content_category: None/Other

category_confidence: high

specificity_confidence: high

reasoning: This paragraph is only a cross-reference directing readers to the Risk Factors section for more information about cybersecurity-related risks. It does not describe governance, management, processes, third-party risk, an actual incident, or a business-impact assessment.

provider: openai

stage: benchmark


reasoning: This paragraph is only a cross-reference directing readers to another section for discussion of cybersecurity-related risks. It does not describe board oversight, management roles, cybersecurity processes, third-party risk, an actual incident, or a materiality/business impact assessment.


reasoning: This paragraph is a forward-looking limitation/disclaimer about cybersecurity risk and a cross-reference to Risk Factors, not a substantive description of governance, management, process, third-party risk, incident details, or strategy impact. It contains no qualifying cybersecurity-specific facts beyond generic boilerplate language.


category_confidence: medium

reasoning: The paragraph only states a general commitment to protecting IT assets, data, intellectual property, and products, without describing any actual cybersecurity governance, management role, process, third-party oversight, incident, or business-impact assessment. Because it is purely high-level and non-substantive, it fits None/Other.


content_category: Strategy Integration

reasoning: The paragraph primarily provides a materiality assessment, stating that the company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the business, results, or financial condition. The remaining sentence is just a cross-reference to risk-factor disclosure and does not change the primary focus.


reasoning: This paragraph only provides general context that the company handles personal information and faces cyber threats from external parties and insiders. It does not describe oversight, management roles, risk management processes, third-party risk practices, a real incident, or a material business impact assessment.


content_category: Board Governance

reasoning: The paragraph primarily describes how cybersecurity information flows to the board and how the board is educated on cybersecurity matters, which is a board oversight function. The VPIT and DIS titles provide firm-specific organizational detail, but there are no externally verifiable quantified facts.


reasoning: The paragraph primarily states a materiality conclusion that past cybersecurity incidents have not materially affected the company or its financial position, which falls under Strategy Integration. The remaining language is generic forward-looking risk and investment boilerplate rather than a substantive description of governance, management, or cybersecurity processes.


reasoning: This paragraph is only a cross-reference to another section of the filing and does not itself describe cybersecurity governance, management, processes, third-party risk, incidents, or strategy impacts.


content_category: Incident Disclosure

reasoning: The paragraph primarily describes an actual cybersecurity incident, including its timing, operational disruption, remediation steps, and resulting effects on the business. Although it mentions financial impact, the dominant focus is what happened and how the company responded.


specificity_confidence: medium

reasoning: The paragraph primarily describes an oversight body's responsibilities to review information security regulatory reports and monitor emerging information security risk issues, which is board-level governance activity rather than management operations or program execution. It does not include any qualifying firm-specific roles, committees, dates, numbers, or named frameworks.


content_category: Risk Management Process

reasoning: The paragraph primarily describes how cybersecurity risks and incidents are monitored and managed through threat intelligence, security alerts, and internal/external inputs, which is about the operation of the cybersecurity program rather than management roles. Although management is mentioned, the substance is the monitoring process and sources of cybersecurity information.


reasoning: The paragraph primarily discloses an actual past cybersecurity event—its timing and basic nature—even though it also includes forward-looking statements about possible future impacts. The reference to a material 2017 incident and the affected consumer populations makes Incident Disclosure the best fit.


content_category: Management Role

reasoning: The paragraph primarily describes how management is organized to oversee and respond to cybersecurity matters through a named management steering committee and its interaction with the CISO. Although it mentions escalation to the Audit Committee and Board, the main focus is the management-level structure and responsibilities.


content_category: Third-Party Risk

reasoning: The paragraph primarily describes how the company manages cybersecurity risk arising from external vendors, emphasizing vetting, approval, inventorying, and risk mitigation of third parties. Although it ends with a materiality conclusion, most of the paragraph is focused on vendor oversight rather than business impact.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from third-party service providers, making third-party risk the central topic. It describes a cyber-focused vendor risk management program, but does not include named, quantified, or otherwise verifiable firm-specific details.


reasoning: The paragraph primarily describes what the company’s cybersecurity program does: risk assessments, security controls, training, incident response planning, and use of external assessors. Although it includes one item on vendor oversight, third-party risk is only one component of the broader program rather than the central topic.


reasoning: This paragraph primarily describes an actual cybersecurity incident, including when it was disclosed, how the company responded, operational disruption, and resulting impacts. Although it includes business impact and a materiality statement, the dominant focus is what happened and its consequences, which makes it Incident Disclosure.


reasoning: The paragraph is primarily about how the company manages cybersecurity risks arising from vendors and other third parties, making Third-Party Risk the best fit. While it includes process details like due diligence, contractual review, and ongoing monitoring, those activities are all framed specifically around third-party relationships.


reasoning: The paragraph primarily explains how management is organized to handle cybersecurity, including leadership roles, team composition, and reporting structure. Although it mentions third-party support and security activities, those are secondary to the description of management responsibility and qualifications.


