fact: SOC reports

reasoning: The paragraph focuses on managing cybersecurity risks of third-party service providers through due diligence, contractual requirements, and ongoing monitoring, aligning with Third-Party Risk. Specificity is Domain-Adapted because it includes the cybersecurity domain term 'SOC reports,' demonstrating expertise beyond generic risk management language.


content_category: Board Governance

category_confidence: high

specificity_confidence: high

reasoning: The paragraph describes the board and Audit Committee's oversight of cybersecurity risks, fitting the Board Governance category. It contains no specific facts, domain expertise, or verifiable claims, making it generic boilerplate.

provider: xiaomi

stage: benchmark


content_category: Strategy Integration

reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a conclusion on material impact and mentioning cyber insurance, aligning with Strategy Integration. It contains no specific, verifiable facts—only general assertions about materiality and insurance—resulting in Generic Boilerplate specificity.


content_category: Risk Management Process

category_confidence: medium

reasoning: The paragraph primarily answers what the cybersecurity program aims to do by describing the goal of risk management strategies, aligning with Risk Management Process, but it contains no specific facts and uses generic business language that does not demonstrate cybersecurity expertise or provide verifiable details.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating that no material incidents have occurred and future risks are reasonably likely to be material, which is a Strategy Integration assessment. It contains no specific facts, domain terms, firm-specific details, or verifiable claims, making it Generic Boilerplate.


content_category: Management Role

reasoning: The paragraph focuses on the organizational roles and responsibilities of the Senior Director of IT and General Counsel in cybersecurity, which directly answers how management is organized, making it Management Role. It lacks any specific facts such as verifiable claims, domain-adapted terms, or firm-unique details beyond generic titles and duties, resulting in Generic Boilerplate specificity.


content_category: None/Other

reasoning: The paragraph is generic risk disclosure about potential cybersecurity impacts and cross-references another section, without describing any specific governance, management roles, processes, or incidents, so it falls under None/Other. It contains no specific facts—only hypothetical language and standard risk terms—making it Generic Boilerplate.


reasoning: This paragraph is a cross-reference to risk factors in Item 1A, providing no substantive cybersecurity disclosure, so it is classified as None/Other. It contains no specific facts about cybersecurity governance, processes, or incidents, resulting in Generic Boilerplate specificity.


fact: CIO also serves as CISO

reasoning: The paragraph describes board committee oversight of cybersecurity through reports and briefings, fitting Board Governance. The mention of the CIO who also serves as CISO is a firm-specific fact that elevates specificity to Level 3.


reasoning: The paragraph answers how the board oversees cybersecurity through the Audit Committee's risk management review, making it Board Governance. It contains no specific facts, using only generic oversight language without domain-adapted terms or verifiable details, resulting in Generic Boilerplate specificity.


reasoning: The paragraph states a conclusion about whether cybersecurity threats have materially affected or are likely to affect business outcomes, which aligns with Strategy Integration. It contains no specific facts, domain-adapted terms, firm-specific details, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph is solely a cross-reference to risk factors with no substantive cybersecurity disclosure, fitting None/Other. It contains no specific facts about cybersecurity measures, incidents, or governance, resulting in Generic Boilerplate specificity.


content_category: Third-Party Risk

reasoning: The paragraph primarily answers how third-party cyber risks are managed by describing periodic risk assessments and due diligence for IT suppliers handling personal or customer data. It contains no specific facts, domain-adapted terminology, firm-specific details, or verifiable claims, making it generic boilerplate.


fact: obtained our second ISO 27001 certification

reasoning: The paragraph primarily answers 'What does the cybersecurity program do?' by describing activities like control reviews, testing, training, and third-party assessments, aligning with Risk Management Process. The verifiable claim of obtaining a second ISO 27001 certification elevates specificity to Level 4.


reasoning: The paragraph directly states a materiality conclusion about cybersecurity incidents, fitting Strategy Integration. It lacks any specific facts beyond a generic timeframe and negative assertion, resulting in Generic Boilerplate specificity.


reasoning: The paragraph centers on managing cybersecurity risks for third-party service providers, fitting the Third-Party Risk category. It uses generic risk management language without any specific, verifiable, or domain-adapted facts, resulting in Generic Boilerplate specificity.


fact: over 30 years of experience in various information technology roles

fact: over 20 years of experience as an IT Director

fact: over 10 years of experience in risk management

reasoning: The paragraph focuses on management roles and responsibilities for cybersecurity, specifically the Global Director of IT and CFO, making it Management Role. It contains verifiable claims about years of experience (e.g., 'over 30 years'), elevating specificity to Level 4.


fact: CISO role

fact: Certificate in Cybersecurity Oversight from Carnegie Mellon University Software Engineering Institute

reasoning: The paragraph primarily answers how management is organized to handle cybersecurity, focusing on the CISO's responsibilities and qualifications. The specific certification from Carnegie Mellon University is an externally verifiable fact, setting specificity to Level 4.


fact: Incident Response Team (named non-generic team)

fact: Senior Vice President, Finance as part of Incident Response Team

fact: over twenty years of experience (verifiable lower bound)

reasoning: The paragraph primarily answers how management is organized for cybersecurity, detailing roles and responsibilities, which fits Management Role. Specificity is driven by the verifiable claim of 'over twenty years of experience' for the Senior Director, setting it at Level 4.


reasoning: The paragraph primarily answers how the board oversees cybersecurity by describing delegation to the audit committee, fitting Board Governance. It contains no specific facts—only generic oversight language—resulting in Generic Boilerplate specificity.


reasoning: The paragraph states a conclusion about the materiality of cybersecurity incidents (both backward-looking and forward-looking), which directly answers how cybersecurity affects the business, fitting Strategy Integration. It contains no specific facts—only generic statements and a negative assertion that is not externally verifiable—resulting in Generic Boilerplate specificity.


fact: penetration tests

reasoning: The paragraph primarily answers what the cybersecurity program does by describing management's involvement in activities like overseeing policies, testing incident response plans, and engaging vendors for penetration tests, aligning with Risk Management Process. Specificity is Domain-Adapted due to the mention of 'penetration tests,' a specific cybersecurity practice that demonstrates domain expertise.


reasoning: The paragraph is a generic statement about cybersecurity importance and general safeguarding intent without describing any specific processes, roles, governance, or incidents, so it falls under None/Other. It contains no specific facts, using only boilerplate language with no verifiable or firm-specific details.


reasoning: The paragraph primarily answers how the board oversees cybersecurity by describing the board's ultimate oversight and executive leadership's reporting on risks, fitting Board Governance. It contains no specific facts—only generic governance roles and actions—resulting in Generic Boilerplate specificity.


fact: risk assessment processes

fact: cybersecurity policies and procedures

fact: monitoring and testing safeguards

fact: security measures consistent with applicable laws

fact: breach reporting requirements

reasoning: The paragraph focuses on managing third-party cyber risks through engagement and certification requirements, fitting the Third-Party Risk category. It demonstrates cybersecurity domain expertise with terms like 'cybersecurity policies and procedures' and 'monitoring and testing safeguards,' but lacks firm-specific or verifiable facts, resulting in Domain-Adapted specificity.


reasoning: The paragraph answers how the board oversees cybersecurity by delegating to the Audit Committee, fitting Board Governance; it contains no specific facts, using only generic governance terms without domain expertise, firm-specific details, or verifiable claims.


reasoning: This paragraph is a cross-reference to risk factors in Item 1A and does not describe any actual cybersecurity governance, management, processes, incidents, or strategies, so it falls under None/Other. It contains no specific facts, only generic boilerplate language, resulting in Generic Boilerplate specificity.


reasoning: This paragraph primarily answers how the board oversees cybersecurity through annual reports and incident updates, fitting Board Governance. It contains no specific facts—only generic governance language like 'annual reports' and 'cybersecurity incidents' without verifiable or firm-specific details, making it Generic Boilerplate.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a conclusion that no threats have materially affected or are likely to affect business strategy, results, or financial condition, which aligns with Strategy Integration. It contains no specific facts—only generic materiality assertions and a cross-reference—resulting in Generic Boilerplate specificity.


reasoning: The paragraph centers on managing cybersecurity risks from third-party vendors through due diligence and contractual requirements, fitting Third-Party Risk. However, the language is generic, describing standard practices without specific domain terms, firm-unique details, or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph is a generic statement of commitment to cybersecurity without answering any substantive question about governance, processes, or impact, and it contains no specific facts, domain-adapted terms, firm-specific details, or verifiable claims.


reasoning: The paragraph primarily answers how the board oversees cybersecurity by describing executive team oversight and regular updates to the audit committee, fitting Board Governance. It contains no specific facts, using generic language that fails to show cybersecurity domain expertise or firm-specific details, resulting in Generic Boilerplate specificity.


reasoning: The paragraph is a generic statement of commitment to cybersecurity without describing any specific oversight, processes, incidents, or strategy, so it falls under None/Other. It contains no specific facts, domain terms, or verifiable claims, making it Generic Boilerplate.


reasoning: The paragraph primarily answers how cybersecurity affects the business by concluding that past incidents have not materially impacted operations and are not reasonably likely to do so, which is a materiality assessment under Strategy Integration. It contains no specific, verifiable facts—only generic statements about attacks and materiality conclusions—resulting in Generic Boilerplate specificity.


