reasoning: The paragraph serves as a general introduction to the topic of cybersecurity, stating broad principles about the importance of information security without describing any specific governance, management, processes, incidents, or strategic impacts. It does not answer any of the six substantive questions and instead sets the stage for subsequent disclosures. Specificity is Generic Boilerplate because the content consists of vague, non-substantive statements that lack any domain-specific terminology, firm-specific details, or verifiable facts.


content_category: Management Role

fact: Chief Security and Trust Officer reports to Executive Vice President, Operations

fact: Chief Security and Trust Officer has over 25 years of experience in information technology and information security

category_confidence: high

specificity_confidence: high

reasoning: The paragraph primarily describes the role, reporting structure, and qualifications of the Chief Security and Trust Officer, focusing on management-level responsibilities and experience, which aligns with Management Role. The mention of 'extensive cybersecurity experience' and 'over 25 years' in IT and information security provides a verifiable, firm-specific claim that supports Level 4 specificity.

provider: qwen

stage: benchmark


fact: CSO reports to the CFO

fact: CSO has served in that role since 2018

reasoning: The paragraph primarily describes the role, responsibilities, reporting line, and qualifications of the CSO, which answers the question of how management is organized to handle cybersecurity. The mention of the CSO's experience and tenure elevates specificity to Level 4 due to the verifiable claim of 'over 14 years of global executive cybersecurity experience'.


content_category: Board Governance

fact: Corporate Risk Committee of the Board oversees information technology systems, including information security, compliance and privacy

fact: Audit Committee oversees adequacy and effectiveness of controls and procedures for cybersecurity risks

fact: CIO and/or CISO report on cybersecurity matters to the Corporate Risk Committee at least bi-annually

fact: CIO provides updates to the Board of Directors annually or more frequently as appropriate

fact: ERM team reports annually on company risks, including cybersecurity mitigation progress and risk conditions

reasoning: The paragraph primarily describes how the Board of Directors and its committees (Corporate Risk Committee and Audit Committee) oversee cybersecurity and related risks, including reporting cadences and responsible officers (CIO, CISO), which directly answers 'How does the board oversee cybersecurity?' This is a governance-chain structure focused on board-level oversight. Specificity is driven by firm-specific roles (CIO, CISO, Corporate Risk Committee) and reporting relationships that distinguish the company’s governance model.


content_category: Third-Party Risk

fact: periodically conducts assessments of the third-party service providers' security frameworks

fact: security measure protocols that are appropriately and proportionally tailored to the corresponding risks

reasoning: The paragraph primarily answers how Tredegar manages cyber risks associated with third-party service providers, focusing on their responsibility for security measures and Tredegar's periodic assessments of those providers' security frameworks—making Third-Party Risk the dominant category. Specificity is elevated to Level 2 due to the use of domain-specific concepts like 'security measure protocols,' 'security frameworks,' and 'assessments' in the context of third-party risk, which reflect cybersecurity expertise beyond generic risk management language.


content_category: Strategy Integration

reasoning: The paragraph primarily addresses whether cybersecurity has or could materially affect the company's business strategy, operations, or financial condition, which aligns with Strategy Integration under Rule 5. It includes a backward-looking negative assessment ('not aware of any...material impact') and a forward-looking statement about reasonably likely material effects, both of which constitute materiality assessments. Specificity is Generic Boilerplate because the content consists of standard disclaimers and cross-references without any domain-specific terms, firm-specific details, or verifiable facts.


fact: Chief Risk Officer

reasoning: The paragraph primarily describes the role of the Chief Risk Officer in the company's risk management structure, focusing on their specialized expertise and oversight, which centers on management's organizational responsibility rather than board-level governance. The specificity is elevated to Level 3 due to the mention of a firm-specific leadership role (Chief Risk Officer), which distinguishes this company's cybersecurity posture.


fact: Audit Committee receives cybersecurity updates on a quarterly basis

fact: Audit Committee receives IT security/cybersecurity briefing from management at least semi-annually

fact: Full Board receives updates on Cybersecurity Program and cybersecurity risks at least annually

fact: Vice President of Cybersecurity participates in briefings to the Audit Committee

reasoning: The paragraph primarily describes how the Board and its Audit Committee oversee cybersecurity risks, including the frequency and nature of briefings, which directly answers the question of board-level oversight. Specificity is driven by firm-specific roles and reporting cadences, including the named involvement of the Vice President of Cybersecurity and structured update cycles.


content_category: None/Other

reasoning: The paragraph primarily consists of generic risk disclosures and forward-looking speculation about potential cybersecurity failures and their possible consequences, which are standard across 10-K filings. It does not describe any specific governance, management structure, risk processes, third-party oversight, incident details, or strategic integration beyond stating hypothetical material adverse effects. The specificity is low because it contains only boilerplate language and no verifiable facts, firm-specific details, or domain-adapted terminology beyond repeated references to Regulation S-K definitions.


