptions without any specific, verifiable, or domain-adapted facts, resulting in Level 1 specificity.


reasoning: This paragraph states a conclusion that no cybersecurity incidents materially affected or are likely to affect business outcomes, which aligns with Strategy Integration per Rule 5. It contains no specific facts—only a negative assertion and generic reporting period—resulting in Generic Boilerplate specificity.


reasoning: This paragraph is solely a cross-reference to risk factors in Item 1A, with no substantive cybersecurity content, so it is classified as None/Other. It contains no specific facts about cybersecurity practices, governance, or incidents, resulting in Generic Boilerplate specificity.


reasoning: The paragraph directly addresses how third-party cyber risks are managed through due diligence and compliance checks, fitting Third-Party Risk. It contains no specific facts—only generic process descriptions that fail to demonstrate cybersecurity expertise or firm-unique details, resulting in Generic Boilerplate specificity.


fact: between approximately August 5-8, 2025

reasoning: The paragraph primarily answers what happened in the 2025 cybersecurity incident by detailing the timeline and scope, fitting Incident Disclosure. The specificity is driven by the verifiable date range 'August 5-8, 2025,' which is a hard fact that could be externally confirmed.


reasoning: This paragraph is a cross-reference to risk factors and does not answer any of the substantive cybersecurity questions, so it is classified as None/Other. It contains no specific facts, only generic boilerplate language about potential consequences, resulting in Generic Boilerplate specificity.


fact: CIO has led IT efforts since 2016

fact: CIO has more than 20 years of experience

reasoning: The paragraph primarily answers how management is organized for cybersecurity, focusing on the CIO's role, qualifications, and reporting line, making it Management Role. Specificity is Level 4 because it contains verifiable facts such as the CIO's tenure since 2016 and over 20 years of experience.


reasoning: The paragraph primarily answers the question of business impact by stating that no prior cybersecurity incidents have materially affected the company, which aligns with Strategy Integration. It contains no specific facts demonstrating cybersecurity expertise or verifiable claims, consisting only of generic statements about threats and third-party requirements, resulting in Generic Boilerplate specificity.


reasoning: This paragraph is a cross-reference to the Risk Factors section for cybersecurity risks, fitting 'None/Other' as it provides no substantive disclosure. It lacks any specific facts about the company's cybersecurity practices, resulting in 'Generic Boilerplate' specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating materiality conclusions (e.g., no material incidents in 2023 and forward-looking assessments), fitting Strategy Integration. It contains no verifiable or domain-specific facts, as all statements are negative assertions or generic references, resulting in Generic Boilerplate specificity.


fact: intelligence sharing about emerging threats

fact: collaboration with Arizona Cyber Threat Response Alliance (ACTRA)

fact: collaboration with The Internet and Television Association (NCTA)

reasoning: This paragraph primarily answers what the cybersecurity program does by describing intelligence sharing through collaborations, fitting Risk Management Process. It contains verifiable facts by naming specific organizations ACTRA and NCTA, which are externally confirmable, setting specificity at Level 4.


fact: Chief Technology Officer (CTO) is primarily responsible for cybersecurity risks

fact: Chief Operating Officer (COO) is primarily responsible for cybersecurity risks

fact: CTO has over 10 years of experience overseeing cybersecurity functions

fact: COO has over 5 years of experience overseeing cybersecurity and IT functions

reasoning: The paragraph describes board oversight of cybersecurity through delegation to the Audit Committee and management reporting, fitting Board Governance. It contains verifiable facts about the CTO's and COO's years of experience (over 10 and over 5 years, respectively), which are quantified and externally checkable, setting specificity at Level 4.


reasoning: The paragraph primarily answers how third-party cyber risks are managed through due diligence and contractual obligations, making it Third-Party Risk. All statements are generic, lacking domain-adapted terms, firm-specific details, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating materiality conclusions (both backward and forward-looking), which aligns with Strategy Integration. It contains no specific, verifiable, or firm-unique facts, using generic risk language that does not demonstrate cybersecurity expertise, resulting in Generic Boilerplate specificity.


reasoning: The paragraph focuses on how third parties are used to validate, design, implement, and monitor the cybersecurity program, which aligns with describing program activities (RMP). It lacks any specific, verifiable, or firm-unique facts, containing only generic language about third-party engagement and requirements.


fact: penetration testing

fact: threat monitoring

fact: risk assessments

reasoning: The paragraph directly answers how third-party cyber risks are managed by describing partnerships with cybersecurity firms and vendor security requirements, and it includes domain-specific terms like penetration testing and threat monitoring that demonstrate cybersecurity expertise.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a negative conclusion on material impact, which aligns with Strategy Integration; it contains no specific facts such as domain terms, firm-specific details, or verifiable claims, leading to Generic Boilerplate specificity.


fact: COO leads cybersecurity strategy

fact: Reports to CEO

fact: Over 15 years of cybersecurity experience

reasoning: The paragraph primarily answers how management is organized for cybersecurity by detailing the COO's role, responsibilities, and reporting structure, fitting Management Role. Specificity is Level 4 due to the verifiable claim of 'over 15 years of experience' and firm-specific facts about the COO's position.


reasoning: The paragraph primarily answers how cybersecurity risk management is integrated into the overall enterprise risk management program, fitting the Risk Management Process category. It contains no specific facts—only generic descriptions of integration and common methodologies—resulting in Generic Boilerplate specificity.


reasoning: This paragraph defines the term 'systems' and does not answer any substantive cybersecurity question, so it is classified as None/Other. It contains no specific facts, only generic definitional language, resulting in Generic Boilerplate specificity.


category_confidence: medium

reasoning: The paragraph is primarily a cross-reference to Item 1A for cybersecurity risk factors, which is non-substantive and falls under None/Other. No specific facts are present, making it generic boilerplate.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a materiality assessment of past and potential incidents, fitting Strategy Integration. It contains no specific facts, verifiable claims, or domain-adapted terminology, making it Generic Boilerplate.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating it has not materially affected them, which is a Strategy Integration assessment. It contains no specific facts—only generic language about materiality and vague experiences—making it Generic Boilerplate.


fact: ransomware virus

reasoning: The paragraph describes a specific past cybersecurity incident (ransomware attack), directly answering 'What happened?' for Incident Disclosure. It contains the domain term 'ransomware virus,' which demonstrates cybersecurity expertise, elevating specificity to Domain-Adapted.


reasoning: This paragraph is solely a cross-reference to risk factor disclosures in Item 1A and does not substantively answer any of the cybersecurity questions (e.g., governance, processes, incidents), so it is classified as 'None/Other'. It contains no specific facts about cybersecurity, resulting in Generic Boilerplate specificity.


fact: NIST governance requirements and cybersecurity framework

reasoning: The paragraph primarily describes board oversight of cybersecurity risk through the Audit Committee and its integration into the broader risk management framework, aligning with Board Governance. It contains the domain term 'NIST,' which demonstrates cybersecurity expertise and elevates specificity to Domain-Adapted.


fact: scanning internal network and infrastructure

fact: third-party vulnerability testing

reasoning: The paragraph primarily answers what the cybersecurity program does by detailing activities like risk assessment, monitoring, and testing, which aligns with Risk Management Process. It contains domain-adapted terms such as network scanning and vulnerability testing that demonstrate cybersecurity expertise, elevating specificity to Level 2.


