fact: August 2021 cybersecurity incident

fact: January 2023 cybersecurity incident

fact: lawsuits including mass arbitration claims and class actions

fact: consumer class actions and regulatory inquiries

reasoning: This paragraph describes actual cybersecurity incidents from August 2021 and January 2023, including their legal and regulatory impacts, making it Incident Disclosure. It contains verifiable facts such as specific dates and details of lawsuits, supporting Quantified-Verifiable specificity.


content_category: None/Other

category_confidence: high

specificity_confidence: high

reasoning: The paragraph is a generic risk statement about IT reliance and potential disruptions that does not answer any substantive cybersecurity questions (e.g., governance, processes, incidents), so it is classified as None/Other. It contains no specific facts, domain-adapted terms, or verifiable claims, making it Generic Boilerplate.

provider: xiaomi

stage: benchmark


content_category: Management Role

reasoning: This paragraph describes the responsibilities of management roles (CFO and Head of IT) in cybersecurity, answering how management is organized, so it is Management Role. It contains no specific facts—only generic responsibilities and roles—resulting in Generic Boilerplate specificity.


reasoning: This paragraph is a generic risk statement acknowledging cybersecurity threats without describing any specific governance, processes, incidents, or strategy, so it falls under 'None/Other'. It contains no specific facts—only vague, boilerplate language—resulting in Generic Boilerplate specificity.


content_category: Third-Party Risk

reasoning: The paragraph focuses on third-party risk management by requiring vendors to maintain security measures and report breaches, but it contains no specific, verifiable facts, domain expertise, or firm-specific details, making it generic boilerplate.


fact: Head of Resources Management has more than 30 years of overall experience

fact: more than 20 years directly assessing and managing cyber information technology and human resources systems

fact: CCO has more than 30 years of overall experience as a CPA

fact: more than 15 years managing information technology systems and databases

fact: 15-plus years supporting our Adviser's and Administrator's resource management department

reasoning: The paragraph focuses on management roles, responsibilities, and qualifications for cybersecurity, fitting Management Role; it contains multiple verifiable claims about years of experience, elevating specificity to Level 4.


reasoning: The paragraph directly addresses how third-party cyber risks are managed through a vendor management program and audits, making it Third-Party Risk. It contains no specific facts—only generic descriptions of a program and audit verification without verifiable details, firm-specific identifiers, or domain-adapted terms, resulting in Generic Boilerplate specificity.


content_category: Risk Management Process

reasoning: The paragraph describes incident response and recovery plans as part of the cybersecurity program's activities, answering 'What does the cybersecurity program do?' and thus classified as Risk Management Process. It contains no specific facts, domain-adapted terms, firm-specific details, or verifiable claims, making it Generic Boilerplate.


content_category: Incident Disclosure

fact: In 2021, the Bank was the target of a ransomware attack

fact: An external actor illegally accessed and/or acquired certain data on its network

fact: The Bank was sued in a purported class action lawsuit that is in process of settlement

reasoning: The paragraph primarily describes a specific past cybersecurity incident (2021 ransomware attack) and its consequences, fitting Incident Disclosure. It contains verifiable facts such as the year of the attack and the legal outcome, which are externally confirmable, leading to Level 4 specificity.


reasoning: The paragraph describes employee training and awareness activities, which primarily answer 'What does the cybersecurity program do?' and thus fall under Risk Management Process. It contains no specific facts, domain-adapted terminology, firm-specific details, or verifiable claims, making it generic boilerplate.


reasoning: The paragraph directly answers how third-party cyber risks are managed by describing generic assessment processes and contract requirements, fitting Third-Party Risk. It contains no specific facts, domain terms, firm-specific details, or verifiable claims, resulting in Generic Boilerplate specificity.


content_category: Board Governance

fact: vulnerability assessments

fact: threat environment

reasoning: The paragraph primarily answers how the board oversees cybersecurity through the Audit Committee and Board of Directors, making it Board Governance. It includes domain-specific terms like 'vulnerability assessments' and 'threat environment' that demonstrate cybersecurity expertise, elevating specificity to Level 2, but lacks firm-specific or verifiable facts.


content_category: Strategy Integration

reasoning: The paragraph primarily answers how cybersecurity affects the business by stating conclusions about materiality (both backward-looking and forward-looking), which aligns with Strategy Integration. It contains no specific, verifiable, or domain-adapted facts, only generic assertions about material impact, resulting in Generic Boilerplate specificity.


fact: Announcement date: October 28, 2023

fact: Incident adversely affected ability to ship orders in first quarter of fiscal 2024

fact: All facilities operational by mid-December 2023

fact: Expenses of $1.5 million related to the incident in first fiscal quarter of fiscal 2024

reasoning: The paragraph primarily answers 'What happened in a cybersecurity incident?' by describing a real event with specific dates, impacts, and expenses, making it Incident Disclosure. It contains verifiable facts such as the announcement date, resolution timeframe, and $1.5 million expense, elevating specificity to Quantified-Verifiable.


fact: malware, viruses, ransomware and phishing attacks

fact: monitor and develop our information technology networks and infrastructure

fact: prevent, detect, address and mitigate the risk of unauthorized access, misuse, computer viruses

reasoning: The paragraph primarily describes cybersecurity activities like monitoring and threat mitigation, aligning with Risk Management Process. It contains domain-specific terms (e.g., 'ransomware', 'phishing attacks') that demonstrate cybersecurity expertise, but lacks firm-specific or verifiable facts, resulting in Level 2 specificity.


fact: National Institute of Standards and Technology Cybersecurity Framework (NIST CSF)

reasoning: The paragraph describes the cybersecurity program's methodology by using the NIST CSF as a guide for risk identification and management, fitting Risk Management Process. Specificity is Domain-Adapted due to the mention of the NIST CSF, a named cybersecurity standard that demonstrates domain expertise.


reasoning: The paragraph directly answers how third-party cyber risks are managed by describing outsourcing of functions and reliance on the provider's cybersecurity, making Third-Party Risk the primary category. It contains no specific facts—only generic descriptions of outsourcing and risk considerations—resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes using external consultants to assess cybersecurity controls, which is an activity within the cybersecurity program, fitting Risk Management Process. It is generic boilerplate language with no specific, domain-adapted, or verifiable facts, resulting in Level 1 specificity.


fact: Cyber Risk Committee comprised of the CIO and other executive officers

fact: CIO has more than twenty years of experience

fact: CIO has been CIO since 2007

reasoning: The paragraph focuses on management organization, including the Cyber Risk Committee and the CIO's role and qualifications, fitting Management Role. Specificity is Level 4 due to verifiable facts like the CIO's experience duration and tenure start date.


fact: threat intelligence

reasoning: The paragraph primarily describes how executive leadership supervises cybersecurity efforts, answering the management organization question for the Management Role category. It includes domain-specific terminology like 'threat intelligence', which demonstrates cybersecurity expertise and elevates specificity to Domain-Adapted.


fact: CTO and CISO roles

reasoning: This paragraph primarily answers how the board oversees cybersecurity through the Audit Committee and reporting from management, making it Board Governance. It contains firm-specific facts like the CTO and CISO roles and domain terms such as vulnerability assessments, elevating specificity to Firm-Specific.


reasoning: The paragraph primarily describes the company's ongoing cybersecurity risk management activities, such as reviewing and updating systems and procedures to safeguard against threats, which aligns with Risk Management Process. It contains no specific facts, domain-adapted terms, firm-specific details, or verifiable claims, making it Generic Boilerplate.


fact: CISO has more than 20 years of experience

fact: dedicated CISO

fact: appointed by the RACC

fact: provide periodic reports to the RACC, at least quarterly

fact: CISO and CRO

fact: chair of the RACC

reasoning: The paragraph primarily describes board oversight through the RACC's appointment and monitoring of the CISO, making it Board Governance. It contains a verifiable fact about the CISO's experience (more than 20 years), setting specificity to Quantified-Verifiable.


reasoning: The paragraph provides generic background on cyber threats without describing any company-specific cybersecurity measures, processes, or assessments, fitting 'None/Other'. It uses common terms like 'malware' and 'viruses' but lacks firm-specific or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph states a conclusion about the materiality of cybersecurity threats on business outcomes, which aligns with Strategy Integration. It lacks any specific cybersecurity facts, domain-adapted terms, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a materiality conclusion (no material threats or incidents have occurred or are likely to affect it), which aligns with Strategy Integration. It contains no specific facts—only generic negative assertions and a cross-reference—resulting in Generic Boilerplate specificity.


reasoning: The paragraph directly addresses the management of cybersecurity risks with vendors and service providers, fitting the Third-Party Risk category, but it contains only generic language with no specific, verifiable, or firm-unique facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers what the cybersecurity program does by describing risk assessments as part of the risk management process, fitting the Risk Management Process category. The language is generic, using terms like 'risk assessments' and 'cybersecurity threats' that do not demonstrate domain expertise or contain firm-specific or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily describes cybersecurity risk assessments and network upgrades, which aligns with Risk Management Process activities; specificity is Level 1 as it contains no domain-adapted terms beyond generic references, no firm-specific facts, and no verifiable claims.


reasoning: The paragraph describes incident response procedures, which falls under Risk Management Process. It contains only generic language about having a defined procedure and written plan without any specific domain terms, firm-unique details, or verifiable claims, making it Level 1 specificity.