content_category: Incident Disclosure

fact: February 21, 2024, Change Healthcare notified us of a cybersecurity incident

fact: Change Healthcare, a subsidiary of UnitedHealth Group, processed payment claims for all payors

fact: We severed business service connections with Change Healthcare in response

fact: We conducted forensics on our systems and did not identify any compromise

fact: The incident disrupted our ability to submit claims for payment for a period of time

fact: The disruption did not materially affect our business strategy, results of operation or financial condition

reasoning: The paragraph primarily answers 'What happened in a cybersecurity incident?' by detailing the Change Healthcare incident, its impact on Encompass Health, the response actions taken (severing connections, conducting forensics), and the operational disruption to claims submission. Although it includes a conclusion about materiality, the dominant frame is the description of a real, specific incident and its effects, which aligns with Incident Disclosure. Specificity is driven by verifiable facts including a specific date (February 21, 2024), a named third party (Change Healthcare), and a concrete operational impact (temporary disruption to claims submission).


fact: require third-party vendors to provide SOC 2 reports

fact: require third-party vendors to provide ISO 27001 reports

fact: conduct reviews of third-party hosted applications involving sensitive data

fact: impose security requirements based on level of perceived security risk

reasoning: The paragraph primarily answers how third-party cyber risks are managed, detailing vendor onboarding assessments, risk-based security requirements, and mandated reporting (e.g., SOC 2 or ISO 27001). This central focus on vendor oversight aligns with the Third-Party Risk category. Specificity is elevated to Level 4 due to the mention of verifiable standards (SOC 2, ISO 27001), which are externally auditable certifications.


reasoning: The paragraph primarily addresses general speculative risks of cybersecurity threats without describing any specific governance, management, programmatic, or incident-related content. It answers a 'what could go wrong' question rather than explaining how the company governs, manages, or responds to such risks. The specificity is low because it contains only generic risk statements common across 10-K filings, with no domain-specific practices, firm-specific details, or verifiable facts.


fact: have not experienced any recent material cybersecurity incidents

reasoning: The paragraph primarily addresses whether cybersecurity risks have or could materially affect the company’s business strategy, results of operations, or financial condition, which aligns with Strategy Integration under Rule 5. It includes a backward-looking assertion of no recent material incidents and a forward-looking statement about potential material impact, both of which constitute materiality assessments. Specificity is driven by the firm-specific claim about the absence of recent material incidents, which distinguishes this company's posture.


fact: CISO has over 20 years of information technology and cybersecurity experience

fact: CISO has a technical degree in computer science from an accredited public university

fact: team comprises security engineers, detection specialists, and business cybersecurity experts

reasoning: The paragraph primarily describes the leadership and composition of the cybersecurity team, focusing on the CISO's qualifications and the team's structure, which directly answers 'How is management organized to handle cybersecurity?' This aligns with Management Role. Specificity is driven by the verifiable fact about the CISO's 'over 20 years of information technology and cybersecurity experience,' which is a quantified and externally checkable claim, elevating specificity to Level 4.


fact: dedicated department within its Enterprise Risk Management division

fact: manages risks of third-parties

fact: evaluates cybersecurity risks associated with the Company's third-party service providers with the Bank's Information Technology Department

reasoning: The paragraph primarily answers how third-party cyber risks are managed, focusing on the oversight of third-party service providers and the collaboration between the dedicated risk department and IT. This aligns with the 'Third-Party Risk' category. Specificity is Level 3 due to the mention of a dedicated department within Enterprise Risk Management and collaboration with the Information Technology Department, which are firm-specific organizational details.


fact: Chief Information Officer

fact: many years of experience leading cybersecurity oversight

fact: broad, extensive experience with information technology, including security, auditing, compliance, systems and programming

reasoning: The paragraph primarily describes the role, responsibilities, and qualifications of management—specifically the Chief Information Officer—in overseeing cybersecurity, which directly answers the question of how management is organized to handle cybersecurity. Specificity is driven by the mention of the CIO's role, responsibilities, and 'many years of experience,' a verifiable tenure claim.


fact: Vice President of Information Technology, Security and Business Intelligence is the principal manager overseeing cybersecurity risk management

fact: Over 18 years of experience in information technology and information security

fact: Prior employers: Biogen, AstraZeneca, Iron Mountain, Charles River Labs, Sunovion Pharmaceuticals, Agero, DentaQuest

fact: Holds master's degrees in business administration (Boston University) and electrical and computer engineering (Utah State University), and bachelor's in electronics engineering (Mumbai University)

fact: Information Technology team has over 10 years of experience managing cybersecurity risks

fact: Information Technology team holds specific professional certifications

reasoning: The paragraph primarily describes the leadership role, qualifications, and reporting structure of the Vice President of Information Technology, Security and Business Intelligence, which directly answers 'How is management organized to handle cybersecurity?' The inclusion of career history, education, certifications, and team experience centers on the individual and team's credentials, making this a Management Role (MR) assignment. Specificity is driven by multiple firm-specific facts (VP title with security scope, named prior employers) and one verifiable fact (over 18 years of experience), elevating it to Quantified-Verifiable.