reasoning: The paragraph primarily provides a materiality-oriented assessment that the company has not experienced any material cyber threats or incidents to date and discusses the potential business and financial effects of future incidents, which fits Strategy Integration. The rest of the paragraph is largely generic cautionary language and a cross-reference to risk factors.


reasoning: The paragraph primarily describes which management roles are responsible for cybersecurity risk oversight and management, not board oversight or program activities. Its specificity comes from identifying the company's particular management roles involved in cybersecurity responsibility.


reasoning: The paragraph primarily describes how the Board oversees cybersecurity risk through the Audit Committee and management reporting flows. Although it mentions management participants, its main focus is the board-level oversight structure and the information provided to directors.


reasoning: The paragraph primarily describes how the board and its committees oversee cybersecurity risk, including delegated oversight, reporting flows, and escalation to the full board. Although management roles are mentioned, they are included mainly to explain how information reaches board-level oversight bodies.


reasoning: The paragraph primarily describes how the company’s cybersecurity program detects, investigates, and assesses incidents, which is a description of operational cybersecurity processes. It mentions management teams, but only in the context of carrying out detection and incident analysis activities rather than organizational structure.


reasoning: This paragraph primarily describes how cybersecurity information flows to the board and how the board and its committees oversee cybersecurity, which is board-level governance. Although it includes management titles, those details are presented mainly to explain the oversight chain rather than management's standalone organizational role.


reasoning: The paragraph primarily describes how cybersecurity information flows to the board and senior leadership, including board-facing exercises and briefings, which makes it a board oversight disclosure. It includes firm-specific organizational details such as the CISO role and the named ELT/SLT, but no externally verifiable quantified fact.


reasoning: The paragraph's most direct substantive disclosure is that the Board oversees cybersecurity through a specific board-level Cybersecurity Committee, which makes board oversight the primary topic. Although it also includes a materiality statement about past incidents, that appears secondary to the governance description.


reasoning: This paragraph is a cross-reference directing readers to Item 1A risk factors rather than providing substantive disclosure about governance, management, risk processes, third-party risk, incidents, or strategy impact. Under the cross-reference rule, it is classified as None/Other.


reasoning: The paragraph primarily explains how the nature of the company's business—handling large volumes of sensitive information and client funds—makes it a particularly attractive target for cyber threats, which is most aligned with how cybersecurity relates to the business. It does not describe governance, management roles, or concrete cybersecurity processes, and it provides no qualifying specific or verifiable facts.


reasoning: The paragraph primarily explains how cybersecurity information flows to the Board and how the Board participates in oversight through regular meetings and tabletop exercises. Although it mentions the CISO's leadership role, the dominant focus is the Board's oversight structure rather than management organization alone.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from vendors and partners, making third-party risk the central topic. It describes cyber-specific vendor oversight practices such as pre-engagement vetting and ongoing monitoring, but provides no firm-unique names, roles, numbers, or other verifiable details.


reasoning: The paragraph primarily provides a materiality-related assessment that the company is not aware of any material cybersecurity incidents affecting it, which fits Strategy Integration under the SEC materiality rule. The rest of the paragraph is largely generic risk language and cross-reference boilerplate rather than description of a specific incident, governance structure, or risk management process.


reasoning: The paragraph primarily describes how the Board and its committees oversee cybersecurity risk, including delegation to the Risk Management Committee and Cybersecurity and Technology Subcommittee and reporting up to the Board. Although it mentions management reporting and exercises, the dominant focus is the Board-level oversight structure.


reasoning: The paragraph primarily describes what the company's cybersecurity incident response process does: containment, remediation, recovery, use of external forensic/incident-response support, escalation, and plan maintenance. References to the Board and Audit Committee are secondary to the operational description of the incident response program.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity risks or incidents have not had a material adverse effect on the company to date, which fits Strategy Integration under the materiality rule. The rest of the language is largely generic risk framing and monitoring boilerplate rather than a concrete governance, management, or process description.


reasoning: The paragraph primarily describes how the board, through its Audit Committee, receives information and oversees cybersecurity risk. While it mentions management and third-party activities, those details mainly support the board oversight structure rather than describing the management organization or the cybersecurity program itself.


reasoning: The paragraph primarily describes how the board oversees cybersecurity through delegated responsibility to the Audit Committee and reporting flows up to the full Board. Its only qualifying specific detail is the firm-specific security leadership role of Senior Director of Governance & Information Security.


reasoning: The paragraph primarily explains how IBM's cybersecurity function is organized within management, identifying the responsible organization, leadership roles, and internal security teams. Although it mentions supplier risk and product vulnerabilities, the core focus is the management structure and responsibilities rather than the operational process itself.


reasoning: The paragraph primarily describes what the company's cybersecurity program does to identify, assess, and mitigate cyber risk, including monitoring, software updates, endpoint protection, and access controls. Although it contains cybersecurity-specific practices and terminology, it does not include firm-unique or externally verifiable facts such as named roles, committees, vendors, products, dates, or quantified details.


