fact: Data breaches resulting from failures in Progress software

fact: SEC request received on or about February 26, 2024

reasoning: The paragraph primarily answers 'what happened in a cybersecurity incident?' by describing a breach disclosure, customer notifications, and an SEC investigation, making it Incident Disclosure. Specificity is Quantified-Verifiable due to verifiable facts including the named software (Progress) and a specific date (February 26, 2024).


content_category: Incident Disclosure

fact: July 2018

category_confidence: high

specificity_confidence: high

reasoning: The paragraph describes a specific cybersecurity incident (ransomware in July 2018) with details on scope and investigation, directly answering 'What happened in a cybersecurity incident?' so it is Incident Disclosure. The date 'July 2018' is a verifiable hard fact, elevating specificity to Quantified-Verifiable.

provider: xiaomi

stage: benchmark


content_category: Board Governance

fact: CISO role (firm-specific)

fact: Cybersecurity Executive Committee (firm-specific)

fact: Audit Committee composed of two board members who are also members of the Cybersecurity Executive Committee (verifiable)

reasoning: The paragraph primarily answers how the board oversees cybersecurity through the CISO's annual briefing to the Audit Committee, fitting Board Governance. It contains verifiable facts such as the specific number of Audit Committee members and their dual role on the Cybersecurity Executive Committee, elevating specificity to Quantified-Verifiable.


content_category: Management Role

fact: SVP, Engineering role

fact: VP, Technology & CISO role

fact: Primary responsibility for cybersecurity risk management program

fact: Supervision of internal cybersecurity personnel and external cybersecurity consultants

fact: VP, Technology & CISO's experience in developing secure products and previous head of security/CISO positions

reasoning: The paragraph describes management roles and responsibilities for cybersecurity, fitting Management Role. It contains firm-specific facts like VP-level titles and supervisory duties, making it Level 3 specificity.


fact: SVP of IT Security

reasoning: The paragraph primarily answers how the board oversees cybersecurity through Audit Committee briefings and reporting from management, fitting Board Governance. Specificity is Level 3 due to the firm-specific mention of the SVP of IT Security role.


fact: CISO role

fact: Security Governance Committee

fact: selected from Adviser's business groups

fact: over 20 years of cybersecurity and technology management experience

reasoning: The paragraph primarily answers how management is organized for cybersecurity by describing the CISO's qualifications and the Security Governance Committee's composition, making it Management Role. The verifiable claim of 'over 20 years' of experience sets specificity to Quantified-Verifiable.


content_category: Risk Management Process

fact: Global Information Security Policy

fact: NIST CSF

fact: endpoint detection

fact: security incident response and event management

fact: privileged access management

fact: Our CISO

reasoning: The paragraph primarily describes the cybersecurity program's activities and processes, such as policy creation and specific security measures, fitting Risk Management Process. It contains firm-specific facts like the named Global Information Security Policy and the CISO role, along with domain-specific terms, elevating specificity to Level 3.


content_category: Strategy Integration

fact: December 15, 2020

reasoning: The paragraph states a forward-looking materiality conclusion that cybersecurity is reasonably likely to affect business outcomes, which aligns with Strategy Integration, and it includes a verifiable incident date (December 15, 2020), making specificity Quantified-Verifiable.


content_category: Third-Party Risk

reasoning: The paragraph centers on processes for overseeing cybersecurity risks from third-party service providers, making Third-Party Risk the primary category. It contains no domain-specific terminology, firm-unique details, or verifiable facts, resulting in Generic Boilerplate specificity.


fact: Vice President of Cybersecurity

reasoning: The paragraph focuses on the board's oversight structure for cybersecurity, including Audit Committee briefings and escalation processes, making it Board Governance. The mention of 'our Vice President of Cybersecurity' is a firm-specific fact that elevates specificity to Level 3.


reasoning: The paragraph primarily answers how the board oversees cybersecurity through audit committee responsibilities and meeting cadences, fitting Board Governance. The specific mention of the Vice President of Information Technology role is a firm-specific fact that elevates specificity to Firm-Specific.


fact: cyber maturity

fact: incident response

fact: firewall maintenance

reasoning: The paragraph primarily answers how third-party cyber risks are managed by describing engagement and oversight of external service providers. It demonstrates cybersecurity domain expertise through terms like 'cyber maturity' and 'firewall maintenance', but lacks firm-specific or verifiable facts.