fact: CIO

fact: Director of IT Security, Risk and Compliance

fact: combined 20 years of risk management experience

reasoning: The paragraph primarily describes the composition and qualifications of the ISC (a management-level committee), focusing on the roles and combined experience of its members, which directly answers how management is organized and qualified to handle cybersecurity. Specificity is driven by the verifiable claim of '20 years of risk management experience' and the named security leadership roles, which are firm-specific and include a quantified, externally checkable tenure.


fact: Chief Information Officer (CIO) has more than 30 years of experience

fact: CIO has held chief information officer roles in financial services, banking, healthcare, and hospitality sectors

fact: Cybersecurity team holds Certified Information Systems Security Professional (CISSP)

fact: Cybersecurity team holds Certified Information Security Manager (CISM)

fact: Cybersecurity team holds Microsoft Certified Cybersecurity Architect Expert

fact: Cybersecurity team holds Graduate Certificates in Enterprise Cybersecurity and Data Science

fact: Cybersecurity team holds Security+

fact: Cybersecurity team holds Certified Information Systems Auditor (CISA)

fact: Cybersecurity team holds Master's in Cybersecurity

reasoning: The paragraph primarily describes the leadership structure and qualifications of the individuals responsible for cybersecurity, focusing on the CIO's experience and the cybersecurity team's credentials, which answers 'How is management organized to handle cybersecurity?' The presence of specific certifications and degrees held by the team provides externally verifiable facts, elevating specificity to Level 4.


fact: CIO reports to CFO

fact: CIO is a peer to CSO

fact: CIO and team responsible for executing cybersecurity risk mitigation plans

fact: Current CIO appointed in March 2022

fact: CIO has nearly 20 years of experience in managing IT functions

reasoning: The paragraph primarily describes the organizational structure and responsibilities of management roles (CIO and team) in cybersecurity, including reporting lines and the CIO's qualifications and experience, which aligns with Management Role. The mention of 'nearly 20 years of experience' is a verifiable fact that supports Level 4 specificity.


fact: Operational Risk Committees

fact: Enterprise Risk Management Committee

fact: SHUSA's Head of Technology & Operations

fact: SHUSA's Chief Risk Officer

fact: SHUSA's Chief Technology Officer

fact: CEO participates in Information Security and Data Management Committee

fact: Heads of the Company's businesses participate in Information Security and Data Management Committee

fact: Second line of defense (LOD) representatives participate in Information Security and Data Management Committee

fact: Internal Audit representatives participate in Information Security and Data Management Committee

fact: Board members have experience in managing companies with IT and cybersecurity functions

reasoning: The paragraph primarily describes the governance structure for cybersecurity risk oversight, including management committees and board-level involvement, with emphasis on escalation paths and committee composition chaired by senior leaders—answering 'how does the board oversee cybersecurity?'. Specificity is elevated to Level 3 due to firm-specific committee names and named executive roles (e.g., 'Information Security and Data Management Committee', 'Head of Technology & Operations', 'Chief Risk Officer', 'Chief Technology Officer') that uniquely identify SHUSA's organizational structure.


reasoning: The paragraph is a cross-reference to another section (Item 1A) and contains no substantive cybersecurity disclosure about governance, management, processes, incidents, or strategy. It does not describe any specific facts, practices, or roles, and merely directs readers elsewhere. Specificity is Generic Boilerplate because it lacks any verifiable, firm-specific, or domain-adapted content.


fact: John Bresney, EVP & CIO

fact: reports directly to our Chief Executive Officer

fact: Robert McKenna, SVP of Enterprise Strategy and Execution

fact: reports to our CIO

fact: Christopher Cunniff, SVP and CRO

fact: reports formally to the Chief Financial Officer and on an interim-basis to our Chief Executive Officer

fact: approximately 30 years of employment for John Bresney

fact: approximately 21 years of employment for Robert McKenna

fact: over 27 years of technology and information security experience for Robert McKenna

fact: approximately six years of employment for Christopher Cunniff

fact: over 32 years of insurance industry experience for Christopher Cunniff

fact: bachelor's degree in information systems and business for John Bresney

fact: Master's Certificate in Project Management for John Bresney

fact: Columbia University CIO Program Certificate for John Bresney

fact: master's degree in business administration for Robert McKenna

fact: Certificate in Project Management for Robert McKenna

fact: Certified Insurance Counselor for Robert McKenna

fact: bachelor's degree in mathematics for Christopher Cunniff

fact: fellow of the Casualty Actuarial Society for Christopher Cunniff

fact: member of the American Academy of Actuaries for Christopher Cunniff

fact: leads implementation of our cybersecurity program for Robert McKenna

fact: oversees cybersecurity incidents under our Security Incident Response Plan (IRP) for Robert McKenna

reasoning: The paragraph primarily describes the roles, reporting lines, qualifications, and experience of key management personnel responsible for cybersecurity, which directly answers the question of how management is organized to handle cybersecurity. Specific_facts include multiple firm-specific leadership roles and verifiable credentials, such as named individuals with titles (EVP & CIO, SVP of Enterprise Strategy and Execution, SVP and CRO), degrees, certifications (Certified Insurance Counselor, Fellow of the Casualty Actuarial Society), and specific years of employment and experience, driving the specificity to Level 4.


