reasoning: This paragraph is a cross-reference directing readers to specific risk factor headings in Item 1A. While it contains materiality language ('have materially affected or are reasonably likely to materially affect'), the paragraph is not making a materiality conclusion — it is describing what those Item 1A sections cover and incorporating them by reference. The test per the codebook: 'For risks that may materially affect us, see Item 1A' = N/O (pointing elsewhere, not concluding). No substantive cybersecurity disclosure content is present in the paragraph itself.

thinking: Cross-reference paragraph pointing to Item 1A risk factors. The materiality language ("have materially affected or are reasonably likely to materially affect") is describing what Item 1A covers, not making a conclusion itself.


content_category: Board Governance

category_confidence: high

specificity_confidence: high

reasoning: The paragraph's dominant purpose is describing the Audit Committee's oversight structure — what reports it receives, from whom, and how information flows from management to the board. The CIO's qualifications and team experience in the final two sentences are subordinate to the governance-chain narrative. Per the board-line test, governance-chain paragraphs spanning board → officer are Board Governance when the purpose is describing oversight structure. Specificity reaches Quantified-Verifiable with two QV-eligible hard facts: 'over 10 years of experience' and 'over 13 years of relevant experience' (both specific numeric durations).

provider: anthropic

generationId: agent-sdk

stage: benchmark

thinking:
Let me analyze this paragraph carefully.

This is a long paragraph that spans multiple categories. Let me break it down:

1. "The Audit Committee of the Board oversees management's cybersecurity risk management efforts." — Board Governance
2. "Our chief information officer oversees information technology, cybersecurity risk and efforts to prevent and mitigate such risks." — Could be MR or governance chain
3. "The Audit Committee receives periodic reports summarizing threat detection and mitigation plans, audits of internal controls, summaries of training activities and certification achievements, assessments of cybersecurity program effectiveness and reports on other cybersecurity priorities and initiatives." — Board Governance (what the committee receives)

4. The Audit Committee also gets regular updates on cybersecurity incidents and the effectiveness of the cybersecurity program from the CIO and management team. — Board Governance
5. The CIO brings substantial experience with over a decade of cybersecurity leadership at the company and other public organizations, and is backed by a team of certified professionals averaging more than 13 years in the field. — Management Role (qualifications)

The majority of this section focuses on the Audit Committee's oversight responsibilities and reporting structure, with some detail on the qualifications of the cybersecurity leadership team. So those experience figures do qualify as quantified-verifiable facts — "over 10 years" and "over 13 years" match the QV criteria for specific numbers. The CIO role itself doesn't count toward QV since named positions don't qualify, but I've identified two solid QV-eligible facts from this section.

fact: Chief information officer (cybersecurity-specific role)

fact: CIO has over 10 years of experience overseeing cybersecurity teams

type: quantified

fact: Team of certified cybersecurity professionals with an average of over 13 years of relevant experience


content_category: Risk Management Process

category_confidence: medium

reasoning: This paragraph spans governance chain and internal processes. While the CIO→Audit Committee→Board reporting chain is present, the dominant content by volume describes internal risk management mechanisms: ERM Committee integration, independent internal audit of controls, the ARB for new IT initiatives, and the PMO for implementation monitoring. Applying the person-removal test, removing the CIO title leaves the entire paragraph coherent as a process description. Multiple named non-generic committees (ERM Committee, ARB) and a named cybersecurity-specific role (CIO) provide firm-specific detail without reaching the two-hard-fact QV threshold.

thinking:
Let me analyze this paragraph carefully.

This is a complex, multi-topic paragraph. Let me break down what it covers:

1. "Cooper Standard IT leadership team manages the global cybersecurity and IT compliance organization" - management/process
2. "Senior Vice President, Chief Information Technology Officer directly reports updates to the Audit Committee... at least twice annually and the full Board... at least annually" - governance chain (reporting to board)
3. "cybersecurity team periodically reports to our Global Leadership Team ('GLT')" - reporting structure
4. "ERM Committee which ensures cybersecurity risks are integrated into overall risk management" - ERM integration

5. "internal audit team independently assesses the cybersecurity program" - independent oversight process
6. "Architecture Review Board ('ARB')" and "Project Management Office ('PMO')" - additional governance bodies

The paragraph describes a multi-layered oversight structure where the CIO reports directly to the Audit Committee and Board, while various internal teams and committees—including the ERM Committee, internal audit, ARB, and PMO—provide additional layers of cybersecurity governance and risk management integration. chain (CIO → Audit Committee → Board) is one component. But the paragraph goes well beyond that to describe internal processes: ERM Committee integration, internal audit assessment, ARB reviews, PMO monitoring.

Actually, let me reconsider. The paragraph starts with the IT leadership team, then describes the reporting chain to the board, then describes various internal processes and committees. The dominant content is about the organizational structure and processes for managing cybersecurity.

Applying the person-vs-function test: Is this about WHO the person is (credentials, experience)? No. It's about organizational structure and processes. The SVP/CIO is mentioned as part of the reporting chain.

The paragraph's primary communicative purpose seems to be describing the overall governance and risk management structure. It spans board governance (reporting to Audit Committee/Board) and risk management process (ERM integration, internal audit, ARB, PMO).

Looking at the distribution of content, most of the text focuses on internal processes and structures rather than the governance chain itself. The board reporting is mentioned but the bulk describes how ERM, internal audit, ARB, and PMO all fit together in the oversight framework. Rule 2 says governance-chain paragraphs are almost always Board Governance, but this one extends significantly beyond just the chain—it's really about how the internal risk management mechanisms operate and interconnect.

I think Risk Management Process is the better fit since the dominant content describes internal processes and organizational structures for managing cybersecurity risk.

Now I'm working through the specific facts to identify what qualifies as information security content—the CIO role is clearly cybersecurity-specific, and the ERM Committee appears on the IS list as a named committee. I'm checking whether other elements like the Architecture Review Board and Project Management Office meet the specificity threshold, and reviewing the IS list to confirm which items should be tagged.

fact: Chief Information Technology Officer (SVP level)

fact: Enterprise Risk Management ('ERM') Committee

fact: Architecture Review Board ('ARB')

fact: Project Management Office ('PMO')

fact: Global Leadership Team ('GLT')


content_category: Management Role

reasoning: The paragraph describes a management-level committee ('Bank Technology Governance Committee'), its composition (CRO, CIO, senior leadership), its responsibilities (approving cybersecurity policies), and the reporting it receives from the director of information security. The codebook explicitly includes 'management committees responsible for cybersecurity' under Management Role. The purpose is describing the management-layer governance structure—who is responsible and how information flows at the management level—rather than board oversight (no board is the primary actor) or process details (no frameworks, tools, or methodologies). Firm-Specific due to the named non-generic committee and cybersecurity-specific roles (CIO, director of information security); these do not count toward QV.

thinking:
Let me analyze this paragraph.

The paragraph describes a management-level committee (Bank Technology Governance Committee) and its composition, responsibilities, and reporting structure.

Category analysis:
- It names a specific committee ("Bank Technology Governance Committee") - this is a named non-generic committee
- It describes committee composition (CRO, CIO, senior leadership)
- It describes what the committee does (approving policies, receiving reports)
- It mentions reporting FROM the director of information security TO this committee
- It also references reporting similar to what goes to the board

This is about the governance/oversight structure.

The key distinction here is that this is a management-level committee handling oversight responsibilities, not a board committee, which points me toward Management Role rather than Board Governance—specifically the reporting lines and responsibilities of named officers fit that category better than the board oversight rules. I'm settling on Management Role since the paragraph describes a named governance committee at the management level with specific composition and reporting responsibilities. The Bank Technology Governance Committee structure—with the CIO and reporting from the director of information security—fits the codebook definition of management committees responsible for cybersecurity oversight.

For specificity, the CIO and director of information security are both IS facts, while the CRO isn't cybersecurity-specific. There are no quantifiable elements like dates or headcounts, so this isn't QV. Since it includes a named non-generic committee and specific cybersecurity roles, I'm coding this as Firm-Specific (3).

fact: Bank Technology Governance Committee (named non-generic management committee)

fact: Chief Information Officer

fact: Director of Information Security


reasoning: The paragraph describes the company's training and professional development program for its cybersecurity team — industry group participation, simulated exercises, training budget, and certifications. No specific individual is named; the content is about organizational processes for maintaining team competence, making it RMP rather than Management Role. Multiple named certifications (CISSP, GIAC variants, CompTIA Security+) and named industry organizations (FS-ISAC, ABA) provide well over two hard verifiable facts, reaching Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: About cybersecurity personnel training, certifications, industry group memberships. Lists specific certifications and industry groups.

Category: This is about the qualifications and credentials of cybersecurity personnel. It's about WHO these people are (their certifications, training). But it's not about a single named officer - it's about the team collectively. The person-vs-function test: if I remove all credential/certification info, what's left? "Our cybersecurity personnel maintain current knowledge... expand and test their knowledge... We maintain a training budget." That's still a process description about training programs. But the dominant content is the certifications and qualifications of the personnel.