reasoning: This paragraph is solely a cross-reference to risk factors in another section and provides no substantive cybersecurity disclosure, fitting the None/Other category. As a None/Other paragraph, it is assigned Generic Boilerplate specificity by default, with no specific facts present to elevate it.


reasoning: The paragraph is a forward-looking disclaimer about cybersecurity risks and cross-references Item 1A for detailed risk factors, providing no substantive disclosure on governance, management, or processes, thus classified as None/Other. As a None/Other paragraph, it is assigned Generic Boilerplate specificity per the rules.


reasoning: The paragraph directly answers how third-party cyber risks are managed through vendor oversight, making Third-Party Risk the primary category. It contains no specific facts—only generic descriptions of a vendor management program and periodic reviews—resulting in Generic Boilerplate specificity.


reasoning: The paragraph directly states a conclusion about the material impact of cybersecurity on business strategy and operations, which aligns with Strategy Integration. It contains no specific facts, relying entirely on generic boilerplate language about threats, internal controls, and insurance without verifiable or firm-specific details.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a materiality conclusion (backward and forward-looking), which aligns with Strategy Integration. It contains no specific facts—only a generic assertion and cross-reference—resulting in Generic Boilerplate specificity.


reasoning: The paragraph directly answers how cybersecurity risks affect business outcomes by concluding that no material impacts have been identified, fitting Strategy Integration. It contains no specific facts—only generic assessment language and a negative self-assertion about material incidents—resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes board and audit committee oversight of cybersecurity risk processes, which directly answers how the board oversees cybersecurity (Board Governance). It contains no specific facts, domain expertise, or verifiable details, using only generic oversight language that any company could use, resulting in Generic Boilerplate specificity.


fact: Deputy Chief Executive Officer and Chief Financial Officer manages cybersecurity program

fact: More than seven years of operational responsibility for IT

reasoning: The paragraph primarily answers how management is organized for cybersecurity, detailing specific roles and qualifications, so it is Management Role. It contains a verifiable fact about years of experience, elevating specificity to Quantified-Verifiable.


reasoning: This paragraph directly answers how cybersecurity affects the business by stating a materiality assessment—that threats have not materially impacted and are not reasonably likely to do so—which fits Strategy Integration. It contains no specific facts, domain-adapted terms, or verifiable claims, making it Generic Boilerplate.


reasoning: The paragraph does not discuss cybersecurity; it only describes Mr. Tao's general professional experience in business consultation, operations, and management, with no reference to cybersecurity roles, processes, or risks, so it falls under None/Other. Since no cybersecurity-specific facts are present, the specificity is Generic Boilerplate.


reasoning: The paragraph centers on managing cybersecurity risks from third-party vendors through assessments, directly answering how third-party cyber risks are managed (Third-Party Risk). It contains no specific domain terms beyond generic references to 'cybersecurity risk assessments,' no firm-unique details, and no verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes the Board's oversight structure for cybersecurity, which aligns with Board Governance. It uses generic language with no specific, firm-unique, or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes using a third party to assess cybersecurity risk management processes, which aligns with Risk Management Process as it focuses on program activities. It contains no specific facts such as named entities, verifiable claims, or domain-adapted terms, making it generic boilerplate.


fact: reviewing security questionnaires

fact: imposing contractual obligations related to cybersecurity

reasoning: The paragraph focuses on managing cybersecurity risks from third-party vendors through assessments and contractual obligations, aligning with Third-Party Risk. Specificity is Domain-Adapted as it includes cybersecurity-specific practices like security questionnaires, demonstrating domain expertise.


fact: Chief Information Consultant

reasoning: The paragraph primarily answers how cybersecurity risks are managed and integrated into overall risk management processes, fitting Risk Management Process. It contains the firm-specific role 'Chief Information Consultant,' which elevates specificity to Level 3.


reasoning: The paragraph states a conclusion about whether cybersecurity incidents have materially affected or are likely to affect the business, which directly answers the Strategy Integration question. It contains no specific facts—only generic references to vendors and a negative materiality assertion—making it generic boilerplate.


reasoning: The paragraph describes the company's lack of operations and cybersecurity program as a blank check company, which does not answer any of the substantive cybersecurity questions (e.g., governance, management, processes), so it is classified as None/Other. Specificity is Generic Boilerplate because, as a None/Other paragraph, it defaults to Level 1 with no specific cybersecurity facts.


content_category: Incident Disclosure

fact: December 2021 targeted cyber-attack

fact: March 2024 cybersecurity breach at Canadian subsidiary

fact: approximately two weeks of disruption

fact: restored within one week

reasoning: The paragraph primarily answers 'What happened in a cybersecurity incident?' by detailing two real events with dates, impacts, and responses, fitting Incident Disclosure. It contains verifiable facts such as specific incident dates (December 2021, March 2024) and durations of disruption, making it Quantified-Verifiable.


fact: CISO

reasoning: The paragraph describes board and audit committee oversight of cybersecurity and incident reporting lines, fitting Board Governance. The specific mention of 'CISO' as a cybersecurity leadership role makes it Firm-Specific (Level 3).


fact: The Company uses the Ontrack software solution to monitor and track risk assessment and cybersecurity incidents and remediation tasks.

reasoning: The paragraph describes cybersecurity risk monitoring activities using a specific tool (Ontrack), which falls under Risk Management Process. The named software solution is a verifiable fact, elevating specificity to Level 4.


reasoning: The paragraph primarily answers how third-party cybersecurity risks are managed through consultant engagement and oversight processes, fitting Third-Party Risk. It contains no specific facts, using generic language like 'risk assessment' and 'third parties' that does not demonstrate cybersecurity domain expertise or firm-specific details.


fact: GDPR

reasoning: The paragraph primarily describes the cybersecurity program's activities, such as using specific frameworks and processes to manage risks, fitting Risk Management Process. It includes named cybersecurity and data protection frameworks (ISO 27001, NIST 800-53, GDPR), which demonstrate domain expertise and elevate specificity to Domain-Adapted.


reasoning: The paragraph describes the cybersecurity program's engagement of third-party consultants for risk assessment and incident response activities, which directly answers 'What does the cybersecurity program do?' (RMP). It contains no specific facts, domain-adapted terms, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph directly states a conclusion about the material impact of cybersecurity threats on business strategy, operations, and finances, which aligns with Strategy Integration. It contains no specific facts—only a generic negative assertion that is not externally verifiable—resulting in Generic Boilerplate specificity.


fact: NIST Framework

reasoning: The paragraph primarily answers what the cybersecurity program does by describing its layered governance structure, use of the NIST Framework, and various security tools and policies, making it Risk Management Process. The mention of the NIST Framework is a domain-adapted term that demonstrates cybersecurity expertise, elevating specificity to Level 2.


fact: Senior Vice President – Technology Solutions role (VP-level title with IT portfolio)

fact: Reports directly to President

fact: Over four years in this role

fact: More than 25 years of experience in aggregate

fact: More than ten years with the Company

reasoning: The paragraph focuses on the audit committee's oversight of cybersecurity and management reporting, which is core to Board Governance. Specificity is elevated to Level 4 due to verifiable facts about the Senior VP's tenure and experience durations.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a negative conclusion on material incidents (Strategy Integration). It contains no specific facts—only generic negative assertions and vague references, resulting in Generic Boilerplate specificity.


fact: IT Security Steering Committee

fact: CFO leads the committee

fact: VP of Software Engineering and Director of Information Systems and Security are members

fact: over 40 years of experience collectively

reasoning: The paragraph primarily answers how management is organized for cybersecurity, with details on committee structure and leadership roles. The verifiable claim of 'over 40 years of experience' sets the specificity to Level 4.


fact: cyber intrusions

fact: denial of service attacks

fact: manipulation and other cyber misconduct

fact: unauthorized access, destruction, disclosure, disruption and modification of use

reasoning: The paragraph primarily sets general context about technology reliance and defines Information Security without answering any of the six substantive questions, so it is classified as 'None/Other'. It includes domain-specific cybersecurity terms like 'denial of service attacks', demonstrating expertise and elevating specificity to Domain-Adapted.


reasoning: The paragraph centers on how third-party cyber risks are managed through assessments and contractual obligations, fitting Third-Party Risk. It contains no specific facts—only generic process descriptions without domain-adapted terms, firm-unique details, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: This paragraph is a cross-reference to Item 1A for cybersecurity risk details, so it does not answer any substantive cybersecurity question and is classified as None/Other. It contains no specific facts, only a generic reference, resulting in Generic Boilerplate specificity.


reasoning: The paragraph is a speculative risk factor fragment discussing potential impacts like disruption, costs, and reputation damage without describing any actual cybersecurity governance, processes, or incidents, so it falls under None/Other. It lacks any specific facts, domain-adapted terms, or verifiable claims, resulting in Generic Boilerplate specificity.


fact: Chief Technology Officer

reasoning: The paragraph describes board oversight of cybersecurity through Audit Committee reports and management briefings, fitting Board Governance. The mention of the Chief Technology Officer is a firm-specific role, setting specificity to Level 3.


reasoning: This paragraph is a forward-looking disclaimer and cross-reference to another section, providing no substantive cybersecurity disclosure, hence None/Other. It contains no specific facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a negative assertion about past material incidents and speculating on future risks, which is Strategy Integration. It contains no specific facts beyond generic risk disclosure language, making it Generic Boilerplate.