fact: Chief Information Officer supervises the information security team

fact: Information Security Officer conducts training

fact: combined over 35 years of IT management experience

reasoning: The paragraph primarily answers how management is organized for cybersecurity, detailing roles and qualifications of the CIO and Information Security Officer, making it Management Role. Specificity is Level 4 due to the verifiable claim of over 35 years of combined IT management experience.


fact: August 2023 incident date

reasoning: The paragraph primarily answers whether past cybersecurity incidents have materially affected the company, stating a materiality conclusion that aligns with Strategy Integration. The specific mention of an incident in August 2023 provides a verifiable fact, elevating specificity to Level 4.


specificity_confidence: medium

reasoning: The paragraph centers on overseeing cybersecurity risks from third-party entities like suppliers and vendors, directly answering how third-party cyber risks are managed, so it is classified as Third-Party Risk. It contains no specific cybersecurity domain terms, verifiable facts, or firm-unique details beyond generic role mentions (e.g., CCO, Adviser's personnel), resulting in Generic Boilerplate specificity.


fact: CTO

fact: CISO

reasoning: The paragraph primarily answers how management is organized for cybersecurity by describing the experience and qualifications of key roles like CTO and CISO, making it Management Role. The specific titles CTO and CISO are firm-specific facts, elevating specificity to Firm-Specific.


fact: CIO (Chief Information Officer)

reasoning: The paragraph focuses on how the Board oversees cybersecurity risks through coordination with management and the Audit Committee, fitting Board Governance. The specific mention of the CIO role is a firm-specific fact that elevates specificity to Level 3.


fact: CISO reports to Chief Financial Officer

fact: CISO has over 20 years of information security experience

fact: CISO has over four years as a director in a big four accounting firm's information security management practice

fact: CISO holds a B.S. in Network Security

fact: CISO leads Information Security Steering Committee (ISSC)

reasoning: The paragraph primarily answers how management is organized for cybersecurity, detailing the CISO's role, reporting line, qualifications, and the ISSC committee structure, making it Management Role. It contains verifiable facts such as specific years of experience, job history, and educational background, elevating specificity to Level 4.


fact: Chief Technology Officer

fact: Technology Leadership Centre

fact: Chief Risk Officer

fact: Controlling Department

reasoning: The paragraph describes the cybersecurity risk governance model with three lines of defense, focusing on oversight structure involving board committees and management roles, which aligns with Board Governance. It contains firm-specific facts like named roles (CTO, CRO) and departments (Technology Leadership Centre, Controlling Department), elevating specificity to Level 3.


fact: Chief Operating Officer oversees cybersecurity policies and processes

reasoning: The paragraph answers how management is organized for cybersecurity by identifying the COO as overseeing policies and processes, fitting Management Role. Specificity is Firm-Specific because the COO role is a firm-specific executive fact.


fact: Vice-President of Information Technology (VPIT)

fact: Director - Information Security (DIS)

reasoning: This paragraph primarily answers how the board oversees cybersecurity through Audit Committee reporting and board presentations, fitting Board Governance. It contains firm-specific roles (VPIT and DIS), which elevate specificity to Firm-Specific.


fact: Executive Vice President – Operations

fact: reporting line from CTO to EVP – Operations

fact: cybersecurity incidents reported to legal department

reasoning: This paragraph primarily answers how management is organized to handle cybersecurity through reporting lines and role descriptions, making it Management Role. It contains firm-specific facts like the Chief Technology Officer title and organizational structure, leading to Firm-Specific specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a negative materiality conclusion, which aligns with Strategy Integration. It contains domain-adapted terminology like 'tabletop exercises simulating potential cyber threats,' demonstrating cybersecurity expertise, but lacks firm-specific or verifiable facts.


fact: ransomware

fact: malware

fact: phishing attacks

fact: data theft

fact: virus and intrusion software

fact: operational technology

fact: layered technical protective capabilities and detective surveillance controls

fact: phishing, social engineering training

fact: incident response and disaster recovery procedures

fact: table top exercises

reasoning: The paragraph primarily answers what the cybersecurity program does by detailing its risk assessment and management activities, fitting Risk Management Process. It includes domain-specific terms like ransomware, phishing, and incident response, demonstrating cybersecurity expertise at Level 2.