fact: third-party risk assessments

fact: request that material third-party service providers provide security policies and procedures

fact: monitor cybersecurity incidents involving third-party providers

reasoning: The paragraph primarily answers how third-party cyber risks are managed, focusing on risk assessments, requests for security information from material providers, and monitoring of incidents involving third parties—making Third-Party Risk the dominant category. Specificity is Level 2 because the paragraph includes domain-adapted cybersecurity terms like 'third-party risk assessments' and 'security policies and procedures' that reflect cybersecurity-specific practices, though no firm-specific roles or verifiable facts are present.


reasoning: The paragraph primarily addresses whether cybersecurity risks have or are reasonably likely to materially affect the company's business, strategy, or financial condition, which aligns with Strategy Integration under Rule 5. It includes a forward-looking materiality assessment ('are reasonably likely to materially affect') and a backward-looking assertion, both of which qualify as Strategy Integration. Specificity is Generic Boilerplate because the content consists of standard disclaimers and cross-references without any domain-specific terms, firm-specific details, or verifiable facts.


fact: CISO has more than 20 years of experience in cybersecurity and information technology

fact: CISO holds a Certified Information Security Manager (CISM) certification

fact: CISO reports to Senior Vice President – Enterprise Risk Officer

fact: Senior Vice President – Enterprise Risk Officer reports to the Chief Executive Officer

reasoning: The paragraph primarily describes the role, qualifications, reporting structure, and oversight of the CISO, which answers the question of how management is organized to handle cybersecurity. While it mentions the cybersecurity program, the focus is on the CISO as a person—their experience, credentials, and position in the governance chain—making this about management structure rather than program activities. Specificity is driven by verifiable facts including the CISO's CISM certification, more than 20 years of experience, and specific reporting lines to the SVP Enterprise Risk Officer and CEO.


content_category: Risk Management Process

fact: aligned with the National Institute on Standards and Technology Cybersecurity Framework

fact: multi-factor authentication

fact: access controls

fact: email filtering

fact: firewalls

fact: partitioning and encryption of information

fact: backup and data recovery procedures

fact: malware defenses

fact: disaster recovery and incident plan responses

fact: hardware and software updates and patching

reasoning: The paragraph primarily describes the company's cybersecurity program activities—such as threat detection, defensive controls, incident response planning, and employee training—answering 'What does the cybersecurity program do?' This aligns with Risk Management Process. The specificity is Level 2 because the paragraph includes domain-specific terminology like 'intrusion prevention and detection systems,' 'multi-factor authentication,' and 'NIST Cybersecurity Framework,' which demonstrate cybersecurity expertise beyond generic risk management language.


reasoning: The paragraph primarily describes the Risk Committee's role in providing oversight and assurance to the Board and management regarding cybersecurity risk management, which directly answers the question of how the board oversees cybersecurity risks. This fits the 'Board Governance' category under Rule 1, as it focuses on the governance chain and committee-level oversight. The specificity is Level 2 because the mention of a specific internal plan—'Incident Management and Information Security Plan'—demonstrates domain-adapted knowledge of cybersecurity frameworks, which an ERM professional would not typically name without cybersecurity expertise.


fact: formalize our security due diligence process for each acquisition target

fact: security is a formally embedded component of our due diligence

fact: independent testing of the target technology prior to closing the acquisition

fact: require remediation by the target or attempt to ensure a remediation path post-closing

fact: contractual protections and liability parameters set forth in the purchase agreement

reasoning: The paragraph primarily answers how the company manages cybersecurity risks associated with third parties, specifically acquisition targets, by describing a formalized security due diligence process, independent testing, and contractual risk mitigation—making Third-Party Risk the clear category. Specificity is Level 4 because it includes verifiable claims about independent testing of target technology, requirement of remediation, and inclusion of contractual protections and liability parameters in purchase agreements, all of which are concrete, externally confirmable practices.