reasoning: The paragraph directly addresses how third-party cyber risks are managed through partnerships, engagements, and evaluations, making Third-Party Risk the central topic. It lacks any specific facts, using generic language that does not demonstrate cybersecurity expertise, firm-specific details, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating potential risks and asserting no incidents have occurred, which is an assessment of material impact (Strategy Integration). It contains no specific facts demonstrating domain expertise, firm-specific details, or verifiable claims; the language is generic and the negative assertion with a date is not externally verifiable, resulting in Generic Boilerplate specificity.


fact: Reference to Item 106 (a) of Regulation S-K

reasoning: The paragraph focuses on the company's process for assessing and managing cybersecurity risks, aligning with Risk Management Process. The specificity is Level 2 due to the reference to Item 106 of Regulation S-K, which demonstrates domain expertise in cybersecurity disclosure requirements.


reasoning: The paragraph describes components of the cybersecurity risk management program (e.g., risk assessments, offsite backups, external providers, training), directly answering what the program does, so it is Risk Management Process. It lacks any firm-specific details, verifiable claims, or domain-adapted terminology beyond generic risk management language, resulting in Generic Boilerplate specificity.


reasoning: The paragraph is a generic commitment to cybersecurity and a cross-reference to risk factors, not answering any substantive cybersecurity question (e.g., governance, processes, incidents), so it falls under None/Other. It contains no specific facts—only boilerplate language and a standard definition—resulting in Generic Boilerplate specificity.


fact: Detection of unauthorized occurrences on July 10, 2024

fact: Threat actor ejected from IT systems on July 10, 2024

reasoning: The paragraph describes a specific cybersecurity incident with detection and response actions, directly answering 'What happened?' making it Incident Disclosure. The inclusion of verifiable dates (July 10, 2024) for key events elevates specificity to Level 4.


fact: access controls

fact: firewalls

fact: vulnerability and patch management processes

fact: phishing tests

reasoning: The paragraph primarily describes the cybersecurity program's activities and controls, answering 'What does the cybersecurity program do?' which aligns with Risk Management Process. It demonstrates cybersecurity expertise through domain-specific terms like intrusion detection and prevention systems and phishing tests, but lacks firm-specific or verifiable facts, placing it at Domain-Adapted specificity.


fact: Chief Operating Officer and Chief Compliance Officer are responsible for assessing and managing material risks from cybersecurity threats

reasoning: The paragraph directly addresses management's organizational role in cybersecurity by naming specific responsible officers, fitting the Management Role category; the firm-specific roles elevate specificity to Level 3.


reasoning: The paragraph describes oversight reporting to a committee on cybersecurity risks and incidents, which primarily answers how the board oversees cybersecurity (Board Governance). It contains no specific facts, domain expertise, or verifiable claims, making it generic boilerplate.


reasoning: The paragraph directly answers how the board oversees cybersecurity through annual discussions and audit committee quarterly evaluations, fitting Board Governance. It contains no specific facts—only generic oversight cadences and standard governance structures—so specificity is Generic Boilerplate.


fact: All of the Company's executive officers are executive officers, directors and employees of Bimini.

reasoning: The paragraph primarily answers how cybersecurity risks are managed by relying on the Manager's processes, fitting Risk Management Process. It contains a verifiable fact about executive officers' affiliation with Bimini, elevating specificity to Level 4.


reasoning: The paragraph primarily answers how cybersecurity affects the business or finances by describing cybersecurity insurance coverage, which aligns with Strategy Integration. It contains no specific, verifiable, or firm-unique facts, making it generic boilerplate.


reasoning: This paragraph primarily serves as a cross-reference to risk factors in Item 1A, providing no substantive cybersecurity disclosure, so it is classified as None/Other. It contains no specific facts, using only generic language and a pointer to another section, resulting in Generic Boilerplate specificity.


fact: ransomware

specificity_confidence: medium

reasoning: The paragraph primarily answers how cybersecurity affects the business by stating no material impact to date and acknowledging potential future material impacts, which aligns with Strategy Integration. It contains domain-specific terminology like 'ransomware,' demonstrating cybersecurity expertise and elevating specificity to Level 2, but lacks firm-specific or verifiable facts.


reasoning: This paragraph is a cross-reference to risk factor disclosures in Item 1A, providing no substantive cybersecurity content, so it is classified as None/Other. With no specific facts present, it is Generic Boilerplate.


reasoning: The paragraph describes cybersecurity program activities like incident response operation and employee training, fitting Risk Management Process. It contains no specific facts beyond generic practices, with terms like 'incident response plan' failing the ERM test for domain expertise, resulting in Generic Boilerplate specificity.


reasoning: This paragraph is a cross-reference to Item 1A for cybersecurity risk disclosures, so it does not substantively answer any of the cybersecurity questions and is classified as 'None/Other'. It contains no specific facts, resulting in Generic Boilerplate specificity.


reasoning: This paragraph is a cross-reference to Item 1A Risk Factors for cybersecurity risk details, which falls under 'None/Other' as it does not substantively answer any of the six questions. It contains no specific facts about cybersecurity practices, roles, or incidents, leading to Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating no past incidents or financial impact and acknowledging future risks, which fits Strategy Integration under Rule 5. It contains no specific facts, domain-adapted terms, or verifiable claims, making it generic boilerplate.


reasoning: The paragraph primarily answers how the board oversees cybersecurity through periodic updates on frameworks and incidents, fitting Board Governance. It contains no specific facts—only generic terms like 'Information Technology department' and 'periodically'—resulting in generic boilerplate specificity.


reasoning: This paragraph is solely a cross-reference to a risk factor in Item 1A, containing no substantive cybersecurity disclosure, so it is classified as None/Other. It lacks any specific facts about cybersecurity practices, incidents, or governance, resulting in Generic Boilerplate specificity.


reasoning: The paragraph is a vague, high-level statement about cybersecurity governance and dedication without answering any specific substantive question, making it None/Other. It contains no specific facts—only generic terms like 'third-party assessments' and 'industry certifications'—resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes general technology dependence without addressing cybersecurity oversight, processes, or incidents, so it is classified as None/Other. It contains no specific facts, domain terms, or verifiable claims, resulting in Generic Boilerplate specificity.


fact: The members of our Board do not have experience in enterprise risk management, compliance, corporate governance, technology, or finance

reasoning: The paragraph directly answers how the board oversees cybersecurity, making it Board Governance. The specificity is Firm-Specific because it discloses a distinguishing negative fact about this company's board member qualifications.


reasoning: The paragraph directly addresses how third-party cyber risks are managed, fitting the Third-Party Risk category, but it contains no specific facts—only generic descriptions of a risk-based approach—resulting in Generic Boilerplate specificity.


reasoning: The paragraph directly addresses how third-party cyber risks are managed, fitting the Third-Party Risk category. It contains no specific facts, domain-adapted terms, firm-specific details, or verifiable claims, making it Generic Boilerplate.


reasoning: The paragraph describes generic IT services (vCIO services) without directly answering any cybersecurity-specific question about governance, risk management, or incidents, and it contains no verifiable or firm-specific facts, relying on broad terms like 'operational review' and 'IT policy/handbook'.


fact: Cybersecurity Committee

fact: ten years of cybersecurity experience

fact: thirty-five years of experience in various technology domains

reasoning: The paragraph primarily describes management roles and responsibilities for cybersecurity oversight, including executives, IT management, and a Cybersecurity Committee, fitting Management Role. It contains verifiable facts such as specific years of experience (ten years in cybersecurity, thirty-five years in technology domains), which elevate specificity to Quantified-Verifiable.


reasoning: The paragraph primarily describes the company's cybersecurity measures, such as implementing security technologies and disaster recovery processes, which aligns with the Risk Management Process category. It contains no specific facts—only generic risk mitigation language without verifiable, firm-specific, or domain-adapted details—resulting in Generic Boilerplate specificity.


reasoning: The paragraph centers on managing third-party cyber risks by engaging consultants and outlining future certification requirements for service providers, aligning with the TP category. It employs generic risk management language without any domain-adapted terms, firm-specific details, or verifiable claims, resulting in Level 1 specificity.


fact: continuous system monitoring

fact: threat detection

fact: cybersecurity assessments

fact: cybersecurity risks, threats or incidents

reasoning: The paragraph centers on managing third-party cyber risks through contracts and notification requirements, fitting Third-Party Risk. It employs domain-specific terms like 'continuous system monitoring' and 'threat detection,' demonstrating cybersecurity expertise but lacking firm-specific or verifiable facts, resulting in Level 2 specificity.


reasoning: The paragraph primarily describes board oversight and management responsibilities in cybersecurity risk governance, fitting Board Governance. It contains no specific facts, using only generic language with no verifiable or firm-specific details.


reasoning: The paragraph describes engaging third-party experts for risk management activities like audits and threat assessments, which is part of the cybersecurity program's operations (RMP). It contains no specific, verifiable, or firm-unique facts, making it generic boilerplate.


fact: Chief Information Security Officer

fact: Chief Technology Officer

fact: Chief Operations Officer

fact: over 25 years' experience in the field

reasoning: The paragraph primarily answers how management is organized for cybersecurity, focusing on the CISO's role, oversight, and qualifications, making it Management Role. It contains a verifiable fact (over 25 years of experience), which elevates specificity to Level 4.