reasoning: The paragraph primarily answers how the board oversees cybersecurity through delegation to the Audit Committee, fitting Board Governance. It contains no specific facts—only generic oversight language—resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily describes the cybersecurity program's processes and activities, fitting Risk Management Process. It contains no specific facts—only generic risk management language and oversight references—resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating resource constraints and potential damage, fitting Strategy Integration. It contains no specific facts—only generic risk language and unquantified assertions—resulting in generic boilerplate specificity.


reasoning: The paragraph directly addresses how third-party cyber risks are managed through weekly compliance monitoring and issue resolution, fitting the Third-Party Risk category. It contains no cybersecurity-specific terminology, firm-unique details, or verifiable claims, using only generic language about process oversight.


reasoning: The paragraph directly answers how the board oversees cybersecurity by describing Board and Audit Committee oversight, fitting Board Governance. It contains no specific facts, using only generic governance language without cybersecurity domain expertise or firm-specific details.


reasoning: The paragraph primarily answers what the cybersecurity program does by describing risk management processes like program maturity assessments and third-party security risk assessments, fitting the Risk Management Process category. It contains no specific facts beyond generic risk management language that could apply to any domain, resulting in Generic Boilerplate specificity.


reasoning: The paragraph is a general risk statement with a cross-reference to the Risk Factors section, providing no substantive cybersecurity disclosure, so it is classified as None/Other. As a None/Other paragraph, it is assigned Generic Boilerplate specificity with no specific facts.


reasoning: The paragraph directly answers how the board oversees cybersecurity by describing delegation to the Audit Committee and update cadences, fitting Board Governance. It contains no specific facts—only generic terms like 'Board of Directors,' 'Audit Committee,' and 'regular basis'—making it Generic Boilerplate.


reasoning: The paragraph primarily answers what the cybersecurity program does by describing risk assessments, training, tools, and incident response, fitting Risk Management Process. It contains no specific facts beyond generic terms like 'risk assessments' and 'incident response plan', which fail to demonstrate domain expertise or provide verifiable details, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily addresses how cybersecurity insurance is used to manage financial risk, fitting Strategy Integration. It contains no specific facts—only generic statements about having insurance and its limitations—resulting in Generic Boilerplate specificity.


fact: CTO has over 26 years of information technology experience

reasoning: The paragraph focuses on how management is organized for cybersecurity, detailing the CFO and CTO's roles and the CTO's qualifications, which aligns with Management Role. Specificity is driven by the verifiable claim of the CTO's over 26 years of experience, making it Quantified-Verifiable.


reasoning: The paragraph describes the company's operational dependency on IT/OT systems without addressing any substantive cybersecurity governance, management, processes, or incidents, so it fits None/Other; specificity is Generic Boilerplate as per the rule that None/Other paragraphs always receive this level.


reasoning: The paragraph directly answers how the board oversees cybersecurity, fitting Board Governance. It contains no specific facts—all statements are generic oversight language without verifiable, firm-specific, or domain-adapted details, resulting in Generic Boilerplate specificity.


fact: 2019 wire fraud incident involving employee email compromise and fraudulent wire transfer

fact: Implementation of multi-factor authentication (MFA) across all systems and email accounts

reasoning: The paragraph primarily answers 'What happened in a cybersecurity incident?' by describing a specific 2019 wire fraud event and remediation actions, fitting Incident Disclosure. It contains verifiable facts such as the incident date and MFA implementation, elevating specificity to Level 4.


reasoning: The paragraph directly addresses how third-party cybersecurity risks are managed, fitting the Third-Party Risk category. However, it uses generic language like 'comprehensive, risk-based approach' without any specific practices, tools, or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how third-party cyber risks are managed through vendor collaboration, fitting Third-Party Risk. It contains no specific facts, using only generic language about department roles and collaboration cadences, resulting in Generic Boilerplate specificity.


fact: Chief Information Officer (CIO)

fact: Chief Information Security Officer (CISO)

reasoning: The paragraph focuses on board and committee oversight of cybersecurity, fitting Board Governance, and includes firm-specific roles (CIO and CISO) that elevate specificity to Level 3.


reasoning: The paragraph describes implemented information security processes to manage cybersecurity risks, directly answering what the program does and fitting the Risk Management Process category. It contains no specific facts beyond generic risk management language, making it generic boilerplate.


fact: scanning

fact: phishing attempts

fact: minor technical vulnerabilities

reasoning: The paragraph describes actual cybersecurity incidents observed and mitigated during specific fiscal years, directly answering 'What happened in a cybersecurity incident?' for Incident Disclosure. It contains domain-specific terms like 'scanning' and 'phishing attempts' that demonstrate cybersecurity expertise, elevating specificity to Level 2.


reasoning: The paragraph primarily answers what the cybersecurity program does by describing proactive detection and prevention measures, fitting Risk Management Process. However, it contains no specific facts—only generic risk language and vague process descriptions—making it generic boilerplate at Level 1.


fact: September 2024 appointment date for Brian Fellon

fact: 28 years of experience in information technology

fact: Prior role as Director of Information Technology at Puget Sound Energy from 2016 to September 2024

reasoning: This paragraph primarily answers how management is organized to handle cybersecurity, fitting the Management Role category. It contains verifiable facts such as a specific appointment date, quantified years of experience, and detailed prior employment, warranting Quantified-Verifiable specificity.


reasoning: The paragraph is a generic commitment to protecting IT assets without answering any specific cybersecurity question (e.g., governance, process, or incident), so it is classified as None/Other. It contains no specific facts—only broad, non-domain-adapted language—resulting in Generic Boilerplate specificity.


reasoning: The paragraph centers on managing third-party cyber risks via vendor assessments and notification requirements, fitting the Third-Party Risk category. It contains only generic process descriptions without any domain-adapted terms, firm-specific details, or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily addresses how cybersecurity affects business strategy and finances through potential material adverse effects and insurance costs, aligning with Strategy Integration. It contains no specific facts beyond generic aims, forward-looking disclaimers, and a cross-reference, resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes board oversight and delegation to the Audit Committee for cybersecurity risk, which is classic Board Governance. It uses generic terms like ERM, internal controls, and Audit Committee with no cybersecurity-specific expertise or verifiable facts, resulting in Generic Boilerplate specificity.


fact: cyber-attacks

fact: cyber intrusions over the Internet

fact: ransomware

fact: other forms of malware

fact: computer viruses

fact: attachment to emails

fact: extortion

fact: other scams

reasoning: The paragraph primarily states a negative assertion about the absence of material cybersecurity incidents, which is a conclusion about cybersecurity impact, fitting Strategy Integration. It contains domain-specific threat terminology like ransomware and phishing, demonstrating cybersecurity expertise and elevating specificity to Domain-Adapted.