I'm reconsidering the classification here. The paragraph really focuses on the company's training and development practices—industry memberships, simulated exercises, budget allocation—rather than describing specific individuals. While certifications are mentioned, they're presented as part of the organization's overall approach to keeping the team current, not as credentials tied to named people. This feels more like a process description than a personnel profile. The certifications are held by individuals on the team, and there are multiple named ones—CISSP, various GIAC certifications, CompTIA Security+—which makes this quantified and verifiable. So this should count as QV-eligible content.

fact: FS-ISAC membership

fact: American Bankers Association participation

fact: Mid-Sized Banking Coalition of America participation

fact: CERT Insider Threat Program Manager certification

fact: GIAC Information Security Professional certification

fact: GIAC Security Leadership certification

fact: GIAC Continuous Monitoring certification

fact: GIAC Certified Forensic Analyst certification

fact: CompTIA Security+ certification

fact: ISC2 CISSP certification


reasoning: The paragraph describes two management-level committees (OROC and IT Steering Committee) responsible for cybersecurity oversight, their leadership (CRO, CIO), composition, and meeting cadence. The codebook lists 'management committees responsible for cybersecurity' under Management Role. The content is about organizational structure—who comprises these committees and how they function—rather than the cybersecurity processes themselves. Multiple firm-specific facts (named committees with unique identifiers, CIO role, specific departmental composition) but no QV-eligible hard facts (dates, dollar amounts, named third-party firms, or tools).

thinking:
Let me analyze this paragraph.

Content category: This describes management-level committees (OROC and IT Steering Committee) that oversee cybersecurity. The grammatical subjects are committees led by CRO and CIO. The purpose is describing the oversight structure at the management level - who comprises these committees, how often they meet, what they oversee.

This is about management committees and their composition/structure. The board isn't mentioned. The CRO and CIO are named as leaders but the paragraph is about the committees and their function, not about the persons' qualifications.

Board vs Management: No board mentioned. These are management-level committees.

Now I'm testing whether the paragraph's core meaning survives if I strip away the role titles and focus on the committee structure itself. The content still reads coherently when I remove the CRO and CIO references - it's fundamentally about what these committees do and who sits on them, not about the individuals' credentials or positions.

Looking at the codebook definition, management committees responsible for cybersecurity oversight clearly fall under Management Role, and describing the organizational structure, reporting relationships, and committee composition are all signals of that category. Since the committees themselves represent the management structure for cybersecurity governance, this is Management Role.

For specificity, I'm checking whether the details are firm-specific: the OROC and IT Steering Committee are named non-generic committees, the CIO appears on the IS list, and the department composition listing IT, Legal, Accounting, and Operational Risk Management is specific to this organization. There are no quantifiable metrics like dates, dollar amounts, or headcounts, so this doesn't meet the QV threshold.

fact: Operational Risk Oversight Committee (OROC)

fact: CIO leads Information Technology Steering Committee

fact: Comprised of senior leaders from IT (including Security), Legal, Accounting, and Operational Risk Management departments


reasoning: This is a governance-chain paragraph describing the oversight structure: Board → CFO/VP of Internal Audit → IT. The purpose is describing how cybersecurity oversight flows and how information reaches the Board (quarterly updates, periodic communication, incident reporting protocol). No person's credentials or qualifications are discussed, so this is not Management Role. CFO is generic C-suite (NOT list), VP of Internal Audit is not a cybersecurity-specific title, 'quarterly' and 'periodically' are generic cadences, and 'third-party IT service provider' is unnamed — no IS-list facts survive validation.

thinking:
Let me analyze this paragraph carefully.

This paragraph describes the oversight structure for cybersecurity at Kartoon Studios. Let me work through the category and specificity.

**Category Analysis:**

The paragraph covers:
1. Oversight responsibility shared by Board, CFO, VP of Internal Audit, and IT resources
2. CFO and VP of Internal Audit oversee cybersecurity risk management
3. CFO communicates with Board periodically
4. Cyber incident response plan reporting protocol

This is a governance-chain paragraph: Board → CFO/VP Internal Audit → IT. The purpose is describing the oversight STRUCTURE - who oversees what, how information flows, reporting lines.

Per Rule 2, governance-chain paragraphs are almost always Board Governance. The purpose here is describing oversight structure, not the qualifications of the people involved. Applying the category tests confirms this is Board Governance since it focuses on reporting lines and information flow to the board rather than individual credentials or experience.

**Specificity Analysis:**

Now I'm checking for specific facts in the paragraph. The CFO and VP of Internal Audit are named roles, but I need to see if there are concrete details about their responsibilities or the actual governance mechanisms described.

Looking at the elements: CFO is generic C-suite, VP of Internal Audit isn't a cybersecurity-specific title, Board is generic governance terminology, quarterly updates and periodic reviews are standard cadences with no unique identifiers, the third-party IT service provider is unnamed, and the cyber incident response plan has no specific identifier. None of these items meet the specificity threshold—they're all generic boilerplate language that could apply to any organization. This is Generic Boilerplate (1).


reasoning: The paragraph enumerates the responsibilities of the Information Security Management Committee — setting/reviewing the security program, monitoring risk trends, ensuring resources, executing risk management, maintaining incident response preparedness, and coordinating assessments. These are internal cybersecurity process and program management activities. While the last bullet describes reporting to the board's Compliance and Information Security Committee (a governance-chain element), the dominant content is what the management committee does to run the program, not how the board exercises oversight. Two named non-generic committees (Information Security Management Committee, Compliance and Information Security Committee) are firm-specific facts but not QV-eligible, yielding Firm-Specific.

thinking:
Let me analyze this paragraph.

The paragraph describes the responsibilities of the "Information Security Management Committee." This is a management-level committee, not a board committee. Let me determine the category.

The paragraph lists responsibilities of this committee - setting/reviewing security program, monitoring risks, ensuring resources, risk management, culture, assessments, incident response, reporting to the board's "Compliance and Information Security Committee."

This is about what a management committee does. The last bullet mentions reporting to the Board's committee, which is a governance chain element.

Category analysis:
- The subject is the "Information Security Management Committee" - a management committee

- These responsibilities are process and oversight activities, not credentials or individual qualifications
- The governance chain connects this management body to the board committee, suggesting this describes the oversight structure rather than internal operational processes
- The committee itself is management-level, not board-level, so while it touches on governance, the focus is on what the management committee does and how it reports upward

. The activities described—monitoring risks, managing controls, assessments, incident response—are core cybersecurity program functions. This feels more like Risk Management Process than Board Governance, since the paragraph is really about the operational and oversight responsibilities of the cybersecurity program as executed through this committee structure.

Now I'm looking at the specificity of the entities mentioned. The "Information Security Management Committee" and "Compliance and Information Security Committee of the Board of Directors" are both named, non-generic committees specific to this firm. These would count as firm-specific facts, though I need to think through whether named committees themselves constitute IS facts or if they're just organizational structure.

Looking back at the category options, the reporting relationship to the board suggests Board Governance, but that's only one element. The bulk of the paragraph focuses on what the committee actually does—overseeing the security program, monitoring activities, handling incident response. These are core risk management responsibilities, so Risk Management Process seems like the stronger fit. The specificity level is Firm-Specific since we're dealing with named committees and internal processes.


reasoning: Applying the person-removal test: removing CISO/CTO titles, the paragraph still coherently describes cybersecurity program functions — maintaining an incident response plan, annual testing, threat information sharing, staff training, logging incidents, and providing technical resources. No personal qualifications, credentials, or career history are mentioned; the paragraph describes what the program does organized by functional responsibility. The Risk Committee (non-generic, IS-list committee) and cybersecurity-specific titles (CISO, CTO) provide firm-specific facts, but none are QV-eligible (no dates, dollar amounts, headcounts, named firms/tools, or certifications).

thinking:
Let me analyze this paragraph.

Content category: This paragraph names CISO and CTO roles and describes their responsibilities. Let me apply the three-step decision chain for MR vs RMP.

Step 1 — Subject test: CISO and CTO are the grammatical subjects throughout. Signal for MR, but continue to Step 2.

Step 2 — Person-removal test: Remove "CISO" and "CTO" titles. The remaining content describes: implementing cybersecurity organization, maintaining incident response plan, testing it annually, sharing threat information, training board and staff, logging security incidents, providing technical resources. This is all process/program description.

The content stands on its own without the role titles—it's describing processes and governance structures like reporting to the Risk Committee, not personal qualifications or experience. This points to Risk Management Process rather than Management Responsibility.

Looking at specificity: CISO, CTO, and Risk Committee are all named organizational elements that qualify as IS facts. But checking for QV—there's no concrete data like dates, metrics, or named external tools, just a generic "annually" cadence. So this lands as Firm-Specific based on having at least one IS fact.

fact: Chief Information Security Officer (CISO)

fact: Chief Technology Officer (CTO)

fact: Risk Committee


reasoning: The paragraph describes the reporting structure from CISO to the Risk Committee, detailing briefing cadence and report content. The purpose is describing how information flows upward to a board-level committee — a governance-chain paragraph → Board Governance. The CISO (cybersecurity-specific role) and Risk Committee (non-generic committee) are both on the IS list, making it Firm-Specific, but neither is QV-eligible so it does not reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

The paragraph describes the CISO presenting reports to the Risk Committee on a quarterly basis, detailing what the report includes.

Category: The purpose is describing the oversight/reporting structure - how information flows from the CISO to the Risk Committee. The Risk Committee is receiving reports. This is about governance structure - Board Governance per Rule 2.

Specific facts:
- CISO (cybersecurity-specific title) → IS list ✓
- Risk Committee (named non-generic committee) → IS list ✓

QV check: CISO and Risk Committee are firm-specific but not QV-eligible.