fact: cyber readiness

fact: hardening environment, systems and infrastructure

reasoning: The paragraph primarily describes cybersecurity program activities such as internal audits, risk evaluation, system hardening, and employee training, which aligns with Risk Management Process. It contains domain-specific terms like 'cyber readiness' and 'hardening' that demonstrate cybersecurity expertise, but lacks firm-specific or verifiable facts.


reasoning: The paragraph describes a cybersecurity incident's impact and recovery, directly answering 'What happened?' for Incident Disclosure. Specificity is Generic Boilerplate because it uses vague terms like 'some systems' and 'a few days' with no verifiable facts, domain-adapted terminology, or firm-specific details.


reasoning: The paragraph primarily answers what the cybersecurity program does by describing its integration into enterprise risk management, fitting Risk Management Process. It contains no specific cybersecurity practices, firm-unique details, or verifiable facts, using only generic risk management language, resulting in Generic Boilerplate specificity.


fact: penetration testing firms

fact: threat intelligence service providers

fact: encryption and authentication technology

reasoning: The paragraph primarily describes third-party providers used in cybersecurity operations, which is part of the risk management process rather than focusing on third-party risk oversight. It contains domain-specific terms like penetration testing and threat intelligence, demonstrating cybersecurity expertise and elevating specificity to Level 2.


reasoning: The paragraph is a speculative risk disclosure about potential cybersecurity impacts without describing any actual governance, processes, or incidents, so it falls under None/Other. It contains no specific facts, making it Generic Boilerplate.


reasoning: The paragraph is a forward-looking disclaimer about the limitations of cybersecurity measures and cross-references a risk factor, providing no substantive disclosure about processes, roles, or incidents, so it falls under None/Other. It contains no specific facts—only generic statements like 'cybersecurity processes' and 'security measures'—resulting in Generic Boilerplate specificity.


reasoning: The paragraph is purely speculative about potential cybersecurity incidents and lack of insurance, with no description of actual cybersecurity measures, processes, or assessments, fitting None/Other. It contains no specific facts, leading to Generic Boilerplate specificity.


fact: CRO's data systems are 21 CFR 11 (Part 11) compliant

reasoning: The paragraph primarily addresses how the company manages cybersecurity risks through oversight and requirements imposed on its CROs, fitting Third-Party Risk. The mention of 21 CFR 11 compliance is a specific, verifiable fact that elevates specificity to Level 4.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a materiality assessment (no known risks likely to materially affect us), which aligns with Strategy Integration. It contains no specific facts—only generic management responsibility language and a non-verifiable negative assertion—resulting in Generic Boilerplate specificity.


reasoning: This paragraph is a cross-reference to risk factors in Item 1A, providing no substantive cybersecurity disclosure, so it falls under None/Other. It contains no specific cybersecurity facts, only generic reference language, making specificity Generic Boilerplate.


reasoning: The paragraph describes general cybersecurity risk management processes (assessing, identifying, managing risks, safeguards, tests, reviews), aligning with RMP. It contains no domain-specific terminology, firm-unique details, or verifiable facts, making it generic boilerplate.


reasoning: The paragraph focuses on board oversight of cybersecurity risks, specifically delegation to the Audit Committee, which aligns with Board Governance. It contains no specific facts, such as domain-adapted terms, firm-specific details, or verifiable claims, making it generic boilerplate.


reasoning: The paragraph is a generic acknowledgment of cybersecurity necessity without describing any specific measures, processes, or assessments, so it fits None/Other. It contains no specific facts—only vague statements about 'strong cybersecurity measures' and the CIA triad—resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers 'What does the cybersecurity program do?' by describing activities like risk assessment, monitoring, and tool usage, aligning with Risk Management Process. It contains no specific, verifiable, or firm-unique facts, using only generic risk management language that fails to demonstrate cybersecurity domain expertise or company-specific details.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating past incidents were immaterial and discussing potential future risks and expenditures, fitting Strategy Integration. No specific facts like domain terms, firm-specific details, or verifiable claims are present, making it Generic Boilerplate.


reasoning: The paragraph describes the company's cybersecurity program by stating it outsources IT and cybersecurity functions to a third party, which falls under Risk Management Process as it explains what the program does. Specificity is Generic Boilerplate because the statement is high-level and lacks any specific, verifiable, or firm-unique facts such as named entities, numbers, or domain-specific details that pass the ERM test.


fact: Executive Vice President of Technology role

fact: over 16 years of experience

fact: reports directly to the Chief Executive Officer

reasoning: The paragraph primarily answers how cybersecurity affects the business by concluding on material effects (Strategy Integration). Specificity is Quantified-Verifiable due to the verifiable claim of over 16 years of experience for the EVP of Technology.


reasoning: The paragraph centers on how third-party cyber risks are managed via engagement and certification requirements, but it lacks any specific facts, relying entirely on generic risk management language.


reasoning: This paragraph describes the audit committee's oversight role and information flow to the board, which directly answers how the board oversees cybersecurity, making it Board Governance. It contains no specific facts, domain expertise, or verifiable claims—only generic oversight language—resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a conclusion on material impact ('have not had a material impact'), which aligns with Strategy Integration. It contains no specific facts, domain terms, firm-specific details, or verifiable claims, consisting only of generic statements and a negative assertion, making it Generic Boilerplate.


reasoning: The paragraph directly answers how cybersecurity affects the business by stating no material threats were identified and discussing potential material impact, which aligns with Strategy Integration. It contains no specific facts, domain terms, or verifiable claims, making it generic boilerplate.


reasoning: The paragraph centers on managing third-party cyber risks through consultant engagement and certification requirements, but it uses generic language without specific domain terms, firm-unique details, or verifiable claims, resulting in Level 1 specificity.


fact: cybersecurity incident response plan ('CIRP')

reasoning: The paragraph describes cybersecurity program activities like threat intelligence, training, monitoring, vendor assessments, and incident response planning, fitting Risk Management Process. Specificity is Firm-Specific due to the named 'CIRP' identifier, a firm-unique fact.


fact: CISO has over 30 years of industry experience

fact: CISO joined Visa in November 2015

fact: President of Technology has over 30 years of experience

fact: President of Technology joined Visa in November 2013

fact: Reference to Zero Trust Architecture (domain term)

fact: Reference to VisaNet (firm-specific)

reasoning: The paragraph primarily answers how management is organized for cybersecurity by detailing the CISO and President of Technology's roles, qualifications, and responsibilities. It contains verifiable facts such as specific years of experience and joining dates, which elevate specificity to Level 4.


fact: information security

fact: risk management

fact: incident response

fact: forensic analysis

fact: regulatory compliance

fact: military veterans

fact: Master's degree in Cybersecurity

reasoning: The paragraph focuses on the cybersecurity leadership team's roles and qualifications, aligning with 'Management Role'. It includes verifiable facts like 'over 23 years of combined Cybersecurity experience' and 'Master's degree in Cybersecurity', elevating specificity to Level 4.


reasoning: The paragraph primarily answers how the board oversees cybersecurity by describing the Board's role in being informed of risk management processes and monitoring strategic risk exposure, with executive officers handling day-to-day management, fitting Board Governance. It contains no specific facts, domain terms, or verifiable claims, making it generic boilerplate.


fact: based on NIST and ISO frameworks

fact: addresses confidentiality, integrity, and availability of information systems

reasoning: The paragraph primarily describes the cybersecurity program's activities, such as using recognized frameworks and conducting risk assessments, which aligns with Risk Management Process. It contains domain-specific terms like NIST, ISO, and the CIA triad (confidentiality, integrity, availability), demonstrating cybersecurity expertise and elevating specificity to Domain-Adapted.


reasoning: The paragraph primarily describes the CEO's responsibilities in leading cybersecurity processes and reporting to the board, which aligns with Management Role. It uses generic language without cybersecurity domain expertise or firm-specific verifiable facts, resulting in Generic Boilerplate specificity.


fact: CIO

reasoning: The paragraph primarily answers how management is organized to handle cybersecurity, focusing on roles like the CIO coordinating with other executives, which aligns with Management Role. It contains the firm-specific fact 'CIO' (a VP-level cybersecurity role), elevating specificity to Firm-Specific.


fact: Director of Information Technology since June 2019

fact: Founder of a data privacy consulting company

fact: Over 20 years of experience in data management

fact: Processes include system alerts, real-time dashboards, status reports (daily, weekly, monthly), and communications with service providers about attack vectors and vulnerabilities

fact: Reports to Audit Committee

reasoning: The paragraph primarily answers how management is organized for cybersecurity, detailing Mr. Dennis's role, qualifications, and team processes. It contains verifiable facts like 'over 20 years of experience' and specific dates, elevating specificity to Level 4.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating no material impairment, which is a Strategy Integration assessment. It contains no specific facts—only a generic negative assertion and cross-reference—resulting in Generic Boilerplate specificity.


reasoning: The paragraph states a conclusion about cybersecurity impact by asserting no incidents occurred in 2024, which aligns with Strategy Integration per the materiality rule for negative assertions. It lacks any specific facts, containing only generic commitments and a non-verifiable negative claim, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how management is organized for cybersecurity, detailing senior management responsibilities and incident reporting processes, which fits Management Role. It contains no specific facts, domain-adapted terms, or verifiable claims, making it Generic Boilerplate.