fact: Director of IT Security and Compliance

fact: IT Steering Committee

fact: vulnerability assessments

fact: audits

fact: continuous monitoring techniques

fact: industry frameworks and cybersecurity standards

reasoning: The paragraph primarily answers what the cybersecurity program does by describing assessment methods, governance structures, and monitoring techniques, aligning with Risk Management Process. Specificity is Firm-Specific due to the mention of company-specific roles (Director of IT Security and Compliance) and committees (IT Steering Committee), which distinguish its organizational structure.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a negative assertion about past incidents ('not experienced any significant impacts') and discussing potential material effects, which aligns with Strategy Integration. It contains no specific facts—only generic risk language and a cross-reference—so specificity is Generic Boilerplate.


reasoning: The paragraph primarily answers how cybersecurity affects the business by concluding that risks have not materially affected and are not reasonably likely to materially affect business strategy, results, or finances, which is a materiality assessment under Strategy Integration. It contains no specific facts—only generic risk language and unverifiable negative assertions—resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how management is organized for cybersecurity by describing a Director's responsibility for the information security program and regular reviews with the CFO, fitting Management Role. It contains no specific facts such as verifiable claims, firm-specific details, or domain expertise, using only generic language, so specificity is Generic Boilerplate.


fact: more than 20 years' experience in financial services

fact: degree from the University of California, Santa Barbara with focus on Business Administration coursework

fact: Certified Information Systems Security Professional from ISC2 Organization

reasoning: The paragraph primarily describes the Director of Information Technology's role, qualifications, and responsibilities, fitting Management Role. It contains multiple verifiable facts—years of experience, specific educational institution, and CISSP certification—elevating specificity to Level 4.


fact: data security

fact: availability

fact: confidentiality

reasoning: The paragraph directly answers how third-party cyber risks are managed by describing vendor assessments for data security, availability, and confidentiality, which are core cybersecurity domain terms, placing it in Third-Party Risk at Domain-Adapted specificity.


fact: malware, viruses, worms, ransomware

fact: password spraying

fact: phishing

fact: denial-of-service attacks

fact: nation-state actors

fact: organized crime groups

fact: advanced persistent threat intrusions

reasoning: This paragraph describes the general cybersecurity threat landscape and a generic commitment to protection, not answering any of the six substantive questions about governance, management, processes, incidents, or strategy, so it is classified as None/Other. The specificity is Domain-Adapted because it includes cybersecurity-specific terminology like types of attacks and threat actors that demonstrate domain expertise beyond generic business risk language.


reasoning: The paragraph is a generic statement about the cybersecurity threat environment that does not answer any of the specific questions about governance, management, processes, or incidents, and it contains no specific facts, domain expertise, firm-specific details, or verifiable claims.


reasoning: The paragraph primarily answers what the cybersecurity program does by describing risk assessment, incident response planning, and third-party assessments, which aligns with Risk Management Process. It contains no specific facts, using only generic risk management language that any business professional could write, resulting in Generic Boilerplate specificity.


reasoning: The paragraph answers how the board oversees cybersecurity through the Audit Committee and management interactions, fitting Board Governance. It contains no specific facts, using only generic governance language without domain-adapted, firm-specific, or verifiable details.


reasoning: The paragraph primarily addresses external regulatory trends and generic compliance monitoring, which does not substantively answer any of the core cybersecurity questions (e.g., governance, processes, incidents), and it lacks any specific, verifiable, or firm-unique facts about the company's cybersecurity posture.


reasoning: The paragraph is a generic statement about IT investments supporting business operations without addressing cybersecurity specifically, fitting 'None/Other', and it contains no specific facts, making it Generic Boilerplate.


reasoning: The paragraph states conclusions about the lack of material cybersecurity incidents and their financial impact, which is an assessment of how cybersecurity affects the business, fitting Strategy Integration; it contains no specific facts about cybersecurity practices, roles, or verifiable claims, only generic negative assertions and a cross-reference, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a conclusion about material impact (no incidents materially affected or are likely to affect operations), which aligns with Strategy Integration. It contains no specific facts about cybersecurity processes, roles, or verifiable claims, consisting only of generic boilerplate language and a cross-reference.


fact: Critical Threat Committee

reasoning: The paragraph focuses on the oversight chain from the Critical Threat Committee to the Board regarding incident materiality evaluation and disclosure, which is core to Board Governance. The specific mention of the 'Critical Threat Committee' is a firm-specific identifier that distinguishes this company's governance structure.


reasoning: The paragraph primarily describes cybersecurity program activities like risk assessment, policy development, and employee training, aligning with Risk Management Process. It uses generic enterprise risk management language without any domain-specific terms, firm-specific details, or verifiable facts, resulting in Generic Boilerplate specificity.


fact: identity management and access control safeguards

fact: encryption of data in transit and at rest

fact: system and network security and monitoring

fact: information protection and governance

fact: ongoing systems and equipment maintenance

reasoning: The paragraph lists protective cybersecurity measures, primarily answering what the program does, so it is Risk Management Process. The specific measures like encryption and access control are domain-specific terms that demonstrate cybersecurity expertise, elevating specificity to Domain-Adapted.


reasoning: The paragraph describes board-level oversight via the Audit Committee receiving reports on cybersecurity risks and incidents, fitting Board Governance. It contains no specific, verifiable, or domain-adapted facts, making it Generic Boilerplate.


reasoning: The paragraph directly states a conclusion that no cybersecurity incidents have materially impacted the business, which is a backward-looking materiality assessment fitting Strategy Integration. It contains no specific facts, domain terms, or verifiable claims, making it generic boilerplate.


fact: Existence of an 'executive risk committee' overseeing cybersecurity

fact: Committee includes Chief Financial Officer, Chief Legal Officer, and Senior Vice President, Engineering Operations

reasoning: The paragraph primarily answers how management is organized for cybersecurity by detailing the executive risk committee's composition and expertise, making it Management Role. Specificity is Firm-Specific due to the named committee and specific member roles that distinguish the company's structure.


reasoning: The paragraph focuses on managing cybersecurity risks associated with an IT consultant, directly addressing third-party risk oversight. It lacks any specific facts like named entities, quantifiable details, or domain-specific terminology, rendering it generic boilerplate.


reasoning: The paragraph focuses on managing third-party cyber risks through vendor review processes, directly answering how external risks are handled, but it contains no specific facts, using only generic risk management language without domain-specific terms, firm-specific details, or verifiable claims.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a conclusion that no risks have materially affected or are likely to materially affect the company, which is a materiality assessment fitting Strategy Integration. It contains no specific facts about cybersecurity practices, roles, or verifiable claims, using only generic boilerplate language, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a backward-looking materiality assessment (no material effect over three years), which aligns with Strategy Integration. It contains no specific facts, domain terms, or verifiable claims, making it Generic Boilerplate.


fact: Senior Vice President of Engineering

fact: Chief Information Security Officer (CISO)

fact: Head of Global Affairs

fact: Chief Privacy Officer

fact: Privacy and Security Council

fact: Reporting lines: CISO reports to CEO, General Counsel and Head of Global Affairs report to CEO, Chief Privacy Officer reports to General Counsel

reasoning: The paragraph primarily describes how management is organized for cybersecurity, with specific roles and reporting lines, fitting the Management Role category. It contains multiple firm-specific facts like named positions and a committee, making specificity Level 3.