Since there are no dates, dollar amounts, headcounts, named firms, or specific tools mentioned, this falls under Firm-Specific classification.

fact: CISO


reasoning: The paragraph describes how information about cybersecurity incidents flows to the Board — a crisis management team led by CIO/CISO communicates significant incidents to the Board and provides updates through resolution, while a disclosure committee evaluates materiality. Per Rule 2, describing 'how information flows to the board' is Board Governance even though management-level entities are the grammatical subjects. CIO and CISO are cybersecurity-specific titles on the IS list, triggering Firm-Specific, but no QV-eligible hard facts (dates, dollar amounts, named firms/tools) are present.

thinking:
Let me analyze this paragraph carefully.

The paragraph describes:
1. A cybersecurity crisis management team led by CIO and CISO
2. This team communicates significant incidents to the Board
3. A cyber incident disclosure committee evaluates materiality

Category analysis:
- The paragraph describes a governance structure for incident management and communication to the Board
- It spans multiple layers: management team structure, board communication, materiality evaluation
- The primary purpose is describing the organizational structure for crisis management and how information flows

Applying the board-line test: The paragraph mentions Board communication but the primary focus is on the management-level crisis management team and disclosure committee structure.

Now I'm reconsidering the emphasis here. The Board receives the communication, but the paragraph is really about the management structure that handles crises and how that structure operates. Looking at the person-removal test, if I strip out the CIO and CISO titles, the core message remains intact—it's describing how the management team is organized to handle incidents and communicate them up the chain. This is fundamentally about the management process and organizational structure rather than board-level oversight or specific qualifications.

The governance chain is present, but it's secondary to the main point about how incidents are managed at the management level. This reads as a Risk Management Process description—specifically the incident response and crisis management organizational structure that sits within the company's broader risk management framework. The paragraph describes how information flows to the board during incidents—the crisis management team communicates findings and the disclosure committee evaluates materiality—which fits the Board Governance category. The specific roles mentioned (CIO, CISO) and the named internal structure (cyber incident disclosure committee) make this Firm-Specific, though there are no quantitative indicators like dates or dollar amounts.

fact: CIO leads cybersecurity crisis management team

fact: CISO leads cybersecurity crisis management team


reasoning: The paragraph's purpose is describing the reporting/oversight structure — how the Director of Compliance provides reports to the Board on cybersecurity developments. This is a governance-chain paragraph (officer → board) where the communicative purpose is describing how oversight works, making it Board Governance. 'Director of Compliance' is not a cybersecurity-specific title per the IS list, 'Board of Directors' is generic, and 'regular reports' is a generic cadence, leaving no firm-specific facts.

thinking:
Let me analyze this paragraph.

Content category: The paragraph describes how the Director of Compliance reports to the Board on cybersecurity matters. The purpose is describing the reporting/oversight structure - how information flows to the board. This is a governance-chain paragraph.

The grammatical subject is "The Director of Compliance" but the purpose is describing the reporting structure to the Board. Per Rule 2, governance-chain paragraphs are almost always Board Governance.

Specificity: "Director of Compliance" - this is NOT a cybersecurity-specific title (it's a compliance role).

The role isn't on the IS list, and the language is all generic - just mentions a Board of Directors and regular reports with no named frameworks, specific dates, or firm-specific details. This is boilerplate content.


reasoning: This is a governance-chain paragraph describing how incident information flows from management to the Audit Committee. The primary communicative purpose is the oversight/reporting structure — the crisis management team's described function is communicating significant incidents to the Audit Committee and providing updates through resolution. Per the codebook, governance-chain paragraphs describing how information flows upward to the board are Board Governance, even when management teams are the grammatical subjects. The CIO and CISO are cybersecurity-specific titles (IS list), giving Firm-Specific; however, named roles do not count toward the QV two-fact threshold, so it remains at Level 3.

thinking:
Let me analyze this paragraph carefully.

The paragraph describes:
1. A cybersecurity crisis management team led by CIO and CISO
2. Communication of incidents to Audit Committee
3. A cyber incident disclosure committee that evaluates materiality

This is a governance-chain paragraph. Let me apply the decision rules.

Purpose test: The paragraph describes the organizational structure for incident management and how information flows to the board (Audit Committee). It spans management structure and board reporting.

The primary purpose is describing the governance/oversight structure - how incidents get communicated upward to the Audit Committee, and how materiality is evaluated.

So I'm looking at the organizational structure for incident management here. The CIO and CISO lead the crisis management team, which communicates incidents to the Audit Committee, and there's a separate disclosure committee evaluating materiality. The focus is really on how management has structured this process rather than the board's oversight role itself. I'm weighing whether this is Board Governance or Risk Management Process. The paragraph describes how incidents flow to the Audit Committee, which points toward governance structure, but the crisis management team and disclosure committee are also operational processes for handling incidents. The deciding factor is the primary purpose: communicating the oversight chain to investors, not detailing how incidents are managed operationally. This is Board Governance. Now I need to note the specificity—the CIO and CISO roles are mentioned in relation to cybersecurity responsibilities.

Looking at the facts: CIO and CISO are both cybersecurity-specific titles, which qualifies this as Firm-Specific. The Audit Committee is generic, and while the crisis management and disclosure committees are named, they're not unique program identifiers. There are no dates, dollar amounts, headcounts, or named external firms, so this doesn't meet the Quantitative/Verifiable threshold. This lands at Board Governance, Firm-Specific, Level 3.


content_category: Strategy Integration

reasoning: The paragraph contains an explicit negative materiality assertion ('To date, these threats and attacks have not resulted in a material cybersecurity incident'), which is the company stating a conclusion about whether cybersecurity has affected business outcomes — triggering Strategy Integration per Rule 6. The surrounding content is generic threat enumeration, speculative consequence language ('could adversely affect'), and a cross-reference, none of which override the materiality assessment. No firm-specific facts from the IS list are present.

thinking:
Let me analyze this paragraph.

The paragraph describes cybersecurity threats the company faces, then makes a materiality assessment ("To date, these threats and attacks have not resulted in a material cybersecurity incident"), then describes potential consequences, and ends with a cross-reference.

The materiality assessment "have not resulted in a material cybersecurity incident" is a negative assertion - the company is stating a conclusion about materiality. Per Rule 6, this triggers Strategy Integration.

The rest is generic risk language and a cross-reference, but the materiality assessment is the substantive disclosure content.

Specificity: No named standards, no firm-specific facts from the IS list.

The language throughout is mostly boilerplate without concrete details or company-specific examples.


reasoning: The paragraph contains both a backward-looking materiality assessment ('have not materially affected us') and a forward-looking assessment with the SEC qualifier ('reasonably likely to materially affect us'), triggering Strategy Integration per Rule 6. The cross-references to Risk Factors are ancillary. No firm-specific facts are present — all language is boilerplate materiality disclosure.

thinking:
Let me analyze this paragraph.

It contains:
1. A backward-looking materiality assessment: "have not identified risks...that have materially affected us"
2. A forward-looking materiality assessment with SEC qualifier: "reasonably likely to materially affect us"
3. Cross-references to Risk Factors

Per Rule 6, materiality assessments → Strategy Integration. The paragraph makes explicit materiality conclusions (both backward and forward-looking). The cross-references are noise.

Specificity: No specific facts from the IS list. Generic boilerplate materiality language. → Generic Boilerplate (Specificity 1).


reasoning: The paragraph describes the composition of a management-level committee (Technology and Operations Committee), detailing which roles and departments are represented. This is about organizational structure at the management layer — who sits on the committee — rather than board oversight or process description. Multiple firm-specific facts (named non-generic committee, CISO, CIO, specific departmental composition) but no QV-eligible hard facts (named roles and committees don't count toward QV).

thinking:
Let me analyze this paragraph.

Content: Describes a Technology and Operations Committee's composition - members include CIO, CISO, other IT/security leadership, and representatives from various departments.

Category: This is about a management committee's composition. The purpose is describing WHO sits on this committee. It's not about board oversight (no board mentioned), not about processes/tools, not about third parties or incidents.

This is Management Role - it describes the composition and structure of a management-level committee responsible for cybersecurity. The committee members, their roles, and departmental representation are the content.

Wait - let me reconsider. Is this Board Governance or Management Role?

The "Technology and Operations Committee" is clearly a management committee since it's composed of the Bank's operational leadership - the CIO, CISO, and representatives from specific departments like operational risk, information security, and IT. This fits squarely under Management Role since it's describing a management-level committee structure responsible for cybersecurity oversight, with named positions and specific departmental representation.

Now I'm checking whether this qualifies as Quantified Value - the named roles and committee don't count as QV, and there are no dates, dollar amounts, headcounts, named firms, tools, or certifications mentioned. So this is Firm-Specific information with multiple IS facts but no QV elements, giving it a Specificity rating of 3.

fact: Technology and Operations Committee

fact: CIO

fact: Committee composed of operational risk, information security, information technology, operations, and other departments


reasoning: Person-removal test: removing the SVP/CTO clause leaves a coherent process description about continuous monitoring, threat analysis, risk mitigation strategies, employee training, and security assessments — the paragraph is fundamentally about what the program does, not who the person is. The CTO and experience are subordinate attribution. Specificity: CTO is a cybersecurity-specific role (Firm-Specific), and 'over 20 years' is a QV-eligible number, but it is the only QV-eligible fact (named roles don't count toward QV threshold), so Firm-Specific rather than Quantified-Verifiable.

thinking:
Let me analyze this paragraph step by step.

**Content Category:**

Apply the MR vs RMP three-step decision chain:

Step 1 — Subject test: "Management" is the subject initially, then "the Company" later. The SVP/CTO is mentioned mid-paragraph. Person as subject is a signal, continue to Step 2.