reasoning: The paragraph primarily describes how the Board oversees cybersecurity risk, including its role in ERM oversight, receiving updates from management, and being informed of significant incidents. It does not provide named committees, roles, firms, dates, or other qualifying specific facts, and the language remains largely generic governance boilerplate.


reasoning: The paragraph primarily describes how cybersecurity oversight flows through the board structure, with the Audit Committee monitoring cyber risk and management reporting up to the Board. Its most distinctive fact is the named VP-level technology role involved in that governance chain, making it firm-specific.


reasoning: The paragraph’s most decisive disclosure is the materiality conclusion that, as of the stated point in time, the company is not aware of cybersecurity incidents that have materially affected or are reasonably likely to materially affect its business, results, or financial condition. Although it also references oversight and risk management generally, those statements are high-level and secondary to the business-impact assessment.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity breaches have not materially affected the company's business strategy, results of operations, or financial condition to date, which fits Strategy Integration under the SEC-specific materiality rule. The rest of the paragraph is largely generic risk framing and cross-references to other risk-factor sections rather than describing governance, management, or operational cybersecurity processes.


reasoning: The paragraph primarily describes the escalation and reporting chain for cybersecurity matters up to the board level, culminating in elevation of significant issues to the Audit Committee. Although management actors are mentioned, the main point is board oversight and information flow.


reasoning: The paragraph primarily provides a materiality assessment and discusses potential business and financial impact from cybersecurity incidents, including insurance coverage, which fits Strategy Integration. It does not describe governance, management structure, or operational cybersecurity processes.


reasoning: The paragraph primarily describes what the company's cybersecurity program does to identify, monitor, test, and respond to cyber risks and incidents, which fits Risk Management Process. It uses cybersecurity-specific practices and tools such as behavioral analytics, firewall and authentication logging, and penetration testing, but does not provide firm-unique or externally verifiable facts.


reasoning: The paragraph primarily describes the Trust’s cybersecurity measures and practices, such as isolated workstations, credential protections, and two-factor authorization, which answers what the cybersecurity program does. References to banks, service providers, and vendors are incidental rather than a central discussion of vendor risk management.


reasoning: The paragraph primarily describes an operational cybersecurity activity—reviewing and drilling on a response plan—rather than board oversight or management qualifications. Its main focus is what the company does to prepare for cyber incidents, with the named Emergency Incident Response Team making it company-specific.


reasoning: The paragraph does not describe cybersecurity governance, management, processes, third-party risk, incidents, or business impact. It mainly states that the trust has no active operations and limited exposure, which is non-substantive cybersecurity context.


reasoning: The paragraph primarily describes the board oversight chain for cybersecurity: the Board delegates oversight, the Audit Committee receives cybersecurity reporting, and findings are escalated to the full Board. Although it also mentions program activities like incident logging and third-party risk assessments, those are secondary to the governance structure being described.


reasoning: The paragraph primarily states management’s conclusion that no known cybersecurity incidents have materially affected or are reasonably likely to materially affect the company’s business strategy, results of operations, or financial condition, which is a materiality/business-impact assessment. The reference to Item 1A is secondary and does not change the paragraph’s main function.


reasoning: The paragraph primarily describes a real cybersecurity incident, including when it occurred, its operational and data impacts, and remediation steps taken afterward. Although it mentions costs and ongoing threat exposure, the dominant focus is the incident itself and the response to it.


reasoning: The paragraph primarily describes what the company's cybersecurity program does to assess and manage cyber risk, including threat categories, training, technical controls, third-party assessments, and response procedures. It is not mainly about board oversight or management roles.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks posed by third-party service providers, including assessments, reassessments, and contractual security requirements. It is not about the general cyber program overall, but specifically vendor-related risk oversight.


reasoning: This paragraph provides general business context about reliance on technology, third-party systems, and sensitive data, but it does not describe cybersecurity oversight, management roles, risk management activities, vendor risk controls, an incident, or a materiality assessment. It is therefore background context rather than a substantive cybersecurity disclosure.


reasoning: The paragraph primarily describes the oversight chain for cybersecurity risk: risks are reviewed by the ERM Committee and then reported to the Audit Committee. Although it also mentions risk assessment activities and third-party SOC1 reviews, the dominant focus is how cybersecurity risk oversight is governed.


reasoning: The paragraph primarily provides a materiality assessment, stating that the company is not aware of cybersecurity incidents that have materially affected or are reasonably likely to materially affect operations or financial condition. It does not describe governance, management structure, or cybersecurity processes.


reasoning: The paragraph primarily provides a materiality-style assessment that the company did not experience a material cybersecurity incident during the period, which fits Strategy Integration under the SEC materiality rule. The rest is cautionary language and a cross-reference, not process, governance, or incident-detail disclosure.


reasoning: The paragraph primarily states Seaboard's conclusion that cybersecurity threats have not materially affected and are not reasonably likely to materially affect its business strategy, results of operations, or financial condition, which is a Strategy Integration materiality assessment. The remaining references to updating an information security plan and making investments are generic and secondary.


reasoning: The paragraph is primarily about how the company manages cybersecurity risks arising from vendors and supply chain relationships, including screening, risk ranking, rescreening, and vendor requirements. Although it briefly mentions cyber insurance, the central topic is third-party cyber risk oversight.