reasoning: The paragraph describes the cybersecurity incident response process, including escalation to management and reporting to the audit committee, which aligns with Risk Management Process. It lacks any domain-specific terminology, firm-unique details, or verifiable facts, making it generic boilerplate.


reasoning: The paragraph centers on managing cybersecurity risks from third-party service providers through a dedicated program, assessments, and contractual controls, fitting the Third-Party Risk category. All described elements are generic processes without domain-specific expertise, firm-unique details, or verifiable claims, resulting in Level 1 specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a conclusion on materiality (no identified threats that have or are likely to materially affect the business), which aligns with Strategy Integration. It contains no specific facts—only generic boilerplate language and a non-verifiable negative assertion—resulting in Generic Boilerplate specificity.


fact: Time of incident: fourth quarter of fiscal 2025

reasoning: This paragraph describes a specific cybersecurity incident with details on timing, response, and impact, fitting Incident Disclosure. The verifiable fact of the incident occurring in the fourth quarter of fiscal 2025 elevates specificity to Level 4.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating no material incidents have occurred and discussing potential risks, aligning with Strategy Integration. It contains no specific facts beyond a date tied to a non-verifiable negative assertion, resulting in Generic Boilerplate.


reasoning: The paragraph states a backward-looking conclusion about the lack of material cybersecurity impact on business outcomes, which aligns with Strategy Integration. It contains no specific facts, domain expertise, or verifiable claims, making it generic boilerplate.


reasoning: The paragraph is a general statement about cybersecurity risks and their potential material adverse effects without detailing any specific board oversight, management organization, risk management processes, third-party risk management, or actual incidents, so it is classified as None/Other. As a None/Other paragraph, it is assigned Generic Boilerplate specificity per the rules.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating no material impact and describing generic awareness, fitting Strategy Integration. It contains no specific facts, as all statements are negative assertions or vague proactive steps, making it Generic Boilerplate.


reasoning: The paragraph describes the company's cybersecurity program and its activities to assess and manage risks, which directly answers 'What does the cybersecurity program do?' fitting Risk Management Process. It uses generic risk management language without specific domain expertise, firm-unique details, or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph directly answers how third-party cyber risks are managed by describing vendor management processes, but it uses only generic language without any domain-specific terms, firm-unique details, or verifiable facts, resulting in Level 1 specificity.


fact: CCO

fact: the Adviser

reasoning: The paragraph primarily answers how management is organized to handle cybersecurity, detailing roles, qualifications, and information flow, which aligns with Management Role. It contains firm-specific facts like the CCO title and reference to the Adviser, elevating specificity to Level 3.


reasoning: The paragraph describes general procedures for asset identification and risk assessment within the cybersecurity program, directly answering 'What does the cybersecurity program do?' for Risk Management Process. It contains no specific, verifiable, or firm-unique facts, using generic language that lacks domain-adapted detail, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers what the cybersecurity program does by describing risk assessment processes, fitting Risk Management Process. The specificity is Generic Boilerplate as it contains no specific, verifiable, or domain-adapted facts—only generic risk management language that fails the ERM test for cybersecurity expertise.


reasoning: The paragraph primarily answers how the board oversees cybersecurity risks, fitting Board Governance. It contains no specific facts—only generic risk management and governance terms like 'audit committee' without domain expertise or verifiable details, resulting in Generic Boilerplate specificity.


reasoning: The paragraph centers on managing cybersecurity risks from third-party service providers, directly answering how third-party risks are handled, which aligns with the Third-Party Risk category. It contains no specific facts—such as quantified details, firm-specific practices, or domain-adapted terminology beyond generic mentions—making it generic boilerplate.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a conclusion that risks have not materially affected the company, which aligns with Strategy Integration. Specificity is Generic Boilerplate because the paragraph contains no verifiable or firm-specific facts; it relies on generic risk language and a non-verifiable negative assertion about material impact.


reasoning: The paragraph primarily answers 'What does the cybersecurity program do?' by stating the company's focus on identifying and mitigating threats, fitting Risk Management Process. It contains no specific facts beyond generic risk management language, resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes management's responsibility for cybersecurity policies and team qualifications, fitting Management Role. It lacks specific facts like named roles, quantified details, or domain-specific terms, making it generic boilerplate.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating no material incidents have occurred, which is a materiality assessment under Strategy Integration; specificity is Generic Boilerplate as it contains only a cross-reference and a non-verifiable negative assertion with no specific facts.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a conclusion on materiality, which aligns with Strategy Integration. It contains no specific facts, such as verifiable claims or domain expertise, resulting in Generic Boilerplate specificity.


fact: Senior Director - Information Security

fact: over 15 years' experience in the information technology and cybersecurity field

fact: over 15 years' experience in auditing information security

fact: completed a CISO Academy Workshop

fact: BA in math and computer science from Ohio Wesleyan University

fact: holds an Information Systems Auditor certification

reasoning: The paragraph focuses on the qualifications, experience, and credentials of a specific management role, answering how management is organized for cybersecurity, thus fitting Management Role. It contains multiple verifiable facts such as specific years of experience, a degree from a named university, and a certification, elevating specificity to Quantified-Verifiable.


reasoning: This paragraph is a standard forward-looking statements disclaimer that does not address any substantive cybersecurity questions, fitting None/Other. It contains no specific facts about cybersecurity or the company, consisting entirely of generic legal language, hence Generic Boilerplate.


fact: CIO role

fact: CISO role

fact: over 20 years of experience

reasoning: The paragraph describes the governance-chain oversight structure from the Board to management, fitting Board Governance. It contains firm-specific roles (CIO, CISO) and a verifiable claim of over 20 years of experience, setting specificity at Level 4.


reasoning: The paragraph primarily answers what the cybersecurity program does by describing risk assessment, safeguard implementation, monitoring, testing, and training activities, aligning with Risk Management Process. It lacks any specific facts, domain-adapted terms, firm-specific details, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a conclusion that no risks have materially affected or are reasonably likely to materially affect business strategy, results, or financial condition, which aligns with Strategy Integration. It contains no specific facts such as domain expertise, firm-specific details, or verifiable claims; it uses only generic language and unverifiable negative assertions, resulting in Generic Boilerplate specificity.


reasoning: The paragraph directly answers how third-party cyber risks are managed through a dedicated program, fitting Third-Party Risk. It contains no specific facts, using only generic language about vendor risk assessments, controls, and compliance monitoring, which does not demonstrate domain expertise or provide verifiable details.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating materiality assessments (e.g., no material impact to date and forward-looking risks), which fits Strategy Integration. It contains no specific facts, domain-adapted terms, or verifiable claims, consisting entirely of generic boilerplate language and cross-references.


reasoning: The paragraph primarily describes external regulatory requirements and cross-references another section, not the company's own cybersecurity practices, so it is classified as None/Other. As a None/Other paragraph, it is assigned Generic Boilerplate specificity by default.


reasoning: The paragraph primarily answers how cybersecurity affects the business by concluding that past incidents had no material impact, which aligns with Strategy Integration. It contains no specific facts that demonstrate domain expertise, firm-specific details, or verifiable claims, relying instead on generic statements and negative assertions, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily describes external regulatory requirements and cross-references another section, answering no substantive cybersecurity question about the company's internal practices, so it is classified as None/Other. As a N/O paragraph, it contains no specific facts about the company's cybersecurity posture, resulting in Generic Boilerplate specificity.


reasoning: The paragraph focuses on the Board's oversight responsibilities for cybersecurity risks, which aligns with Board Governance. It contains no specific facts—only generic statements about awareness and oversight—resulting in Generic Boilerplate specificity.


reasoning: The paragraph states a materiality conclusion about cybersecurity risks (not materially affected and not reasonably likely to be), which directly answers how cybersecurity affects the business, fitting Strategy Integration. It contains no specific facts—only generic risk language and a cross-reference—resulting in Generic Boilerplate specificity.


fact: In August 2020, we discovered ransomware on a server

reasoning: The paragraph primarily describes a past cybersecurity incident (ransomware discovery in August 2020), fitting 'Incident Disclosure'. The specific date 'August 2020' is a verifiable hard fact, setting specificity to Level 4.


reasoning: The paragraph centers on managing cybersecurity risks from third-party service providers through process implementation and contract reviews, directly answering how third-party cyber risks are managed, which defines the Third-Party Risk category. It lacks any specific, verifiable, or firm-unique details, using generic language that does not demonstrate cybersecurity expertise or provide quantifiable facts, resulting in Generic Boilerplate specificity.


fact: January 18, 2023 ransomware attack announcement

fact: closure of fewer than 300 restaurants

fact: data breach involving personal information of employees

reasoning: This paragraph primarily answers what happened in a cybersecurity incident by describing a specific ransomware attack on January 18, 2023, with verifiable details such as the date and number of restaurants affected, making it Incident Disclosure at Quantified-Verifiable specificity.


fact: Vaidyanathan Raghavan is the CTO

fact: He previously served as General Manager of Technology at Wayfair

fact: He holds a Master of Science in Electrical Engineering from the University of Minnesota

fact: Brendan Hamilton is the Vice President of Information Technology and Security

fact: He previously worked as a Vice President at an international bank with supervisory responsibility for cybersecurity issues

fact: He is a Certified Information Systems Security Professional (CISSP)

reasoning: The paragraph primarily answers how management is organized for cybersecurity by detailing specific executives' roles and qualifications, fitting Management Role. It contains verifiable facts such as educational degrees and professional certifications, elevating specificity to Quantified-Verifiable.


