reasoning: The paragraph describes internal cybersecurity processes (collaborative approach, technical safeguards, incident response planning, third-party risk management, and education) without naming specific frameworks, roles, dates, or verifiable details. All elements are generic and could apply to any company.


content_category: Board Governance

category_confidence: high

specificity_confidence: high

reasoning: The paragraph focuses on the board's oversight role in cybersecurity governance, with the board of directors as the grammatical subject. Specific roles (CISO) and a named committee ('Cybersecurity Governance') are included.

provider: mistralai

stage: benchmark


reasoning: The paragraph focuses on the Board of Directors' and Audit Committee's oversight of cybersecurity risks, making Board Governance the clear category. No specific facts (e.g., named committees beyond 'Audit Committee', dates, or firm-unique details) are present, resulting in Generic Boilerplate.


content_category: Risk Management Process

specificity_confidence: medium

reasoning: The paragraph focuses on the company's internal risk management processes (framework adoption, specific plans, and assessment cadence), with multiple firm-specific systems and practices identified. The NIST Framework is a recognized standard, but the inclusion of named internal programs (IRP, BCP, Disaster Recovery Plan) and the annual cadence make this Firm-Specific.


reasoning: The paragraph focuses on internal cybersecurity processes (monitoring, incident response plan, vulnerability management) rather than board oversight, management roles, or third-party risk. Named internal program and third-party system qualify as firm-specific facts.


reasoning: The paragraph centers on board and committee oversight of cybersecurity risk, with the Board of Directors as the grammatical subject. The Audit Committee's role and reporting cadence are mentioned, but the primary focus is board governance. Specific facts include named roles (Board of Directors, Audit Committee, head of information security department) and reporting lines.


reasoning: The paragraph focuses on internal cybersecurity processes (Agility Plan, incident response policies, CMT, training, and third-party assessments), making it a Risk Management Process. It contains multiple firm-specific facts (named plan, teams, and roles).


content_category: Strategy Integration

reasoning: The paragraph discusses materiality assessments and potential financial/operational impacts of future cybersecurity incidents without describing any actual incident (content_category = Strategy Integration). It contains no specific facts (no dates, named entities, frameworks, or quantified details) → Generic Boilerplate.


reasoning: The paragraph describes the company's internal cybersecurity processes and controls (monitoring, encryption, third-party risk management, DRP, insurance) without naming any specific frameworks, roles, dates, or verifiable details. The focus is on generic security practices rather than board oversight, incidents, or third-party oversight as a central topic.


reasoning: The paragraph focuses on the Board of Directors' oversight role (grammatical subject) regarding cybersecurity risk management, which aligns with the Board Governance category. No specific facts (e.g., named roles, dates, or firm-unique details) are present.


content_category: None/Other

reasoning: The paragraph contains forward-looking disclaimers, generic risk statements, and cross-references to other sections without substantive cybersecurity-specific disclosure. No incident details, management roles, board oversight, or firm-specific facts are provided.


reasoning: The paragraph describes internal cybersecurity measures and processes without naming specific frameworks, roles, dates, or unique company details. All listed items are generic security practices.


reasoning: The paragraph describes the company's internal cybersecurity risk management program and materiality assessment without naming any specific frameworks, roles, dates, or verifiable details. The focus is on generic processes and boilerplate language about risk assessment and materiality.


reasoning: The paragraph focuses on the company's internal cybersecurity risk management approach and general resource allocation, with no named entities, dates, or verifiable facts. The mention of the Board and management oversight is generic and not the grammatical subject.


content_category: Management Role

reasoning: The paragraph focuses on the Chief Technology Officer's leadership, qualifications, and the establishment of a named internal committee and incident response plan, making it a Management Role category. The presence of multiple firm-specific facts (named role, certifications, committee, and plan) elevates it to Firm-Specific.