reasoning: The paragraph primarily describes what the cybersecurity program does day to day: implementing tools and processes for identifying, containing, and remediating incidents, using consultants, and conducting employee training and phishing tests. Although management roles are mentioned, the focus is on operational cybersecurity activities rather than organizational structure.


reasoning: The paragraph primarily describes what the company's cybersecurity program does: incident response planning, security operations monitoring, insider threat assessment, training, and preparedness activities. Its most distinguishing detail is the use of a 24/7 security operations center, which makes the disclosure firm-specific rather than merely domain-adapted.


reasoning: The paragraph primarily describes how the Board, through its Audit Committee, oversees cybersecurity and what information it receives from management. Although the CISO is mentioned, the focus is on board-level oversight rather than management organization or operational processes.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from third-party service providers, including due diligence, onboarding assessments, contractual security requirements, and follow-up on provider incidents. It contains cybersecurity and vendor-risk process language, but no firm-unique roles, named programs, dates, numbers, or other verifiable facts.


reasoning: The paragraph is primarily about how the company manages cybersecurity risks arising from suppliers and other third parties, including monitoring, assessments, and contract provisions. Although it mentions cybersecurity practices, it does not include firm-unique or externally verifiable facts such as named vendors, tools, committees, or quantified details.


reasoning: The paragraph primarily describes what the cybersecurity program does: the safeguards and activities used to protect systems and manage vulnerabilities. It focuses on defensive controls and assessment activities rather than board oversight, management roles, or third-party risk.


reasoning: The paragraph primarily states management's conclusion that cybersecurity issues have not materially affected the company's business strategy, operations, or financial condition, which is a materiality/business-impact assessment. It does not describe governance, management structure, or cybersecurity processes.


reasoning: The paragraph is primarily about how the company evaluates and monitors cybersecurity risks from third-party service providers, making third-party risk the central topic. Although it describes a vendor onboarding risk assessment process, it does so in broad terms without firm-unique, quantified, or externally verifiable details.


reasoning: The paragraph primarily describes what the cybersecurity program does: its controls, processes, technologies, training, testing, and third-party risk procedures. Although it mentions third-party risk, that topic is only one component of a broader description of the company’s overall cybersecurity risk management program.


reasoning: The paragraph primarily describes a real cybersecurity incident, including when it occurred and its consequences, so it is best classified as Incident Disclosure. The specific month and concrete incident effects make the disclosure externally checkable and therefore Quantified-Verifiable.


reasoning: The paragraph primarily explains how the company identifies, escalates, assesses, and responds to cybersecurity threats and incidents, which is a description of the cybersecurity process. Although several roles and teams are named, they are presented mainly as part of the incident escalation and response workflow rather than as a discussion of management qualifications or board oversight.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from third-party service providers, making third-party risk the central topic. It includes cyber-focused concepts such as provider access to information assets and related assessments, but does not provide firm-specific or externally verifiable details.


reasoning: The paragraph primarily gives a materiality assessment, stating that cybersecurity risks have not materially affected the business to date and could materially affect it in the future, which fits Strategy Integration under the SEC materiality rule. The rest is largely cautionary language and a cross-reference to risk factors rather than discussion of governance, management, or cybersecurity processes.


reasoning: The paragraph primarily states management's conclusion that prior cybersecurity threats have not materially affected the company's business strategy, results of operations, or financial condition, which is a Strategy Integration assessment. The rest is largely generic cautionary language and a cross-reference to risk factors rather than substantive process, governance, or incident details.


reasoning: The paragraph primarily describes how cybersecurity information flows to an oversight body and what that body reviews, which is board-level governance rather than management operations. Its named committee (RCSC) and cybersecurity-specific role (CISO) make it firm-specific.


reasoning: The paragraph primarily provides a materiality-oriented business impact assessment, including that the company has not experienced a cybersecurity threat or incident resulting in a material adverse impact and describing potential operational, financial, and reputational consequences. Although it briefly mentions detection and prevention efforts, those references are generic and secondary to the impact/materiality discussion.


reasoning: The paragraph primarily explains how the Board oversees cybersecurity, including the information it receives, the roles that report to it, and escalation to the Board for significant incidents. Although management roles are mentioned, they are described mainly as part of the Board oversight structure rather than management organization.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity threats and prior incidents have not materially affected the company’s business strategy, results of operations, or financial condition. It does not describe governance, management roles, or cybersecurity processes.


reasoning: The paragraph primarily describes what VF's cybersecurity program does: securing information, detecting and responding to incidents, training personnel, managing third-party risk, and maintaining an incident response plan. Although it includes management qualifications and some third-party risk language, those elements are secondary to the overall description of the cybersecurity program and its operations.


reasoning: The paragraph primarily describes the company's cybersecurity program measures—policies, procedures, and systems designed to identify and address cybersecurity risks and incidents—so it fits Risk Management Process. It is not board or management structure focused, and its reference to information security and confidentiality, integrity, and availability shows cybersecurity-specific domain language despite lacking firm-specific details.