reasoning: The paragraph lists key elements of the cybersecurity program, such as risk assessments and incident response plans, which directly answer what the program does (RMP). It uses generic process descriptions without any firm-specific roles, verifiable claims, or domain-specific terminology that passes the ERM test, resulting in Generic Boilerplate specificity.


reasoning: This paragraph is a forward-looking disclaimer and cross-reference to the Risk Factors section, providing no substantive cybersecurity disclosure, so it falls under None/Other. It contains no specific facts, domain-adapted terms, firm-specific details, or verifiable claims, making it generic boilerplate.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a conclusion about the lack of material incidents, which is a materiality assessment under Strategy Integration. It contains no specific facts, domain terms, or verifiable claims, making it generic boilerplate.


fact: security questionnaires

fact: security capabilities and maturity assessments

fact: controls evidence reviews

fact: application vulnerability assessments

fact: public internet presence monitoring

fact: NIST

fact: ISO

fact: HIPAA

fact: Payment Card Industry standards

fact: right to audit

fact: technology requirements

fact: key performance metrics

fact: service levels

fact: background checks

reasoning: The paragraph centers on managing third-party cyber risks through contractual obligations and specific assessment methods, with detailed cybersecurity practices and standards demonstrating domain expertise (Level 2).


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a conclusion that no risks have materially affected or are likely to materially affect the company, which aligns with Strategy Integration. It contains no specific facts about the company's cybersecurity posture, relying on generic definitions and unverifiable negative assertions, resulting in Generic Boilerplate specificity.


fact: CISO

fact: Chief Information Officer

reasoning: The paragraph describes board and Audit Committee oversight of cybersecurity risks, including updates from specific leadership roles, which aligns with Board Governance. The mention of CISO and Chief Information Officer are firm-specific facts that elevate the specificity to Firm-Specific level.


reasoning: The paragraph primarily answers how the board oversees cybersecurity through its committees and management reporting, fitting Board Governance. It contains no specific facts beyond generic governance roles and risk management language, so specificity is Generic Boilerplate.


reasoning: The paragraph directly answers how the board oversees cybersecurity, detailing oversight by independent board members and quarterly reviews, which fits Board Governance. It contains no specific facts like domain terms, firm-specific details, or verifiable claims, making it generic boilerplate.


fact: vulnerability management policy

reasoning: The paragraph primarily describes the cybersecurity program's activities and processes, such as incident response and vulnerability management, fitting the Risk Management Process category. It contains domain-specific terminology like 'vulnerability management policy,' which demonstrates cybersecurity expertise and elevates specificity to Level 2, despite other generic terms.


reasoning: The paragraph primarily describes the oversight structure from the Board to management, answering how cybersecurity is governed, which aligns with Board Governance. However, it contains no specific or verifiable facts beyond generic roles and processes, resulting in Generic Boilerplate specificity.


fact: In October 2023, experienced a cybersecurity incident with unauthorized access to user information from 23andMe.com accounts

reasoning: The paragraph primarily answers what happened in a cybersecurity incident by detailing the October 2023 breach and remedial actions, fitting Incident Disclosure. The specific date 'October 2023' is a verifiable hard fact, setting specificity to Level 4.


reasoning: This paragraph describes a specific cybersecurity incident involving unauthorized email access and fund diversion, fitting Incident Disclosure. It lacks any domain-adapted, firm-specific, or quantified-verifiable facts, using generic language without specific details, so specificity is Generic Boilerplate.


reasoning: The paragraph is a forward-looking disclaimer about potential cybersecurity incidents and their financial impact, which does not address any substantive cybersecurity governance, management, or process questions, and it lacks any specific facts, domain expertise, firm-specific details, or verifiable claims, making it generic boilerplate.


fact: Security Incident Response Plan (SIRP)

fact: encryption protocols

fact: multi-factor authentication

fact: data loss prevention controls

reasoning: The paragraph primarily describes cybersecurity program activities like incident response planning and data protection measures, aligning with Risk Management Process. It includes domain-specific terms (encryption, MFA, DLP) and a named internal program 'SIRP', which is a firm-specific identifier, elevating specificity to Firm-Specific.


reasoning: The paragraph primarily answers how third-party cyber risks are managed through processes for third-party service providers, fitting Third-Party Risk. It contains no specific domain terms beyond generic references to cybersecurity, no firm-specific details, and no verifiable facts, making it boilerplate.


fact: Pension Benefit Information, LLC (PBI) as the affected third-party vendor

fact: Progress Software Corporation's MOVEit Transfer software involved in the breach

fact: Approximately 850,000 customers' personally identifiable information obtained

reasoning: The paragraph directly describes a specific cybersecurity incident, including the vendor, software, impact, and remediation, so it is classified as Incident Disclosure. It contains verifiable facts such as named entities (PBI, MOVEit) and a quantified number of affected customers (850,000), making it Quantified-Verifiable.


fact: Cybersecurity incident occurred in October 2023

fact: Unauthorized access to user accounts on 23andMe.com

fact: Implementation of two-step verification for customers

fact: Enhancements to Security Operations

reasoning: The paragraph primarily answers 'What happened in a cybersecurity incident?' by disclosing a specific incident in October 2023 with details on nature and remediation, making it Incident Disclosure. The verifiable date and involvement of 23andMe.com accounts provide externally confirmable facts, elevating specificity to Level 4.


fact: Manager is an affiliate of ORIX USA

fact: ORIX USA is a subsidiary of ORIX

fact: relies on ORIX USA's cybersecurity risk management program

reasoning: The paragraph primarily addresses how cybersecurity risks are managed through reliance on third parties (Manager and ORIX USA), fitting 'Third-Party Risk'. It contains verifiable facts like named entities (ORIX USA, ORIX) and their relationships, elevating specificity to Level 4.


fact: $1.0 million in costs related to the Cybersecurity Incident in 2023

fact: Remediation concluded as of December 30, 2023

fact: $0.6 million excess insurance proceeds received in Q4 2024

reasoning: The paragraph directly answers what happened in a cybersecurity incident by detailing the impact, containment actions, restoration timeline, costs, and remediation conclusion, fitting Incident Disclosure. It contains verifiable facts such as specific dollar amounts ($1.0 million, $0.6 million) and a date (December 30, 2023), elevating specificity to Quantified-Verifiable.


fact: Form 8-K filed on July 14, 2023

fact: on or about May 31, 2023

fact: zero-day vulnerability

fact: managed file transfer software MOVEit

fact: First National 1870 division

fact: Guardian Mortgage division

reasoning: The paragraph describes a real cybersecurity incident with specific dates, named software, and company divisions, directly answering 'What happened?' for Incident Disclosure. It contains verifiable facts like filing dates and product names, elevating specificity to Quantified-Verifiable.


reasoning: The paragraph primarily answers how management reports to the audit committee on cybersecurity, which is part of board governance oversight. It contains no specific facts, using only generic terms and cadences, making it generic boilerplate.


fact: cloud-based technology to scan and analyze for vulnerable software or misconfigurations

fact: cybersecurity questionnaire

reasoning: The paragraph primarily answers how third-party cyber risks are managed through assessments, contractual requirements, monitoring, and disengagement capabilities, making it Third-Party Risk. It contains domain-adapted terms like vulnerability scanning and cybersecurity questionnaires, demonstrating cybersecurity expertise but no firm-specific or verifiable facts, resulting in Level 2 specificity.