reasoning: The paragraph focuses on USCF's internal cybersecurity risk management processes, including its information security program, risk assessments, and third-party due diligence. The named firm 'USCF' and the specific cadence 'annually' make this Firm-Specific.


reasoning: The paragraph contains only generic definitions and boilerplate language about cybersecurity risks and processes without any substantive disclosure or specific facts. It does not describe an incident, management roles, board governance, or any firm-specific details.


reasoning: The paragraph focuses on management roles and responsibilities in cybersecurity oversight, including named executives and their qualifications and activities. The grammatical subject is management (e.g., 'Our management is responsible', 'Our technology group is led by').


reasoning: The paragraph centers on board oversight of cybersecurity risks, with management roles mentioned as supporting context. The inclusion of specific roles (CTO, CIO, CISO) and quantified experience years, along with a named system (SOC Managed Service), qualifies as Quantified-Verifiable.


reasoning: The paragraph focuses on internal cybersecurity processes (monitoring, defense-in-depth, risk management frameworks, penetration testing, vendor assessments) rather than board oversight, management roles, or a specific incident. Named frameworks and the Information Security Risk Committee are firm-specific details.


reasoning: The paragraph focuses on internal risk management processes, frameworks, and integration of cybersecurity risks into overall risk management. No specific incidents, named roles (beyond generic 'Senior Director of Information Technology' and 'Chief Financial Officer'), or verifiable facts are present.


reasoning: The paragraph focuses on the company's internal cybersecurity and technology risk management program, governance processes, and third-party risk controls, making Risk Management Process the most applicable category. The named committee (Business Risk Committee), framework (NIST Cybersecurity Framework and CRI Profile), and unique internal program (Third-Party Risk Management Program) qualify as firm-specific facts.


reasoning: The paragraph focuses on the roles, responsibilities, and qualifications of management (CISO, CCO, Information Security Team) in cybersecurity, making it a clear Management Role category. It contains multiple verifiable facts (e.g., certifications, years of experience, named degrees) that qualify it as Quantified-Verifiable.


reasoning: The paragraph focuses on the company's internal cybersecurity risk management processes (e.g., policies, controls, monitoring) without naming specific frameworks, roles, dates, or unique firm details. The third-party risk mention is a component of internal processes, not the central topic.


reasoning: The paragraph focuses on internal cybersecurity processes (incident response plan, roles, and frameworks) rather than board governance, management roles, or third-party oversight. Specific facts like named roles (CISO, CIO), frameworks (NIST RMF, CMMC), and a named firm (U.S. Department of Defense) make it Firm-Specific.


reasoning: The paragraph discusses the company's internal cybersecurity risk management approach and oversight, with no specific facts, named entities, or verifiable details. The content focuses on generic processes and disclaimers.


reasoning: The paragraph focuses on the board's oversight responsibility and delegation to the Audit Committee, with management's role as the grammatical subject. No specific facts from the ✓ IS list remain after filtering out generic terms like 'Audit Committee' and 'management'.


reasoning: The paragraph focuses on the company's internal cybersecurity program, risk assessment, and governance processes, making Risk Management Process the clear category. It includes firm-specific facts (NIST CSF framework and named cybersecurity roles), confirming Firm-Specific specificity.


reasoning: The paragraph focuses on internal cybersecurity processes (risk assessment, response planning, team composition) rather than board oversight or incident details. The inclusion of the FAIR model and named teams qualifies as firm-specific details.


reasoning: The paragraph describes internal cybersecurity risk management processes (incident response plan, testing cadence, tabletop exercises) without naming specific frameworks, roles, dates, or firm-unique details. The focus is on generic program structure and practices.


content_category: Third-Party Risk

reasoning: The paragraph focuses on the company's use of third-party service providers for cybersecurity risk management and vendor oversight, making Third-Party Risk the central topic. There are no specific facts (e.g., named firms, dates, or unique programs) beyond generic descriptions.