fact: Chief Information Security Officer

reasoning: The paragraph primarily describes the cybersecurity program's activities—implementation, team deployment, real-time monitoring, and incident reporting—answering 'What does the cybersecurity program do?' for Risk Management Process. The mention of the CISO, a firm-specific leadership role, elevates specificity to Level 3.


reasoning: The paragraph primarily answers how materiality is determined for cybersecurity incidents, focusing on impact criteria that align with Strategy Integration. It contains no specific facts, using generic risk assessment language without domain-specific terminology, firm-specific details, or verifiable claims, resulting in Generic Boilerplate specificity.


fact: threat intelligence service providers

fact: cybersecurity consultants

fact: penetration testing firms

fact: cybersecurity software providers

fact: managed cybersecurity service providers

fact: professional services firms (including legal counsel)

reasoning: The paragraph describes the company's use of various service providers to support its cybersecurity risk management activities, which directly answers what the program does, fitting Risk Management Process. It contains domain-specific terms like 'penetration testing firms' and 'threat intelligence service providers,' demonstrating cybersecurity expertise and elevating specificity to Level 2, but lacks firm-specific or verifiable facts.


fact: over 20 years of experience in information security, risk management, and compliance

reasoning: This paragraph primarily answers how management is organized to handle cybersecurity by detailing the Director of Information Technology's responsibilities, qualifications, and support structure. The specificity level is Quantified-Verifiable due to the verifiable claim of 'over 20 years of experience,' which is a hard, externally checkable fact.


fact: data security posture

fact: third-party assessments

fact: incident response plan

reasoning: This paragraph primarily answers how the board oversees cybersecurity through the Audit Committee's role, making it Board Governance. It contains domain-specific terms like 'data security posture' and 'third-party assessments,' which demonstrate cybersecurity expertise and elevate specificity to Domain-Adapted.


fact: IT Security Director reports to CBIZ's Chief Information Officer

fact: head of the Company's cybersecurity team

fact: cyber risk management program

fact: prevention, detection, mitigation, and remediation of cybersecurity incidents

fact: cybersecurity technologies

fact: threat intelligence

reasoning: This paragraph primarily answers how management is organized for cybersecurity by detailing the IT Security Director's role, reporting line, and team qualifications, making it Management Role. The specificity is Firm-Specific due to the named IT Security Director role and organizational structure, which are unique to CBIZ.


fact: Cybersecurity Sub-Committee of the Board of Directors

reasoning: The paragraph primarily answers how the board oversees cybersecurity, detailing the Audit Committee's role and a Cybersecurity Sub-Committee for incidents, which is a firm-specific governance structure that elevates specificity to Level 3.


fact: Chief Information Officer

reasoning: The paragraph directly addresses how third-party cyber risks are managed through assessments and monitoring, making Third-Party Risk the central topic. The mention of the Chief Information Officer is a firm-specific role that elevates specificity to Level 3.


fact: Enterprise Cybersecurity Management Review Group (Enterprise Cybersecurity MRG)

fact: Chief Information Security Officer

reasoning: The paragraph primarily answers how management is organized for cybersecurity by detailing the Enterprise Cybersecurity MRG's structure and responsibilities, making it Management Role. Specificity is Firm-Specific due to the named committee and CISO role, which are firm-unique facts.


fact: Interagency Guidelines for Safeguarding Customer Information

reasoning: The paragraph primarily answers how the board oversees cybersecurity through annual reporting from the ISO, fitting Board Governance; specificity is Domain-Adapted due to the reference to specific Interagency Guidelines, demonstrating cybersecurity domain expertise.


fact: Information Technology Committee

reasoning: The paragraph describes board oversight of cybersecurity, including monthly updates and review of risk assessments, fitting Board Governance. It contains a firm-specific fact, the named 'Information Technology Committee', which elevates specificity to Level 3.


fact: vulnerability assessments

reasoning: The paragraph primarily answers how the board oversees cybersecurity through Audit Committee oversight and Board discussions with the CISO, making it Board Governance. It contains domain terms like 'vulnerability assessments' and a firm-specific role 'Chief Information Security Officer,' elevating specificity to Firm-Specific.


reasoning: The paragraph focuses on the oversight structure where the Chief Operating Officer briefs the Audit Committee on cybersecurity risks, detailing information flow and committee involvement, which aligns with Board Governance. It lacks any specific, verifiable facts, using generic roles and processes without domain-adapted or firm-unique details, resulting in Generic Boilerplate specificity.