reasoning: The paragraph primarily describes an actual cybersecurity incident—its nature, response, recovery, and aftermath—so Incident Disclosure is the best fit. Although it also includes a materiality conclusion, the incident narrative is the dominant focus.


reasoning: The paragraph primarily describes what the company's cybersecurity program does to identify, mitigate, and respond to cyber risks, including technical controls, training, and threat monitoring support. Although third parties are mentioned, they are one component of the broader security program rather than the central focus.


reasoning: This paragraph is primarily a cross-reference directing readers to another section and does not substantively describe board oversight, management roles, cybersecurity processes, third-party risk, an incident, or business impact. Its mention of enterprise risk management is generic and not a substantive cybersecurity process disclosure.


reasoning: The paragraph is primarily about how the company manages cybersecurity risk arising from third-party service providers, making Third-Party Risk the best fit. It includes firm-specific vendor oversight practices, but no externally verifiable dates, quantities, or named firms/products.


reasoning: This paragraph is a general statement about the existence of cyber threats and industry-wide risk, not a description of the company's governance, management structure, risk management process, third-party risk practices, strategy assessment, or an actual incident. It is speculative/background risk language, so it falls into None/Other.


reasoning: The paragraph primarily explains how the company's cybersecurity program operates: monitoring, detection, escalation, severity evaluation, and remediation of threats and incidents. Although it names management roles and teams, those details mainly support the description of the incident handling process rather than management organization itself.


reasoning: The paragraph primarily describes the existence and purpose of the company's cybersecurity risk management program, which fits Risk Management Process. Although it mentions service providers and regulatory bodies, those are not the central focus, and the language remains high-level and boilerplate rather than describing concrete cyber practices.


reasoning: This paragraph is a high-level, generic statement about the importance of cybersecurity governance, without describing board oversight, management roles, specific program activities, or any actual assessment. It does not substantively answer one of the core Item 1C questions beyond boilerplate framing language.


reasoning: The paragraph primarily explains which management roles are accountable for cybersecurity and what they are responsible for, making it a management organization disclosure rather than a description of the broader cybersecurity program. Although it mentions a risk-based approach and controls, the core focus is the CIO and CISO's responsibilities.


reasoning: The paragraph primarily describes actual cybersecurity incidents that have occurred, including a concrete example involving a vendor breach and the software implicated. Although it also states the incidents were not material, the dominant focus is what happened, so Incident Disclosure is the best fit.


reasoning: The paragraph primarily states a conclusion about the business impact of cybersecurity, namely that Murphy has not experienced material impacts to its business, operations, or reputation from cyber incidents. The remaining language is general commitment and vigilance language, which does not change the primary focus from impact assessment.


reasoning: This paragraph primarily describes how management is organized to oversee cybersecurity and related privacy governance through specific management committees, chairs, and reporting lines. It is not board-focused, and the emphasis is on management structure rather than the operational details of the cybersecurity program itself.


reasoning: The paragraph primarily explains how the company's cybersecurity function identifies and manages risk through threat intelligence, monitoring, and vulnerability scanning, which makes it a risk management process disclosure. Although it mentions the Enterprise Cybersecurity team and certifications, the core of the paragraph is the program's operational activities rather than management structure.


reasoning: The paragraph primarily describes which management leaders are responsible for cybersecurity-related functions, their reporting lines, committee roles, and their qualifications and experience. Although it mentions board reporting and an incident response plan, the dominant focus is the organization and expertise of management personnel.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk from vendors by imposing security requirements, contractual addenda, insurance, and incident-reporting obligations on third-party providers. It uses cybersecurity-specific concepts such as data protection safeguards and mandatory incident reporting, but does not include clear firm-unique or externally verifiable facts.


reasoning: The paragraph primarily provides a materiality-oriented assessment of how cybersecurity threats could affect the company and states that no material cybersecurity incidents occurred in the last three fiscal years. That makes Strategy Integration the best fit rather than Incident Disclosure, because it reports an absence of material incidents rather than describing an actual event.


reasoning: This paragraph is a generic risk statement about potential consequences of cyber failures and breaches, including those involving third-party vendors, but it does not describe any actual cybersecurity governance, management structure, risk process, or incident. Despite the introductory heading language, the substantive content is hypothetical and non-specific, so it fits None/Other.


reasoning: The paragraph primarily explains which management roles oversee cybersecurity and highlights their relevant experience, so it is about management organization rather than program activities. The named executive roles and the specific claim of over 20 years of experience make the paragraph quantified and externally verifiable.


reasoning: The paragraph is centrally about how the company manages cybersecurity risk from vendors and supply-chain service providers, including assessments and contractual requirements. It describes third-party oversight measures rather than the company’s broader internal cybersecurity program or board/management structure.


reasoning: This paragraph primarily describes a real cybersecurity event, including how it arose, what data may have been affected, the response taken, and the operational impact. Although it mentions a third-party vendor and insurance, the dominant focus is the actual MOVEit-related incident and its consequences.