reasoning: The paragraph is a general risk disclaimer that cross-references Item 1A for material impact details, providing no substantive cybersecurity disclosure, so it falls under None/Other. It contains no specific facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how the board oversees cybersecurity through the Audit Committee's oversight structure and reporting lines, making it Board Governance. It contains only generic roles and responsibilities without domain-specific terminology, firm-unique details, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph is a cross-reference to another section and a generic forward-looking statement about potential material impact, with no substantive cybersecurity content, making it None/Other. It contains no specific facts, so specificity is Generic Boilerplate.


reasoning: The paragraph describes cybersecurity program activities like incident response planning and employee training, which aligns with Risk Management Process. It contains only generic descriptions without any specific, verifiable, or firm-unique facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes general cybersecurity threats and system dependencies without answering any of the substantive questions about governance, management roles, risk processes, third-party risk, incidents, or strategy integration, making it None/Other. As a None/Other paragraph, it is assigned Generic Boilerplate specificity per the override rule.


fact: regularly scanning our environment for vulnerabilities

fact: performing penetration testing

fact: engaging third parties to assess the effectiveness of our technical cybersecurity practices

reasoning: The paragraph describes the cybersecurity program's activities, such as vulnerability scanning and penetration testing, which directly answers what the program does, fitting Risk Management Process. The specificity is Domain-Adapted because it includes cybersecurity-specific practices that demonstrate domain expertise, but lacks firm-specific or verifiable details.


reasoning: The paragraph describes communication of material cybersecurity matters to the Audit Committee for oversight, which directly answers how the board oversees cybersecurity (Board Governance). It contains no specific facts, using generic terms like 'senior management' and 'Audit Committee', so it is Generic Boilerplate.


reasoning: The paragraph is speculative about potential cybersecurity risks and impacts (e.g., 'could materially and adversely affect') without describing any substantive governance, management processes, or actual incidents, fitting None/Other. It contains no specific facts—all language is generic boilerplate applicable to any company—so specificity is Level 1.


reasoning: The paragraph focuses on board and committee oversight of cybersecurity risks, which is core to Board Governance. It uses generic oversight language without any specific facts, domain expertise, or verifiable claims, resulting in Generic Boilerplate specificity.


fact: Company's CCO

fact: dedicated monitoring platform that provides real time threat detection and mitigation

reasoning: The paragraph primarily describes management's responsibilities and the cybersecurity processes in place, such as third-party resources and monitoring, aligning with Risk Management Process. It contains a firm-specific fact (CCO role) and domain-adapted terms (real-time threat detection platform), elevating specificity to Level 3.


fact: third-party risk monitoring security rating services

reasoning: The paragraph directly addresses how third-party cyber risks are managed through methods like diligence and security rating services, fitting Third-Party Risk. The term 'security rating services' demonstrates cybersecurity domain expertise, elevating specificity to Level 2.


reasoning: The paragraph states a conclusion about the material impact of cybersecurity incidents (none occurred), which aligns with Strategy Integration. It contains no specific facts—only a generic negative assertion and reporting period context—resulting in Generic Boilerplate specificity.


reasoning: The paragraph centers on managing cybersecurity risks from third parties by relying on the Adviser's personnel, fitting Third-Party Risk. Specificity is Generic Boilerplate as it lacks any domain-adapted, firm-specific, or verifiable facts, using only generic business language.


reasoning: This paragraph is a cross-reference to Item 1A for cybersecurity risks, providing no substantive disclosure, so it falls under None/Other. It contains no specific facts, making it Generic Boilerplate.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a backward-looking materiality assessment (no material effects), which is characteristic of Strategy Integration. It contains no specific facts, domain terms, or verifiable claims, making it generic boilerplate.


reasoning: The paragraph describes the audit committee's oversight structure for cybersecurity, answering how the board oversees cybersecurity, which fits Board Governance. It contains no specific facts—only generic roles and activities—so specificity is Generic Boilerplate.


reasoning: The paragraph describes oversight and promotion responsibilities, which are typical management functions in cybersecurity governance, aligning with the Management Role category. It contains no specific facts, domain-adapted terms, firm-specific details, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph directly answers how cybersecurity affects the business by stating a materiality conclusion (no known risks reasonably likely to materially affect), which is a Strategy Integration assessment. It contains no specific facts about cybersecurity roles, processes, or verifiable claims, only generic materiality language and a cross-reference, so specificity is Generic Boilerplate.


fact: Fortra, LLC (named third-party vendor)

fact: GoAnywhere managed file transfer as a service system (MFTaaS) (named system)

fact: zero-day vulnerability (specific vulnerability type)

fact: protected health information (PHI) and personally identifiable information (PII) (data types)

fact: Health Insurance Portability and Accountability Act (HIPAA) (referenced standard)

reasoning: The paragraph describes a real cybersecurity incident involving a third-party vendor, including details on nature, scope, and response, so it is Incident Disclosure. It contains verifiable facts like the named vendor Fortra, LLC and the GoAnywhere system, which are externally confirmable, setting specificity at Level 4.


fact: Chief Risk Officer designated as Chief Privacy Officer

fact: Chief Privacy Officer coordinates with Chief Information Security Officer

fact: Chief Privacy Officer reports to Board's Risk Oversight Committee

fact: Chief Information Security Officer responsible for day-to-day management of Information Security Program and Security Incident Response Policy

fact: Chief Privacy Officer has over 13 years of experience as CFO

fact: Chief Information Security Officer has over 20 years of work experience in cybersecurity at financial institutions

reasoning: The paragraph primarily answers how management is organized for cybersecurity, detailing roles and responsibilities, so it is Management Role. Specificity is Quantified-Verifiable because it includes verifiable claims about years of experience (over 13 years and over 20 years).


reasoning: The paragraph primarily describes how management informs the board and the board's oversight activities, fitting Board Governance. It lacks domain-specific terminology, firm-unique details, or verifiable facts, making it generic boilerplate.


fact: June 2024

fact: CDK (third-party provider)

reasoning: The paragraph primarily answers 'What happened in a cybersecurity incident?' by describing a specific event involving CDK in June 2024, including its impact and response, which fits Incident Disclosure. It contains verifiable facts such as the exact date and named third-party, elevating specificity to Quantified-Verifiable.


fact: In December 2022 (specific, verifiable date of incident)

fact: personal data of employees had been extracted (firm-specific incident detail)

fact: cybersecurity threat (domain term)

fact: containment protocols (domain term)

fact: engaging third-party information technology cyber security and forensics experts (domain term)

reasoning: This paragraph primarily describes a specific cybersecurity incident, including its timeline, nature, and response, so it is classified as Incident Disclosure. The mention of 'December 2022' provides a verifiable date, which elevates specificity to Level 4.


reasoning: The paragraph directly addresses how third-party cyber risks are managed through due diligence and contractual requirements, aligning with the Third-Party Risk category. It contains no specific facts, domain expertise, or verifiable claims, rendering it generic boilerplate.


reasoning: The paragraph provides a general description of cybersecurity risks and operational dependencies without answering any of the six substantive questions (e.g., board oversight, management roles, specific processes), so it is classified as None/Other. As a None/Other paragraph, it is assigned Generic Boilerplate specificity per the rules.


fact: phishing attacks

fact: malware infections

fact: unauthorized access attempts

reasoning: The paragraph primarily answers how cybersecurity affects the business by assessing that past attempts were not material and acknowledging future risks, aligning with Strategy Integration. It contains domain-specific terms like 'phishing attacks' and 'malware infections,' which demonstrate cybersecurity expertise at the Domain-Adapted level.


reasoning: This paragraph is a cross-reference to risk factors and does not provide substantive cybersecurity disclosure, so it is classified as None/Other. It contains no specific facts, making it Generic Boilerplate.


reasoning: The paragraph states a conclusion that cybersecurity threats have not materially affected the company, which directly answers how cybersecurity impacts business outcomes, fitting Strategy Integration. It contains no specific facts, domain terms, or verifiable claims, making it Generic Boilerplate.


fact: information security and data privacy training

fact: phishing attempt

fact: phishing security test

reasoning: The paragraph primarily answers what the cybersecurity program does by describing employee training and phishing simulations, fitting Risk Management Process. It uses domain-specific terms like 'phishing attempt' and 'information security training,' demonstrating cybersecurity expertise but lacks firm-specific or verifiable facts.


reasoning: The paragraph centers on managing third-party cyber risks via oversight processes like due diligence and monitoring, but it lacks any specific facts, using generic risk management language without domain expertise or verifiable details.


reasoning: The paragraph directly answers how third-party cyber risks are managed through assessments and contracting processes, fitting the Third-Party Risk category. Specificity is Level 1 because the language is generic, with no firm-specific details, verifiable claims, or domain terms that demonstrate cybersecurity expertise beyond standard risk management.


specificity_confidence: medium

reasoning: The paragraph primarily describes how the board and committees oversee cybersecurity risk management, fitting Board Governance. The mention of 'management's Technology Steering Committee' is a firm-specific named committee, elevating specificity to Firm-Specific.