fact: IS Steering Committee

reasoning: The paragraph primarily answers how third-party cyber risks are managed through a vendor management program overseen by a management committee, making 'Third-Party Risk' the correct category. It contains firm-specific facts like the IS Steering Committee and the CIO chairing it, which elevate specificity to Firm-Specific, as these details distinguish the company's organizational structure.


fact: Third quarter of fiscal year 2023 material cybersecurity incident

fact: Zero-day vulnerability exploited in third-party vendor file transfer application

reasoning: The paragraph primarily answers 'What happened in a cybersecurity incident?' by detailing a material incident in Q3 FY2023 involving a zero-day vulnerability, making it Incident Disclosure. The specific time frame (third quarter of fiscal year 2023) is a verifiable fact, elevating specificity to Quantified-Verifiable.


reasoning: The paragraph primarily answers how management is organized to handle cybersecurity by describing the supervisory roles of departments like legal, finance, and internal audit, making it Management Role. It contains no specific, verifiable, or firm-unique facts, using generic oversight language that does not elevate specificity above Level 1.


fact: third-party and independent reviews

fact: threat environment

fact: technological trends

fact: Vice President of Information Security

reasoning: The paragraph primarily describes board and audit committee oversight of cybersecurity risks, fitting Board Governance; it includes domain terms like vulnerability assessments and a firm-specific VP-level security role, elevating specificity to Firm-Specific.


fact: June 2018 incident date

fact: $10 million forged payments

fact: unauthorized access to email system

reasoning: The paragraph primarily answers 'What happened in a cybersecurity incident?' by detailing a real event from June 2018 with specific date, amount, and method, making it Incident Disclosure. It contains verifiable facts like the exact date and $10 million loss, elevating specificity to Quantified-Verifiable.


fact: over 20 years of experience

fact: cyber incident response

fact: ERMC

reasoning: This paragraph primarily answers how management is organized to handle cybersecurity, detailing roles and qualifications, which fits the Management Role category. Specificity is Level 4 due to verifiable facts like 'over 20 years of experience' and firm-specific elements such as 'Vice President of Information Technology' and 'ERMC'.


fact: Chief Information Officer

reasoning: The paragraph describes the Board's oversight of cybersecurity risks, including updates from the CIO, which aligns with Board Governance. The reference to the Chief Information Officer is a firm-specific role, elevating specificity to Level 3.


fact: Named board member Paresh Patel with information technology expertise

reasoning: The paragraph primarily answers how the board oversees cybersecurity through periodic reports, fitting Board Governance. It contains a firm-specific fact about a named board member with IT expertise, which elevates specificity to Level 3.


fact: patching and vulnerability management

fact: cybersecurity tabletop exercise

fact: supplier management

fact: security awareness training

fact: cybersecurity threat assessment

reasoning: The paragraph describes board oversight through management reports, fitting Board Governance, and includes cybersecurity-specific terms like 'patching and vulnerability management' and 'cybersecurity tabletop exercise' that demonstrate domain expertise, but lacks firm-specific or verifiable details.


fact: Two members of the audit committee have obtained certifications in cybersecurity oversight

reasoning: The paragraph focuses on board and committee oversight of cybersecurity, including reporting structures and board member expertise, which aligns with Board Governance. Specificity is Level 4 due to the verifiable, quantified fact that two audit committee members hold cybersecurity certifications.


fact: Third-Party Risk Management Program

fact: Vendor Management Policy

fact: compliance with the Interagency Guidance on Third-Party Relationships: Risk Management

reasoning: The paragraph centers on managing third-party vendor risks via the company's named Third-Party Risk Management Program and Vendor Management Policy, fitting 'Third-Party Risk'. Specificity is Level 3 due to firm-specific program names and a domain-adapted regulatory reference.


reasoning: The paragraph centers on managing cybersecurity risks from third-party service providers through monitoring, vendor evaluation, and policy oversight, directly answering how third-party risks are handled. It lacks any specific facts such as verifiable claims, firm-specific details, or domain-adapted terminology, relying instead on generic risk management language.


fact: Breach Response Team

fact: tabletop exercises

reasoning: The paragraph describes cybersecurity program activities such as conducting tabletop exercises and developing incident response strategies, which aligns with Risk Management Process. The specificity is Firm-Specific (Level 3) due to the mention of the company's 'Breach Response Team,' a named operational team, supported by domain-adapted terms like 'tabletop exercises' and 'detection, mitigation and remediation strategies.'