fact: VP of IT

reasoning: The paragraph primarily answers how the board oversees cybersecurity through delegation to the Audit Committee and reporting lines, fitting Board Governance. It contains the firm-specific fact 'VP of IT', which is a VP-level title with IT portfolio, elevating specificity to Firm-Specific.


reasoning: The paragraph primarily answers how third-party cyber risks are managed through contractual obligations, reviews, and data deletion requirements, making it Third-Party Risk. It contains only generic process descriptions without firm-specific or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph details the incident response process, answering what the cybersecurity program does during an incident, which aligns with Risk Management Process. It contains no specific domain terms, firm-unique facts, or verifiable claims, making it generic boilerplate.


fact: Cybersecurity Leadership Team

reasoning: The paragraph primarily answers how the board oversees cybersecurity through delegation to the Audit Committee and reporting structures, fitting Board Governance. It contains the firm-specific fact 'Cybersecurity Leadership Team,' which distinguishes the company's organizational structure, elevating specificity to Level 3.


reasoning: The paragraph primarily cross-references Item 1A for detailed risk factors and contains only a generic statement about senior leadership evaluation, providing no substantive cybersecurity disclosure. No specific facts are present, making it generic boilerplate.


reasoning: The paragraph is a generic statement about cybersecurity risks and controls without detailing any specific processes, roles, governance, or incidents, so it falls under None/Other. It contains no specific facts—only vague assurances—resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how third-party cyber risks are managed by describing a third-party risk management (TPRM) program, fitting the Third-Party Risk category. The content is generic, using standard terminology like 'TPRM program' and 'assess potential risks' without any verifiable, firm-specific, or domain-adapted details that elevate specificity above Level 1.


reasoning: The paragraph states a conclusion about the material impact of past cybersecurity incidents on business outcomes, which directly answers the Strategy Integration question. It contains no specific facts—only generic risk statements and an unverifiable negative assertion about materiality—resulting in Generic Boilerplate specificity.


fact: security event monitoring and detection

fact: extended detection and response

fact: vulnerability scanning

fact: security awareness and privacy training

fact: phishing simulations

fact: cybersecurity incident response team

fact: audits and penetration tests

reasoning: The paragraph describes the cybersecurity program's components, answering what the program does, so it is classified as Risk Management Process. The specificity is Domain-Adapted because it includes cybersecurity-specific terms like extended detection and response and vulnerability scanning, which demonstrate domain expertise beyond generic risk management language.


reasoning: The paragraph primarily answers what the cybersecurity program does by describing general risk management processes, aligning with Risk Management Process. It contains no specific facts—only generic language like 'policies and procedures' and 'monitoring for threats'—resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating no material adverse impact and describing general risk management efforts, fitting Strategy Integration. It contains no specific facts, using only generic risk management language without verifiable or firm-specific details.


reasoning: This paragraph is a forward-looking disclaimer about the effectiveness of the cybersecurity program and a cross-reference to risk factors, providing no substantive disclosure on governance, processes, or incidents, thus classified as None/Other. It contains no specific facts, using only generic cautionary language, making it Generic Boilerplate.


fact: identification and testing of vulnerabilities

fact: cybersecurity awareness training

fact: internal security reviews

fact: external reviews

fact: assessments of data protection practices

fact: targeted attack simulations

reasoning: The paragraph primarily answers what the cybersecurity program does by describing activities like vulnerability testing and training, fitting Risk Management Process. Specificity is Domain-Adapted as it uses cybersecurity-specific terms such as phishing simulations and targeted attack simulations, demonstrating domain expertise without firm-specific or verifiable facts.


reasoning: The paragraph primarily answers how third-party cyber risks are managed through assessments and monitoring, fitting Third-Party Risk. It lacks specific facts, domain-adapted terms, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a conclusion that no material incidents have occurred, which aligns with Strategy Integration. It contains no specific facts about the cybersecurity program, such as tools, standards, or verifiable details, making it generic boilerplate.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating that risks have not materially affected it, which is a materiality assessment for Strategy Integration. It contains no specific facts, domain-adapted terms, or verifiable claims, making it Generic Boilerplate.


fact: risk assessments

fact: reviewing written security programs

fact: reviewing security assessments and responses to security questionnaires

fact: auditing

fact: vulnerability scans

fact: contractual information security obligations

reasoning: The paragraph primarily answers how third-party cyber risks are managed through a vendor management program, fitting Third-Party Risk. It contains domain-specific cybersecurity practices like vulnerability scans and security questionnaires, which demonstrate expertise beyond generic risk management, leading to Level 2 specificity.


fact: Enterprise Risk Committee (ERC)

fact: Operational Risk Committee (ORC)

fact: CISO holds Bachelor of Science in Electrical Engineering and Mathematics from the University of Texas at Arlington

fact: CISO is a Certified Information Systems Security Professional (CISSP)

fact: CISO has 17 years of experience in a banking institution

reasoning: The paragraph primarily describes management's organizational structure for cybersecurity, including committees and the CISO's role, making it Management Role. Specificity is Level 4 due to verifiable facts such as the CISO's education, CISSP certification, and 17-year experience.


fact: VP of IT has over 24 years of experience in information technology and information security

fact: VP of IT served as Chief Information Security Officer of a healthcare company

fact: VP of IT holds undergraduate and graduate degrees in computer science

fact: NVP of Finance and Cybersecurity Response Committee have over 50 years of collective experience managing enterprise risks

reasoning: The paragraph focuses on management roles and qualifications, answering how cybersecurity leadership is organized (Management Role). It contains verifiable facts like specific years of experience and educational degrees, elevating specificity to Level 4.


reasoning: The paragraph describes board oversight through quarterly updates on cyber events and annual program overviews, fitting Board Governance. It uses generic risk management language with no specific cybersecurity domain terms, firm-unique details, or verifiable claims, resulting in Generic Boilerplate specificity.


fact: CISSP certification held by members

fact: CCNP certification held by members

fact: CISA certification held by members

fact: CySA+ certification held by members

reasoning: This paragraph primarily answers how management is organized for cybersecurity by describing the team's qualifications, making it Management Role. It includes verifiable certifications (CISSP, CCNP, CISA, CySA+) that can be independently confirmed, setting specificity to Level 4.


reasoning: The paragraph primarily offers forward-looking disclaimers about cybersecurity limitations and cross-references to risk factors, without substantively describing governance, processes, or incidents. It contains no specific facts, domain terms, or verifiable claims, making it generic boilerplate.


fact: Incident Response Plan (IRP)

fact: processes for containment, review, escalation, recovery, remediation

fact: Chief Information Officer

fact: DPT

fact: IRT

reasoning: The paragraph primarily describes the incident response plan and processes, which aligns with Risk Management Process. It contains firm-specific details such as the Chief Information Officer role and named teams (DPT, IRT), elevating specificity to Firm-Specific.


fact: CIO has over two decades of experience in technology development, management, and security

fact: CEO, CFO, and GC each have over 15 years of experience managing enterprise risks, including cybersecurity threats

fact: CIO holds a technical undergraduate degree and a graduate business degree with a strong technical focus

fact: Each executive holds undergraduate and graduate degrees in their respective fields

reasoning: The paragraph primarily answers how management is organized to handle cybersecurity by detailing executives' qualifications and experience, fitting Management Role. Specificity is Quantified-Verifiable due to verifiable claims like specific years of experience and educational degrees.