reasoning: The paragraph primarily describes an actual cybersecurity incident, including its disclosure date, suspected perpetrators, and ongoing investigation, which makes Incident Disclosure the best fit. Although it includes a materiality statement, the dominant focus is on what happened and the status of the incident.


reasoning: The paragraph primarily describes how the board and its Risk Committee oversee cybersecurity risk, including delegated oversight, approvals, and reporting flows from management. While it mentions program topics like vulnerability assessments and risk indicators, those details are presented in the context of board-level oversight.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity attacks have not been material to the company's operations or financial condition to date, which fits Strategy Integration under the materiality rule. The rest is generic risk language and a cross-reference, without describing governance, management structure, or cybersecurity processes.


reasoning: The paragraph primarily explains how management is organized to lead cybersecurity, including the responsible role, reporting line, and the leader’s qualifications. Although it mentions program responsibilities and executive reporting, the central focus is the management leader and structure rather than the cybersecurity processes themselves.


reasoning: The paragraph primarily states management’s conclusion that cybersecurity breaches have not materially affected and are not reasonably likely to materially affect the company’s business strategy, results of operations, or financial condition, which is a materiality assessment. The rest is only a cross-reference to risk-factor disclosure rather than a description of governance, management, or processes.


reasoning: The paragraph primarily explains cybersecurity risk arising from third parties, including card transaction counterparties and other service providers, and notes that the company performs security assessments on higher-risk vendors. Although it briefly mentions prior cyber incidents, the dominant focus is vendor- and third-party-related exposure rather than a specific incident or broader internal program.


reasoning: The paragraph primarily explains management’s cybersecurity organization by identifying the CISO’s responsibilities and qualifications. Its main focus is the role and experience of a specific management position, not the broader cybersecurity program activities themselves.


reasoning: The paragraph primarily provides management’s conclusion about whether cybersecurity threats or prior incidents have materially affected, or are reasonably likely to materially affect, the company’s business, results, or financial condition, which is a Strategy Integration assessment. The remaining language is cautionary and cross-referential rather than describing governance, management structure, or cybersecurity processes.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity threats, including a previously disclosed incident, have materially affected and are reasonably likely to materially affect the company’s business strategy, results of operations, or financial condition. That makes Strategy Integration the best fit rather than Incident Disclosure, because it emphasizes business impact rather than describing what happened in the incident.


reasoning: The paragraph primarily describes how the Audit Committee oversees cybersecurity through direct engagement with management and receipt of reporting on cyber topics. Although it mentions program evaluations and audits, those details are presented in service of board-level oversight rather than describing the operational program itself.


reasoning: The paragraph primarily provides the company's materiality assessment of cybersecurity incidents and threats on its business strategy, results of operations, and financial condition, which fits Strategy Integration. It contains standard SEC-style forward-looking and cross-reference language without firm-specific, verifiable cybersecurity details.


reasoning: The paragraph primarily provides a materiality-oriented assessment that cybersecurity threats are reasonably likely to materially affect the company's business strategy, results of operations, or financial condition, which is Strategy Integration under the SEC-specific rule. The rest is cautionary language and a cross-reference, without describing governance, management structure, or risk management processes.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from third-party service providers, making Third-Party Risk the best fit. Although it ends with a materiality-related fragment, the substance of the paragraph is centered on the TPRM program and vendor oversight practices.


reasoning: This paragraph primarily explains how the company manages cybersecurity risk from suppliers, vendors, and other third parties by imposing contractual security requirements and data-use restrictions. It is not about the internal cybersecurity program generally, but about third-party oversight specifically.


reasoning: The paragraph primarily describes what the company’s cybersecurity program is designed to do: protect information, assess and manage cyber risks, address third-party risk, and respond to incidents. Although it references the CSO, the focus is on program activities and scope rather than management qualifications or board oversight.


reasoning: The paragraph primarily describes what the cybersecurity program does—defense in depth, encryption, data loss prevention, and employee security awareness training—so it is about the risk management process rather than management structure or board oversight. It rises above generic domain language because it identifies a company-specific named program.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks posed by vendors and service providers, making third-party risk the central topic. Its references to a specific Vendor Management Committee and Vendor Management team make it company-specific rather than generic.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from vendors and service providers, including due diligence and ongoing monitoring, so third-party risk is the central topic. Although it ends with a materiality-style statement, the bulk of the paragraph is about vendor cybersecurity oversight processes.


reasoning: The paragraph primarily explains which management roles lead cybersecurity and what qualifications and experience they have, which makes it a management-organization disclosure rather than a process description. Although it mentions monitoring incidents and the incident response plan, those points are framed as responsibilities of the CDO and CISO.


reasoning: The paragraph is centered on a real cybersecurity event involving Change Healthcare, including when it occurred, what response actions were taken, and what operational effects resulted. Although it ends with a materiality conclusion, the dominant purpose is describing the incident and its consequences.


reasoning: This paragraph primarily describes which management roles handle cybersecurity risk and the qualifications and experience of those leaders, which fits Management Role. It is not mainly about board oversight or the mechanics of the cybersecurity program.