Step 2 — Person-removal test: Remove "Led by our Senior Vice President and Chief Technology Officer with over 20 years of cyber and risk management experience" — the remaining text: "Management plays a pivotal role in identifying, assessing, and managing material risks from cybersecurity threats. This involves continuous monitoring, analyzing emerging threats, and the development and implementation of risk mitigation strategies. The Company actively implements and enforces cybersecurity policies, procedures, and strategies, including employee training programs, security assessments, and updates to ensure alignment with our evolving threat landscape."

Yes, this still makes sense as a process description. The paragraph's core content is about what the risk management program does, not about the person leading it. Even though the SVP/CTO's qualifications are mentioned, they're secondary to the dominant process narrative. → **Risk Management Process**

**Specificity:**

The CTO title appears on the IS list as cybersecurity-specific, making that firm-specific. The "over 20 years" reference is a specific quantifiable detail. Both count toward specificity scoring.

Now checking what qualifies for QV eligibility: the years of experience is a specific number, but named roles don't count toward QV. That leaves just one QV-eligible fact, so this lands at **Firm-Specific (3)**.


reasoning: The paragraph's primary purpose is describing management committee structure, composition, and organizational roles for cybersecurity oversight — the codebook explicitly lists 'management committees responsible for cybersecurity' as a Management Role marker. It names specific committees (IT Steering Committee, IT Subcommittee) and their detailed membership (CISO, CTO, CRO, Director of Internal Audit), making the organizational structure the dominant content. Multiple IS-list facts (CISO, CTO, named non-generic committees, specific team compositions) establish Firm-Specific, but no QV-eligible facts (dates, dollar amounts, named third-party firms, named tools) reach the two-fact threshold for Quantified-Verifiable.

thinking:
Let me analyze this paragraph carefully.

The paragraph describes management committees (IT Steering Committee, IT Subcommittee) that assist in cybersecurity risk management. Let me apply the decision rules.

**Category Analysis:**

The paragraph describes:
1. Management committees that help prevent/detect/mitigate cyber risks
2. IT Steering Committee composition and responsibilities
3. IT Subcommittee composition and responsibilities
4. CISO works with these committees

This is about organizational structure for cybersecurity oversight at the management level. The committees are management-level (not board committees). The paragraph describes what these committees DO (review controls, monitor threats, review projects) and WHO comprises them.

These are clearly management committees rather than board committees, and while they mention specific roles like CISO and CTO, the focus is on the committee structure itself and what responsibilities they hold. This falls under Management Role—it's describing the organizational framework and reporting relationships that support cybersecurity oversight. The codebook explicitly lists management committees under Management Role, and this paragraph is fundamentally about committee structure and composition—who sits on these committees and their organizational relationships. Looking at the specificity, I've got concrete details like the CISO, IT Steering Committee, CTO, and IT Subcommittee, which are all named non-generic committees and cybersecurity-specific roles.

Checking against the IS list, I have multiple firm-specific facts but none that qualify for QV eligibility since named roles and committees don't count toward that threshold. This lands it as Firm-Specific.

fact: IT Steering Committee

fact: Chief Technology Officer

fact: Chief Risk Officer

fact: IT Subcommittee

fact: Committee composition: President/CEO, CFO, CISO, CTO, CRO, Board representatives, Director of Internal Audit, IT/IS teams, senior management from business units


reasoning: Applying the person-removal test: removing the InfoSec Director references, the paragraph still coherently describes monitoring processes, security measures, system audits, and an incident response plan. The one person-specific sentence (thought leader, FS-ISAC speaker) is subordinate to the dominant content about the company's monitoring and IR processes. The paragraph's header ('Process for Monitoring Cybersecurity Incidents') confirms the communicative purpose is process description. Firm-Specific due to InfoSec Director (cybersecurity-specific title), eRISC (uniquely named internal body), and FS-ISAC (named organization), but only one QV-eligible fact (FS-ISAC), so not Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

The paragraph is about the "InfoSec Director" and "eRISC" monitoring cybersecurity incidents. Let me apply the decision chain.

Content Category:
- The paragraph mentions the InfoSec Director extensively. Let me apply the MR vs RMP three-step test.

Step 1 — Subject test: The InfoSec Director is the grammatical subject in most sentences. This is a signal, continue to Step 2.

Step 2 — Person-removal test: If I remove "The InfoSec Director" and role references, what remains?

Looking at the remaining content, I see a mix of personal attributes and operational responsibilities. Some elements describe the individual as a thought leader and conference speaker, which are clearly about the person, while others focus on processes like incident response planning and system monitoring that are more about the role's functions and organizational practices. I'm counting up the sentences to get a clearer picture of what dominates here. Most of them describe actual processes—monitoring systems, security measures, audits, incident response plans—with the InfoSec Director as the one executing them. There's really just one sentence about the person's thought leadership and conference participation, which stands out but doesn't shift the overall focus. The bulk of the content is definitely about the risk management process itself, even though the person is the one implementing it.

Now I'm breaking down what counts as a firm-specific fact versus something that qualifies for QV purposes. The InfoSec Director title is a named role but not QV-eligible. eRISC is an internal program with a specific identifier, also not QV-eligible. FS-ISAC is the one that stands out—it's a named external organization, which would be QV-eligible. That gives me one QV-eligible fact to work with here.

fact: InfoSec Director (cybersecurity-specific leadership title)

fact: eRISC (named internal body with unique identifier)

fact: FS-ISAC (named cybersecurity conference/organization)


reasoning: Applying the person-removal test: removing 'Our CISO and CIO' and 'The CISO,' the paragraph still coherently describes monitoring processes, security measures, system audits, vulnerability identification, and an incident response plan. The roles are incidental attribution; the substantive content is about what the program does. CISO and CIO are cybersecurity-specific titles (one IS-list fact), but no second QV-eligible hard fact exists, so specificity is Firm-Specific.

thinking:
Let me analyze this paragraph.

Content Category: The paragraph mentions CISO and CIO but describes what the program does - monitoring, security measures, audits, incident response plan. Apply the person-removal test: remove "Our CISO and CIO" and "The CISO" - the remaining text describes processes (monitoring, security measures, audits, incident response plan). This is Risk Management Process.

Specificity: CISO and CIO are cybersecurity-specific titles → Firm-Specific. No second hard verifiable fact for QV.

That gives me a Firm-Specific rating of 3.


reasoning: The paragraph's primary communicative purpose is describing the governance/oversight structure: the Sponsor's board periodically receives reports on BlackRock's cybersecurity program, and the Sponsor relies on BlackRock's ERM framework. While it touches on management (Sponsor's responsibility) and RMP (ERM framework), the framing establishes how oversight flows from the board downward. Despite the trust having no employees, this is not the SPAC/no-operations exception — BlackRock does maintain a cybersecurity program for the trust. No cybersecurity-specific roles (CISO, CIO), no named frameworks (NIST, ISO), no specific dates or quantified facts appear; 'BlackRock' is essentially a company self-reference as the parent/sponsor, 'periodically' is a generic cadence, and 'ERM framework' is a generic program name.

thinking:
Let me analyze this paragraph carefully.

This is from iShares Gold Trust (IAU), a trust structure where BlackRock is the sponsor. The paragraph covers multiple elements:

1. "The Trust does not have any officers, directors or employees" - establishes no-operations context
2. "The Sponsor... is responsible for oversight and overall management" - management attribution
3. "The Sponsor relies on BlackRock's ERM framework for cybersecurity risk management and strategy" - RMP reference
4. "The board of directors of the Sponsor... periodically receives reports from BlackRock regarding BlackRock's cybersecurity program" - Board governance

5. The trust does have a cybersecurity program through BlackRock's framework, so the no-operations exception doesn't fully apply here.

The dominant purpose is describing the governance and oversight structure—specifically how the board of the sponsor monitors cybersecurity through BlackRock's ERM framework and receives periodic reports. This is fundamentally about Board Governance.

Looking at the specificity: BlackRock is the parent/sponsor (essentially a self-reference), the ERM framework is generic, Board of Directors is generic, and "periodically" lacks any concrete timing. There are no named cybersecurity standards like NIST or ISO, no specific roles like CISO or CIO, and no quantified facts. This falls into Generic Boilerplate.

Though the trust itself has no officers or directors, it's not a SPAC—it's a gold trust with actual operations, so the None/Other category doesn't quite fit either.

The paragraph does describe substantive governance elements: the board receives reports and relies on an ERM framework. So I'm categorizing this as Board Governance, Generic Boilerplate.


reasoning: This is a governance-chain paragraph describing how the Board and Audit Committee exercise oversight of cybersecurity risk, with the VP of Strategic Initiatives and CFO serving as intermediaries who report upward. The purpose is describing the oversight structure, not the people or the program itself. No cybersecurity-specific titles (VP of Strategic Initiatives and CFO are generic), no named frameworks, no specific dates or numbers — all entities are on the NOT list (Audit Committee, Board, CFO).

thinking:
Let me analyze this paragraph carefully.

The paragraph describes a governance chain: VP of Strategic Initiatives and CFO oversee the program → Board has overall responsibility → Audit Committee supports the Board on cyber matters → Audit Committee receives updates from VP/CFO → Audit Committee updates full Board.

Category: This is a governance-chain paragraph. The purpose is describing the oversight structure - how information flows from management to the Audit Committee to the Board. Per Rule 2, governance-chain paragraphs are almost always Board Governance. The officers (VP of Strategic Initiatives, CFO) appear as intermediaries in the governance chain, not as the focus. The purpose is describing oversight structure.