fact: IT Lead has 5 years of experience in roles that include oversight of cybersecurity risk management programs

reasoning: The paragraph focuses on management organization for cybersecurity, detailing the IT Lead's role and experience, which answers the 'How is management organized?' question. The specific, verifiable fact of '5 years of experience' elevates specificity to Level 4.


fact: cybersecurity assessors

fact: threat assessments

fact: proactive detection tools

reasoning: The paragraph primarily describes cybersecurity risk management activities, including engaging external experts and using technology solutions, which aligns with Risk Management Process. Specificity is Level 2 because it contains domain-adapted terms like 'threat assessments' and 'proactive detection tools' that demonstrate cybersecurity expertise beyond generic boilerplate.


reasoning: The paragraph primarily explains the absence of a cybersecurity program due to the company's status as a SPAC with no operations, fitting None/Other as it lacks substantive cybersecurity disclosure. Specificity is Generic Boilerplate because no cybersecurity-specific facts, domain terms, or verifiable claims are present.


fact: CISO role

fact: Reports to CIO

fact: Works with Chief Legal Officer

fact: Over 30 years of experience in cybersecurity and intelligence

fact: Experience with Department of Defense, defense contracting, and publicly traded companies

fact: CIO Program Certificate from College of Information and Cyberspace, National Defense University

fact: CISSP designation

fact: CIPP designation

reasoning: The paragraph primarily answers how management is organized for cybersecurity by detailing the CISO's role, reporting lines, and qualifications, fitting Management Role. Specificity is Level 4 due to verifiable facts such as the CISO's over 30 years of experience and specific certifications like CISSP and CIPP.


reasoning: The paragraph describes generic IT systems and data collection without addressing cybersecurity governance, risk management, or incidents, fitting None/Other. It contains no cybersecurity-specific or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: This paragraph is a cross-reference to Item 1A for cybersecurity risks, providing no substantive disclosure, and contains no specific facts, making it generic boilerplate.


fact: April 28, 2023 (specific incident detection date)

fact: $54,300 (specific monetary amount involved)

fact: June 29, 2023 (specific fund recovery date)

reasoning: The paragraph directly describes a specific cybersecurity incident with timeline, impact, and response, fitting Incident Disclosure. It contains verifiable facts including specific dates and a monetary amount, elevating specificity to Quantified-Verifiable.


reasoning: The paragraph directly answers how third-party cyber risks are managed by describing assessment and monitoring practices, but it contains no specific facts such as named standards, tools, or verifiable claims, making it generic boilerplate.


reasoning: The paragraph primarily describes how management is organized to handle cybersecurity, listing roles and responsibilities, which aligns with the Management Role category. It contains no specific facts, domain-adapted terms, or verifiable claims, making it generic boilerplate.


fact: SOC type reports

reasoning: The paragraph describes the cybersecurity program's activities, such as using industry standards, internal audits, and requiring SOC reports from service providers, which aligns with Risk Management Process. The mention of 'SOC type reports' demonstrates cybersecurity domain expertise, elevating specificity to Domain-Adapted.


reasoning: The paragraph discloses that as a blank check company with no operations, there are no material cybersecurity threats, which lacks substantive cybersecurity disclosure and falls under None/Other. Specificity is Generic Boilerplate because no cybersecurity-specific facts are present; it is a generic statement about the company's status.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a materiality assessment (have not materially affected and are not reasonably likely to materially affect), which aligns with Strategy Integration. It contains no specific facts, using only generic cross-references and a non-verifiable negative assertion, resulting in Generic Boilerplate.


fact: Mr. Lee

reasoning: This paragraph answers how the board oversees cybersecurity by describing updates to the Board and Audit Committee, fitting Board Governance. It contains a named individual ('Mr. Lee'), which is a firm-specific fact, setting specificity to Level 3.


reasoning: The paragraph describes general processes for identifying, assessing, and managing cybersecurity risks, which aligns with Risk Management Process. It lacks specific domain expertise, firm-unique details, or verifiable claims, making it generic boilerplate.


reasoning: The paragraph directly answers how third-party cyber risks are managed through assessments and monitoring, fitting Third-Party Risk. It contains only generic process descriptions without specific, verifiable, or domain-adapted facts, resulting in Generic Boilerplate.


reasoning: The paragraph states a conclusion about the material effect of cybersecurity incidents on business outcomes (Strategy Integration), but contains no specific facts, only generic risk language and a non-verifiable negative assertion, resulting in Generic Boilerplate specificity.


reasoning: The paragraph focuses on the Audit Committee's oversight activities (periodic discussions and annual review), which directly answers how the board oversees cybersecurity, fitting Board Governance. It contains no specific facts—terms like 'Audit Committee,' 'periodic discussions,' and 'annual review' are generic and lack domain expertise, firm-specific details, or verifiable claims, resulting in Level 1 specificity.


reasoning: The paragraph directly addresses how third-party cyber risks are managed through due diligence and monitoring, fitting Third-Party Risk. It lacks any specific facts, domain-adapted terms that demonstrate cybersecurity expertise, or verifiable claims, making it Generic Boilerplate.


fact: Senior Director, Information Protection & Compliance

fact: CIO

fact: management committee on cybersecurity

reasoning: This paragraph describes the oversight structure where management briefs the board and committees on cybersecurity risks, aligning with Board Governance. Specificity is Firm-Specific due to the inclusion of specific roles (Senior Director, CIO) and a named management committee on cybersecurity.


reasoning: This paragraph is a general acknowledgment of cybersecurity risks without describing any specific governance, management roles, risk processes, third-party oversight, incidents, or strategy integration, so it falls under None/Other. It contains no domain-adapted terms, firm-specific facts, or verifiable claims, making it Generic Boilerplate.


fact: CSIRPs (Cybersecurity Incident Response Plans)

fact: detection, analysis, containment, eradication, recovery, post-incident review

reasoning: The paragraph primarily answers what the cybersecurity program does by detailing the incident response plans, which falls under Risk Management Process. It uses domain-specific terminology like 'CSIRPs' and lists cybersecurity incident response phases, demonstrating expertise beyond generic risk management language.


reasoning: The paragraph primarily states a conclusion about the material impact of cybersecurity risks on business strategy and operations, aligning with Strategy Integration. It contains no specific, verifiable facts; all statements are generic plans or negative assertions, resulting in Generic Boilerplate specificity.


reasoning: This paragraph solely defines 'cybersecurity threat' in a generic manner, not answering any substantive questions about the company's cybersecurity practices, and it contains no specific facts, firm-unique details, or verifiable claims, making it generic boilerplate.


reasoning: The paragraph directly addresses how third-party cybersecurity risks are managed, making Third-Party Risk the central topic. It contains no specific facts, tools, or verifiable details, relying on generic risk management language.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating no material impact or incidents, which is a materiality assessment fitting Strategy Integration. It contains no specific facts—only generic negative assertions—resulting in Generic Boilerplate specificity.


fact: CISSP certification

fact: CISM certification

fact: CISA certification

reasoning: The paragraph primarily answers how management is organized to handle cybersecurity, describing responsibilities and qualifications, which aligns with Management Role. Specificity is Level 4 because it includes verifiable certifications (CISSP, CISM, CISA) that can be externally confirmed.


fact: CFO and CCO roles with cybersecurity oversight responsibilities

fact: CFO has been responsible for oversight function for three years

fact: CFO has more than 30 years of experience in financial services

fact: CCO has been responsible for oversight functions for three years

fact: Current CCO has been serving since April 2025

fact: CCO has more than 35 years of experience in financial services

reasoning: The paragraph primarily describes management's organizational roles and qualifications in cybersecurity, fitting Management Role, and contains multiple verifiable facts such as specific tenures (three years), experience durations (more than 30/35 years), and a start date (April 2025), making it Quantified-Verifiable.


reasoning: The paragraph is a generic statement about data collection and storage that does not address any cybersecurity-specific question (e.g., governance, management, risk processes), so it is classified as None/Other. It contains no specific facts, domain terms, firm-specific details, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how the board oversees cybersecurity through the Audit Committee's reporting and annual board reviews, fitting Board Governance. It contains no specific facts, using generic governance language without domain expertise, firm-specific details, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes board-level oversight of cybersecurity risks via the Audit Committee and CFO updates, which aligns with Board Governance. It contains only generic governance language with no domain-specific terms, firm-specific details, or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: This paragraph falls under 'None/Other' as it explains the lack of cybersecurity measures due to the company's status as a SPAC with no operations, providing no substantive cybersecurity disclosure. Specificity is Generic Boilerplate because all statements are generic or negative assertions without any specific, verifiable, or domain-adapted facts.


reasoning: The paragraph describes the general reliance on IT systems and data processing for business operations but does not answer any specific cybersecurity governance, management, or process questions, fitting 'None/Other'. It contains no specific facts, relying on generic language about IT infrastructure and data handling, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by concluding that no material incidents have occurred, which is a materiality assessment under Strategy Integration. It contains no specific facts—only generic language and a non-verifiable negative assertion—resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how management is organized for cybersecurity, describing roles (CEO, MIS consultant, MIS supervisor) and their responsibilities. It contains no firm-specific or verifiable facts, using only generic titles and activities, resulting in Level 1 specificity.


reasoning: The paragraph centers on the use of third-party consultants and external service providers for cybersecurity oversight, making Third-Party Risk the primary category. It contains only generic descriptions with no specific domain terms, firm-specific details, or verifiable facts, resulting in Level 1 specificity.