reasoning: The paragraph primarily describes how board-level committees oversee cybersecurity-related matters, specifically the Audit Committee's monitoring role and coordination with the Risk Committee. It does not provide qualifying firm-specific or externally verifiable details beyond generic committee oversight language.


reasoning: The paragraph primarily describes a real cybersecurity incident involving Change Healthcare, the company's response actions, current status, and operational effects. Although it includes a materiality conclusion, the dominant focus is the nature, timing, and handling of the actual incident.


reasoning: The paragraph primarily assesses whether cybersecurity threats and incidents have materially affected, or could materially affect, the company’s business strategy, results of operations, and financial condition, which is the core Strategy Integration question. It does not mainly describe governance, management roles, or detailed cybersecurity processes.


reasoning: The paragraph primarily describes how the board and its committee oversee cybersecurity, including the reporting flow from management to the Audit Committee and full Board. Although it mentions management participation, the main purpose is the board-level oversight structure rather than management’s organizational role.


reasoning: This paragraph primarily describes a real cybersecurity incident that occurred and its immediate consequences, which makes Incident Disclosure the best fit. Although it also states the incident was not material, the incident itself is the central subject.


reasoning: The paragraph primarily describes how the board, through the Audit Committee, oversees cybersecurity risk, which is a board oversight/governance function. It does not provide cybersecurity-specific operational detail or any qualifying firm-specific or verifiable facts.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks from third-party service providers, making third-party risk the central topic. However, it uses high-level, generic language about risk assessments and committee review without verifiable details, named cybersecurity-specific structures, or distinctive program elements.


reasoning: The paragraph primarily explains how the company evaluates and manages cybersecurity risks posed by vendors, including selection, oversight, contractual requirements, and review of provider security practices. Its focus is third-party/vendor cyber oversight rather than the company’s internal cyber program generally.


reasoning: The paragraph primarily describes how cybersecurity risk information flows to and is overseen by the Board and its committee structure, making board oversight the central topic. Although it mentions management responsibility, that content serves mainly to explain the governance chain.


reasoning: The paragraph primarily describes how the Board and its Audit Committee oversee cybersecurity, including how management information flows upward and how the committee briefs the full Board. Its most distinguishing detail is the involvement of the Chief Innovation Officer in reporting to the committee.


reasoning: The paragraph primarily describes what the company's cybersecurity program does: incident response planning, updating, testing, training, and use of outside experts. Although people are mentioned, the focus is on operational response processes rather than management structure or board oversight.


reasoning: The paragraph’s primary purpose is to assess business impact and materiality: it states that prior cybersecurity incidents, including the August 2023 incident, have not materially affected the company. Although it references a real incident, the dominant disclosure is the conclusion about impact on the business, results of operations, and financial condition.


reasoning: The paragraph primarily explains how management is organized to oversee cybersecurity, including the composition and responsibilities of the CCMT. Although it mentions communications to the Board and Audit Committee, the focus is management structure and role rather than board oversight.


reasoning: This paragraph primarily explains which management role is responsible for cybersecurity and details that leader’s experience and qualifications, so it is about management organization rather than the cybersecurity program itself. It includes multiple externally checkable facts, including a specific VP title, quantified years of experience, prior employers, and educational credentials.


reasoning: The paragraph primarily provides the company's materiality assessment that cybersecurity threats have not materially affected, and are not reasonably likely to materially affect, its business strategy, financial condition, or results of operations. The cross-reference to Risk Factors is secondary and does not change the main focus.


reasoning: The paragraph primarily describes how the Board and Audit Committee oversee cybersecurity risk through reporting, presentations, and incident escalation, which makes board oversight the central topic. Although management roles are mentioned, they are presented mainly as part of the governance chain feeding information to the Board.


reasoning: The paragraph primarily describes how the board oversees cybersecurity through its committee structure and reporting flows from management to the board. Its most distinctive details are the named Corporate Risk Committee and the involvement of the CIO/CISO in board reporting, which make it firm-specific rather than generic.


reasoning: The paragraph primarily describes a component of the company's cybersecurity program—using external assessors and consultants for threat evaluation, security assessments, and incident forensics—so it is about how the program operates. Although third parties are mentioned, they are service providers supporting the company's own security program rather than vendors being overseen, so this is not Third-Party Risk.


reasoning: The paragraph primarily provides a materiality and business-impact assessment, stating that cybersecurity threats have not materially affected results of operations and financial condition to date, but have materially affected business strategy and processes. It also discusses investment and insurance in that impact context, which supports Strategy Integration rather than describing governance or operational processes.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity threats and prior incidents have not materially affected the company’s business strategy, results of operations, or financial condition, which fits Strategy Integration under the SEC Item 106 framework. The rest of the paragraph is a cross-reference to risk factors rather than a description of governance, management, or risk management processes.


reasoning: The paragraph is centrally about how the company manages cybersecurity risks posed by vendors and service providers, including assessments and remediation tracking. While it describes concrete third-party risk practices, it does not include firm-unique or externally verifiable facts.