fact: defense-in-depth approach

fact: NIST Cyber Security Framework

fact: vulnerability scanning

fact: penetration testing

fact: incident response exercises

fact: encryption

fact: multi-factor authentication

reasoning: The paragraph primarily describes the cybersecurity program's activities and processes, such as risk assessment and security measures, fitting Risk Management Process. It contains domain-adapted terms like 'defense-in-depth' and 'NIST CSF' that demonstrate cybersecurity expertise, but no firm-specific or verifiable facts.


fact: threat intelligence

reasoning: The paragraph primarily describes management's supervision of cybersecurity activities and program functions (preventing, detecting, mitigating, remediating risks), fitting Risk Management Process. Specificity is Level 2 due to the domain term 'threat intelligence,' which demonstrates cybersecurity expertise beyond generic risk management language.


fact: CSO (Chief Security Officer) role

fact: Reports to Executive Vice President and Chief Operations Officer

fact: CSO has over 20 years of security experience

fact: Team members hold certifications such as CISSP and CISM

reasoning: The paragraph primarily answers how management is organized to handle cybersecurity, detailing the CSO's role, reporting line, experience, and team qualifications (Management Role). Specificity is Level 4 due to verifiable facts including the CSO's over 20 years of experience and specific certifications (CISSP, CISM) held by team members.


fact: CISO role

fact: CISO meets at least quarterly with Board, ELT, and SLT

fact: Tabletop exercises performed at least annually with Board and SLT

reasoning: The paragraph focuses on the CISO's role in facilitating board oversight through regular meetings and exercises, aligning with Board Governance. Specificity is Level 4 due to verifiable frequency claims ('at least quarterly' and 'at least annually') that could be externally confirmed.


fact: CIS Critical Security Controls

reasoning: The paragraph primarily answers how cybersecurity affects the business by concluding that no risks have materially affected or are likely to materially affect the company, which is a Strategy Integration assessment. It contains domain-specific terms like penetration testing and CIS Critical Security Controls, demonstrating cybersecurity expertise and elevating specificity to Level 2.


content_category: None/Other

fact: ransomware and denial-of-service attacks

fact: nation state actors

reasoning: The paragraph primarily discusses the general cybersecurity threat landscape and its importance to the company without detailing specific governance, management roles, risk processes, third-party oversight, incidents, or strategy assessments, fitting 'None/Other.' It includes domain-specific threat terms like ransomware and nation state actors, which demonstrate cybersecurity expertise and elevate specificity to Level 2.


fact: Delegation of cybersecurity oversight to the Audit Committee and Aerospace Safety Committee

fact: Chief Information Officer and Senior Vice President, Information Technology & Data Analytics (CIO) and Chief Security Officer (CSO) provide presentations at bimonthly Audit Committee meetings

fact: Audit Committee has designated one of its members with expertise in cyber risk management

fact: Aerospace Safety Committee receives updates from Chief Engineer, Chief Aerospace Safety Officer, and Chief Product Security Engineer

fact: CIO provides annual briefings to the Board on cybersecurity matters

reasoning: The paragraph describes board oversight of cybersecurity through delegation to specific committees and management briefings, fitting Board Governance. It contains firm-specific facts like the Aerospace Safety Committee and named executive roles, elevating specificity to Level 3.


fact: Vice President of IT role responsible for information security program

fact: Specific cyber threat types listed (e.g., denial-of-service attacks, hacking, phishing, ransomware, malware)

reasoning: The paragraph primarily answers how the board oversees cybersecurity through the Board and Audit Committee, with the VP of IT responsible, fitting Board Governance. Specificity is Firm-Specific due to the firm-specific Vice President of IT role, and Domain-Adapted terms like specific threat types are also present.


fact: CISO chairs the Cybersecurity Steering Committee

fact: one director is the President of a major cybersecurity services provider

reasoning: The paragraph focuses on board oversight through CISO updates and board education, fitting Board Governance. It contains firm-specific facts (CISO, Cybersecurity Steering Committee) and a verifiable claim about a director's external role, elevating specificity to Level 4.


fact: Chief Information Officer

reasoning: This paragraph primarily answers how management is organized to handle cybersecurity, fitting the Management Role category. It contains a firm-specific fact (the Chief Information Officer role), which elevates specificity to Firm-Specific.