fact: DSCP (named internal program for cybersecurity incident procedures)

fact: Form 8-K filed on February 29, 2024 (specific, verifiable date and filing reference)

fact: MOVEit Cybersecurity Incident exposure affecting approximately 2.5 million to 2.7 million policyholders or customers (quantified range)

fact: Exposure of social security numbers (specific data type)

reasoning: The paragraph primarily describes the MOVEit cybersecurity incident, including its investigation, scope, and impact, which aligns with Incident Disclosure. It contains verifiable facts such as the specific Form 8-K filing date and the quantified number of affected individuals, elevating specificity to Quantified-Verifiable.


reasoning: The paragraph is a generic statement about the importance of cybersecurity without detailing any specific governance, roles, processes, third-party risks, incidents, or business impacts, so it falls under None/Other. It contains no specific facts, domain expertise, firm-specific details, or verifiable claims, making it Generic Boilerplate.


fact: 26 BTC transferred

fact: value of approximately $560,000

fact: Sphere 3D Corp. named

fact: Gryphon engaged with US Federal law enforcement

reasoning: This paragraph describes a specific cybersecurity incident involving impersonation and cryptocurrency theft, directly answering 'What happened?' and thus classifying as Incident Disclosure. It contains verifiable facts such as the exact year (2023), number of BTC stolen (26), and dollar value ($560,000), making it Quantified-Verifiable.


reasoning: The paragraph directly answers how third-party cyber risks are managed through a vendor management program with enhanced scrutiny for sensitive data, fitting Third-Party Risk. It contains only generic statements like 'risk-based approach' and 'identifying and overseeing cybersecurity risks' without specific practices, tools, or verifiable details, resulting in Generic Boilerplate.


reasoning: The paragraph is a general statement about cybersecurity threats and resource expenditure that does not substantively address board governance, management roles, risk management processes, third-party risk, incident disclosure, or strategy integration, making it None/Other. As a None/Other paragraph, it is assigned Generic Boilerplate with no specific facts elevating specificity.


reasoning: The paragraph primarily answers whether cybersecurity has materially affected the business by stating that no material incidents occurred in fiscal year 2025, which is a materiality assessment fitting Strategy Integration. It contains no specific facts about cybersecurity processes, roles, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily states the company's lack of internal cybersecurity personnel/processes and generic board oversight without describing any substantive cybersecurity measures, fitting 'None/Other'. Specificity is Generic Boilerplate as per the rule for such paragraphs.


reasoning: The paragraph primarily answers how third-party cyber risks are managed by describing a process to assess vendors' data protection practices, fitting Third-Party Risk. It contains no specific facts—only generic language about having a formal process—resulting in Generic Boilerplate specificity.


reasoning: This paragraph primarily answers how management is organized to handle cybersecurity, focusing on responsibilities and oversight structure, which fits the Management Role category. It contains no specific facts—only generic risk management language—resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily discloses hypothetical cybersecurity risks and their potential business impacts without describing any specific governance, management processes, or actual incidents, fitting None/Other. It contains only generic risk language with no domain-adapted, firm-specific, or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating no incidents have occurred and describing potential impacts, fitting Strategy Integration. It contains no specific facts—only generic risk language and a non-verifiable negative assertion—resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how the board oversees cybersecurity by describing delegation to the Audit Committee, fitting Board Governance. It contains no specific facts—only generic oversight language without domain expertise, firm-specific details, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily addresses the potential material adverse consequences of cybersecurity risks and asserts no past incidents, which relates to how cybersecurity affects the business (Strategy Integration). It contains no specific, verifiable facts; all statements are vague or negative assertions that are not externally verifiable, resulting in Generic Boilerplate specificity.


fact: confidentiality, integrity, and availability

reasoning: The paragraph primarily answers what the cybersecurity program does by describing risk management and strategy as part of an information security program, fitting Risk Management Process. The reference to the CIA triad (confidentiality, integrity, availability) demonstrates cybersecurity domain expertise, elevating specificity to Level 2.


fact: Chief Information Officer (CIO)

fact: more than 20 years of experience

reasoning: This paragraph focuses on the CIO's responsibility and qualifications, answering how management is organized for cybersecurity, thus classified as Management Role. The specificity is Quantified-Verifiable because it includes the verifiable claim of over 20 years of experience.


reasoning: The paragraph primarily answers 'What does the cybersecurity program do?' by describing integration into ERM and program components, fitting Risk Management Process. It contains no specific facts beyond generic process descriptions, with terms like 'assessments' and 'security controls' failing the ERM test for domain expertise, resulting in Generic Boilerplate specificity.


fact: Incident detected in May 2025

reasoning: This paragraph directly answers 'What happened in a cybersecurity incident?' by detailing a real event in May 2025, so it is Incident Disclosure. The specificity is Quantified-Verifiable because the date 'May 2025' is a hard, verifiable fact that an external party could confirm.


reasoning: The paragraph primarily answers how third-party cyber risks are managed by discussing dependency on IT service providers, vendor management processes, and obtaining reports on cybersecurity issues, fitting Third-Party Risk. It contains no specific, verifiable, or firm-unique facts, using generic risk language that lacks cybersecurity domain expertise or concrete details, resulting in Generic Boilerplate specificity.


fact: SOC reports

reasoning: The paragraph primarily answers how third-party cyber risks are managed through assessments and monitoring, with 'SOC reports' demonstrating cybersecurity domain expertise, but no firm-specific or verifiable facts are present.


fact: Security assessments

reasoning: The paragraph primarily addresses how third-party cyber risks are managed through oversight of vendors and customers, making Third-Party Risk the central topic. It includes the domain term 'security assessments,' which demonstrates cybersecurity expertise by referencing a specific practice, elevating specificity to Level 2.


reasoning: The paragraph describes periodic oversight meetings by management and the board to assess cybersecurity status, aligning with Board Governance. It contains no specific facts, domain terms, or verifiable details, making it generic boilerplate.


fact: IASME Cyber Essentials framework

fact: Approved by UK government Cyber Security NCSC

fact: ISO 27001 framework

fact: NIST framework

reasoning: The paragraph primarily describes the company's cybersecurity program activities, such as annual assessments and policy implementation based on specific frameworks, which aligns with Risk Management Process. It contains a verifiable claim that the IASME Cyber Essentials framework is approved by the UK NCSC, elevating specificity to Level 4.


fact: CISO role

fact: Specialization in safeguarding healthcare data across health technology companies

reasoning: The paragraph directly answers how management is organized for cybersecurity by detailing the CISO's responsibilities and qualifications, fitting Management Role. It contains firm-specific facts such as the CISO position and industry-specific expertise, but lacks quantified-verifiable claims, resulting in Firm-Specific specificity.


fact: third-party assessments of vendor's information security practices and protocols

fact: readiness to protect against and respond to cybersecurity breaches

fact: vendor due diligence questionnaires seeking cyber and information security control environment

fact: resiliency in the event of an intrusion

fact: formalized vendor incident response procedures for cyber events

reasoning: The paragraph centers on managing third-party cyber risks through vendor assessments, categorization, and incident response procedures, fitting the Third-Party Risk category. It uses cybersecurity domain terms like 'information security protocols' and 'intrusion', demonstrating expertise, but lacks firm-specific or verifiable details, so specificity is Domain-Adapted.


fact: December 18, 2023 (effective date of SEC cybersecurity disclosure rules)

reasoning: The paragraph primarily outlines regulatory requirements and cross-references another section without describing the company's own cybersecurity practices, fitting 'None/Other'. It includes a verifiable date for the SEC rule effective date, elevating specificity to Level 4.


fact: In February and April 2025, Microsoft notified the Company about unauthorized activity within our Azure environment by a suspected nation-state threat actor.

fact: The Company activated its incident response plan.

fact: The Company issued security advisories.

fact: The Company implemented advanced security measures including enhanced rotation of credentials and strengthened security monitoring.

reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a materiality conclusion (no material impacts to date), which aligns with Strategy Integration; specificity is driven by a verifiable incident with specific dates and details (Microsoft notification in February/April 2025).


reasoning: The paragraph directly addresses how third-party cyber risks are managed through vendor evaluation and SOC report requests, making it Third-Party Risk. The reference to 'System and Organization Controls reports' demonstrates cybersecurity domain expertise, elevating specificity to Domain-Adapted.


reasoning: This paragraph is a cross-reference to risk factors in Item 1A, providing no substantive cybersecurity disclosure, so it is classified as None/Other. It contains no specific facts about cybersecurity measures, governance, or incidents, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a backward-looking materiality assessment (no material incidents to date), which fits Strategy Integration. It contains no specific facts beyond generic risk disclosures and a non-verifiable negative assertion, resulting in Generic Boilerplate specificity.


reasoning: The paragraph is a generic statement of commitment and definition of cybersecurity threats without describing any specific governance, processes, or incidents, so it falls under None/Other. It contains no specific facts, making it Generic Boilerplate.


fact: Members of the CCDC

reasoning: The paragraph centers on the Vendor Management Program for overseeing cybersecurity risks in vendor relationships, directly addressing third-party risk management. Specificity is driven by the firm-specific reference to 'CCDC,' a named committee, which distinguishes the company's governance structure.