fact: Cybersecurity Sub-Committee of the Board of Directors

reasoning: The paragraph primarily describes the Board's oversight structure for cybersecurity, including the Audit Committee's role in monitoring risks and receiving updates, and the Cybersecurity Sub-Committee's involvement in incident response — all of which answer 'How does the board oversee cybersecurity?' This is a governance-chain structure focused on board-level oversight. Specificity is elevated to Level 3 due to the mention of a named, non-generic board sub-committee ('Cybersecurity Sub-Committee'), which is a firm-specific organizational feature that distinguishes NN Inc.'s governance structure.


fact: over 30 years of experience

fact: implementing and verifying the effectiveness of cybersecurity controls in a Defense Industrial Base environment

fact: GIAC Security Essentials certification

fact: GIAC Certified Enterprise Defender certification

fact: GIAC Certified Incident Handler certification

fact: GIAC Certified Windows Security Administrator certification

fact: GIAC Critical Controls Certification

fact: reports to our Vice President of Information Technology

fact: over 19 years of experience

fact: Certified Information Systems Security Professional certification

fact: Masters of Business Administration

reasoning: The paragraph primarily describes the organizational structure, leadership roles, qualifications, and reporting lines within the cybersecurity and IT functions, focusing on the Director of IT Infrastructure and Security and the Vice President of Information Technology—answering 'How is management organized to handle cybersecurity?'. Specific_facts include multiple firm-specific roles and verifiable certifications, which elevate specificity to Level 4.


fact: obtain System Organization and Control Reports (SOC Reports) for key third-party financial systems

reasoning: The paragraph primarily answers how third-party cyber risks are managed, focusing on pre-acquisition diligence, contractual obligations, performance monitoring, and obtaining SOC Reports for key third-party systems—making Third-Party Risk the dominant category. The mention of SOC Reports demonstrates domain-specific knowledge of cybersecurity assurance mechanisms, elevating specificity to Level 2.


reasoning: The paragraph is a biographical description of a senior executive, focusing on his role, responsibilities, and career history in human resources. It does not address cybersecurity governance, management, risk processes, third-party risk, incident disclosure, or strategy integration. The content is unrelated to cybersecurity and consists of standard executive biography language.


fact: vendor due diligence process

fact: assess vendor control environments

fact: evaluating risks associated with vendor access to confidential data and systems

fact: reviewing information security practices

reasoning: The paragraph primarily describes the company's internal process for assessing and managing cyber risks related to third-party vendors, which is part of its broader cybersecurity program; this aligns with Risk Management Process under Rule 3, as the focus is on the company's own practices rather than contractual requirements imposed on vendors (which would be Third-Party Risk). Specificity is Level 2 because the paragraph includes domain-specific terminology such as 'vendor due diligence process,' 'control environments,' and 'information security practices' that reflect cybersecurity expertise beyond generic risk management language.


fact: Company's disclosure committee responsible for detecting and reporting cybersecurity incidents

fact: Audit committee responsible for review of IT governance and data security

fact: Board of Directors receives briefings and assessments of IT, data governance, cybersecurity, and data security risks

fact: Complaint reporting procedures managed by an independent organization for confidential, anonymous submissions

fact: Enhanced Employee Self Service portal developed in 2022 for employee IT resources and service requests

reasoning: The paragraph primarily describes the Board of Directors’ and audit committee’s oversight responsibilities for cybersecurity and IT governance, including briefing frequency and delegation of complaint reporting procedures—answering 'how does the board oversee cybersecurity?' This aligns with Board Governance. Specificity is elevated to Level 3 due to the mention of the 'Company's disclosure committee' and the 'enhanced Employee Self Service portal' as firm-specific structures, even though they are not quantified or externally verifiable.


reasoning: The paragraph primarily describes the company's ongoing efforts to develop and maintain systems and programs to mitigate cybersecurity incidents, which directly answers 'What does the cybersecurity program do?'—a core question of Risk Management Process. Although it references 'Risk Factors' and third-party risks, those are secondary and not the central focus. Specificity is Generic Boilerplate because the paragraph contains only vague, non-specific statements about 'systems and programs' without any domain-specific terminology, firm-specific details, or verifiable facts.


fact: uses an external risk management software program to identify, assess, monitor and mitigate risks

fact: vendor security assessment process evaluates key vendors

fact: assesses vendor's controls for IT security, privacy, business continuity

fact: third-party risk assessment is a cross-functional effort involving end-user, Legal, Privacy and Information Security teams

reasoning: The paragraph primarily answers how the company manages cyber risks from third-party service providers, detailing the process for assessing and monitoring vendor risks, use of risk management software, and cross-functional team involvement—making Third-Party Risk the clear category. Specificity is Level 4 due to the verifiable claim of using an external risk management software program, which implies a specific, identifiable tool or platform that could be confirmed.