fact: National Institute of Standards and Technology Cybersecurity Framework (NIST CSF)

fact: Identify, Protect, Detect, Respond, and Recover principles

reasoning: The paragraph describes the cybersecurity program's methodology based on the NIST CSF framework, fitting the Risk Management Process category. It demonstrates domain expertise by referencing specific cybersecurity framework principles, elevating specificity to Domain-Adapted.


fact: Prudential's CISO, CIO and/or Operational Risk Management

fact: the Manager and the Subadviser

fact: Prudential cybersecurity program developments

reasoning: The paragraph focuses on the Board's oversight role in cybersecurity, such as receiving updates from specific roles and entities, which fits Board Governance. It contains firm-specific references to Prudential's CISO/CIO and the Manager/Subadviser, making it Level 3 specificity.


fact: Vendor Management Committee

fact: Vendor Management team

reasoning: The paragraph focuses on managing third-party cyber risks through vendor due diligence and oversight, directly aligning with Third-Party Risk. It contains firm-specific organizational facts like the Vendor Management Committee and team, which elevate specificity to Level 3.


fact: CSO (Chief Security Officer)

fact: Global Security Organization

fact: Risk Committee of the Board

fact: ERM Steering Committee

fact: Disclosure Committee

reasoning: The paragraph describes the oversight structure for cybersecurity, with the Risk Committee of the Board overseeing senior executives and the Global Security Organization, making it Board Governance. It contains firm-specific entities like the CSO and named committees, elevating specificity to Level 3.


fact: CISO

fact: FedEx Executive Committee

fact: DTRC

fact: CyTOC

fact: threat intelligence briefings

reasoning: The paragraph primarily describes cybersecurity oversight structure and information flow to the board and committees, aligning with Board Governance. It contains firm-specific facts such as the CISO role, FedEx Executive Committee, DTRC, and CyTOC, which elevate specificity to Firm-Specific.


fact: National Institute of Standards and Technology Cybersecurity Framework

fact: Center for Internet Security – Top 18 Critical Security Controls

fact: phishing tests

fact: cybersecurity tabletop exercises

fact: incident response plan

fact: disaster recovery plans

reasoning: The paragraph describes the cybersecurity program's activities, such as risk assessments, training, and incident response, directly answering 'What does the cybersecurity program do?' for RMP. It includes domain-specific terms like NIST CSF and phishing tests, demonstrating cybersecurity expertise, but lacks firm-specific or verifiable claims, so specificity is Level 2.


fact: CIO

fact: Technology & Operations Committee

reasoning: The paragraph describes oversight structure with management presenting to board committees, fitting Board Governance. It includes firm-specific roles (CISO, CIO) and a named committee (Technology & Operations Committee), elevating specificity to Firm-Specific.


fact: penetration testing

fact: independent audits

reasoning: The paragraph primarily answers what the cybersecurity program does by describing risk assessment, policy development, and third-party evaluations, making it Risk Management Process. It includes domain-specific terms like 'penetration testing' and 'independent audits,' which demonstrate cybersecurity expertise and elevate specificity to Level 2.


fact: CDIO

fact: Security council

fact: Cross-functional departments: Legal and Regulatory, Corporate Security, Network Engineering, Internal Audit, Finance & Accounting and Risk and IT Infrastructure

fact: April 2024 cyber-attack

reasoning: The paragraph primarily describes management's organizational structure for cybersecurity, including a security council chaired by the CDIO with specific cross-functional representation, making it Management Role. The reference to the April 2024 cyber-attack is a verifiable fact, setting specificity to Level 4.


reasoning: The paragraph describes the delegation of cybersecurity oversight from the Board to the Audit Committee and reporting cadences, which directly answers how the board oversees cybersecurity (Board Governance). The specific title 'Senior Director of Governance & Information Security' is a firm-specific fact that distinguishes this company's governance structure, setting specificity at Firm-Specific.


fact: July 23, 2023 (specific incident date)

fact: $14.3 million (specific incurred costs)

reasoning: The paragraph primarily discloses a specific cybersecurity incident with verifiable details (date and costs), fitting Incident Disclosure. Specificity is Level 4 due to the presence of hard, externally verifiable facts like the incident date and dollar amount.