reasoning: The paragraph directly answers how cybersecurity affects the business by stating a materiality conclusion (no material impact identified), which aligns with Strategy Integration. It contains no specific facts, domain expertise, or verifiable claims—only generic statements and cross-references—resulting in Generic Boilerplate specificity.


fact: 24/7 SIEM/SOC monitoring

reasoning: The paragraph concludes with a materiality assessment that the incident did not have a material impact, directly answering how cybersecurity affects business outcomes, which aligns with Strategy Integration. Specificity is Firm-Specific because the claim of '24/7 SIEM/SOC monitoring' is a specific organizational detail that distinguishes the company's cybersecurity posture.


reasoning: The paragraph primarily answers what the cybersecurity program does by describing the use of third-party partners and consultants as part of the risk management strategy, aligning with RMP. It contains no specific facts, domain-adapted terms, firm-specific details, or verifiable claims, making it generic boilerplate.


reasoning: The paragraph states that the company has no cybersecurity personnel or processes and relies entirely on third parties, which does not describe any substantive cybersecurity measure, process, or assessment, fitting the None/Other category for SPACs with no program. As a None/Other paragraph, it is assigned Generic Boilerplate specificity with no specific facts.


fact: 24x7 Security Operations Center (SOC)

fact: Security Information and Event Management (SIEM) systems

reasoning: The paragraph describes specific cybersecurity activities (SOC and SIEM for monitoring and response), answering 'What does the cybersecurity program do?' and thus fits Risk Management Process; it uses domain-specific terms like SOC and SIEM that demonstrate cybersecurity expertise, but lacks firm-specific or verifiable facts, placing it at Domain-Adapted level.


reasoning: The paragraph describes board-level oversight of cybersecurity, delegating responsibility to the Audit Committee, which is standard governance language. It contains no specific facts, domain expertise, firm-specific details, or verifiable claims, making it generic boilerplate.


fact: Cybersecurity Risk Assessment

fact: Vendor Management Risk Assessment

fact: Quarterly Internal Vulnerability Reports

fact: current Cyber Events briefings

reasoning: The paragraph focuses on how the board oversees cybersecurity through the Risk Management Committee, making it Board Governance. The specificity is Domain-Adapted because it includes cybersecurity-specific report types like 'Cybersecurity Risk Assessment' and 'Internal Vulnerability Reports', which demonstrate domain expertise beyond generic risk management language.


fact: penetration testing

fact: vulnerability scanning

reasoning: The paragraph primarily describes cybersecurity program activities such as training, penetration testing, vulnerability scanning, and remediation, fitting Risk Management Process. Specificity is Domain-Adapted due to the use of cybersecurity-specific terms like 'penetration testing' and 'vulnerability scanning' that demonstrate domain expertise.


fact: monitoring and rating services

fact: posture and intelligence reviews

reasoning: The paragraph centers on managing cybersecurity risks for third-party vendors through specific programs and assessments, directly answering how third-party risks are handled, so it is classified as Third-Party Risk. It includes domain-specific terms like 'open-source intelligence risk assessments' and 'posture and intelligence reviews,' which demonstrate cybersecurity expertise, elevating specificity to Level 2.


reasoning: The paragraph discusses cyber risk insurance as a financial risk mitigation strategy, answering how cybersecurity affects the business financially (Strategy Integration). It contains no specific or verifiable facts, such as coverage amounts or policy details, making it generic boilerplate.


reasoning: The paragraph primarily describes the oversight chain from cybersecurity monitoring to board briefings, answering how the board oversees cybersecurity, which aligns with Board Governance. It contains no specific facts beyond generic oversight language, such as 'continuous monitoring' and 'quarterly briefings,' which do not demonstrate domain expertise or firm-specific details, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how the board oversees cybersecurity through delegation to the Audit Committee and receiving reports, fitting Board Governance. It contains no specific facts—only generic oversight language—making it Generic Boilerplate.


reasoning: The paragraph states conclusions about the materiality of cybersecurity risks and incidents, directly answering how cybersecurity affects the business, which aligns with Strategy Integration. It contains no specific facts, domain terms, or verifiable claims, as the negative assertions and materiality assessments are generic and not externally verifiable, resulting in Generic Boilerplate specificity.


fact: April 9, 2024, 10:25 p.m. local Hong Kong SAR time

fact: Chief Information Security Officer

reasoning: The paragraph details a real cybersecurity incident with specific timeline, financial impact, and response actions, fitting Incident Disclosure. It contains verifiable facts like exact dates and a dollar amount, achieving Quantified-Verifiable specificity.


reasoning: This paragraph is a generic statement about technology dependency without describing any cybersecurity governance, processes, or incidents, so it falls under None/Other. It contains no specific facts, domain-adapted terms, firm-specific details, or verifiable claims, making it Generic Boilerplate.


reasoning: The paragraph centers on managing third-party cybersecurity risks, aligning with Third-Party Risk. It uses generic language like 'manage third-party risks' and 'developing a vendor risk management program' without any domain-specific details, firm-specific facts, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: This paragraph is a forward-looking disclaimer speculating on potential cybersecurity incidents and their impacts, which is common boilerplate and does not substantively address governance, processes, or actual events. No specific facts are present, as the language is generic and non-verifiable.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a materiality assessment (Strategy Integration). It contains no specific facts about the company's cybersecurity program, relying on generic risk language and a non-verifiable negative assertion, resulting in Generic Boilerplate specificity.


reasoning: The paragraph is a general introductory statement about the company's commitment to a secure trading environment without addressing any specific cybersecurity governance, management, processes, or incidents, so it falls under None/Other. It contains no specific facts about cybersecurity practices, roles, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: This paragraph is a cross-reference to Item 1A Risk Factors and does not provide substantive cybersecurity disclosure, making it None/Other. It contains no specific facts, so specificity is Generic Boilerplate.


reasoning: The paragraph describes the lack of a cybersecurity program and any incidents, which does not answer any substantive cybersecurity question, fitting None/Other. It contains no specific facts about cybersecurity measures, processes, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph directly answers how third-party cyber risks are managed by describing contractual requirements for vendors, fitting Third-Party Risk. It contains no specific facts, domain-adapted terms, firm-specific details, or verifiable claims, making it generic boilerplate.


fact: CISO role (firm-specific title)

fact: Joined Workday in 2010 (specific year)

fact: Served as CISO since April 2018 (specific date)

fact: More than 15 years of experience (verifiable lower bound)

fact: Degree in information systems management (verifiable claim)

reasoning: The paragraph primarily describes the CISO's responsibilities, tenure, and qualifications, fitting Management Role. It contains multiple verifiable facts like specific dates and experience years, elevating specificity to Level 4.


fact: data protection

fact: malware detection

fact: phishing simulations

fact: disaster recovery exercises

reasoning: The paragraph describes cybersecurity program activities like employee training and preparedness testing, which directly answers 'What does the cybersecurity program do?' for Risk Management Process. It includes domain-specific terms such as 'malware detection' and 'phishing simulations' that demonstrate cybersecurity expertise, but lacks firm-specific or verifiable details, resulting in Domain-Adapted specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a materiality conclusion (Strategy Integration), with a secondary mention of third-party risk. No specific facts are present; the language is generic and lacks domain expertise or verifiable details, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers whether cybersecurity has materially affected the company by stating no known material incidents, which is a materiality assessment fitting Strategy Integration. It contains no specific facts beyond generic statements and negative assertions, making it Generic Boilerplate.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a materiality assessment (have not materially affected and are not reasonably likely to materially affect), which aligns with Strategy Integration; however, it contains no specific facts, only generic assertions and speculation, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating no past incidents and acknowledging risks, which is a materiality assessment (Strategy Integration). It contains no specific facts—only generic language about risks and proactive measures—resulting in Generic Boilerplate specificity.


fact: layered security model

reasoning: The paragraph primarily describes the cybersecurity program's activities and measures, answering what the program does, which aligns with Risk Management Process. It uses domain-specific terminology like 'layered security model' and the CIA triad (confidentiality, integrity, and availability), indicating cybersecurity expertise and elevating specificity to Domain-Adapted.


reasoning: This paragraph states a negative conclusion about the absence of material cybersecurity incidents, which is a materiality assessment fitting Strategy Integration. It contains no specific facts, domain terms, or verifiable claims, making it Generic Boilerplate.


fact: October 28, 2023 announcement date

fact: mid-December 2023 recovery timeframe

fact: $1.5 million in incident-related expenses

reasoning: The paragraph primarily answers 'What happened in a cybersecurity incident?' by disclosing a real event with specific dates, operational impact, and costs, making it Incident Disclosure. It contains verifiable facts such as the announcement date, recovery timeline, and dollar amount, elevating specificity to Quantified-Verifiable.


reasoning: The paragraph directly answers how third-party cyber risks are managed by describing a dedicated Third Party Program, making Third-Party Risk the primary category. It contains no specific facts beyond generic risk management language, resulting in Generic Boilerplate specificity.


reasoning: The paragraph directly answers how cybersecurity risks materially affect or are likely to affect the business, making it Strategy Integration. It contains no specific, verifiable facts—only generic materiality assertions and a cross-reference—resulting in Generic Boilerplate specificity.