fact: SVP IT implements and oversees processes for the regular monitoring of information systems

fact: deployment of advanced security measures

fact: regular system audits to identify potential vulnerabilities

fact: well-defined incident response plan governing assessment, response, and notifications

reasoning: The paragraph primarily describes the company's cybersecurity program activities—monitoring systems, deploying security measures, conducting audits, and having an incident response plan—which directly answers 'What does the cybersecurity program do?' This aligns with Risk Management Process. Specificity is Level 4 due to the verifiable claim that the SVP IT 'implements and oversees processes for the regular monitoring of our information systems,' which implies a structured, ongoing program that could be audited or confirmed.


fact: Head of Global IT

fact: IT Security Team

fact: cybersecurity experience includes managing the network, infrastructure security and a cyber security team of a global consumer products company with a heavy online presence and with sales of services and goods to the U.S. government

fact: employees that have security certifications from reputable cybersecurity training organizations, including CompTIA

fact: over 20 years of combined infrastructure architecture experience, including PCI, SOC1 and SOC2 level compliance

reasoning: The paragraph primarily describes the organizational structure and qualifications of management-level cybersecurity leadership (Head of Global IT and IT Security Team), including their responsibilities, experience, and team composition—answering 'How is management organized to handle cybersecurity?'. Specific_facts include firm-specific roles and verifiable credentials, which elevate specificity to Level 4.


reasoning: The paragraph primarily describes a specific cybersecurity incident (the AMCA Incident), including its nature (security incident at a third-party vendor), timing (notification on May 14, 2019), affected party (patients of the Company), and resulting consequences (litigation, regulatory inquiries). This directly answers the question of what happened in a cybersecurity incident, making it Incident Disclosure. The specificity is Level 1 because all details are either generic (e.g., 'pending litigation', 'various inquiries') or non-verifiable; the date refers to notification, not the incident itself, and no quantified or externally verifiable facts about the incident's scope or impact are provided.


fact: offered identity protection services, including credit monitoring, to all of our current and former customers for two years

reasoning: The paragraph primarily describes actions taken in response to a cybersecurity incident—specifically, offering identity protection and credit monitoring to current and former customers—which implies a data breach affecting customer information. This directly answers 'What happened in a cybersecurity incident?' and centers on post-incident remediation, making it Incident Disclosure. The specificity is elevated to Level 4 due to the verifiable claim of providing services for 'two years,' a concrete duration that can be independently confirmed.


fact: supplemental reviews as necessary commensurate with the risk

fact: cybersecurity team continuously monitors and addresses cybersecurity threats and incidents at third-party service providers

reasoning: The paragraph primarily answers how third-party cyber risks are managed, detailing due diligence, security risk assessments, and ongoing monitoring of third parties—making Third-Party Risk the dominant category. Specificity is Level 4 due to the verifiable claim that a 'third party security risk assessment is conducted,' which implies a defined, repeatable process that could be audited or confirmed externally.


fact: integrated into overall enterprise risk management (ERM) process

fact: cybersecurity related risks included in annual ERM risk universe evaluation

fact: assess approach to information and physical security, risk management, incident response, business continuity management, and personal data privacy and protection

reasoning: The paragraph primarily describes how cybersecurity risks are assessed, identified, and managed within the company's enterprise risk management framework, including annual evaluations of top risks and specific domains like incident response and business continuity—answering 'What does the cybersecurity program do?' This aligns with Risk Management Process. Specificity is Level 2 because it includes domain-specific practices such as 'incident response,' 'business continuity management,' and 'personal data privacy and protection,' which demonstrate cybersecurity expertise beyond generic risk language.


fact: Third-Party Risk Management program

fact: require that these third parties maintain certain security controls

fact: assess their compliance with these requirements

reasoning: The paragraph primarily answers how third-party cyber risks are managed, specifically by requiring security controls and assessing compliance for service providers handling material information, which aligns with the 'Third-Party Risk' category. The mention of threat intelligence is secondary and does not shift the focus from the central topic of third-party oversight.


fact: Audit Committee of the board of directors

fact: Controlling Department

fact: Technology Leadership Centre

fact: Chief Technology Officer

fact: Chief Risk Officer

reasoning: The paragraph primarily describes the governance structure for cybersecurity risk oversight, detailing the three lines of defense and the roles of board-level committees (Risk Committee and Audit Committee), which directly answers the question of how the board oversees cybersecurity. This aligns with the Board Governance category under Rule 1. Specificity is elevated to Level 3 due to the mention of firm-specific roles and committees, such as 'Risk Committee of the board of directors' and 'Controlling Department', which distinguish this company's governance structure.


fact: Cyber ERM Committee

fact: cross-functional representation across the Company

fact: responsible for implementing a rapid response and incident program

fact: reporting all incidents to the Audit Committee and Board of Directors

reasoning: The paragraph primarily describes the organizational structure and responsibilities of a management-level committee (Cyber ERM Committee) in responding to cybersecurity threats and reporting to the Board, which answers the question of how management is organized to handle cybersecurity—making it Management Role. The specificity is Level 3 because it names a firm-specific committee ('Cyber ERM Committee') with cross-functional representation, a detail that distinguishes this company's structure from others.