reasoning: The paragraph is a negative assertion about the absence of material security breaches, which is a materiality assessment under Strategy Integration. It contains no specific facts, domain terms, or verifiable claims, making it Generic Boilerplate.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating no material incidents in the past two years and potential future impacts, which aligns with Strategy Integration. It contains no verifiable or domain-specific facts, relying on generic statements and unverifiable negative assertions, resulting in Generic Boilerplate specificity.


fact: detect, triage and eradicate

reasoning: The paragraph primarily answers how cybersecurity affects the business or finances by stating a materiality conclusion, making it Strategy Integration. It contains domain-specific terminology like 'triage,' which demonstrates cybersecurity expertise and elevates specificity to Level 2.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating that past threats have not materially affected it and discussing potential future material impacts, which aligns with Strategy Integration. It contains no specific facts, domain expertise, firm-specific details, or verifiable claims, making it generic boilerplate.


reasoning: The paragraph directly answers how cybersecurity affects the business through materiality assessments (backward- and forward-looking), fitting Strategy Integration. It contains no specific facts—only generic, self-assertive statements and a cross-reference—resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily describes the cybersecurity oversight chain from the CEO and executive management to the board, fitting Board Governance. It contains only generic language with no specific, verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily states a conclusion about the material impact of cybersecurity risks on business strategy and operations, which aligns with Strategy Integration. It contains no specific facts—only generic boilerplate language, disclaimers, and a cross-reference—resulting in Generic Boilerplate specificity.


reasoning: The paragraph directly assesses whether cybersecurity risks have materially affected or are reasonably likely to affect business outcomes, which is a core Strategy Integration question. It contains no specific, verifiable facts—only generic materiality assertions and vague insurance references, resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes the development and implementation of cybersecurity risk management processes, which directly answers 'What does the cybersecurity program do?' for the Risk Management Process category. It includes the domain-specific 'confidentiality, integrity and availability' triad, demonstrating cybersecurity expertise and elevating specificity to Domain-Adapted.


reasoning: The paragraph primarily answers whether cybersecurity has materially affected the business by stating no material incidents have occurred, which is a materiality assessment under Strategy Integration. It contains no specific facts, only generic statements and a non-verifiable negative assertion, resulting in Generic Boilerplate.


reasoning: The paragraph describes the activities of the cybersecurity program (e.g., risk assessments, training, incident response plan), fitting the Risk Management Process category. It uses generic language without any specific details, domain expertise, or verifiable facts, resulting in Generic Boilerplate specificity.


fact: cybersecurity incident response

fact: simulated incident scenario

fact: incident response program

reasoning: The paragraph primarily answers what the cybersecurity program does by detailing incident response processes and activities, such as team collaboration, escalation, and annual testing, which aligns with Risk Management Process. It demonstrates cybersecurity expertise through domain-specific terms like 'simulated incident scenario' and 'cybersecurity incident response,' supporting Level 2 specificity, but lacks firm-unique or verifiable facts for higher levels.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating that past incidents have not materially impaired operations and speculating on future impacts, which aligns with Strategy Integration under Rule 5. It contains no specific facts—only generic statements, negative assertions, and cross-references—resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily states the lack of formal cybersecurity programs and forward-looking intentions without describing any current substantive measures, fitting 'None/Other'. It contains no specific cybersecurity facts, domain-adapted terms, or verifiable claims, resulting in Generic Boilerplate specificity.


fact: over 30 years of experience in cybersecurity

fact: serving as a Security Officer while in the United States Navy

fact: CISO at Amgen and Warner Bros

fact: various other Cybersecurity roles at KPMG and Forrester

reasoning: This paragraph focuses on the CISO's responsibilities and career history, answering how management is organized for cybersecurity, thus classified as Management Role. It includes verifiable claims like specific years of experience and past roles at named organizations, elevating specificity to Level 4.


fact: January 2021 incident where improper access to third-party hosted IT systems occurred, compromising source code and credentials

reasoning: The paragraph primarily describes a past cybersecurity incident with specific details (e.g., January 2021 date, nature of compromise), fitting Incident Disclosure; the verifiable date elevates specificity to Level 4.


reasoning: The paragraph describes the oversight structure from the Board to the Audit Committee, which is a classic Board Governance topic. It contains no specific facts—only generic references to oversight functions and committees—resulting in Generic Boilerplate specificity.


reasoning: The paragraph centers on managing third-party cybersecurity risks via due diligence and contractual requirements, but it contains no verifiable facts, firm-specific details, or domain expertise beyond generic terms, resulting in Level 1 specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a conclusion on material impact and lack of cybersecurity insurance, fitting Strategy Integration. It contains no specific facts—only generic assertions about beliefs and insurance absence that are not verifiable or domain-specific, resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes the Board's strategic oversight and periodic updates from the CFO and CCO, directly answering how the board oversees cybersecurity (Board Governance). It contains no specific facts, domain-adapted terms, or verifiable claims, using only generic language about oversight and updates.


reasoning: The paragraph primarily answers whether cybersecurity has materially affected the company by stating no material incident occurred, which is a materiality assessment under Strategy Integration. It contains no specific facts about cybersecurity processes, roles, or verifiable claims, consisting only of a negative assertion and a cross-reference, making it generic boilerplate.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a materiality assessment (no incidents have materially affected us), which aligns with Strategy Integration. It contains no specific facts—all statements are generic or negative assertions, resulting in Generic Boilerplate specificity.


reasoning: This paragraph is a cross-reference to another section and does not provide any substantive cybersecurity disclosure, so it falls under None/Other. It contains no specific facts about cybersecurity, making it Generic Boilerplate.


fact: CISO works at the direction of the CDO

fact: CDO has more than 20 years of executive IT leadership experience

fact: CDO joined MPC in 2021

fact: CDO was employed by GE for over 20 years

fact: CDO was named Senior Vice President and Chief Information Officer of Services for GE in 2017

fact: CDO was named Vice President and Chief Information Officer of GE Healthcare

fact: CDO holds a Bachelor's degree in Business Administration, Management and Information Systems

reasoning: The paragraph describes management roles and reporting lines for cybersecurity, fitting Management Role. It contains multiple verifiable facts such as specific years of experience, employment dates, job titles, and educational details, elevating specificity to Quantified-Verifiable.


reasoning: The paragraph primarily discusses the general importance of cybersecurity and potential impacts of threats without describing any specific board governance, management roles, risk processes, third-party risk management, incidents, or strategy assessments, fitting the None/Other category. As a None/Other paragraph, it is assigned Generic Boilerplate specificity with no specific facts.


fact: cybersecurity assessments

fact: information technology and security programs

fact: design and operational effectiveness of information technology and security related controls

fact: information technology and security policies and procedures

reasoning: The paragraph centrally addresses how third-party cybersecurity risks are managed through assessments and evaluations, fitting the Third-Party Risk category. It uses domain-specific terminology such as 'design and operational effectiveness of controls,' demonstrating cybersecurity expertise, but lacks firm-specific or verifiable details, resulting in Domain-Adapted specificity.


fact: Clarium Managed Services, LLC conducted a Cybersecurity Assessment

fact: score of 4.8 on a scale of 0 to 5

reasoning: The paragraph primarily answers how cybersecurity affects the business by concluding no material impact on strategy, operations, or finances, making it Strategy Integration. It contains verifiable facts such as the named third-party assessor Clarium and a specific assessment score of 4.8, elevating specificity to Quantified-Verifiable.


reasoning: This paragraph is a forward-looking disclaimer and cross-reference to another section, providing no substantive cybersecurity disclosure about governance, processes, or incidents, so it is classified as None/Other. It contains no specific facts—only generic statements about past incidents and future risks—resulting in Generic Boilerplate specificity.


fact: SOC reports

reasoning: The paragraph primarily answers how third-party cyber risks are managed through assessments and monitoring, so it is classified as Third-Party Risk. The domain term 'SOC reports' demonstrates cybersecurity expertise, elevating specificity to Domain-Adapted.


reasoning: The paragraph directly answers how cybersecurity affects the business by concluding that no material threats were identified in 2024, which is a materiality assessment fitting Strategy Integration. It contains no specific facts beyond generic risk language and a non-verifiable negative assertion, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity impacts the business by stating a negative materiality conclusion and speculating on future risks, which aligns with Strategy Integration. It contains no specific facts—only generic assertions and a cross-reference—resulting in Generic Boilerplate specificity.


reasoning: The paragraph states a negative materiality conclusion about cybersecurity incidents, which aligns with Strategy Integration as it assesses business impact. It contains no specific facts about cybersecurity practices, incidents, or governance, making it generic boilerplate.


fact: ransomware attack on computer network

fact: occurred on April 28, 2023

fact: network returned to full operation on May 1, 2023

reasoning: The paragraph primarily answers 'What happened in a cybersecurity incident?' by describing a real ransomware attack with specific dates, making it Incident Disclosure. The verifiable dates (April 28, 2023, and May 1, 2023) and the specific incident type (ransomware) provide hard facts that elevate specificity to Quantified-Verifiable.


fact: confidentiality, integrity and availability (CIA triad)

fact: risk register

fact: penetration tests

fact: backup and recovery systems

fact: disaster recovery

reasoning: The paragraph primarily answers what the cybersecurity program does by describing activities like risk-based controls, penetration testing, and backup systems, aligning with Risk Management Process. It demonstrates cybersecurity expertise through domain terms such as 'CIA triad' and 'penetration tests,' but lacks firm-specific or verifiable facts, resulting in Domain-Adapted specificity.