The VP of Strategic Initiatives isn't a cybersecurity-specific role, and neither the CFO nor the Audit Committee nor Board are specialized titles - they're all generic governance entities. There are no specific facts like frameworks, dates, or numbers mentioned, so this is clearly Board Governance with no specificity markers.


reasoning: The paragraph describes management committee structure — the ERM committee and a dedicated cybersecurity committee, their responsibilities, and their composition (CTO, COO/CRO, CCO). Per the codebook, 'management committees responsible for cybersecurity' and 'management committee structure' are Management Role content. The paragraph is not about any person's credentials/background, but about the organizational structure at the management layer. Specificity is Firm-Specific due to the CTO (cybersecurity-specific role on IS list) and named non-generic committees (Cybersecurity Committee, ERM Committee), but no two QV-eligible hard facts are present.

thinking:
Let me analyze this paragraph.

Content Category: This describes management committees and their oversight structure. Let me apply the decision rules.

The paragraph describes:
- ERM committee oversees risk management including cybersecurity
- Cybersecurity committee oversees the cybersecurity program
- CTO is a member, along with COO/CRO and CCO
- CTO updates ERM committee quarterly

This is about management-level oversight structure - committees and their responsibilities. The grammatical subjects are committees and the CTO.

Is this Board Governance or Management Role or RMP?

This is about the management layer, not the board layer.

Now I'm working through the classification between Management Role and RMP. The core content here is the committee structure and composition itself - who sits on these committees and what they oversee. Even if I remove the CTO title, the paragraph is still fundamentally about how these management committees are organized and function. There are no credentials or certifications mentioned, just organizational roles and responsibilities. This falls under Management Role. Role covers "management committees responsible for cybersecurity." The paragraph describes who sits on these committees and what they do.

But wait - the person-vs-function test: the paragraph describes what committees DO (oversee, responsible for strategy/risk/IR). Remove the CTO and other titles, and you still have committee descriptions. But the committee composition (who sits on it) is management role content.

Hmm, but the codebook's MR definition says "management committees responsible for cybersecurity" are covered. And Rule 2b says "Reporting lines as primary content (who reports to whom, management committee structure) → Management Role."

Actually, looking more carefully at the Rule 2 table: "Management role reports TO the board (describing reporting structure) → Board Governance" but this paragraph is about management committees, not reporting to the board.

The paragraph is primarily about the management committee structure - who's on what committee and what each committee does. This fits Management Role per the codebook's inclusion of "management committees responsible for cybersecurity."

Now I'm checking what's firm-specific here. The CTO is a cybersecurity-specific title that appears on the IS list, and both the cybersecurity committee and ERM committee are named non-generic committees. The COO, CRO, and CCO are generic C-suite roles, and quarterly is just a standard cadence. There are no specific dates, dollar amounts, headcounts, named firms, tools, or certifications, so this isn't quantitatively valuable. That gives me three firm-specific facts total, which means this is Firm-Specific.

fact: CTO is a member of the cybersecurity committee

fact: Cybersecurity committee directly oversees the cybersecurity program

fact: ERM committee oversees cybersecurity as part of risk management


reasoning: The paragraph contains two explicit materiality assessments: a negative assertion ('not aware of having experienced any material cybersecurity incidents') and a forward-looking assessment with the SEC qualifier ('reasonably likely to materially affect... business strategy, results of operations or financial conditions'). Per Rule 6, these are materiality conclusions → Strategy Integration. The opening fragment about third-party experts and the closing cross-reference are subordinate. No firm-specific facts appear; the language is standard boilerplate.

thinking:
Let me analyze this paragraph carefully.

The paragraph contains:
1. "if necessary, the use of third-party security experts if and when an incident is detected" - seems like a fragment from a prior paragraph about processes
2. "We are not aware of having experienced any material cybersecurity incidents." - negative materiality assertion
3. "We are not aware of any existent cybersecurity threats that would materially affect, or are reasonably likely to materially affect, our business strategy, results of operations or financial conditions." - materiality assessment with SEC qualifier

4. "For more information, please see 'Cybersecurity' under Item 1A 'Risk Factors' above." - cross-reference

The dominant content here is the materiality assessment. Per Rule 6, both "have not experienced any material cybersecurity incidents" and "reasonably likely to materially affect our business strategy, results of operations or financial conditions" are materiality assessments → Strategy Integration.

The opening fragment about third-party experts is incomplete/minor. The cross-reference is noise.

Specificity: The materiality language is boilerplate. No specific facts from the IS list. → Generic Boilerplate.


reasoning: This is a governance-chain paragraph describing oversight structure from the Board down through its committees to the Director of Information Security. While it touches ERM (RMP) and names a management role (MR), the primary communicative purpose is describing how oversight is structured: the Board oversees through committees, management and consultants handle execution, and the Director of Information Security reports up through the CIO and presents to the Risk Committee. Per the governance-chain rule, this is Board Governance. Specificity is Firm-Specific due to cybersecurity-specific roles (Director of Information Security, CIO) and named non-generic committees (Operational Risk, IT Steering, Risk Committee), but none of these are QV-eligible facts.

thinking:
Let me analyze this paragraph carefully.

This is a long paragraph that spans multiple categories. Let me break down the content:

1. ERM program description (risk management)
2. Cybersecurity as component of ERM
3. Board oversight role
4. Management and outside consultants
5. Director of Information Security - reporting to CIO, member of committees, presents to Risk Committee

This is a governance-chain paragraph: board → committees → management → Director of Information Security. The purpose is describing the oversight STRUCTURE - how information flows from the Director of Information Security up through committees to the Board.

Let me apply the decision rules:

- Board oversight is mentioned but briefly

- The paragraph describes the governance chain: Board → Risk Committee → Director of Information Security → CIO
- The Director of Information Security's reporting lines and committee memberships are described

This spans Board Governance and Management Role. The paragraph's primary communicative purpose is describing the oversight structure - how the board exercises oversight through committees, and how management (specifically the Director of Information Security) fits into that structure. Per Rule 2, governance-chain paragraphs are almost always Board Governance.

Looking at the content more carefully, I'm seeing the ERM program overview, board oversight through the Risk Committee, and the Director of Information Security's role reporting to the CIO with specific committee memberships. The dominant focus is the governance structure flowing from board down through management - this is a governance-chain paragraph, so Board Governance classification.

For specificity, I'm noting cybersecurity-specific titles like Director of Information Security and Chief Information Officer, plus named committees like the Risk Committee and Operational Risk and IT Steering Committees. These are all IS facts, but named roles and committees don't count toward the QV threshold. Without 2+ hard verifiable facts, this falls into Firm-Specific territory despite the multiple IS facts present.

fact: Director of Information Security

fact: Chief Information Officer

fact: Risk Committee of the Board of Directors


reasoning: This is a governance-chain paragraph describing oversight structure from committee → full board → management team. Per the codebook, governance-chain paragraphs are almost always Board Governance because the purpose is describing the oversight structure, even though management roles appear. The management qualifications ('experience in risk management and technology/finance industries') are generic, not dominant. For specificity, CFO is generic C-suite (NOT list), 'Senior Director of Information Technology' maps to 'Director of IT' (NOT list), SVP Quality Assurance is not cybersecurity-specific, and no named frameworks, dates, firms, or other IS-list facts appear.

thinking:
Let me analyze this paragraph carefully.

The paragraph covers multiple topics:
1. Committee reports to Board (Board Governance)
2. Board receives briefings from management (Board Governance)
3. Board members receive presentations (Board Governance)
4. Management team (CFO, Senior Director of IT, SVP Quality Assurance) responsible for assessing/managing risks (Management Role)
5. Team has primary responsibility for cybersecurity program (Management Role / RMP)
6. Management team has experience in risk management and technology/finance industries (Management Role)

This is a governance-chain paragraph spanning board → committee → management. Let me apply the rules.

The first three sentences establish the Board's oversight structure through committee reporting and management briefings, then the paragraph shifts focus to the specific management roles—CFO, Senior Director of IT, and SVP Quality Assurance—who carry responsibility for risk assessment and the cybersecurity program, bringing relevant experience from their respective domains. I'm working through whether this is Board Governance or Management/Risk based on the structure and content. The paragraph spans from board oversight down through management roles, which typically signals Board Governance. But I need to check the dominant content—it's roughly split between governance structure and management responsibilities. The codebook notes that governance-chain paragraphs are almost always Board Governance unless the officer's qualifications are the dominant focus, and here they're fairly generic. The specific role titles like CFO and Senior Director of IT are standard C-suite positions, not particularly distinctive. Given that the primary purpose is describing how oversight flows through the governance structure rather than highlighting individual credentials, this fits Board Governance.

Now I'm checking whether any of these titles count as cybersecurity-specific for classification purposes. "Senior Director of Information Technology" sits in that gray area—it's more general IT than the cybersecurity-focused titles on the inclusion list like CISO or Director of IT Security, so it aligns with the NOT list. The SVP Quality Assurance role is clearly outside cybersecurity scope. No named frameworks, specific dates, or external firms are mentioned, so there's nothing pushing this toward greater specificity.


reasoning: Applying the person-removal test: removing the VP, ISS attribution leaves a fully coherent description of the company's cybersecurity program — control testing, risk assessments, risk reporting, third-party due diligence, email gateway monitoring, remote connection monitoring, and auditor reviews. The paragraph is about the function (what the program does), not the person (who the VP, ISS is). The VP, ISS title is a cybersecurity-specific role on the IS list, reaching Firm-Specific, but no second QV-eligible hard fact (no dates, dollar amounts, headcounts, named firms, or named tools) is present.

thinking:
Let me analyze this paragraph carefully.