reasoning: The paragraph primarily discusses the importance of IT systems to business operations and financial reporting, along with generic risks of system failure or security breaches, but does not describe any specific governance, management, risk processes, third-party oversight, actual incidents, or financial impacts. It contains forward-looking risk language and a negative assertion about past incidents without detailing any cybersecurity program, structure, or verifiable facts. The statement 'we have not experienced any material adverse events' is a non-verifiable negative self-assertion and does not constitute Strategy Integration under Rule 5 because it lacks a materiality assessment of cybersecurity's effect on business strategy or financial condition.


fact: utilize principles from the National Institute of Standards and Technology Cybersecurity Framework

fact: utilize principles from the Center for Internet Security – Top 18 Critical Security Controls – Control Level Framework

fact: biannual employee information security assessments

fact: phishing tests conducted at least quarterly on a global basis

fact: additional periodic phishing tests conducted with high-risk employee groups

fact: deployment and ongoing assessment of technological tools aimed at preventing, detecting, and mitigating cybersecurity threats

fact: policies and procedures to assess third-party service provider cybersecurity risks

fact: periodic performance of cybersecurity tabletop exercises

fact: regular review of and, as applicable, updates to our cyber incident response plan

fact: maintenance of a cyber risk insurance policy

reasoning: The paragraph primarily describes the components and activities of the company's cybersecurity program, answering 'What does the cybersecurity program do?'—a core question of Risk Management Process. It details specific practices like risk assessments, phishing tests, training, incident response planning, and technology deployment. Specificity is driven by multiple domain-adapted terms (e.g., NIST CSF, CIS Top 18, phishing tests, tabletop exercises) that demonstrate cybersecurity-specific knowledge beyond generic risk management language.


fact: As of December 31, 2023, we have not had any material cybersecurity incidents

reasoning: The paragraph primarily addresses whether cybersecurity risks have materially affected the company’s business, stating a backward-looking conclusion that no material incidents have occurred as of a specific date, which qualifies as a materiality assessment under Rule 5. The mention of cybersecurity insurance and cross-references to risk factors further supports a financial and strategic framing. Specificity is elevated to Level 4 due to the verifiable claim about the absence of material incidents as of December 31, 2023, which includes a specific date and a firm-specific assertion that could be corroborated through audit or incident logs.


fact: evaluate third-party service providers' cybersecurity policies, procedures, and practices annually

fact: review of the internal control reports of such third parties

fact: incorporating third-party risk into our incident response plans

reasoning: The paragraph primarily answers how third-party cyber risks are managed, focusing on evaluation of vendors' cybersecurity practices, contractual safeguards, review of internal control reports, and inclusion in incident response planning—making Third-Party Risk the clear category. Specificity is Level 2 due to the use of domain-specific practices like reviewing internal control reports (e.g., SOC reports) and incorporating third-party risk into incident response, which reflect cybersecurity expertise beyond generic risk management language.


fact: managed services agreement with an external party for incident response

fact: engaging an external party for comprehensive cybersecurity assessment, opportunity prioritization, initiative road mapping and cyber project delivery

fact: engaging additional external parties to assist with critical cyber-related infrastructure such as firewall maintenance and upgrade initiatives

fact: assess all third-party service providers for their qualifications before engaging them

fact: monitor such providers throughout the term of the engagement

reasoning: The paragraph primarily describes the company's use of external parties to support and assess its cybersecurity program, including incident response, maturity assessments, and infrastructure maintenance—answering 'what does the cybersecurity program do?' This aligns with Risk Management Process. The mention of third-party monitoring supports the program's operation, not vendor risk as a central theme, so Third-Party Risk does not dominate. Specificity is elevated to Level 4 by the verifiable claim of a 'managed services agreement for incident response,' which implies a concrete, externally confirmable arrangement.


fact: Cybersecurity-related risks are included in our overall risk evaluation for our ERM process

fact: internal audit team uses the ERM program to develop a risk-based audit plan

reasoning: The paragraph primarily describes how cybersecurity risks are integrated into the company's enterprise risk management (ERM) process and used to inform the internal audit plan, which is a core component of the organization's risk assessment and management activities. This aligns with the 'Risk Management Process' category as it details the methodology (ERM integration, annual risk evaluation, audit planning) for identifying and managing cybersecurity risks. Specificity is Level 2 because the paragraph includes domain-specific concepts like 'risk-based audit plan' and the structured use of ERM for cybersecurity risk evaluation, which reflect cybersecurity expertise beyond generic risk language.