fact: Three Directors have cybersecurity risk management experience

fact: Ann Bordelon is Chair of the Audit Committee

fact: Paulette Dodson and Noah Glass are named directors

reasoning: The paragraph focuses on the Board and Audit Committee's oversight of cybersecurity threats, which aligns with Board Governance. It includes verifiable facts such as the specific number and names of directors with cybersecurity experience, elevating specificity to Quantified-Verifiable.


fact: utilizing a third-party security scoring system to evaluate the security posture

reasoning: The paragraph centrally describes processes for managing vendor and third-party cybersecurity risks, aligning with the Third-Party Risk category. It includes a domain-specific practice ('third-party security scoring system'), which demonstrates cybersecurity expertise and elevates specificity to Domain-Adapted.


fact: Specific date of incident: late May 2023

fact: Type of attack: ransomware

reasoning: The paragraph directly describes a real cybersecurity incident (ransomware attack in late May 2023) and the response, fitting 'Incident Disclosure'. The specific date 'late May 2023' is a verifiable fact, achieving Level 4 specificity.


fact: March 2020 ransomware attack

reasoning: The paragraph primarily answers 'What happened in a cybersecurity incident?' by detailing a specific ransomware attack in March 2020, including its nature, response, and potential impacts, making it Incident Disclosure. The specificity is Level 4 because the date and event type constitute a verifiable fact that an external party could confirm.


reasoning: The paragraph primarily answers what the cybersecurity program does by describing a procedure for communicating program details to employees, fitting Risk Management Process. The content is generic, lacking domain-specific expertise, firm-unique details, or verifiable facts, resulting in Generic Boilerplate specificity.


fact: CISO role

fact: Steering committee on information security

fact: Committee composition includes executive management and business functional area leaders

fact: Over 20 years of experience in information security

fact: CIO Executive Education Certificate from Stanford University

reasoning: The paragraph primarily answers how management is organized for cybersecurity by describing the CISO and steering committee's roles and qualifications, making it Management Role. It contains verifiable facts such as the CISO's over 20 years of experience and a specific certificate from Stanford University, setting specificity at Level 4.


fact: CISO

fact: CIO

reasoning: The paragraph primarily answers how the board oversees cybersecurity through the Audit & Finance Committee's governance role, making it Board Governance. Specificity is Firm-Specific because it references the CISO and CIO roles, which are firm-specific cybersecurity leadership positions.


fact: over 7 years of experience leading cybersecurity teams and programs

reasoning: This paragraph primarily answers how management is organized to handle cybersecurity, detailing the Director of ITD's role, responsibilities, and reporting lines to the CFO, thus categorized as Management Role. The specificity is Quantified-Verifiable due to the verifiable claim of over 7 years of experience, which is a hard fact that could be externally confirmed.


fact: Security incident occurred in January 2023

fact: Incident reported to federal law enforcement

fact: Computer systems functionality restored

reasoning: The paragraph primarily describes a specific cybersecurity incident with timing, impact, and response, fitting Incident Disclosure. It contains verifiable facts such as the January 2023 date and actions taken, elevating specificity to Quantified-Verifiable.


fact: Vice President of IT is named Randy Jepsen

fact: Chief Financial Officer is named Russell Devendorf

fact: Randy Jepsen has over 25 years of experience in the IT industry

fact: Randy Jepsen has 19 years at Smith Douglas and The SMART Builder Solutions

fact: Russell Devendorf previously oversaw information technology and risk management at a publicly traded homebuilder from 2008 to 2017

fact: Combined management team experience of almost 50 years managing IT and internal audit functions

reasoning: This paragraph is classified as Management Role because it primarily describes management's organizational roles, responsibilities, and qualifications in cybersecurity. The specificity is Level 4 due to verifiable facts such as named individuals, specific years of experience, and detailed previous roles that could be externally confirmed.


fact: National Institute of Standards and Technology

fact: Center for Internet Security Controls

reasoning: The paragraph describes the cybersecurity risk management program's foundation based on recognized frameworks, fitting Risk Management Process. It includes specific cybersecurity frameworks (NIST, CIS Controls) that demonstrate domain expertise, elevating specificity to Level 2.


fact: Chief Information Officer (CIO) role involved in executive sessions on cybersecurity

reasoning: The paragraph primarily answers how the board oversees cybersecurity, with the Board reviewing risks and holding executive sessions with the CIO, fitting Board Governance. The mention of the CIO role is a firm-specific fact, elevating specificity to Firm-Specific.


fact: over a decade of industry experience

reasoning: The paragraph primarily answers how management is organized for cybersecurity, focusing on the CTO's role, team composition, and reporting lines, which aligns with Management Role. The specificity is Level 4 due to the verifiable claim of 'over a decade of industry experience' for the CTO, which is a quantifiable fact.


fact: CISO (Chief Information Security Officer)

reasoning: The paragraph focuses on the Audit Committee's oversight of cybersecurity risks, answering how the board oversees cybersecurity, which is Board Governance. The specific mention of the CISO role is a firm-specific fact that elevates specificity to Level 3.


fact: Chief Information Officer (CIO)

fact: Chief Information Security Officer (CISO)

fact: Cyber Incident Response Teams

reasoning: The paragraph primarily answers how management is organized for cybersecurity by describing the roles and responsibilities of the CIO, CISO, and their teams, which are firm-specific organizational details.


fact: Deutsche Bank Group's security incident management

fact: Involvement of DWS in incident notification

fact: Protocol to notify RREEF if data is at risk

reasoning: The paragraph describes cybersecurity incident response processes, aligning with Risk Management Process. It includes firm-specific references to Deutsche Bank Group and DWS, which are unique to RREEF's corporate structure, elevating specificity to Level 3.


reasoning: The paragraph primarily answers how the board oversees cybersecurity through Audit Committee reports and Board briefings, fitting Board Governance. It contains no firm-specific or verifiable facts, using generic oversight language without specific details, resulting in Generic Boilerplate specificity.


fact: Head of Information Technology for Latin America, who oversees Cybersecurity

fact: 25 years of experience in strategic IT leadership and global project management

reasoning: The paragraph primarily answers how management is organized for cybersecurity by describing a specific leadership role and qualifications, fitting Management Role. It contains a firm-specific job title and a verifiable claim of 25 years of experience, which elevates specificity to Level 4.


fact: VP Security

fact: IT Risk and Compliance Team

reasoning: The paragraph focuses on management organizational structure, detailing specific roles like VP Security and the IT Risk and Compliance Team, which are firm-specific facts that distinguish the company's cybersecurity governance.


fact: chaired by our CISO

fact: Privacy and Data Governance Committee

fact: chaired by our Chief Privacy Officer

fact: Data Security and Privacy Governance Committee

fact: cross-functional group across approximately 20 departments

reasoning: The paragraph primarily answers how management is organized for cybersecurity through specific committee structures and roles, making it Management Role. Specificity is Firm-Specific due to named committees (e.g., Security and Technology Risk Leadership Committee) and roles (CISO, Chief Privacy Officer).