**Content Category Analysis:**

The paragraph describes:
1. VP of Information Security Systems manages the program - names a specific role
2. VP, ISS acts as second line of defense, provides risk oversight
3. VP, ISS function manages testing, risk assessments, risk reporting, third-party due diligence, monitoring
4. Internal auditors and Board act as third line of defense
5. Regular assessments of infrastructure using internal and third-party specialists
6. Third-party risk management program
7. Email gateway monitoring, remote connection monitoring
8. Internal/external auditors review processes

Applying the MR vs RMP three-step test:

When I remove the VP, ISS references, the paragraph still holds together as a coherent description of cybersecurity activities—testing controls, risk assessments, reporting, third-party due diligence, monitoring, and auditor reviews all remain intact. The VP, ISS is really just the attribution for who oversees these processes, while the substance of the paragraph focuses on what the program actually does. So this is fundamentally a Risk Management Process.

Looking at the specificity, I've got one concrete fact: "VP, ISS" is a cybersecurity-specific title that qualifies as an IS-list item. The "three lines of defense" is a risk management framework but not a named standard like NIST, and everything else—third-party specialists, internal auditors, regular assessments—is generic language. That single IS-list fact puts this at Firm-Specific. For the QV check, I don't have two or more hard verifiable facts—no dates, dollar amounts, headcounts, named firms, or named tools—so it doesn't meet the QV threshold.

fact: Vice President of Information Security Systems (VP, ISS)


reasoning: This is a governance-chain paragraph: the Board reviews and updates the Information Systems Security Program annually, and the COO reports security incidents to the Board. The purpose is describing the oversight structure (Board reviews program, COO reports upward), making it Board Governance rather than Management Role — the COO's experience is mentioned but subordinate to the governance chain. COO is on the NOT list (generic C-suite), but the specific quantified experience ('over 30 years') is a firm-specific fact, yielding Firm-Specific (one QV-eligible fact, insufficient for Quantified-Verifiable).

thinking:
Let me analyze this paragraph carefully.

The paragraph has two sentences:
1. "The Information Systems Security Program, reviewed and updated annually by the Board of Directors, is our benchmark for protecting the Company's confidential information."
2. "The COO, with over 30 years of experience in operations and information security, reports security incidents and updates to the Board as needed."

This is a governance-chain paragraph spanning board → officer → program.

Sentence 1: Names a program ("Information Systems Security Program") and mentions Board reviews it annually.
Sentence 2: Names the COO with qualifications (30 years experience) and reporting to Board.

Purpose test: The paragraph describes the oversight structure - the Board reviews the program, the COO reports to the Board.

The COO's qualifications are mentioned, but they're secondary to the governance structure being described. The first sentence focuses on the program and Board oversight, while the second sentence emphasizes the COO's reporting relationship to the Board. The experience is included as context but isn't the dominant focus of the paragraph. The overall purpose is establishing the governance chain and oversight mechanisms, which points toward Board Governance classification.

Looking at specificity now: "Information Systems Security Program" is a named program with some specificity, though not uniquely identified. COO falls under the generic C-suite exclusions, so that's not a specific fact. The "over 30 years of experience" is quantified and counts as specific. Board of Directors and annual review cadence are both generic elements that don't add specificity.

So I have one quantified fact here—the 30 years—which isn't enough to reach the QV threshold of two. This lands it as Firm-Specific based on that single specific detail.


reasoning: This is a governance-chain paragraph describing oversight structure from board → management → VP of Operations → audit committee → board. The purpose is describing how cybersecurity oversight flows through the organization, making it Board Governance. 'Vice President of Operations' is a general corporate title (not on the cybersecurity-specific IS list like CISO/CTO/CIO/VP of IT/Security), 'audit committee' and 'board of directors' are generic governance terms, and no named frameworks, dates, or firm-specific facts are present.

thinking:
Let me analyze this paragraph.

Content category: This spans board oversight, management role, and risk management process. The paragraph starts with board oversight, then describes management's responsibilities, then names the VP of Operations, then describes reporting structure back to audit committee/board.

Purpose test: This is a governance-chain paragraph (board → management → VP of Operations → audit committee → board). The purpose is describing the oversight structure - how cybersecurity governance flows through the organization.

The VP of Operations is named as a role but no qualifications are given. The paragraph describes the structure of oversight, not who the person is.

Per Rule 2, governance-chain paragraphs are almost always Board Governance.

The board frames the overall responsibility, and the rest of the chain describes how that flows through management and the VP of Operations before reporting back up. This is clearly Board Governance. Now I'm noticing the VP of Operations isn't actually a cybersecurity-specific role—it's not on the list of typical security titles like CISO or CIO, so that's worth flagging as a general corporate position rather than a dedicated security role. I'm realizing that "VP of Operations" is a generic corporate title, not a cybersecurity-specific one, so even though this person handles incident response duties, they still fall into the boilerplate category rather than representing a specialized security role.


reasoning: The paragraph's primary communicative purpose is a backward-looking materiality assessment ('we are not aware of any cybersecurity threats or incidents that have materially affected our business strategy, results of operations, or financial condition'), which is an explicit materiality conclusion per Rule 6 → Strategy Integration. The subsequent generic risk warning ('does not guarantee...') and cross-reference to Item 1A are secondary. No firm-specific facts from the IS list are present — third-party incidents are unnamed, and all language is boilerplate.

thinking:
Let me analyze this paragraph.

The paragraph has three parts:
1. Acknowledges third-party incidents, then states a materiality assessment: "we are not aware of any cybersecurity threats or incidents that have materially affected our business strategy, results of operations, or financial condition"
2. Generic forward-looking risk warning: "does not guarantee that future incidents or threats will not have a material impact"
3. Cross-reference to Risk Factors

The first sentence contains an explicit backward-looking materiality assessment ("materially affected our business strategy, results of operations, or financial condition"). Per Rule 6, this is Strategy Integration.

The second and third sentences are just boilerplate—a generic risk warning and a cross-reference. Looking at specificity, there are no named standards or firm-specific facts from the IS list, and while third-party service providers are mentioned, they're not named. The date reference is vague. This is clearly Generic Boilerplate with minimal specificity.


reasoning: The paragraph opens with an explicit materiality assessment ('not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition'), which is a backward-looking + forward-looking conclusion per Rule 6 → Strategy Integration. The remainder is a generic risk caveat and a lengthy cross-reference to Item 1A, which are noise. No firm-specific facts appear — all language is boilerplate materiality disclaimer usable by any company.

thinking: Materiality assessment paragraph.


reasoning: The paragraph establishes management's responsibility for risk and describes a committee structure chaired by the Executive Director of Information Technology — its primary purpose is identifying WHO is responsible at the management level and the committee reporting structure. The risk management framework mention ('identification, analysis, response') is minimal and generic. 'Executive Director of Information Technology' maps to generic IT leadership (Director of IT) on the NOT list, the committee is unnamed, and no other IS-list facts are present, yielding Generic Boilerplate.

thinking:
Let me analyze this paragraph.

Content category: The paragraph describes management's responsibility and a committee structure. Let me apply the decision chain.

Step 1 — Subject test: "Management" is the subject, then "The Company" - mixed.

Step 2 — Person-removal test: Remove "Executive Director of Information Technology" - the paragraph still describes risk management framework and committee. But the committee composition with the chair role is somewhat about structure.

Actually, this paragraph has two parts:
1. Management is responsible for day-to-day risk management - generic management responsibility
2. A committee of senior leaders chaired by Executive Director of IT

The key question is whether naming the specific chair role makes this about the person or the process. If I remove that title, the core message remains: management handles day-to-day risk administration through an established framework, and the company has a senior leadership committee overseeing it. The person-removal test suggests this is primarily about the risk management process and structure rather than the individual role itself. I'm second-guessing myself on the title specificity. "Executive Director of Information Technology" is essentially a generic IT leadership role—it's not cybersecurity-specific like CISO or Director of IT Security would be. The codebook's NOT list includes "Director of IT" as generic IT leadership, and this title falls into that same category rather than being a dedicated cybersecurity role.

Looking at what's actually here: no named standards, no specific cybersecurity facts from the inclusion list, and just a vague reference to "a committee of senior leaders" with no details. This all points to generic boilerplate rather than substantive content.


reasoning: Despite the company explicitly stating it has no formal cybersecurity program, Jones Soda is an operating company (not a SPAC/shell), so the SPAC exception does not apply. The final sentence contains an explicit materiality assessment using SEC Item 106(b)(2) language ('have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition'), which per Rule 6 triggers Strategy Integration. The CEO/Interim CFO and board mentions are generic C-suite/governance (NOT list items), but 'fiscal year 2023' is a specific date anchoring the materiality conclusion, yielding Firm-Specific.

thinking:
Let me analyze this paragraph carefully.

This is from Jones Soda Co., a small company that explicitly states it has NO formal cybersecurity risk management program. Let me work through the classification.