reasoning: The paragraph centers on the management role (Luca Fabbri) responsible for cybersecurity oversight, including named roles, firms, and specific dates/quantified experience.


reasoning: The paragraph focuses on the company's internal cybersecurity risk management processes and controls, with firm-specific details like named programs (vendor risk management program) and security practices (red/blue team exercises, dedicated information security staff, third-party managed security operations center).


reasoning: The paragraph contains only forward-looking disclaimers and boilerplate language with no substantive cybersecurity disclosure, named entities, or specific facts.


reasoning: The paragraph focuses on internal cybersecurity processes (incident response planning, technical safeguards, education, third-party risk management, and threat intelligence), making Risk Management Process the clear category. The inclusion of the named internal system (ICSIRP) and specific internal policies (annual training, third-party risk process) qualifies as Firm-Specific.


reasoning: The paragraph primarily focuses on the CIO's responsibilities and qualifications, making it a Management Role category. The CIO's role and 20 years of experience provide two verifiable facts (named role + quantified experience).


reasoning: The paragraph discusses the materiality assessment of cybersecurity risks and insurance coverage without describing any actual incident or naming specific frameworks, roles, or dates. It focuses on financial/material impact and insurance, which aligns with Strategy Integration.


reasoning: The paragraph focuses on internal cybersecurity processes (risk management, incident response, training, and oversight) with firm-specific details like named teams and roles. The CMT and CIO are central to the discussion, making this a Risk Management Process category.


reasoning: The paragraph focuses on internal cybersecurity risk management processes, including program structures, reporting lines, and incident escalation procedures. While it names specific roles (CISO, CIO, CFO, General Counsel, CEO) and a team, these are part of the company's internal governance and do not meet the threshold for Quantified-Verifiable.


reasoning: The paragraph centers on board committee (Audit Committee) oversight of cybersecurity, with the CTO as a specific management role mentioned in the context of oversight activities. The annual review cadence and specific oversight topics provide firm-specific details.


content_category: Incident Disclosure

reasoning: The paragraph describes a real cybersecurity incident with specific dates, a named system (website), and a named external firm (FBI), making it clearly an Incident Disclosure. The multiple verifiable facts (two dates + named system + named firm) qualify it as Quantified-Verifiable.


reasoning: The paragraph discusses general awareness and future intentions regarding cybersecurity without substantive disclosure. It lacks any incident narrative, governance details, or firm-specific facts, making it boilerplate.


reasoning: The paragraph discusses the materiality of cybersecurity risks to the company's business strategy and financial condition without describing any actual incidents, making it a strategy/materiality assessment rather than an incident narrative or governance detail.


reasoning: The paragraph focuses on the Board of Directors' and Audit Committee's oversight of cybersecurity governance, with the CISO, CIO, and CTO mentioned as key management roles supporting this oversight.


reasoning: The paragraph contains no substantive cybersecurity-specific facts, named roles, dates, or firm-unique details. It is generic risk acknowledgment language without any qualifying facts.


reasoning: The paragraph focuses on internal risk management processes (audit, risk assessment, remediation) and oversight mechanisms, with the Audit Committee as the grammatical subject for cybersecurity risk oversight. The presence of a named role (Vice President of Risk Management) and a named firm (MSSP) makes it Firm-Specific.


reasoning: The paragraph focuses on the company's internal cybersecurity program and risk management processes without naming specific frameworks, roles, dates, or unique company details. The content is generic and could apply to any company's risk management discussion.


reasoning: The paragraph's grammatical subject is the Audit Committee's oversight role, making Board Governance the clear category. Specific facts include named roles (CIO and CISO), a unique system (NIST Cybersecurity Framework Scorecard), and firm-specific practices (third-party assessments, independent third-party reporting).


reasoning: The paragraph focuses on the Board of Directors as the ultimate approver of risk appetite metrics, with senior management as the recommending party, making the board the grammatical subject of oversight. No specific facts (e.g., named roles, dates, or frameworks) are present.