fact: Members of senior management do not have direct cybersecurity expertise obtained through certifications

reasoning: This paragraph primarily answers how management is organized for cybersecurity by detailing senior management's responsibilities and qualifications, making it Management Role. The specificity is Firm-Specific due to the firm-specific fact that senior management lacks direct cybersecurity certifications, which distinguishes this company's management profile.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating materiality conclusions (e.g., 'have not materially affected' and 'are reasonably likely to materially affect'), which aligns with Strategy Integration. It contains no specific facts—only generic assertions and a cross-reference—resulting in Generic Boilerplate specificity.


fact: Deutsche Bank's Chief Security Officer has more than 20 years of experience in information security

fact: served as global Chief Information Security Officer (CISO) / CSO for three different large European financial institutions

fact: held a partner position in a global strategy and consulting firm

reasoning: This paragraph primarily answers how management is organized to handle cybersecurity by detailing the Chief Security Officer's qualifications and support structure, fitting the Management Role category. It contains verifiable facts such as 'more than 20 years' and specific roles held, which are independently confirmable, warranting Quantified-Verifiable specificity.


fact: CISO role

fact: served since 2015

fact: experience in application security

fact: experience in intrusion detection

fact: experience in penetration testing

fact: experience in complex threat modeling

fact: experience in unconventional cyber-attack vectors

fact: RCOC committee

reasoning: The paragraph primarily answers how management is organized for cybersecurity by detailing the CISO's leadership, experience, team oversight, and reporting to the RCOC, fitting Management Role. Specificity is Quantified-Verifiable due to the verifiable fact of the CISO serving since 2015 and domain-specific expertise terms.


fact: tabletop exercises

fact: threat modeling

fact: vulnerability testing

fact: information security maturity assessments

reasoning: The paragraph primarily describes cybersecurity program activities such as assessments and testing, aligning with Risk Management Process. It includes domain-specific terms like 'threat modeling' and 'vulnerability testing' that demonstrate cybersecurity expertise, but lacks firm-specific or verifiable details.


reasoning: The paragraph describes the board's delegation of cybersecurity risk oversight to the audit committee, answering how the board oversees cybersecurity (Board Governance). It contains only generic governance terms with no specific, firm-unique, or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a conclusion on material impact (e.g., not materially affected in the past), fitting Strategy Integration. Specificity is Generic Boilerplate because no verifiable or firm-specific facts are present; all statements are generic, self-assessed, or speculative.


reasoning: This paragraph is a cross-reference to another section and contains no substantive cybersecurity disclosure, making it None/Other. With no specific facts present, the specificity is Generic Boilerplate.


fact: firewalls

fact: intrusion prevention and detection systems

fact: anti-malware functionality

fact: access controls

fact: evaluations of security controls

fact: independent audits

reasoning: The paragraph primarily describes the cybersecurity program's activities, such as deploying technical safeguards and engaging third parties for evaluations, which aligns with Risk Management Process. Specificity is Domain-Adapted because it includes cybersecurity-specific terms like firewalls and intrusion detection systems that demonstrate domain expertise.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a backward-looking materiality conclusion (risks have not materially affected strategy, operations, or finances), which aligns with Strategy Integration. It contains no specific facts, only generic statements and a cross-reference, resulting in Generic Boilerplate specificity.


reasoning: The paragraph centers on managing cybersecurity risks from third-party service providers via a vendor program, directly answering the Third-Party Risk question. It lacks any specific facts, verifiable claims, or domain-adapted terminology, making it generic boilerplate.


reasoning: This paragraph is a cross-reference to risk factors in Item 1A and does not provide any substantive cybersecurity disclosure, so it is classified as None/Other. It contains no specific facts about the company's cybersecurity posture, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a materiality assessment (no material impact identified), which aligns with Strategy Integration. It contains no specific or verifiable facts, only generic assertions about risk and board oversight, resulting in Generic Boilerplate specificity.


fact: IT Committee

reasoning: The paragraph primarily answers what the cybersecurity program does by describing the IT Committee's regular meetings and engagement of experts for assessments, fitting Risk Management Process; the specific reference to 'our IT Committee' is a firm-specific fact that elevates specificity to Level 3.


reasoning: The paragraph describes the Audit Committee's oversight of cybersecurity risks, including briefing frequency and review of the enterprise risk management matrix, which directly answers how the board oversees cybersecurity (Board Governance). It contains only generic oversight language with no specific facts such as domain terms, firm-specific details, or verifiable claims, making it Generic Boilerplate.


reasoning: The paragraph directly answers how third-party cyber risks are managed by describing BNY Mellon's framework for evaluating and mitigating risks from service providers, fitting the Third-Party Risk category. It contains no specific facts—only generic language about frameworks, evaluations, and potential controls—resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business or finances by mentioning cyber liability insurance, which aligns with Strategy Integration. It contains no specific facts beyond a generic statement about maintaining insurance, with no verifiable details or domain expertise demonstrated, resulting in Generic Boilerplate specificity.


fact: enterprise risk management assessment program

fact: cybersecurity audits

reasoning: The paragraph primarily addresses how third-party cyber risks are managed through contractual requirements and inclusion in risk programs, fitting Third-Party Risk. Specificity is Domain-Adapted as it contains cybersecurity domain terms like 'cybersecurity-specific risk identification program' and 'cybersecurity audits', but lacks firm-specific or verifiable facts.


fact: CISO

fact: Risk and Compliance Committee

reasoning: The paragraph primarily answers how the board oversees cybersecurity through reporting structures from the CISO to the Risk and Compliance Committee and the Board, making it Board Governance. It contains firm-specific facts like the CISO role and the named Risk and Compliance Committee, which elevate specificity to Level 3.


reasoning: This paragraph is a cross-reference to Item 1A for additional information, providing no substantive cybersecurity disclosure, so it falls under None/Other. It contains no specific facts—only generic terms like 'cybersecurity' and 'governance'—making it Generic Boilerplate.


reasoning: The paragraph is purely a cross-reference to a risk factor in another section, providing no substantive cybersecurity disclosure, so it falls under None/Other. It contains no specific facts about cybersecurity practices, governance, or incidents, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers what the cybersecurity program does by describing risk management processes and third-party engagements, fitting Risk Management Process. It contains no specific facts, using generic risk management language without cybersecurity domain expertise or verifiable details, resulting in Generic Boilerplate specificity.


fact: Chief Technology Officer

fact: over 15 years of experience in software development and security architecture

fact: reports to and meets periodically with our General Counsel

reasoning: The paragraph primarily describes management organization for cybersecurity, focusing on the CTO's role and reporting lines, which fits Management Role. Specificity is Level 4 because it includes a verifiable claim of 'over 15 years of experience' that could be externally checked.


fact: 25 years of prior experience in the fields of information systems, cybersecurity, risk management, and infrastructure management

fact: holds master's and bachelor's degrees in both Computer Information Systems and Business Administration

fact: certifications: Certified Internal Controls Auditor (CICA), Payment Card Industry Professional (PCIP), Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA) and Certified in Risk and Information Systems Control (CRISC)

reasoning: This paragraph primarily answers how management is organized by detailing the CISO's responsibilities, experience, and certifications, making it Management Role. The specificity is Level 4 due to verifiable facts such as 25 years of experience and specific professional certifications that can be externally confirmed.


reasoning: The paragraph primarily answers how the board oversees cybersecurity, making it Board Governance, and it contains no specific facts—only generic oversight language without domain expertise, firm-specific details, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a materiality assessment (risks have not materially affected and are not expected to), which aligns with Strategy Integration. It contains no specific facts—only generic risk language and negative assertions—resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily addresses how third-party cyber risks are managed through assessments and contract measures, fitting Third-Party Risk. It lacks any specific, verifiable facts, with all statements being generic and not domain-adapted beyond basic ERM language.


fact: October 15, 2025 (date of incident discovery)

fact: Notification to the Federal Bureau of Investigation (FBI)

reasoning: The paragraph directly describes an actual cybersecurity incident with specific details like the date and law enforcement notification, fitting 'Incident Disclosure.' It contains verifiable facts (the date and FBI notification), setting specificity at Level 4.


fact: On February 23, 2023, DISH Network experienced a network outage

fact: on February 28, 2023, we further disclosed that certain data had been extracted

reasoning: This paragraph primarily describes a specific cybersecurity incident with verifiable dates and events, answering 'What happened?' and thus classified as Incident Disclosure. The presence of hard, externally verifiable facts (specific dates of outage and disclosure) sets the specificity to Quantified-Verifiable.


reasoning: The paragraph focuses on the roles and responsibilities of an IT employee and the CEO in monitoring and reporting cybersecurity risks, which aligns with Management Role. It contains no specific facts, domain-adapted terms, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating that risks have not materially affected the company, which is a Strategy Integration conclusion. It contains no specific facts—only generic references to defensive measures and a non-verifiable negative assertion—resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily describes how management (CEO and CFO) is organized to handle cybersecurity, including their responsibilities, experience, and meeting cadence, which aligns with Management Role. It contains no specific, verifiable facts such as quantified details, certifications, or firm-unique identifiers, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a materiality conclusion (no identified risks that have materially affected or are reasonably likely to materially affect the company), which aligns with Strategy Integration. It contains no specific facts, domain expertise, firm-specific details, or verifiable claims, making it generic boilerplate.