Key content:
1. "has not adopted any formal cybersecurity risk management program or formal processes" - explicitly states no program
2. CEO and Interim CFO handle incidents - generic C-suite, not cybersecurity-specific roles
3. Board has oversight but hasn't delegated to any committee - generic
4. Reporting structure for incidents - generic
5. Materiality assessment for fiscal 2023 - "have not materially affected or are reasonably likely to materially affect"

6. The SPAC rule applies specifically to shell companies and SPACs with no operations, but Jones Soda is an operating company that simply hasn't formalized its cybersecurity program yet. The distinction matters because the codebook's None/Other classification is meant for companies with no operations at all, not operating companies lacking formal processes. The competing signals here are whether the lack of a formal program pushes this toward None/Other, or if the materiality assessment at the end triggers Strategy Integration instead. Looking at the SPAC rule and Case 8, even when there's a negative incident statement like "no cybersecurity incidents since IPO," it still gets classified as None/Other—suggesting that materiality assertions alone don't override the no-program classification. The real question is what the paragraph is primarily communicating: the absence of formal processes, or the assessment that nothing material happened. explicit SEC 106(b)(2) materiality conclusion that should point toward Strategy Integration per Rule 6. But the dominant content is really about the absence of a formal program, which pulls toward None/Other instead. I'm torn between these signals, though the materiality language is pretty explicit. Let me reconsider the SPAC analogy though—Jones Soda is an actual operating company with real CEO/CFO involvement and board oversight, not a shell company, so that distinction might matter here. The SPAC exception doesn't apply here since Jones Soda is an operating company, not a SPAC, so I'm classifying this as Strategy Integration—the materiality assessment is substantive even without a formal program. For specificity, "fiscal year 2023" counts as a specific date, and since CEO, CFO, and board are all generic roles not on the cybersecurity-specific list, this is Firm-Specific with one fact.

fact: fiscal year 2023


reasoning: The paragraph identifies who leads cybersecurity (senior management, IT staff, and a third-party business technology partner) and provides a qualification detail (21 years of experience for the partner). While it mentions processes (monitoring, meetings), the primary purpose is describing who is responsible and their credentials. The person-removal test is borderline—removing the actors leaves only generic process fragments—tilting toward Management Role. However, confidence is moderate because the 'routine meetings' and 'continuous monitoring' language leans toward RMP territory, and no cybersecurity-specific titles (CISO, CIO) are named. One QV-eligible fact (21 years) makes it Firm-Specific but not Quantified-Verifiable.

thinking:
Let me analyze this paragraph carefully.

The paragraph describes management leading cybersecurity processes, mentions a third-party business technology partner with 21 years of experience, and describes monitoring/meetings for updates.

Category analysis:
- Grammatical subject: "Our management" and "Our third-party business technology partner"
- Content: management leads risk assessment/mitigation, third-party partner involved, continuous monitoring, routine meetings to update senior management
- Person-removal test: Remove "senior management" and "third-party business technology partner" - remaining content describes processes (risk assessment, mitigation, monitoring, meetings). But the paragraph also has "21 years of experience" for the third-party partner.

- The core structure is about who oversees cybersecurity—senior management and an external partner with substantial experience—and how they maintain visibility through regular monitoring and updates. The 21 years of experience serves as a credential for the third-party partner, while the meetings and monitoring mechanisms describe the information flow keeping leadership informed. The 21 years of experience is a quantified fact specific to this company's disclosure, making it Firm-Specific. The third-party partner itself is unnamed, and the management roles mentioned are generic titles rather than specific positions like CISO or CTO, so there's only that one QV-eligible fact here.

For categorization, this falls under Management Role since the paragraph focuses on who oversees cybersecurity and their qualifications.

fact: Third-party business technology partner has over 21 years of experience in cybersecurity and information technology


reasoning: The paragraph spans Board Governance (committee reports, board briefings) and Management Role (named CFO R. LaDuane Clifton, team responsibilities, 40 years combined experience). The management content dominates by volume and specificity — three sentences identify who manages cybersecurity, name a specific individual, describe the team's responsibilities, and quantify experience, making MR the primary communicative purpose. Specificity is Firm-Specific: the named individual and quantified experience (40 years) are firm-specific facts, but only '40 years combined experience' is QV-eligible (named individuals/roles don't count toward QV), yielding one hard fact — not enough for Quantified-Verifiable.

thinking:
Let me analyze this paragraph carefully.

The paragraph covers multiple topics:
1. Committee reports to Board about cybersecurity activities
2. Board receives briefings from management
3. Board members receive presentations from internal/external experts
4. Names R. LaDuane Clifton, CFO, as responsible for managing cyber risks
5. Team supervises internal and external cybersecurity consultants
6. IT staff with 40+ years combined experience

This spans Board Governance and Management Role. Let me apply the decision rules.

The paragraph starts with board oversight (committee reports, board briefings) then shifts to management team responsibilities. The dominant content seems split - first half is board oversight structure, second half is about the management team.

Now I'm weighing whether this is primarily about board governance or management roles. The text flows from the committee reporting structure into specific details about the management team—naming the CFO, describing their responsibilities, and highlighting their combined experience. While the opening establishes the board's oversight function, the bulk of the content focuses on who manages the cybersecurity function and their qualifications. The CFO being named specifically signals this is about management qualifications, but the paragraph's primary structure traces the governance chain from committee through board to management—that oversight flow is what dominates. Even though the second half emphasizes the team's experience and credentials, the paragraph's communicative purpose is establishing how oversight works, which makes this Board Governance rather than Management Role. The management portion is actually more substantial by volume—the named CFO, specific responsibilities, and quantified experience carry real weight. But the paragraph's overall structure frames everything within the governance oversight chain, which pulls it back toward Board Governance. I'm going to classify this as Management Role since the detailed content about the individual and team responsibilities is what dominates, even though it's nested within a governance context. The "40 years of combined experience" is a quantified fact, which makes this Firm-Specific rather than QV-eligible since it's just one specific number. Named individuals don't count toward QV on their own. So I'm settling on Management Role, Firm-Specific.

fact: R. LaDuane Clifton, Chief Financial Officer, Secretary and Treasurer — named individual responsible for cybersecurity

fact: More than 40 years of combined experience in information security, privacy, data protection, and cybersecurity roles


reasoning: Two of three sentences focus on the Director of IT's responsibility and experience (qualifications tiebreaker favors MR), with the third describing team monitoring activities. Applying the person-removal test, removing the role and experience description leaves only a generic team monitoring sentence — the paragraph is fundamentally about who is responsible and their background. However, 'Director of IT' is on the IS-NOT list (generic IT title, not cybersecurity-specific), and the experience described is entirely vague ('extensive experience') with no certifications, years, or named credentials, yielding no specific facts and Generic Boilerplate specificity.

thinking:
Let me analyze this paragraph step by step.

Content Category: Need to apply the MR vs RMP three-step test.

Step 1 — Subject test: "Director of IT" is the subject in the first two sentences. Third sentence switches to "The team." Person as subject → signal, continue to Step 2.

Step 2 — Person-removal test: Remove "Oblong's Director of IT" and credentials. What remains? "...is responsible for assessing and managing cybersecurity risks. [experience description removed]. The team monitors Oblong's IT environment for potential security threats, investigating and acting on security events to minimize potential risks to the environment."

The first two sentences focus on the person's responsibilities and experience, while the third shifts to describing the team's operational activities. It's a mixed case, so I need to look at the qualifications. The experience language is somewhat vague—it's about staying current and building resilience—which leans toward Management Role. Since the person's role and background dominate the first two sentences, I'd classify this as Management Role.

But wait, the title itself matters. "Director of IT" is explicitly listed as a generic IT title, not cybersecurity-specific. That's a key disqualifier. Looking at the specificity: there are no named frameworks, tools, certifications, or concrete numbers. The experience is described only as "extensive" without detail. This points toward Generic Boilerplate.

Let me reconsider the overall categorization though. The paragraph is fundamentally about who this person is and what they do—their role and experience take up most of the space. That's Management Role territory, even if the language is vague and the title is generic.


reasoning: The paragraph spans RMP (risk assessments, audits) and BG (Board oversight, reporting structure). The most detailed portion describes the Board's oversight responsibility and the reporting chain — what the Director of IT reports to the Board and the scope of those reports — making governance structure the dominant purpose. 'Director of Information Technology' is generic IT leadership per the NOT list (not cybersecurity-specific like 'Director of IT Security'), 'Board' is generic, and cadences ('annual', 'as needed') are generic, leaving no firm-specific facts.

thinking:
Let me analyze this paragraph.

Content: Describes risk assessments by management including Director of IT, annual audits, Board oversight, Director of IT reporting to Board, and roles/responsibilities.

Category analysis:
- Risk assessments and audits → RMP
- Board oversight → BG
- Director of IT reports to Board → governance chain

The paragraph spans multiple categories. Let me identify the dominant one. It starts with risk assessments (RMP), then moves to Board oversight and reporting structure (BG), then ends with roles/responsibilities.

The governance chain (Director of IT reports to Board) is BG per the rules. But the paragraph also has RMP content (risk assessments, audits, vulnerabilities).

Looking at the substance, the paragraph weaves together risk management practices with governance structure—the Board's oversight role and the Director of IT's reporting line are equally prominent as the risk assessment and audit components. The content is genuinely split between RMP and BG, making this a mixed paragraph that doesn't clearly favor one category. Looking at the specifics here, the Director of Information Technology is generic IT leadership rather than a cybersecurity-specific role, and there are no named frameworks or standards mentioned—just standard governance language about Board oversight and reporting cadences. This reads as generic boilerplate.


reasoning: Applying the MR vs RMP three-step chain: Step 1 — the first sentence's subject is 'cybersecurity risk assessment and management processes'; subsequent sentences name COO and SVP as subjects but describe what the program does (hiring, integrating risk, reviewing assessments). Step 2 — removing the role titles leaves a coherent process description ('responsible for hiring appropriate personnel, integrating cybersecurity risk considerations into overall risk management, communicating key priorities, reviewing security assessments'). Step 3 — no qualifications, certifications, experience, or career history are provided for either person. The paragraph is about the function, not the person. COO and 'Senior Vice President for Operations' are generic C-suite/operational titles on the ✗ NOT list, not cybersecurity-specific roles, and no named frameworks or other specific facts appear.

thinking:
Let me analyze this paragraph carefully.