fact: 429,252 Umpqua Bank customers whose information was involved in the Vendor Incident

fact: June 21, 2023: Umpqua Bank informed of breach

fact: June 22, 2023: email notification sent to affected customers

fact: August 2023: mailed notice sent to affected customers

reasoning: The paragraph primarily answers 'What happened in a cybersecurity incident?' by detailing the MOVEit-related breach, including the date of discovery, nature of compromised data (names and SSNs/TINs), scope (429,252 customers), affected parties (consumer and small business customers), and communication actions taken. This is a real, disclosed incident, not hypothetical, making it Incident Disclosure. Specificity is driven by the verifiable number of affected customers and specific dates, which are externally confirmable facts.


fact: CRO, CIO, and CISO each have over 15 years of experience in managing cybersecurity, information technology, and risk management processes

fact: CRO has more than 30 years of experience

fact: CRO is a member of RGA's Executive Committee

fact: CIO is a member of RGA's Executive Committee

fact: CISO is responsible for implementing the Company's cybersecurity risk management strategy

fact: CRO oversees operational risks including cybersecurity

fact: CIO leads strategic direction of information technology resources and global IT operations

fact: CISO oversees global security and privacy teams

reasoning: The paragraph primarily describes the roles, responsibilities, qualifications, and experience of key executives (CRO, CIO, CISO) in managing cybersecurity and technology functions, which directly answers the question of how management is organized and qualified to handle cybersecurity. Specificity is driven by multiple verifiable facts, including named executive roles, over 15 years of experience, and specific functional responsibilities that can be externally validated.


fact: On October 11, 2023, we announced that we had experienced disruptions in our Information Technology (IT) infrastructure and applications resulting from a cybersecurity incident

fact: The incident, which caused disruption of our business operations for approximately three days

fact: we were able to fulfill our backlog of orders caused by the operational disruption within one week

fact: we experienced no material financial impact to our business

reasoning: The paragraph primarily answers 'What happened in a cybersecurity incident?' by detailing a specific event on October 11, 2023, including its nature (unauthorized activity), timeline, response actions, operational impact (three-day disruption), and resolution. This constitutes a real, disclosed incident, not hypothetical risk. Specificity is driven by multiple verifiable facts, including the exact incident date, duration of disruption, and claim of no material financial impact due to recovery speed.


fact: ransomware incident in July 2018

fact: affected certain Dx information technology systems

fact: temporarily affected certain other information technology systems involved in conducting Company-wide operations

fact: investigation determined that the ransomware did not and could not transfer patient or client data outside of Company systems

fact: no theft or misuse of patient or client data

fact: incident did not have a material effect on the Company

reasoning: The paragraph primarily answers 'What happened in a cybersecurity incident?' by describing a specific ransomware event in July 2018, its scope (Dx IT systems and Company-wide operations), impact, investigation findings (no data exfiltration or misuse), and conclusion on materiality. This is a direct disclosure of a real incident. The specificity is driven by the verifiable details: a specific incident type (ransomware), a precise date (July 2018), and named systems affected.


fact: Travis Smith is Executive Vice President, Additives & Functional Products, Manufacturing, WWE&C and HSE

fact: Mr. Smith joined the Company in December 1992

fact: He was appointed Senior Vice President with responsibility for the AFP segment effective October 2022

fact: He was appointed to his current position effective January 2025

reasoning: The paragraph is a biographical overview of an executive's career history and organizational responsibilities, focusing on manufacturing, engineering, and HSE (health, safety, and environment), but does not address cybersecurity governance, management roles in cybersecurity, risk processes, third-party risk, incident disclosure, or strategy integration. HSE is distinct from cybersecurity, and no cybersecurity-specific roles, processes, or risks are mentioned. Specificity is driven by firm-specific executive details, but the content is outside the scope of cybersecurity disclosure.


fact: third-party risk management program regarding the cybersecurity practices of vendors and partners

fact: regular monitoring and reviews to ensure compliance with security standards

reasoning: The paragraph primarily answers how third-party cyber risks are managed, focusing on vendor vetting, ongoing monitoring, and compliance with security standards, which aligns with the 'Third-Party Risk' category. The specificity is Level 2 because it includes domain-adapted terms like 'vetting of third parties before engagement' and 'compliance with security standards,' which reflect cybersecurity-specific practices beyond generic risk management language.


fact: Audit Committee provides oversight of cybersecurity and digital risk

fact: Chief Information Security Officer (CISO) reports to the Audit Committee

fact: Audit Committee receives reports on notable cybersecurity threats or incidents impacting the aviation sector and the Company

fact: Audit Committee reviews results of independent third-party assessments of the Company's cybersecurity program

fact: Audit Committee receives updates on cybersecurity regulatory developments

reasoning: The paragraph primarily describes the Board's Audit Committee's role in overseeing cybersecurity risks, including the frequency and scope of reviews, and the flow of information from the CISO to the Committee—answering 'how does the board oversee cybersecurity?' This aligns with Board Governance. Specificity is elevated to Level 3 due to the mention of the 'Chief Information Security Officer (CISO)', a firm-specific leadership role, and the structured reporting relationship to the Audit Committee, which distinguishes United Airlines' governance model.