reasoning: The paragraph primarily describes the cybersecurity program's activities, such as risk assessment and monitoring, which answers 'What does the cybersecurity program do?' and fits the Risk Management Process category. It includes domain-specific terms like 'vulnerability scans and penetration tests,' indicating cybersecurity expertise and elevating specificity to Domain-Adapted, but lacks firm-specific or quantified-verifiable details.


reasoning: The paragraph centrally discusses managing cybersecurity risks from third-party service providers through diligence, monitoring, and contractual requirements, aligning with Third-Party Risk. It contains no specific facts—only generic processes and vague statements—resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes the board's oversight of cybersecurity investments, compliance, and legal counsel, fitting Board Governance. It uses generic language that could apply to any risk area, with no specific facts or domain expertise, resulting in Level 1 specificity.


reasoning: The paragraph primarily offers regulatory context and a cross-reference to another section, not answering any of the six substantive cybersecurity questions, so it is classified as None/Other. It contains no specific cybersecurity facts, making it Generic Boilerplate.


category_confidence: medium

reasoning: The paragraph describes the oversight structure with the Board responsible for cybersecurity risk oversight and management (CFO and CEO) responsible for practices, fitting Board Governance as a governance chain. It contains no specific facts beyond generic roles and an incomplete date reference, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily assesses the material impact of cybersecurity on the business, aligning with Strategy Integration. It contains no specific facts, using only generic statements about incidents, risks, and insurance without verifiable details.


reasoning: The paragraph states a conclusion that cybersecurity risks and incidents are not material to the business strategy or operations, which directly answers how cybersecurity affects the business (Strategy Integration). It contains no specific facts—only generic, non-verifiable assertions—resulting in Generic Boilerplate specificity.


reasoning: The paragraph centers on third-party risk management by detailing consultant engagement and security certification requirements, but it contains no specific domain terms, firm-unique details, or verifiable facts, making it generic boilerplate.


reasoning: The paragraph primarily answers what the cybersecurity program does by describing the incident response plan, fitting Risk Management Process. It contains no specific, verifiable, or firm-unique facts, making it generic boilerplate.


reasoning: The paragraph describes how the Committee reports cybersecurity review results to the Board, fitting Board Governance as it addresses oversight structure. It uses generic governance language with no specific cybersecurity details, domain-adapted terms, or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph only states that the company has third-party agreements for IT services and is exploring vendors for cybersecurity needs, which does not substantively answer any of the six cybersecurity questions (e.g., governance, roles, processes), making it None/Other. It contains no specific facts, domain-adapted terms, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph directly states a conclusion about the material impact of cybersecurity incidents on business outcomes, which aligns with Strategy Integration. It contains no specific facts, domain terms, or verifiable claims, making it generic boilerplate.


reasoning: The paragraph primarily serves as a cross-reference to risk factors in Item 1A, not answering any substantive cybersecurity questions, and contains no specific facts beyond generic statements, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily describes the cybersecurity program's components and reliance on external experts, answering 'What does the cybersecurity program do?' for Risk Management Process. It contains only generic language with no specific, verifiable, or firm-unique facts, making it Generic Boilerplate.


fact: February 2023 ransomware attack

reasoning: This paragraph directly describes a specific cybersecurity incident (ransomware attack in February 2023) and its remediation, fitting the Incident Disclosure category. The mention of the exact date provides a verifiable fact, setting specificity to Level 4.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating management's conclusion that no known risks are reasonably likely to materially affect the company, which aligns with Strategy Integration. It contains no specific facts, using generic language without verifiable details, domain expertise, or firm-specific information, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a conclusion that risks have not materially affected and are not reasonably likely to materially affect the company, which aligns with Strategy Integration. It contains no specific or verifiable facts, relying on generic assertions and a cross-reference to risk factors, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers what the cybersecurity program does by stating they have established a program to monitor and improve cybersecurity posture, fitting Risk Management Process. It contains no specific facts—only generic language about collecting information and having a program—making it generic boilerplate.


reasoning: The paragraph describes cybersecurity risk management processes, aligning with the Risk Management Process category. It uses generic language without specific details, domain expertise, or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph focuses on managing third-party cyber risks through vendor due diligence and ongoing monitoring, fitting the Third-Party Risk category. It uses generic risk management language without any domain-specific terms, firm-specific details, or verifiable facts, resulting in Level 1 specificity.


reasoning: The paragraph describes the governance chain for cybersecurity oversight, detailing information flow from the cybersecurity team to the CFO and escalation to senior management and the board, which aligns with Board Governance. It contains no specific or verifiable facts, using only generic corporate governance language, so specificity is Generic Boilerplate.


fact: June 2023

fact: two employees

fact: early September 2023

reasoning: The paragraph primarily answers 'What happened in a cybersecurity incident?' by describing a specific event in June 2023, including unauthorized access to email accounts, notification timing, and financial impact, making it Incident Disclosure. Specificity is Quantified-Verifiable due to verifiable facts such as the incident date, number of affected employees, notification timeframe, and incurred expenses.


fact: On February 23, 2023, network outage affecting internal servers and IT telephony

fact: On February 28, 2023, disclosure of data extraction from DISH Network IT systems

reasoning: The paragraph primarily answers 'What happened in a cybersecurity incident?' by detailing the February 2023 network outage and data extraction, making it Incident Disclosure. It contains specific, verifiable dates and event descriptions that an external party could confirm, elevating specificity to Level 4.


fact: Information Security Steering Committee (ISSC)

fact: executives from Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments

reasoning: This paragraph primarily answers how management is organized for cybersecurity by describing the cross-functional Information Security Steering Committee and its composition, fitting Management Role. The specificity is Firm-Specific due to the named committee and specific departmental list, which distinguish this company's setup.


fact: insurance coverage for liability

fact: insurance coverage for privacy and regulatory actions

fact: insurance coverage for incident response

fact: insurance coverage for business interruption

fact: insurance coverage for data recovery

fact: insurance coverage for hardware replacement

fact: insurance coverage for extortion

fact: insurance coverage for reputational harm

reasoning: This paragraph primarily answers how cybersecurity affects the business through financial protection via insurance, aligning with Strategy Integration. The specificity is Domain-Adapted because it lists specific insurance coverage types that demonstrate cybersecurity domain knowledge, but lacks firm-specific or verifiable facts.


fact: Reference to specific risk factor: 'Security breaches and other disruptions to our information technology infrastructure could interfere with our operations and expose us to liability'

fact: Reference to specific section: 'Item 1, Business – Environmental and Other Regulations – Safety Management System Requirements'

reasoning: The paragraph primarily describes cybersecurity program activities (developing, maintaining, monitoring, and updating protocols and systems), aligning with Risk Management Process. It contains verifiable cross-references to specific risk factors and sections in the filing, elevating specificity to Level 4.


reasoning: The paragraph primarily answers how cybersecurity threats materially affect the business through backward-looking and forward-looking assessments, fitting Strategy Integration. It contains no specific facts, using only generic materiality language and unverifiable negative assertions, resulting in Generic Boilerplate specificity.


fact: cyber crisis response plan

fact: threat intelligence feeds

fact: vulnerability management

reasoning: The paragraph primarily describes the cybersecurity program's incident response and training activities, fitting Risk Management Process. Specificity is Domain-Adapted due to cybersecurity-specific terms like 'threat intelligence feeds' and 'vulnerability management' that demonstrate domain expertise.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a conclusion on materiality (no material impact to date, but elevated future risks), fitting Strategy Integration. It contains no specific facts—only generic statements about threats and risks—resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business by concluding that no material impacts have occurred or are likely, which is a Strategy Integration disclosure. It contains no specific facts, using only generic language about board oversight and risk assertions, so specificity is Generic Boilerplate.


fact: patches

fact: security configurations

fact: vulnerability scanning

fact: intrusion detection tools

reasoning: The paragraph describes specific cybersecurity activities like applying patches and updating vulnerability scanning tools, which directly answers what the cybersecurity program does, making it Risk Management Process. It uses domain-specific terminology such as 'intrusion detection tools,' indicating Level 2 domain expertise.


fact: March 31, 2023 (specific date of system restoration)

fact: DISH TV, SLING TV, Retail Wireless services (firm-specific entities)

reasoning: The paragraph primarily answers what happened during a cybersecurity incident by describing operational status and restoration, fitting Incident Disclosure. The specific date 'March 31, 2023' is a verifiable fact, and the named services are firm-specific, setting specificity at Level 4.


reasoning: This paragraph primarily answers how the board oversees cybersecurity through the audit committee's reporting and oversight structure, making it Board Governance. It contains no specific facts beyond generic oversight language, with no domain-adapted terms, firm-specific details, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity risks could materially affect the business, with a forward-looking statement on potential impact and a cross-reference to risk factors, fitting Strategy Integration. It contains no specific facts, using generic language like 'significant time and resources' and standard disclaimers, resulting in Generic Boilerplate specificity.


reasoning: The paragraph centers on managing cybersecurity risks from third-party vendors, making Third-Party Risk the primary category. It contains no verifiable or firm-specific facts, using only generic risk management language, so specificity is Generic Boilerplate.


reasoning: This paragraph describes the Audit Committee's oversight of cybersecurity risks, fitting the Board Governance category. It contains no specific facts, using generic language that does not demonstrate cybersecurity expertise or provide verifiable details, resulting in Generic Boilerplate specificity.