The paragraph mentions COO and SVP for Operations, describes their responsibilities related to cybersecurity. Let me apply the three-step decision chain for MR vs RMP.

Step 1 — Subject test: "Our cybersecurity risk assessment and management processes" is the subject of the first clause. But then "Our COO" and "Our COO and Senior Vice President for Operations" are subjects of subsequent sentences.

Step 2 — Person-removal test: Remove all named roles/titles. What remains? "...cybersecurity risk assessment and management processes are implemented and maintained...

The text continues describing who's responsible for hiring personnel, integrating cybersecurity considerations into overall risk management, communicating priorities, and reviewing security assessments. Even stripped of titles, this still reads as a coherent description of management responsibilities and processes. Step 3 confirms there are no qualifications, certifications, education, or career history mentioned—just role-based responsibilities. This points to Risk Management Process rather than Management Representatives.

Now I'm checking whether the roles mentioned actually qualify. COO and SVP for Operations are both explicitly on the NOT list of cybersecurity-specific titles, which means they're generic C-suite positions. There are no frameworks named, no specific facts, and no cybersecurity-specific expertise indicated. This is generic boilerplate—a standard risk management process description attributed to generic leadership roles.


reasoning: The paragraph primarily describes the company's internal cybersecurity safeguard processes (design, implement, maintain, monitor). The Senior Director, Head of IT and Informatics is named as the responsible person, but the person-removal test shows the first sentence stands alone as a coherent process description, and no qualifications, credentials, or career history are provided (Step 3 = NO) — making this RMP with incidental role attribution. The named cybersecurity-specific title is a firm-specific fact, but CFO is generic C-suite per the NOT list.

thinking:
Let me analyze this paragraph.

Content: Describes safeguards process (re-design, implement, maintain, monitor) and then delegates responsibility to "Senior Director, Head of IT and Informatics" who reports to CFO.

Category analysis:
- First half: risk management process (safeguards, monitoring)
- Second half: names a specific role and reporting line

Person-removal test: Remove "Senior Director, Head of IT and Informatics" and "Chief Financial Officer" - the first clause about safeguards still stands, but the second half is about delegation and reporting structure. The paragraph is split between process description and management role attribution.

The first sentence describes the risk management process itself, which remains coherent without the role names. The second sentence becomes meaningless if I strip out the title and reporting line, since it's purely about organizational structure. The paragraph contains no qualifications or experience requirements—just a title and where it sits in the hierarchy—which points toward classifying this as a risk management process rather than a role description.

The "Senior Director, Head of IT and Informatics" is specific to the firm's structure, while the CFO reference is just a generic C-suite position. That one firm-specific detail pushes this into the Firm-Specific category.


content_category: None/Other

reasoning: This paragraph is risk-factor boilerplate — it opens with a cross-reference to Item 1A, describes the general threat landscape, briefly mentions generic measures taken ('security technologies, internal controls, disaster recovery'), then spends the vast majority of its text on potential adverse consequences ('could have a material adverse effect'). The 'could have a material adverse effect' language is generic speculation, not a materiality assessment. The brief process mentions are subordinate to the risk-warning purpose; the paragraph reads as Item 1A content rather than substantive Item 1C cybersecurity disclosure. No named frameworks, roles, dates, or firm-specific facts appear.

thinking:
This is a long paragraph from a 10-K Item 1C filing. Let me analyze it.

The paragraph discusses general cybersecurity risks, mentions steps taken (security technologies, internal controls, etc.), and discusses potential consequences. It's essentially a risk factors discussion that references Item 1A.

Key observations:
- Opens with a cross-reference to Item 1A Risk Factors
- Describes general industry threats
- Lists generic measures taken (security technologies, internal controls, etc.)
- Discusses potential consequences in generic terms
- Mentions data privacy laws generically
- "could have a material adverse effect" — this is generic risk warning, NOT a materiality assessment

- The paragraph describes some defensive steps like implementing security technologies, upgrading remote work environments, and obtaining insurance, but these are all standard industry practices without firm-specific details, dates, or named frameworks. The language is boilerplate risk disclosure rather than a detailed risk management process or materiality assessment. The company does describe some cybersecurity measures, even if generically, which under Rule 5 should trigger a relevant category assignment. But the overwhelming focus here is on potential risks and consequences rather than actual process disclosure. The measures mentioned are really just scaffolding for the "these might not be enough" argument. I'm leaning toward None/Other since this reads like boilerplate risk language that probably migrated from Item 1A, where the primary intent is warning about adverse effects rather than meaningfully disclosing cybersecurity processes. The language here is purely generic boilerplate—no specific frameworks, named processes, roles, or firm details—which confirms this belongs in the None/Other category rather than as a substantive cybersecurity disclosure.


reasoning: The opening sentence is a negative materiality assertion ('have not experienced a cybersecurity incident that resulted in a material adverse impact to our business or operations'), which per Rule 6 is a materiality assessment triggering Strategy Integration. The remainder is generic risk warning ('could harm,' 'could have an adverse effect') which is boilerplate speculation, not an assessment. No firm-specific facts, named standards, or verifiable details.

thinking:
Let me analyze this paragraph.

First sentence: "We have not experienced a cybersecurity incident that resulted in a material adverse impact" — this is a negative assertion with materiality framing → Strategy Integration per Rule 6.

Second sentence: generic risk warning about what "could" happen — boilerplate speculation.

The first sentence is a materiality assessment (negative assertion). Per Rule 6, this triggers SI. The rest is generic risk warning.

Specificity: No named standards, no firm-specific facts. Generic Boilerplate.


reasoning: This is a governance-chain paragraph describing the oversight structure from Co-President → Audit Committee → Board of Trustees. While the Co-President's risk management activities are mentioned, the paragraph's primary communicative purpose is describing how cybersecurity oversight flows upward through the governance hierarchy — reporting cadence, committee responsibilities, and board-level escalation. Per Rule 2, governance-chain paragraphs are Board Governance. No IS-list facts are present: 'Co-Presidents' is a generic executive title (like President/COO), 'Audit Committee' is standard, 'at least annually' is a generic cadence, and 'enterprise risk management program' is a generic program name.

thinking:
Let me analyze this paragraph carefully.

The paragraph describes a governance chain: Co-President → Audit Committee → Board of Trustees. Let me apply the decision rules.

**Content Category:**
The paragraph spans multiple layers:
- Management: "One of our Co-Presidents is responsible for managing cybersecurity risk. They develop mitigation strategies and implement controls..."
- Board Governance: "they report on this risk... to the Audit Committee... which has primary responsibility for overseeing our enterprise risk management program... The Audit Committee reviews and discusses all of our key enterprise risks..."

Purpose test: This is a governance-chain paragraph.

The core purpose is describing how cybersecurity risk flows through the organizational hierarchy—from the Co-President's management activities up through the Audit Committee's oversight to the Board. While the paragraph does mention what the Co-President does, the communicative focus is on the reporting and oversight structure itself. Per Rule 2, governance-chain paragraphs describing oversight structures are Board Governance content, so this should be categorized there.

Looking at specificity, there aren't any concrete details here—no named frameworks, no cybersecurity-specific titles (Co-President is generic C-suite), no dates, no numbers. The Audit Committee, Board of Trustees, and "at least annually" are all standard governance language without distinguishing facts.


reasoning: This is a governance-chain paragraph describing how management committees (IT Steering Committee, Operational Risk Management Committee) provide oversight and report upward to the board's Innovation and Technology Committee via the CISO. The communicative purpose is describing the oversight/reporting structure — who sits on which committee, how often they meet, and how information flows to the board — making this Board Governance. Multiple named non-generic committees and cybersecurity-specific roles make it Firm-Specific, but no QV-eligible hard facts (dates, dollar amounts, headcounts, named third-party firms) reach the two-fact threshold for Quantified-Verifiable.

thinking:
Let me analyze this paragraph carefully.

This is a dense paragraph spanning multiple governance layers. Let me work through the category and specificity.

**Category Analysis:**

The paragraph describes:
1. Management committees (IT Steering Committee, Operational Risk Management Committee)
2. Who chairs them (CIO, Chief Operational Risk Management Officer)
3. CISO participation
4. Meeting cadence (monthly, quarterly)
5. What the committees oversee
6. Reporting to the Innovation and Technology Committee of the board

This is a governance-chain paragraph: board → Innovation and Technology Committee → management committees → officers → program. The PURPOSE is describing the oversight structure - how information flows from management committees up to the board committee.

So even though the management committees dominate the paragraph's content, the communicative purpose is still about the reporting chain and oversight structure flowing upward to the board. That makes this Board Governance.

Looking at the specificity markers, I've got several named committees and specific titles like CIO, CISO, and Chief Operational Risk Management Officer, plus concrete meeting frequencies. All of these point to IS-list content, which confirms the Board Governance classification.

Now checking for QV-eligible facts—named roles and committees don't qualify, and "monthly" and "quarterly" are just generic cadences without specific dates. There are no dollar amounts, headcounts, or third-party vendors mentioned. So while there are multiple firm-specific details here, none of them reach the QV threshold, putting this at Firm-Specific (3).

fact: Information Technology Steering Committee

fact: Operational Risk Management Committee

fact: Chief Information Officer chairs IT Steering Committee

fact: Chief Operational Risk Management Officer chairs Operational Risk Management Committee

fact: Chief Information Security Officer