fact: SOC 1 audit

reasoning: The paragraph focuses on managing cybersecurity risks from third-party service providers through mandated annual SOC 1 audits and review processes, directly answering how third-party cyber risks are managed. The specificity is Domain-Adapted because the term 'SOC 1 audit' demonstrates cybersecurity domain expertise, moving beyond generic risk management language.


fact: meets at least quarterly with Board, EXCO, and SLT

fact: performs tabletop exercises at least annually

reasoning: The paragraph primarily describes how the CISO facilitates cybersecurity oversight through regular meetings with the Board and senior management, aligning with Board Governance. Specificity is Quantified-Verifiable due to verifiable lower-bound claims about meeting and exercise frequencies.


fact: containment and remediation efforts

reasoning: The paragraph describes third-party assistance for cybersecurity containment and remediation, which is part of the risk management process (RMP) as it details program activities. The terms 'containment and remediation' are domain-specific cybersecurity practices, indicating expertise and elevating specificity to Level 2.


fact: Threat actors unlawfully accessed certain computer systems

fact: Exfiltrated images of video meetings and computer screens that may contain sensitive information

fact: Released a portion of this information publicly, including that of some vendors and customers

fact: Demand for a monetary payment was not acceded to

fact: Additional cybersecurity measures taken: closing off the point of unlawful access and bolstering cyber defensive capabilities

reasoning: The paragraph describes a specific cybersecurity incident, including details on what was accessed, exfiltrated, and the response, making it Incident Disclosure. It contains firm-specific facts about the incident but no quantified or externally verifiable details like dates or numbers, so specificity is Level 3.


fact: SOC2 T2

fact: penetration testing

fact: ISO 27001 certification

reasoning: The paragraph centers on third-party cyber risk management processes, directly answering how vendor risks are handled. It demonstrates cybersecurity domain expertise through references to specific standards and practices (SOC2 T2, penetration testing, ISO 27001), elevating specificity to Level 2.


fact: Named third-party companies: Namecheap, GoDaddy, Cloudflare

reasoning: The paragraph primarily answers how third-party cyber risks are managed by relying on reputable hosting companies, fitting the Third-Party Risk category. It contains verifiable facts by naming specific companies (Namecheap, GoDaddy, Cloudflare), which are externally confirmable, setting specificity at Level 4.


fact: Ransomware attack in May 2020

fact: Cybercriminal removed a copy of a subset of data from self-hosted environment

fact: Ongoing legal proceedings, claims, and investigations related to the Security Incident

reasoning: The paragraph primarily describes a real cybersecurity incident (the May 2020 ransomware attack) and its consequences, fitting Incident Disclosure. It contains verifiable facts such as the specific date and details of the incident, setting specificity at Level 4.


fact: Senior Vice President of Information Technology (SVP IT)

reasoning: The paragraph primarily describes the SVP IT's role in overseeing cybersecurity processes, answering how management is organized for cybersecurity (Management Role). The specific mention of the SVP IT title is a firm-specific fact that elevates specificity to Firm-Specific.


fact: ransomware

fact: malware

fact: phishing

reasoning: The paragraph primarily answers the question of whether cybersecurity has materially affected the business by stating no material incidents have occurred, which is a materiality assessment aligning with Strategy Integration. For specificity, it includes domain-specific threat terms like ransomware and phishing, demonstrating cybersecurity expertise, but lacks firm-specific or verifiable facts, resulting in Level 2.


fact: Vice President of IT and Digital

fact: CISO

reasoning: The paragraph primarily answers how management is organized to handle cybersecurity by describing how key personnel (VP of IT and Digital and CISO) stay informed, fitting the 'Management Role' category. It contains firm-specific facts such as the titles of cybersecurity leadership roles, which elevate specificity to Firm-Specific.


fact: penetration test

fact: Information Systems Audit

fact: Information Security Policy and Program

reasoning: The paragraph primarily answers what the cybersecurity program does by detailing testing methods (audits, penetration tests) and risk assessment processes, fitting Risk Management Process. It demonstrates cybersecurity domain expertise through terms like 'penetration test' and 'Information Systems Audit,' elevating specificity to Level 2.


reasoning: The paragraph centers on third-party supplier risk assessments, fitting the Third-Party Risk category, but it describes a generic process without specific details, certifications, or verifiable facts, making it boilerplate.


fact: cyber incident response plan

fact: third-party assessments

fact: cyber threat trends

fact: cybersecurity policies and methodologies

fact: prevention, detection, mitigation, and remediation of cyber threats

reasoning: The paragraph primarily describes the oversight activities of the Steering Committee, which aligns with Board Governance, and it uses cybersecurity-specific terminology such as 'cyber incident response plan' and 'third-party assessments', indicating domain expertise at Level 2.


reasoning: The paragraph primarily answers how third-party cyber risks are managed through security assessments, contractual requirements, and audits, making it Third-Party Risk. It contains the firm-specific department name 'Information Technology Automated Solutions (ITAS)', which elevates specificity to Level 3.


fact: National Institute of Standards and Technology Cybersecurity Framework

reasoning: The paragraph primarily describes the cybersecurity program's activities, such as risk assessment, monitoring, and use of NIST CSF, answering 'What does the cybersecurity program do?' for Risk Management Process. Specificity is Domain-Adapted due to domain-specific terms like 'NIST Cybersecurity Framework' and 'monitoring and patching of vulnerabilities,' which demonstrate cybersecurity expertise beyond generic risk management.


fact: Chief Information Security Officer (CISO)

reasoning: The paragraph centers on processes for overseeing third-party cybersecurity risks, fitting the Third-Party Risk category. The specific mention of the CISO role is a firm-specific fact that raises the specificity to Level 3.


reasoning: The paragraph focuses on the Director of Operations & Information Technology's role in evaluating cybersecurity risks and leading strategies, which aligns with Management Role. Specificity is Generic Boilerplate because the experience is described as 'approximately 20 years' (a soft number) and certifications are vague without specific names, providing no verifiable or domain-specific facts.


fact: Chief Information Officer (CIO) is a member of the Executive Committee

fact: Chief Information Security Officer (CISO) role

reasoning: The paragraph primarily answers how management is organized for cybersecurity by detailing the roles and responsibilities of the CIO and CISO, making it Management Role. Specificity is Firm-Specific due to the mention of firm-specific leadership positions (CIO and CISO) and the CIO's membership in the Executive Committee.


fact: Company's CISO

reasoning: The paragraph primarily answers how the board oversees cybersecurity through committee structures and reporting, fitting Board Governance. It includes firm-specific facts such as the named Cybersecurity and Technology Subcommittee and the CISO role, elevating specificity to Firm-Specific.


fact: Development of enhanced Employee Self Service portal in 2022

reasoning: The paragraph primarily answers how the board and committees oversee cybersecurity, fitting Board Governance. It contains a verifiable fact (portal development in 2022), elevating specificity to Level 4.


fact: encryption

fact: data loss prevention technology

fact: authentication technology

fact: entitlement management

fact: access control

fact: anti-virus and anti-malware software

fact: transmission of data over private networks

reasoning: The paragraph primarily describes the cybersecurity program's processes and technologies, answering what the program does, which aligns with Risk Management Process. Specificity is Domain-Adapted because it includes specific cybersecurity tools and references the NIST framework, demonstrating domain expertise beyond generic business language.