reasoning: The paragraph states a conclusion that cybersecurity threats have not materially affected the business, which is a backward-looking assessment fitting Strategy Integration. It contains no specific facts such as domain terms, firm-specific details, or verifiable claims, only a generic negative assertion, so specificity is Generic Boilerplate.


fact: vulnerability assessments

reasoning: The paragraph focuses on how the board and Audit Committee oversee cybersecurity risk management, which aligns with Board Governance. Specificity is Level 2 because it includes domain-adapted terms like 'vulnerability assessments,' demonstrating cybersecurity expertise, but lacks firm-specific or verifiable facts.


reasoning: The paragraph directly answers how cybersecurity affects the business by concluding that no material incidents occurred in 2023, which aligns with Strategy Integration. It contains no specific facts—the negative assertion is not verifiable, and the language is generic, resulting in Generic Boilerplate specificity.


reasoning: The paragraph centers on managing cybersecurity risks from third-party technology service providers through outreach to ascertain breach implications, aligning with Third-Party Risk. It lacks any specific facts, measures, or verifiable claims, rendering it generic boilerplate.


fact: DISH TV and SLING TV services (firm-specific services)

fact: As of March 31, 2023 (specific, verifiable date tied to system restoration)

reasoning: This paragraph primarily describes the status and timeline of a cybersecurity incident, including service continuity and system restoration, making it Incident Disclosure. It contains a verifiable date (March 31, 2023) and firm-specific service names, elevating specificity to Level 4.


reasoning: The paragraph centers on managing cybersecurity risks from third-party providers via due diligence and contractual measures, aligning with Third-Party Risk. It contains no specific facts—only generic descriptions of processes—resulting in Level 1 specificity.


fact: CISO role responsible for information security program

fact: CRO role overseeing risk function including information security

fact: CISO has over 18 years of experience in information technology leadership

fact: CISO has eight years of experience in leading information security oversight

reasoning: This paragraph primarily answers how management is organized for cybersecurity, focusing on the CISO's responsibilities, reporting lines, and qualifications. It contains verifiable claims about the CISO's years of experience, which are externally checkable facts, elevating specificity to Quantified-Verifiable.


reasoning: The paragraph lists cybersecurity-related organizations without describing any substantive governance, management roles, risk processes, incidents, or strategy, so it fits None/Other. As a None/Other paragraph, it is assigned Generic Boilerplate specificity by rule.


reasoning: The paragraph is solely a cross-reference to the Risk Factors section, providing no substantive cybersecurity disclosure, so it is classified as None/Other. It contains no specific facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph centers on managing cybersecurity risks from third-party vendors, making Third-Party Risk the primary category. It lacks specific facts such as domain-adapted terms, firm-specific details, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph provides a general overview of cybersecurity threats and states that resources are expended on risk management, strategy, and governance, but it does not answer any of the six substantive questions (e.g., board oversight, management roles, specific processes), so it falls under 'None/Other.' It contains no specific facts—only generic threat descriptions and vague resource claims—resulting in Generic Boilerplate specificity.


fact: Security & Technology Committee

reasoning: The paragraph describes how the board and a committee receive information on cybersecurity incidents, answering the question of board oversight, so it is Board Governance. The named 'Security & Technology Committee' is a firm-specific fact, elevating specificity to Firm-Specific.


reasoning: This paragraph addresses board governance by describing management's reporting to the audit committee on cybersecurity risks, which is part of oversight structure. It contains no specific facts—only generic references to 'members of management' and 'audit committee'—so it is classified as generic boilerplate.


fact: CTO (Chief Technology Officer)

fact: Senior Vice President, Chief Financial Officer and Treasurer

fact: Senior Vice President, General Counsel and Corporate Secretary

fact: Senior Vice President, Chief Accounting Officer

fact: approximately 20 years or more of experience managing risks

reasoning: This paragraph primarily describes senior management roles and their qualifications for handling cybersecurity risks, aligning with the Management Role category. The specificity is Level 4 because it includes a verifiable quantified claim about experience duration ('approximately 20 years or more'), which is an externally checkable fact.


fact: March 2023

fact: $2.7 million of loss

reasoning: This paragraph directly describes a real cybersecurity incident from March 2023, including discovery, response, and financial impact, fitting Incident Disclosure. It contains verifiable facts such as the specific date and loss amount, making it Quantified-Verifiable.


reasoning: The paragraph focuses on vendor due diligence factors for managing third-party cyber risks, fitting the Third-Party Risk category. It lacks any firm-specific or verifiable facts, containing only generic risk management terms, resulting in Level 1 specificity.


fact: successful phishing attempt

reasoning: The paragraph primarily answers how cybersecurity affects the business by concluding that current risks are not reasonably likely to have a material effect, making it Strategy Integration. Specificity is Level 4 due to the verifiable fact 'in 2019' (a specific year tied to an incident) and the domain term 'phishing attempt', which demonstrates cybersecurity expertise.


fact: network security

fact: data encryption

fact: large language models

fact: artificial intelligence systems

reasoning: The paragraph primarily describes cybersecurity measures and activities (e.g., network security, data encryption, AI-related protections), aligning with Risk Management Process, though it briefly mentions board oversight. It contains domain-specific terms that demonstrate cybersecurity expertise, elevating specificity to Level 2.


reasoning: The paragraph centrally addresses how third-party cyber risks are managed through evaluation, contractual requirements, and vendor onboarding reviews, fitting Third-Party Risk. It lacks any specific, verifiable, or firm-unique facts, containing only generic risk management language, resulting in Generic Boilerplate specificity.


fact: CDO reports to the CEO

fact: CDO has over 20 years of experience

fact: CDO holds an MBA from Ecole Supérieure de Commerce de Chambéry, Rhône-Alpes, France

fact: Interim CISO has nearly 20 years of experience

fact: Interim CISO holds a bachelor's degree from Miami University

reasoning: The paragraph focuses on management roles, detailing the CDO and interim CISO's responsibilities, reporting lines, and qualifications, which aligns with the Management Role category. It contains verifiable facts such as specific years of experience and educational credentials, elevating specificity to Quantified-Verifiable.


fact: Energy Transfer's Chief Information Officer has over 35 years of experience

fact: Energy Transfer IT team has over 50 years of combined experience with 20 years dedicated to cybersecurity

fact: Team holds GICSP, CISSP, and CEH certifications

fact: USAC's IT leadership team has an average of over 25 years in IT operations and over 10 years in IT security

reasoning: The paragraph primarily answers how management is organized for cybersecurity, detailing roles, experience, and qualifications, so it is Management Role. It contains verifiable facts such as specific years of experience and named certifications, making it Quantified-Verifiable.


fact: Marco Technologies is the Managed IT provider

fact: Red Canary provides 24/7 monitoring on all endpoints

fact: High Point Networks provides physical and cloud-based network data backup solutions

fact: Return to Operations objectives of less than 24 hours

fact: Monthly cybersecurity trainings provided by Marco Technologies and required for all Advisor personnel

reasoning: The paragraph centers on how third-party providers are used to manage cybersecurity risks, answering the Third-Party Risk question. It includes verifiable facts like named providers and specific operational targets (e.g., less than 24-hour recovery), setting specificity at Level 4.


reasoning: This paragraph directly states that cybersecurity threats are reasonably likely to materially affect business operations and finances, which aligns with Strategy Integration's focus on materiality assessments. It contains no specific facts, domain-adapted terms, or verifiable claims, making it generic boilerplate.


reasoning: The paragraph focuses on board and Audit Committee oversight of cybersecurity, which is core to Board Governance. It includes the firm-specific fact of a Vice President and Chief Information Security Officer (CISO) role, elevating specificity to Level 3.


fact: Incident occurred early in Fiscal 2024

fact: Recognized $2.7 million of loss net of recoveries and fees

reasoning: The paragraph primarily answers 'What happened in a cybersecurity incident?' by detailing a specific fraud scheme in Fiscal 2024, including discovery, response, and financial loss, so it is Incident Disclosure. The specificity is Quantified-Verifiable due to the $2.7 million loss figure, which is a hard, externally verifiable fact.


reasoning: The paragraph centrally addresses how third-party cyber risks are managed, fitting the Third-Party Risk category. However, it contains no specific facts—only generic language about risk-based approaches and monitoring—resulting in Level 1 specificity.


reasoning: The paragraph is a generic disclaimer about cybersecurity risks without describing any specific measures, processes, or incidents, so it falls under None/Other. As a None/Other paragraph, it is assigned Generic Boilerplate specificity.


reasoning: The paragraph directly addresses how third-party cyber risks are managed through assessments and monitoring, making Third-Party Risk the primary category. It contains no specific facts beyond generic processes, with no domain-adapted terms, firm-specific details, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph centers on managing cybersecurity risks from third parties via contractual addenda and incident reporting requirements, fitting Third-Party Risk. However, it contains only generic risk management language without any domain-specific terminology, firm-specific details, or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph centers on third-party risk management by describing vendor engagement for risk assessments and imposing certification and breach reporting requirements, but it lacks any specific, verifiable, or domain-adapted facts, rendering it generic boilerplate.


reasoning: The paragraph directly answers how third-party cyber risks are managed through diligence, monitoring, and contractual requirements, making Third-Party Risk the primary category. It lacks any specific, verifiable, or firm-unique facts, using only generic process descriptions that do not demonstrate cybersecurity expertise or company-specific details.