fact: Board designates Risk Committee for cybersecurity oversight

fact: Chief Information Security Officer (CISO) provides regular presentations to Risk Committee

fact: Reporting topics include vulnerability assessments, risk assessment outcomes, third-party reviews

fact: Board of Directors receives reports at least annually

reasoning: The paragraph focuses on board oversight via the Risk Committee and CISO reporting structure, which is core to Board Governance. It includes firm-specific facts (Risk Committee, CISO) and a verifiable lower-bound claim ('at least annually' for board reports), elevating specificity to Level 4.


fact: Third-Party Risk Management (TPRM) program

fact: cybersecurity due diligence

reasoning: The paragraph centrally describes how third-party cyber risks are managed via the TPRM program, fitting the Third-Party Risk category. It uses domain-specific terms like 'TPRM program' and 'cybersecurity due diligence,' indicating cybersecurity expertise but no firm-specific or verifiable facts, resulting in Domain-Adapted specificity.


fact: InfoSec Director

fact: eRISC committee

reasoning: The paragraph describes the information flow to the board regarding cybersecurity risks, which directly addresses board oversight and fits Board Governance. It contains firm-specific facts such as the 'InfoSec Director' role and the named 'eRISC committee', elevating specificity to Firm-Specific.


reasoning: The paragraph primarily answers how the board oversees cybersecurity through management reports to the Audit Committee, making it Board Governance. The firm-specific role title 'Senior Director, Global Information Security' elevates specificity to Firm-Specific.


fact: denial of service attacks

fact: malicious software attacks

fact: security breaches

fact: cyber attacks

fact: card transactions

fact: sensitive information

fact: security assessments

reasoning: The paragraph primarily answers how third-party cyber risks are managed, focusing on risks from card transactions and service providers, and the company's security assessments. Specificity is Domain-Adapted due to cybersecurity domain terms like denial of service attacks and security assessments, which demonstrate expertise beyond generic risk language.


fact: Information Security Steering Committee (ISSC)

fact: executives from Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments

reasoning: The paragraph primarily answers how management is organized for cybersecurity by detailing a specific cross-functional committee, fitting Management Role. It contains firm-specific facts like the named ISSC and department list, elevating specificity to Firm-Specific.


fact: references to National Institute of Standards and Technology (NIST) frameworks

fact: references to International Organization for Standardization (ISO) standards

reasoning: The paragraph primarily addresses how the Board oversees cybersecurity through integration into enterprise risk management, fitting Board Governance. Specificity is Domain-Adapted because it references specific cybersecurity frameworks (NIST and ISO), demonstrating domain expertise beyond generic boilerplate.


fact: Vice President of Information Systems and Architecture (VP of IT)

reasoning: The paragraph primarily describes management organization for cybersecurity, focusing on the VP of IT's responsibilities, qualifications, and reporting lines, fitting Management Role. It includes a firm-specific role (VP of IT), which elevates specificity to Firm-Specific.


fact: CSO (Chief Security Officer)

fact: Chief Information Officer

reasoning: The paragraph focuses on management roles and information flow, specifically the CSO being informed and communicating with senior management, which aligns with Management Role. Specificity is Firm-Specific due to the mention of firm-specific titles like CSO and Chief Information Officer.


fact: Technology Committee

reasoning: The paragraph answers how the board oversees cybersecurity by describing delegation to the Technology Committee, a firm-specific governance structure, making it Board Governance at Firm-Specific level.


reasoning: The paragraph describes the board's oversight structure for cybersecurity, including committee responsibilities and information flow, which fits Board Governance. It contains no specific facts such as verifiable claims, firm-specific details, or domain-adapted terms beyond generic oversight language, resulting in Generic Boilerplate specificity.


fact: Offered identity protection services including credit monitoring to all current and former customers for two years

reasoning: The paragraph primarily describes remediation actions in response to a cybersecurity incident, such as ongoing engagement with law enforcement and offering customer protection services, which aligns with Incident Disclosure. The specific duration of 'two years' for the identity protection services is a hard, verifiable fact, elevating specificity to Quantified-Verifiable.


fact: Chief Capability Officer (CCO)

fact: Chief Information Officer (CIO)

fact: Chief Information Security Officer (CISO)

reasoning: This paragraph primarily answers how the board oversees cybersecurity through the Audit Committee's quarterly reports and direct engagement with management, making it Board Governance. The specificity is Firm-Specific due to the mention of specific management roles (CCO, CIO, CISO) that distinguish the company's organizational structure.