reasoning: The paragraph describes a specific cybersecurity incident with clear details (date, firms involved, actions taken, and named third-party firm). The grammatical subject is the incident itself, not board governance or management roles.


reasoning: The paragraph describes internal cybersecurity incident investigation and response processes (e.g., ISC involvement, system isolation, advisor engagement) without naming specific frameworks, roles, dates, or firm-unique details. This is a generic description of risk management processes.


reasoning: The paragraph describes a real cybersecurity incident with specific details (date, nature of access, exfiltration, operational disruption, restoration status) making it clearly an Incident Disclosure. The inclusion of the company name and specific incident details confirms Firm-Specific classification.


reasoning: The paragraph describes internal cybersecurity processes (safeguards, vulnerability assessments, threat intelligence, incident response plan) without naming any company-specific details, frameworks, or verifiable facts. The content focuses on generic program elements rather than governance, incidents, or third-party risks.


reasoning: The paragraph describes a real cybersecurity incident with specific dates, named entities (company and third-party firms), and a named internal system, making it a clear Incident Disclosure. The combination of a specific date, named firm, and named system provides two verifiable facts for Quantified-Verifiable specificity.


reasoning: The paragraph describes an internal cybersecurity process (information security training) without naming any specific frameworks, roles, dates, or unique company details. The content is generic and could apply to any company.


reasoning: The paragraph describes internal risk management processes (risk assessments, questionnaires) but does not name any specific frameworks, roles, dates, or firm-unique details. The focus is on generic third-party risk oversight as part of the company's own processes.


reasoning: The paragraph describes internal cybersecurity risk management processes (procedures for evaluating risks, policies, employee training, and third-party risk management) without naming any specific frameworks, roles, dates, or firm-unique details. The focus is on general internal processes rather than board governance, management roles, or incident disclosure.


reasoning: The paragraph focuses on management's operational responsibility for cybersecurity, with the Software Engineer (a cybersecurity-specific role) as the key subject. This aligns with the Management Role category.


reasoning: The paragraph describes the company's internal incident response plan and its general structure, which is a risk management process. No firm-specific facts, named entities, or verifiable details are present.


reasoning: The paragraph describes the company's lack of internal cybersecurity risk management processes, focusing on the absence of specific assessment and management procedures. No named entities, dates, or quantifiable details are present.


reasoning: The paragraph discusses the company's business model and lack of operations, with no substantive cybersecurity disclosure. It does not address any cybersecurity governance, risk management, incidents, or strategy.


reasoning: The paragraph describes internal risk management processes (using third-party service providers to manage cybersecurity threats) but does not center on vendor oversight as the primary topic. No specific facts (named entities, dates, numbers) are present.


reasoning: The paragraph centers on the board-level Risk Committee's oversight of cybersecurity threats and risk management, making Board Governance the clear category. The named committee qualifies as a firm-specific fact.


reasoning: The paragraph describes a real cybersecurity incident with specific dates, scope (33 million accounts accessed, 3,000 accounts with limited data), response actions (perpetrator identified, devices turned over, data deleted), and financial impact (1.685 trillion won/$1.2 billion voucher program). This clearly fits the Incident Disclosure category.


reasoning: The paragraph focuses on the Audit Committee's oversight role regarding cybersecurity risks, which is a board governance topic. No specific facts (e.g., named committees, roles, dates, or unique details) are present, making it generic boilerplate.


reasoning: The paragraph describes internal processes (Information Security and Information Technology teams supporting business functions) without naming any specific frameworks, roles, dates, or firm-unique details. The focus is on general oversight of projects and vendors, which is a standard internal risk management process.


reasoning: The paragraph focuses on the qualifications and experience of cybersecurity management roles (CISO and VP of Information Security), which is a Management Role category. The inclusion of specific years of experience (25 and 30) and the named roles qualify as two hard verifiable facts.