fact: Cybersecurity Committee

fact: SMIS

reasoning: The paragraph describes board and committee oversight of cybersecurity, including reporting flows and incident notification, which directly answers how the board oversees cybersecurity (Board Governance). It contains firm-specific references to the 'Cybersecurity Committee' and the acronym 'SMIS', which distinguish it from generic governance descriptions, setting specificity at Firm-Specific.


reasoning: The paragraph primarily describes board oversight of cybersecurity risks and management's reporting practices, fitting Board Governance. It contains no specific facts like named roles, quantified data, or domain-adapted terms, using only generic risk management language, so specificity is Level 1.


fact: April 2022

reasoning: The paragraph describes an actual cybersecurity incident that occurred in April 2022, including its impact and remediation, fitting the Incident Disclosure category. Specificity is high due to the verifiable date 'April 2022', which is a hard fact that can be independently confirmed.


fact: penetration testing

fact: managed detection and response services

fact: intrusion prevention and detection applications

reasoning: The paragraph primarily addresses how third-party cyber risks are managed through engagements and vendor oversight, fitting the Third-Party Risk category. Specificity is Domain-Adapted because it includes cybersecurity-specific terms like penetration testing and managed detection and response services, demonstrating domain expertise.


fact: ISO 27001:2022 information security standard

fact: Security Operations Center (SOC)

reasoning: The paragraph primarily describes cybersecurity program activities like risk assessment, technical defenses, and maintaining a SOC, which answers 'What does the cybersecurity program do?' for Risk Management Process. It includes domain-specific terms such as ISO 27001:2022 and SOC, demonstrating cybersecurity expertise and elevating specificity to Level 2, but lacks firm-specific or verifiable facts.


fact: advanced persistent threats

reasoning: The paragraph primarily addresses materiality assessments and potential business impacts of cybersecurity, such as the negative assertion of no material incidents and consequences like reputational damage, which aligns with Strategy Integration. It contains domain-specific terminology like 'advanced persistent threats,' demonstrating cybersecurity expertise and elevating specificity to Domain-Adapted, though no firm-specific or verifiable facts are present.


fact: Head of IT reports directly to Chief Financial Officer

fact: over twenty years of experience

fact: Master of Science degree in Telecommunications and Computer Networks

fact: Project Management Professional certified

fact: Certified Scrum Master

fact: IT Infrastructure Library certified

reasoning: The paragraph primarily answers how management is organized for cybersecurity by detailing the Head of IT's reporting line, experience, and certifications, making it Management Role. Specificity is Quantified-Verifiable due to verifiable claims such as years of experience, degree, and professional certifications.


fact: security threat intelligence system

fact: vulnerability management tools

fact: patch management standard

fact: Security Operations Center

fact: real-time awareness

fact: event correlation

fact: incident response capabilities

reasoning: The paragraph primarily describes cybersecurity activities such as threat intelligence, patch management, and SOC operations, aligning with Risk Management Process. It uses domain-specific terminology like 'Security Operations Center' and 'vulnerability management tools,' which demonstrate cybersecurity expertise and elevate specificity to Domain-Adapted.


fact: Enterprise Risk Management Committee (ERM Committee)

fact: SOC1 reports

reasoning: The paragraph primarily answers how cybersecurity risks are overseen through the ERM Committee reporting to the Audit Committee, which is a governance-chain description, fitting Board Governance. Specificity is Firm-Specific due to the named ERM Committee (a firm-specific committee) and the domain term SOC1 reports, which demonstrate cybersecurity expertise.


fact: risk assessments

fact: penetration testing

fact: ISAT

reasoning: The paragraph primarily describes cybersecurity program activities like engaging third parties for risk assessments and penetration testing, which aligns with Risk Management Process. Specificity is elevated to Level 3 due to the firm-specific acronym 'ISAT' (likely a named internal team), alongside domain terms like 'risk assessments' and 'penetration testing'.


fact: World Gold Council

reasoning: The paragraph primarily answers how the board oversees cybersecurity through receiving reports, fitting Board Governance. Specificity is Firm-Specific due to the named World Gold Council, a unique entity involved in reporting on cybersecurity programs.


fact: attest reports

fact: complementary user entity controls

reasoning: The paragraph primarily answers how third-party cyber risks are managed, detailing measures like reviewing attest reports and implementing complementary controls, which demonstrates cybersecurity domain expertise.


fact: CISO

fact: Cybersecurity Executive Steering Body

reasoning: This paragraph primarily answers how the board oversees cybersecurity by describing the reporting chain from the CISO to management and the Audit Committee, fitting Board Governance. The specificity is Firm-Specific because it includes the CISO role and the named Cybersecurity Executive Steering Body, which are firm-specific facts.


reasoning: The paragraph primarily answers what the cybersecurity program does by describing the integration of a cybersecurity risk management program into the overall framework, fitting Risk Management Process. The specificity is Domain-Adapted because it includes the cybersecurity triad 'confidentiality, integrity, and availability,' which demonstrates domain expertise beyond generic risk management language.


fact: regular scanning of both internal and externally facing systems

fact: annual third-party penetration testing

fact: security technologies intended to identify and assist in containing and remediating malware risks

fact: active monitoring of logs and events for our network perimeter and internal systems

fact: due diligence of information security maintained by third-party vendors

reasoning: The paragraph primarily answers what the cybersecurity program does by listing activities like scanning, penetration testing, and monitoring, fitting Risk Management Process. All facts are domain-adapted cybersecurity terms, elevating specificity to Level 2.


fact: Company's CISO

fact: Chief Risk Officer

fact: Chief Information and Technology Officer

reasoning: This paragraph primarily answers how management is organized to handle cybersecurity by listing specific roles responsible for assessing and managing risks, making it Management Role. It contains firm-specific facts such as the CISO title and other C-suite roles, which distinguish the company's cybersecurity governance structure, elevating specificity to Firm-Specific.


fact: Named hotel manager: Our Town

fact: Hotel manager maintains separate cybersecurity insurance coverage

reasoning: The paragraph primarily addresses how third-party cyber risks are managed by relying on the hotel manager and franchisors, fitting Third-Party Risk. It includes firm-specific facts like the named hotel manager 'Our Town' and their cybersecurity insurance, elevating specificity to Firm-Specific.


fact: forensic investigations

fact: incident response management

fact: containment

fact: remediation

fact: recovery

reasoning: The paragraph primarily answers 'What does the cybersecurity program do?' by detailing the incident response process, including containment, remediation, and recovery, which aligns with Risk Management Process. It demonstrates cybersecurity expertise through domain-specific terms like forensic investigations and incident response management, elevating specificity to Domain-Adapted.


fact: CISO

fact: CIO

fact: Technology and Operations Committee

reasoning: The paragraph primarily answers how management is organized for cybersecurity, detailing specific leadership roles and a named committee, which aligns with Management Role. Specificity is Firm-Specific due to the presence of firm-specific facts like the CISO, CIO, and Technology and Operations Committee, which distinguish the company's structure.