reasoning: The paragraph directly addresses how third-party cyber risks are managed through vendor diligence and risk assessment, fitting Third-Party Risk. It contains no specific facts, domain-adapted terms, or verifiable claims, making it generic boilerplate.


reasoning: The paragraph describes a management role's career history without any reference to cybersecurity, so it does not answer any of the substantive cybersecurity questions, making it 'None/Other'. It contains no specific cybersecurity facts, leading to Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how management is organized for cybersecurity by detailing the Director, IT's responsibilities, fitting Management Role. It contains no specific facts, domain-adapted terms, firm-specific details, or verifiable claims, making it generic boilerplate.


reasoning: This paragraph is a cross-reference to the Risk Factors section and does not answer any substantive cybersecurity question, so it is classified as None/Other. It contains no specific facts, only generic boilerplate language, resulting in Generic Boilerplate specificity.


reasoning: This paragraph primarily answers how the board oversees cybersecurity by describing the Board's consideration of risk and delegation to the Audit Committee, fitting Board Governance. It contains no specific facts—only generic governance terms like 'Board of Directors' and 'Audit Committee'—resulting in Generic Boilerplate specificity.


reasoning: This paragraph is a cross-reference to risk factors and does not provide substantive cybersecurity disclosure, so it is classified as None/Other. It contains no specific facts about cybersecurity measures or incidents, resulting in Generic Boilerplate specificity.


fact: risk assessments

fact: risk reduction initiatives

fact: external auditor feedback

fact: control maturity assessments

fact: cybersecurity incidents

fact: prevention, detection, mitigation, and remediation

fact: CIO/CDO

reasoning: The paragraph describes the Board and Audit Committee's oversight structure for cybersecurity, fitting Board Governance. It includes firm-specific details like the CIO/CDO role, elevating specificity to Firm-Specific.


fact: Chief Business Officer

reasoning: The paragraph primarily answers how the board oversees cybersecurity through the Audit Committee's direct oversight and update processes, making it Board Governance. It contains a firm-specific fact—the Chief Business Officer's role in cybersecurity updates—which elevates specificity to Level 3.


reasoning: The paragraph addresses how the board oversees cybersecurity by describing Audit Committee education and expertise, fitting Board Governance. It lacks any specific, verifiable facts about cybersecurity practices or firm-specific details, making it generic boilerplate.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a materiality assessment (no material impacts or likely impacts), which aligns with Strategy Integration. It contains no specific facts, only generic disclaimers and a non-verifiable negative assertion, resulting in Generic Boilerplate specificity.


reasoning: The paragraph directly addresses how third-party cyber risks are managed through pre-contract assessments and contract terms, aligning with the Third-Party Risk category. It describes generic processes without any domain-specific terminology, firm-unique details, or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how third-party cyber risks are managed, focusing on risk-based approaches and due diligence for service providers. It lacks any domain-specific, firm-specific, or verifiable facts, using only generic business language.


reasoning: This paragraph is a cross-reference to Item 1A and does not answer any substantive cybersecurity question, so it is classified as None/Other. It contains no specific facts about cybersecurity practices, roles, or incidents, resulting in Generic Boilerplate specificity.


fact: Security maturity assessment conducted by Kroll in November 2022

fact: Tabletop exercises with Kroll in September 2023

reasoning: This paragraph primarily answers what the cybersecurity program does by detailing activities like security assessments, implementation of solutions, and incident response exercises, fitting Risk Management Process. Specificity is Quantified-Verifiable due to verifiable facts including specific dates (November 2022, September 2023) and engagement with the named firm Kroll.


fact: managed security service monitoring

fact: penetration testing

fact: vulnerability assessment

fact: Management Enterprise Risk Committee

fact: Vendor Management Committee

reasoning: The paragraph centers on managing third-party cyber risks through vendor oversight and due diligence, fitting Third-Party Risk. It includes firm-specific committee names and domain-specific cybersecurity practices, raising specificity to Firm-Specific.


reasoning: The paragraph primarily answers how cybersecurity is overseen by describing support from the Board, Audit Committee, and senior leadership, fitting Board Governance. It contains no specific facts—only generic governance roles and vague process language—making it Generic Boilerplate.


fact: CISO reports to CIO

fact: CISO has over 20 years of experience in IT and information security

fact: Undergraduate degree in Information Systems from Xavier University

fact: MBA from Michigan State

fact: Over 25 IT and Cybersecurity certifications

fact: Certifications include CISSP, CCSP, and CISM

reasoning: The paragraph primarily describes management organization and qualifications for cybersecurity, fitting 'Management Role'. It contains multiple verifiable facts such as years of experience, specific degrees, and certifications, elevating specificity to Quantified-Verifiable.


fact: February 2023 cyberattack

reasoning: The paragraph primarily addresses how cybersecurity incidents affect business and finances through a materiality assessment, referencing a specific past event (February 2023 cyberattack) that is externally verifiable, driving the specificity to Level 4.


fact: Chief Information Officer (CIO) role

fact: 25 years of experience in the information technology industry

fact: CIO reports to the Chief Executive Officer

fact: dedicated cybersecurity team within information systems department

fact: multidisciplinary incident response team

reasoning: The paragraph primarily answers how the board oversees cybersecurity through governance structures, fitting Board Governance. It contains verifiable facts like the CIO's 25 years of experience, elevating specificity to Quantified-Verifiable.


fact: malware, ransomware, computer viruses

reasoning: The paragraph states a materiality conclusion about cybersecurity impacts (no identified material effects), which directly answers how cybersecurity affects the business, fitting Strategy Integration. It includes domain-specific threat terms like 'malware, ransomware, and computer viruses,' demonstrating cybersecurity expertise and elevating specificity to Domain-Adapted.


reasoning: This paragraph is a cross-reference to risk factors in Item 1A, providing no substantive cybersecurity disclosure, so it is classified as None/Other. As a cross-reference with no specific facts, it is Generic Boilerplate.


fact: cloud-based technology

fact: security questionnaires

fact: information security addenda

fact: audits and compliance reviews

fact: network infrastructure

reasoning: The paragraph centers on managing cybersecurity risks from third-party service providers through a dedicated program, which directly answers the Third-Party Risk question. The specificity is Domain-Adapted because it includes cybersecurity-specific practices like security questionnaires and information security addenda, demonstrating domain expertise, but lacks firm-specific or verifiable details.


fact: vulnerability assessments

fact: third-party evaluations

fact: January 2024 board cybersecurity training session

reasoning: This paragraph primarily describes the audit committee's oversight of cybersecurity delegated by the board, fitting Board Governance. The specificity is Quantified-Verifiable because it includes the verifiable fact of a board training session in January 2024.


fact: September 14, 2023 (specific date of announcement, verifiable externally)

fact: social engineering attack (cybersecurity domain term)

fact: outsourced IT support vendor (firm-specific detail about the incident vector)

fact: loyalty program database (firm-specific data affected)

fact: activated IRP (Incident Response Plan, domain term)

reasoning: The paragraph describes a real cybersecurity incident, including its nature, detection, and response, fitting 'Incident Disclosure.' Specificity is Level 4 due to the verifiable date (September 14, 2023) and other concrete details like the attack method and data involved.


reasoning: The paragraph describes a real cybersecurity incident with a specific date (June 30, 2024), directly answering 'What happened in a cybersecurity incident?' for Incident Disclosure. The verifiable date fact elevates specificity to Quantified-Verifiable.


reasoning: The paragraph describes using third-party service providers to assist with identifying, assessing, and managing cybersecurity risks, which aligns with the Risk Management Process category as it focuses on activities rather than third-party risk oversight. It contains no specific facts, domain expertise, or verifiable details, making it generic boilerplate.


reasoning: The paragraph describes the Board's delegation of cybersecurity oversight to the Audit Committee and reporting mechanisms, which directly answers how the board oversees cybersecurity (Board Governance). It contains no specific facts—only generic governance language with no domain expertise, firm-specific details, or verifiable claims—resulting in Generic Boilerplate specificity.


fact: Change Healthcare, a subsidiary of UnitedHealth Group, experienced a cybersecurity incident

fact: UnitedHealth Group issued a statement on March 7, 2024

fact: Expected restoration of service beginning March 18, 2024

fact: Bioventus's Exogen device is affected

reasoning: The paragraph primarily discloses a specific cybersecurity incident involving Change Healthcare, detailing its impact on Bioventus's billing processes and remediation efforts, which aligns with Incident Disclosure. It contains verifiable facts such as named entities (Change Healthcare, UnitedHealth Group) and specific dates (March 7 and March 18, 2024), making it Quantified-Verifiable.


fact: penetration testing firms

fact: managed cybersecurity service providers

reasoning: The paragraph primarily answers what the cybersecurity program does by describing the use of third parties for risk identification and management, fitting Risk Management Process. Specificity is Domain-Adapted due to cybersecurity-specific terms like 'penetration testing firms' that demonstrate domain expertise beyond generic risk management language.


fact: vulnerability scanning (internal and external)

fact: penetration testing

fact: threat intelligence monitoring

fact: risk assessment framework with likelihood and impact categorization

fact: third-party vendor risk assessment including reviewing security policies, certifications, third-party attestation, and security questionnaires

reasoning: The paragraph answers 'What does the cybersecurity program do?' by detailing activities like vulnerability scanning and penetration testing, fitting Risk Management Process. Specificity is Level 2 because it uses domain-specific cybersecurity terms but lacks firm-unique or verifiable facts.