reasoning: The paragraph focuses on the CISO's oversight role in cybersecurity risk management, making it a Management Role category. The presence of a cybersecurity-specific title (CISO) qualifies as a firm-specific fact.


reasoning: The paragraph contains no substantive cybersecurity disclosure—only generic statements about safety and cybersecurity priorities without any specific facts, roles, dates, or frameworks. It is boilerplate language.


reasoning: The paragraph discusses general cybersecurity practices (training, phishing testing, insurance) without naming any specific frameworks, roles, dates, or verifiable details. The insurance mention lacks specifics (amounts, named insurers, or dates).


reasoning: The paragraph focuses on board oversight activities (discussions, presentations, reviews) and does not describe a real incident, management roles, or firm-specific details. The content is generic and could apply to any company's board governance.


reasoning: The paragraph focuses on internal cybersecurity risk management processes, including oversight by a named team (Technology Leadership Centre) and a cybersecurity-specific role (Chief Technology Officer). The subject is the company's own processes, not board governance or incident disclosure.


reasoning: The paragraph focuses on the Board of Directors' oversight role regarding cybersecurity risks, which is the grammatical subject. No specific facts (e.g., named committees, dates, or unique details) are present.


reasoning: The paragraph discusses the company's internal cybersecurity risk management approach and limitations of security controls, with no named entities, dates, or firm-specific details. The focus is on generic risk-based processes rather than board governance, incident disclosure, or third-party oversight.


reasoning: The paragraph focuses on the board's involvement ('Arrow's Board of Directors') in cybersecurity risk management, making Board Governance the most applicable category. No specific facts remain after filtering out generic terms.


reasoning: The paragraph discusses materiality assessments and potential financial impact of cyber risks without describing any actual incidents, fitting Strategy Integration. It contains no firm-specific, sector-adapted, or quantified facts.


reasoning: The paragraph describes internal cybersecurity processes (incident response and vulnerability management) without referencing a specific incident or firm-unique details. The mention of management roles (CEO, CFO) and the audit committee are generic and do not qualify as specific facts per the IS/IS-NOT lists.


reasoning: The paragraph focuses on internal processes (defense approach, vulnerability management, incident response and disaster recovery plans) without referencing any specific entities, dates, or quantifiable details. The language is generic and could apply to any company.


reasoning: The paragraph is a standard materiality disclaimer with no substantive cybersecurity content, incident details, or firm-specific facts. It is boilerplate language typical in filings.


reasoning: The paragraph discusses internal security control implementation and risk mitigation approaches without naming any specific frameworks, roles, dates, or firm-unique details. It focuses on general security practices and limitations.


reasoning: The paragraph focuses on internal cybersecurity risk management processes (risk assessment, tools, policies, training, insurance) without board or incident details. It names two recognized frameworks (CIS and FERPA), making it Sector-Adapted.


reasoning: The paragraph focuses on board and committee oversight of cybersecurity risk, with the Board and TRCC as grammatical subjects. Specific facts include named roles (CISO) and named committees (TRCC, ERC), which are firm-specific.


reasoning: The paragraph focuses on board oversight of cybersecurity through named committees (Cybersecurity Executive Council, Cybersecurity Compliance Committee) and a cybersecurity-specific role (CISO), with the board receiving updates on cybersecurity programs.


reasoning: The paragraph discusses general cybersecurity risks and materiality disclaimers without referencing any specific incident, framework, role, date, or firm-specific detail. It is a forward-looking risk statement with no substantive disclosure.


reasoning: The paragraph focuses on board and committee oversight of cybersecurity incidents, with the Audit Committee explicitly named as a recipient of incident updates. The Head of Cybersecurity is a cybersecurity-specific role.


reasoning: The paragraph's central topic is vendor oversight requirements for storing sensitive information, which aligns with Third-Party Risk. The only other sentence is a generic materiality conclusion without incident details, which does not meet the criteria for Strategy Integration or Incident Disclosure.