fact: CISO

reasoning: This paragraph describes how cybersecurity information flows from the CISO to the Audit Committee and Board, addressing board oversight and thus fitting Board Governance. The mention of the CISO, a firm-specific VP-level role, elevates specificity to Firm-Specific.


reasoning: The paragraph centers on managing third-party risks via an oversight committee, policies, and assessments, fitting the 'Third-Party Risk' category. However, it contains no specific, verifiable, or firm-unique facts—only generic descriptions of processes, resulting in Level 1 specificity.


fact: Security Steering Committee

fact: CSIRT

fact: PSIRT

fact: incident handling lifecycle

fact: key risk indicators

reasoning: The paragraph primarily answers how management is organized for cybersecurity, focusing on roles like the CISO and the Security Steering Committee, which aligns with 'Management Role'. Specificity is Firm-Specific because it includes firm-specific facts such as the CISO title and the named Security Steering Committee, along with domain terms like CSIRT and PSIRT.


fact: CIO

fact: TSA compliance

reasoning: The paragraph describes board oversight of cybersecurity, including dashboard reviews and presentations, fitting Board Governance. Specificity is Firm-Specific due to mentions of firm-specific roles (CISO, CIO) and domain-adapted reference to TSA compliance.


fact: Enterprise & Technology Security (E&TS) organization

fact: CSIRT (Computer Security Incident Response Team)

fact: Product Security Incident Response Team (PSIRT)

fact: Business Information Security Officers (BISO)

reasoning: The paragraph focuses on how management is organized for cybersecurity, detailing roles like CISO and BISO and teams such as CSIRT and PSIRT, which aligns with Management Role. Specificity is Firm-Specific because it includes IBM-specific entities like E&TS and named leadership positions that distinguish the company's structure.


fact: Cybersecurity Incident Response Plan

fact: cybersecurity crisis response team consisting of CEO, CFO, Chief Human Resources Officer, Chief Information Officer, and General Counsel

fact: Public Disclosure Committee

reasoning: The paragraph primarily describes management's organizational structure for handling cybersecurity, including specific roles and teams, making it Management Role. It contains firm-specific facts like the CISO title, a named incident response plan, a crisis team with defined membership, and a Public Disclosure Committee, supporting Level 3 specificity.


reasoning: The paragraph primarily answers how the board oversees cybersecurity through the Audit Committee and periodic updates, fitting Board Governance. Specificity is Firm-Specific due to the mention of specific leadership roles (CISO and CIO), which distinguish the company's governance structure.


fact: management committee on cybersecurity

reasoning: This paragraph primarily answers how management is organized to handle cybersecurity by describing the roles and responsibilities of the Senior Director and Head of Information Technology and a management committee, making it Management Role. The specificity is Firm-Specific due to the mention of the 'management committee on cybersecurity,' which is a named, non-generic committee specific to this company.


fact: phishing tests

fact: information security team

fact: CSO

reasoning: The paragraph focuses on operational cybersecurity activities like implementing programs, developing tools, and conducting training, fitting Risk Management Process. Specificity is Firm-Specific due to firm-specific roles (information security team, CSO) and domain terms (phishing tests).


fact: Chief Technology Officer role in cybersecurity risk management

reasoning: The paragraph primarily answers how management is organized for cybersecurity by describing the CTO's responsibilities and the IT Director's expertise, fitting the Management Role category. It contains a firm-specific fact (Chief Technology Officer), which elevates specificity to Level 3.


fact: penetration tests

reasoning: The paragraph primarily answers how management is organized to handle cybersecurity, highlighting centralized roles like the Vice President of Information Technology, and includes domain-specific activities such as phishing and penetration tests, which elevate specificity to Firm-Specific.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating no material cybersecurity incidents, which is a materiality conclusion under Rule 5, making Strategy Integration the best fit. The incident response plan description and physical incident details lack cybersecurity-specific domain terms, firm-unique facts, or verifiable claims, resulting in Generic Boilerplate specificity.


fact: CIO role

fact: CIO also serves as Kronos CIO

fact: Reporting lines to CEOs

fact: Vice president at CompX

reasoning: The paragraph primarily answers how management is organized for cybersecurity, detailing roles like CIO and director of IT, their responsibilities, reporting lines, and experience, which fits Management Role. Specificity is Firm-Specific due to verifiable firm-specific facts such as the CIO's dual role and reporting structure to CEOs.