fact: quarterly vulnerability scanning

fact: PCI DSS compliance requirements

fact: annual network assessments

fact: annual penetration testing

fact: vulnerability scans as part of cyber insurance underwriting process

reasoning: The paragraph describes cybersecurity assessment activities (e.g., vulnerability scanning, penetration testing), which primarily answer 'What does the cybersecurity program do?' aligning with Risk Management Process. It includes domain-specific terms like PCI DSS and penetration testing that demonstrate cybersecurity expertise, elevating specificity to Level 2.


reasoning: This paragraph is a cross-reference to risk factor disclosures in Item 1A, not providing substantive cybersecurity disclosure, so it is classified as None/Other. It contains no specific facts, leading to Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating that no material impacts have occurred and discussing preventative strategy, fitting Strategy Integration. It contains no specific facts, only generic statements and negative assertions, resulting in Generic Boilerplate specificity.


fact: vulnerability management

reasoning: The paragraph describes oversight structure with the CEO directing programs and management updating the Audit Committee, fitting Board Governance. Specificity is Domain-Adapted because 'vulnerability management' is a cybersecurity domain term that demonstrates expertise beyond generic risk management.


reasoning: This paragraph is a cross-reference to another section and does not contain substantive cybersecurity disclosure, classifying it as 'None/Other'. It lacks any specific facts, resulting in generic boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating that prior incidents have not materially impacted operations, which is a Strategy Integration assessment, but it contains no specific facts—only generic risk language and a non-verifiable negative assertion—resulting in Generic Boilerplate specificity.


reasoning: The paragraph directly answers how cybersecurity incidents have affected the business by stating they did not have a material adverse effect, which is a backward-looking assessment fitting Strategy Integration. It contains no specific facts about incidents, processes, or verifiable claims, only a generic materiality assertion and cross-reference, resulting in Generic Boilerplate specificity.


fact: insider threat controls

fact: controls and tools to alert on suspicious or unusual insider activity

fact: data loss prevention controls

reasoning: This paragraph primarily answers what the cybersecurity program does by describing insider threat controls and data loss prevention measures, making it Risk Management Process. The specificity is Domain-Adapted because it uses cybersecurity-specific terms like 'insider threat controls' and 'data loss prevention,' demonstrating domain expertise, but lacks firm-specific or verifiable facts.


reasoning: The paragraph primarily describes cybersecurity program activities—employee security awareness training and integration into enterprise risk management—fitting Risk Management Process. It contains no firm-specific, verifiable, or domain-adapted facts beyond generic risk management language, resulting in Generic Boilerplate specificity.


fact: in May 2014

reasoning: This paragraph primarily answers 'What happened in a cybersecurity incident?' by describing an actual email spoofing event in May 2014, making it Incident Disclosure. The specific date 'May 2014' is a verifiable fact, setting specificity to Level 4.


reasoning: The paragraph primarily answers how cybersecurity affects the business by concluding that threats and incidents have not materially impacted and are not anticipated to affect business strategy, results of operations, or financial condition, which aligns with Strategy Integration. Specificity is Generic Boilerplate because the paragraph contains no specific facts, domain-adapted terms, firm-specific details, or verifiable claims; it is a generic materiality assertion.


reasoning: The paragraph describes the oversight structure where the Audit Committee oversees the CEO's responsibility for cybersecurity threats, fitting Board Governance. It contains no specific facts, using only generic roles and responsibilities, so specificity is Generic Boilerplate.


reasoning: The paragraph describes ongoing efforts to enhance cybersecurity processes using external resources, which primarily answers what the cybersecurity program does (Risk Management Process). It contains no specific facts—only generic terms like 'outside counsel' and 'response plan'—resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes the board's oversight structure for cybersecurity risks through the Risk Committee, which aligns with Board Governance. It contains no specific facts, using only generic oversight language without domain expertise, firm-specific details, or verifiable claims, resulting in Level 1 specificity.


fact: Forensic investigation completed on December 13, 2023

fact: Last unauthorized third-party activity on November 20, 2023

reasoning: The paragraph directly describes a cybersecurity incident with specific timeline details, fitting Incident Disclosure. It contains verifiable dates (December 13, 2023 and November 20, 2023), elevating specificity to Quantified-Verifiable.


fact: system scans

fact: threat intelligence analysis

reasoning: The paragraph primarily describes cybersecurity program activities such as employee training and leveraging third-party services for scans and threat intelligence, which aligns with Risk Management Process. Specificity is Domain-Adapted because it includes cybersecurity-specific terms like 'system scans' and 'threat intelligence analysis' that demonstrate domain expertise, but lacks firm-specific or verifiable details.


fact: CISO reports to the full Board at least annually

reasoning: The paragraph primarily describes the Board's oversight of cybersecurity, fitting Board Governance. The specificity is elevated to Firm-Specific due to the mention of a CISO, which is a firm-specific role title.


fact: Last confirmed unauthorized third-party activity on November 20, 2023

reasoning: The paragraph describes a specific cybersecurity incident with investigation findings and timeline, directly answering 'What happened?' for Incident Disclosure. It contains verifiable dates (December 13, 2023 and November 20, 2023) that are hard facts, setting specificity at Quantified-Verifiable.


reasoning: The paragraph directly addresses how third-party cybersecurity risks are managed through a third-party risk management program, fitting Third-Party Risk. It contains no specific facts—only generic statements about reliance on IT systems and the existence of a program—making it generic boilerplate.


reasoning: The paragraph primarily offers generic, forward-looking speculation about potential costs and adverse effects of cybersecurity measures and breaches, without substantively addressing board oversight, management roles, specific processes, third-party risks, or actual incidents, thus classifying as None/Other. It contains no specific facts—only vague references to procedures, controls, and impacts—resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating no material impairment and discussing cyber insurance, which aligns with Strategy Integration. It contains no specific, verifiable facts, making it Generic Boilerplate.


reasoning: The paragraph is a cross-reference directing readers to risk factors in Item 1A, providing no substantive cybersecurity disclosure, so it is classified as None/Other. It contains no specific facts about cybersecurity practices, governance, or incidents, making it Generic Boilerplate.


reasoning: The paragraph primarily answers what the cybersecurity program does by describing general processes for risk management and the Adviser's implementation of a program, aligning with Risk Management Process. It contains no specific facts—only generic risk management language without domain expertise, firm-specific details, or verifiable claims, resulting in Generic Boilerplate specificity.


fact: On October 3, 2024, the Company identified unauthorized activity within its information technology computer networks and systems due to a cybersecurity incident

reasoning: The paragraph primarily describes a specific cybersecurity incident that occurred on October 3, 2024, answering 'What happened in a cybersecurity incident?' so it is Incident Disclosure. The specific date of the incident is a verifiable fact, setting the specificity to Quantified-Verifiable.


reasoning: The paragraph primarily answers how the board oversees cybersecurity through ultimate oversight and Audit Committee reviews, fitting Board Governance. It contains no specific facts, domain-adapted terms, firm-specific details, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how third-party cyber risks are managed by describing assessment and communication processes for threats from service providers, fitting Third-Party Risk. It contains no specific facts, using generic language that does not demonstrate domain expertise or firm-specific details, resulting in Generic Boilerplate specificity.


fact: NIST CSF

reasoning: The paragraph primarily answers what the cybersecurity program does by describing its design and assessment based on the NIST CSF framework for risk management, categorizing it as Risk Management Process. The specific reference to NIST CSF, a named cybersecurity standard, demonstrates domain expertise, elevating specificity to Domain-Adapted.


fact: CISO

reasoning: The paragraph describes board-level oversight of cybersecurity risks through the Audit Committee and CISO updates, fitting Board Governance. The mention of the CISO role is a firm-specific fact that elevates specificity to Level 3.


reasoning: The paragraph primarily answers how third-party cyber risks are managed through a dedicated program, so it is classified as Third-Party Risk. It contains no specific facts, using only generic language about reliance on IT systems and implementation of a risk management program, resulting in Generic Boilerplate specificity.


reasoning: The paragraph states a conclusion about the material impact of cybersecurity incidents on the business, which aligns with Strategy Integration. It contains no specific verifiable facts beyond a negative assertion about material incidents, resulting in Generic Boilerplate specificity.


fact: service organization controls reports

reasoning: The paragraph centers on managing third-party cyber risks through a dedicated program and contract reviews, directly answering how third-party risks are handled. It includes domain-specific terminology like 'service organization controls reports,' which demonstrates cybersecurity expertise but lacks firm-specific or verifiable details.


reasoning: The paragraph directly states a conclusion about the material impact of cybersecurity risks on business strategy and finances, which aligns with Strategy Integration. It contains no specific facts—only generic statements about insurance and unverifiable negative assertions about materiality—resulting in Generic Boilerplate specificity.


fact: reshaped our Board of Directors

fact: do not have formal cybersecurity and risk assessment policies and procedures in place

fact: fiscal year ending on December 31, 2024

reasoning: The paragraph primarily addresses how the board oversees cybersecurity, including current gaps and future plans, fitting Board Governance. It contains a verifiable date for SEC disclosure applicability, elevating specificity to Level 4.


fact: penetration testing

fact: offensive testing

fact: maturity assessments

fact: incident response program

fact: phishing tests

reasoning: The paragraph details the cybersecurity program's activities, including assessments and training, which aligns with Risk Management Process. It uses domain-specific terms like penetration testing and phishing tests, demonstrating cybersecurity expertise and setting specificity at Domain-Adapted.