reasoning: The paragraph describes internal cybersecurity program evaluation activities (engaging third parties, tabletop exercises) but does not reference board oversight, specific roles, vendors as the central topic, or any incident. No specific facts remain after filtering.


reasoning: The paragraph describes internal cybersecurity processes (vulnerability/patching programs, monitoring) without naming unique entities or standards. The practices (audits, penetration testing, SOC as a service) are generic and not firm-specific.


reasoning: The paragraph describes the company's internal cybersecurity program and processes without referencing any firm-specific roles, dates, named tools, or verifiable facts. The content focuses on generic risk management practices like identification of critical systems, network segmentation, access controls, and monitoring.


reasoning: The paragraph focuses on the Audit Committee's oversight role for cybersecurity risks, with the committee as the grammatical subject. Specific facts include the named committee (Audit Committee), the cybersecurity-specific role (CISO), and a named internal system (Cybersecurity Incident Response Plan).


reasoning: The paragraph describes internal cybersecurity processes (vulnerability testing, vendor control reviews, and response evaluation) without naming specific frameworks, roles, dates, or verifiable details. The focus is on general practices rather than board governance, incident disclosure, or third-party oversight.


reasoning: The paragraph describes internal risk management processes (assessment, identification, mitigation) without naming any frameworks, roles, dates, or firm-specific details. The mention of a 'third-party security program' is generic and does not qualify as Third-Party Risk since it is framed as an internal process component.


reasoning: The paragraph focuses on the company's internal ERM process and cybersecurity risk management structure, with no specific facts (e.g., named roles, dates, frameworks, or quantified details) that would qualify as firm-specific or quantified-verifiable.


reasoning: The paragraph focuses on the roles and responsibilities of specific management positions (CIO, CTO, and Information Security Officer) in overseeing the cybersecurity program. The named roles are cybersecurity-specific and firm-unique.


reasoning: The paragraph describes internal cybersecurity safeguards (firewalls, anti-malware, monitoring agents) without naming specific frameworks, roles, dates, or unique company details. The focus is on general technical measures, making it a Risk Management Process category.


reasoning: The paragraph discusses the materiality of cybersecurity risks to financial condition and business strategy without describing any incident. No specific facts are present.


reasoning: The paragraph describes internal cybersecurity practices (penetration testing, incident response engagements, collaboration with experts) but does so in generic terms without naming frameworks, roles, dates, or specific entities. The focus is on internal processes rather than board governance, management roles, or incident disclosure.


reasoning: The paragraph focuses on the ISO's role, qualifications, and experience, making it a Management Role category. The ISO title, 22 years of experience, and specific background at a CPA firm are firm-specific and verifiable facts.


reasoning: The paragraph focuses on the company's internal cybersecurity program and the frameworks it uses for control assessment and compliance, which aligns with Risk Management Process. The named frameworks (HIPAA, NIST CSF, HITRUST, SOC 2) are recognized standards without firm-specific details.


reasoning: The paragraph focuses on the CISO's qualifications, responsibilities, and reporting structure, making it a Management Role. It includes firm-specific facts (CISO role and quantified experience).


reasoning: The paragraph focuses on vendor oversight during procurement, which is the central topic of Third-Party Risk. No specific facts (dates, named entities, or quantifiable details) are present, making it generic boilerplate.


reasoning: The paragraph centers on vendor/supplier security oversight and contractual security standards, making Third-Party Risk the clear category. No specific facts (e.g., named firms, dates, or quantified details) are present, so specificity is Generic Boilerplate.


reasoning: The paragraph focuses on the CIO's leadership of the Information Security Department and reporting structure, making it a Management Role. The presence of a cybersecurity-specific role (CIO) qualifies as a firm-specific fact.


reasoning: The paragraph focuses on management roles (CCO, CISO) and their responsibilities, qualifications, and experience, making it a clear Management Role category. It contains multiple verifiable facts (dates, years of experience) meeting the Quantified-Verifiable threshold.


reasoning: The paragraph focuses on the Senior Director of Information Technology presenting cyber threats to the CEO, CFO, and Audit Committee, which is a board governance oversight activity. No firm-specific facts remain after filtering (e.g., 'Senior Director of Information Technology' is generic, 'Audit Committee' is standard).


reasoning: The paragraph centers on a named committee (Cyber Security Subcommittee) and its composition, which are board/committee oversight elements. The focus is on governance structure rather than management roles or incident details.


reasoning: The paragraph focuses on the company's internal cybersecurity risk management program and its alignment with industry standards, making it a clear Risk Management Process category. The only specific fact is the named framework (NIST), which qualifies as Sector-Adapted.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes (policies, programs, controls, monitoring, risk assessments, training) without referencing any specific facts, frameworks, roles, dates, or unique details. It is a generic description of cybersecurity practices.


reasoning: The paragraph focuses on the company's internal cybersecurity incident response structure and processes, with specific roles and team names making it Firm-Specific. The content is about internal risk management processes rather than board governance or incident disclosure.


reasoning: The paragraph contains no substantive cybersecurity-specific facts, named entities, or verifiable details. It is a generic risk statement without incident details, governance specifics, or measurable impacts.


reasoning: The paragraph focuses on executive management's oversight of cybersecurity risk, which is a management role. No specific facts (e.g., named roles, dates, or unique details) are present, making it generic boilerplate.


reasoning: The paragraph focuses on the CISO's reporting structure to the IOC (presumably an internal oversight committee) and executive sessions, making board/committee oversight the grammatical subject. The CISO is a cybersecurity-specific role, qualifying as a firm-specific fact.


reasoning: The paragraph focuses on the responsibilities of a cybersecurity-specific management role (VP of IT and Facilities), making it a Management Role category. The named role qualifies as a firm-specific fact.


reasoning: The paragraph discusses internal risk assessment processes and safeguards, focusing on the lack of formal policies and hypothetical implementation steps. No board governance, incident details, or firm-specific details are present.


reasoning: The paragraph focuses on board committee oversight of cyber risk, with the Audit Committee as the grammatical subject. No firm-specific facts, dates, or named entities are present.


reasoning: The paragraph describes internal cybersecurity monitoring and threat mitigation activities, focusing on the company's own processes. No specific facts (dates, named roles, frameworks, etc.) are present, making it generic boilerplate.


reasoning: The paragraph describes internal cybersecurity processes (vulnerability management, monitoring, backup/recovery, physical protection, third-party risk review) without naming any specific frameworks, roles, dates, or firm-unique details. The focus is on generic process descriptions.


reasoning: The paragraph describes internal cybersecurity processes (awareness program, policy updates, control testing) without naming any specific frameworks, roles, dates, or firm-unique details. The focus is on generic risk management activities.


reasoning: The paragraph describes internal incident response processes (policy, triage, cross-functional team) but contains no firm-specific facts, named entities, dates, or verifiable details beyond generic practices.


reasoning: The paragraph describes internal cybersecurity processes (monitoring, detection, third-party testing, and participation in exercises) without naming any firm-specific entities, dates, or verifiable details. The focus is on general security efforts rather than board governance, incident disclosure, or third-party risk oversight.


reasoning: The paragraph focuses on the Cybersecurity Council's oversight role, chaired by the CISO and including multiple named senior management roles, which clearly indicates board governance oversight. The inclusion of a quantified meeting cadence ('at least six times annually') and multiple named roles (11 members) provides two verifiable facts, meeting the Quantified-Verifiable threshold.


reasoning: The paragraph explicitly describes the Technology Committee's oversight role over technology and cybersecurity risks, making Board Governance the clear category. The named committee is a firm-specific fact.