reasoning: This paragraph is a cross-reference directing readers to Risk Factors in Item 1A rather than providing a substantive cybersecurity governance, management, process, incident, third-party, or strategy assessment itself. It does not state an actual materiality conclusion; it only points elsewhere for that discussion.


reasoning: The paragraph primarily describes the governance structure through which cybersecurity risks are escalated and overseen, culminating in board-level oversight and board member experience. Although it mentions management committees and roles, the main purpose is explaining the oversight chain rather than detailing management's operational responsibilities.


reasoning: The paragraph primarily explains how management is organized to lead cybersecurity, emphasizing the CIO’s role, experience, and the qualifications of the supporting cybersecurity team. Although it mentions control design and monitoring, the main focus is on management leadership and credentials rather than the cybersecurity process itself.


reasoning: The paragraph is primarily about how the company manages cybersecurity risk arising from third-party service providers by requiring them to implement security measures and by assessing their security frameworks. It does not describe the company's broader internal cyber program, but rather vendor-focused oversight.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk arising from external acquisition targets, including security due diligence, testing, remediation expectations, and contractual protections. Its focus is third-party oversight rather than the company’s broader internal cybersecurity program.


reasoning: This paragraph is a cross-reference to risk factor disclosures in Item 1A rather than a substantive cybersecurity disclosure. It does not itself describe oversight, management roles, processes, third-party risk, an incident, or an actual materiality assessment conclusion.


reasoning: The paragraph primarily describes management’s cybersecurity leadership structure and qualifications, centered on the Chief Security and Trust Officer’s reporting line, responsibilities, and experience. Although it mentions implementing policies and incident response, the main question answered is how management is organized to handle cybersecurity.


reasoning: The paragraph primarily describes how the Board is informed about and oversees cybersecurity, including briefings and education for directors. Its most specific qualifying detail is the involvement of the CISO in reporting to the Board, which makes it firm-specific.


reasoning: This paragraph is only a high-level introductory statement about the importance of cybersecurity and the purpose of the disclosure. It does not describe board oversight, management roles, risk management activities, third-party risk, a specific incident, or a business-impact assessment.


reasoning: The paragraph primarily explains how management is organized to handle cybersecurity by identifying the CISO's responsibilities, qualifications, and reporting line. Although it includes board oversight and program activities, the emphasis is on the CISO's role and credentials within management.


reasoning: The paragraph primarily describes how management is organized to handle cybersecurity, emphasizing leadership roles, reporting lines, and the qualifications of the Director of IT Infrastructure and Security and the Vice President of Information Technology. Although it briefly mentions cybersecurity activities, the dominant focus is on management responsibility and credentials.


reasoning: The paragraph primarily explains how management is organized to handle cybersecurity, focusing on the CISO's qualifications and the composition of the cybersecurity team. Although it also mentions incident response and reporting, those activities are secondary to the management-role description.


reasoning: The paragraph primarily addresses whether cybersecurity incidents have materially affected, or are reasonably likely to materially affect, the company's business strategy, results of operations, or financial condition, which is a Strategy Integration assessment. Although it mentions an Incident Response Team, that detail is generic and secondary to the materiality conclusion.


reasoning: This paragraph primarily describes management’s cybersecurity leadership structure, responsibilities, reporting line, and the qualifications of the CSO. It is about who leads cybersecurity and how that role is positioned, not about board oversight or the underlying security program activities.


reasoning: The paragraph is primarily about how the company evaluates and manages cybersecurity risks from third-party vendors, making Third-Party Risk the best fit. It includes a firm-specific reference to the ISP as the program/framework through which that vendor due diligence is carried out.


reasoning: The paragraph primarily explains management's cybersecurity organization by describing the CIO's role, reporting relationship, responsibilities, and qualifications. It is not mainly about the cybersecurity program itself, but about who in management is responsible and how that role is staffed.


reasoning: The paragraph primarily describes how the company manages cybersecurity risks arising from vendors and other third-party service providers, making Third-Party Risk the best fit. It also includes a firm-specific organizational detail about which internal teams participate in the third-party risk assessment process.


reasoning: The paragraph primarily describes the board’s and audit committee’s oversight of cybersecurity- and IT-related risk, including how the Board receives briefings and how oversight is allocated. Although it also mentions an employee portal, that is secondary to the governance structure and board oversight focus.


reasoning: This paragraph is primarily a forward-looking risk disclaimer about possible consequences of cybersecurity failures or vendor breaches, rather than a substantive description of governance, management, process, third-party oversight, incident facts, or a concrete materiality assessment. Its brief reference to having implemented cybersecurity measures is non-substantive and the paragraph otherwise consists of generic adverse-effect language.


reasoning: The paragraph primarily provides a materiality assessment: it states that no cybersecurity threats or incidents had a material impact in the last fiscal year and that certain risks are reasonably likely to materially affect the company if realized. That makes it a Strategy Integration paragraph rather than an incident description or process discussion.


reasoning: The paragraph primarily describes who within management is responsible for cybersecurity-related matters and highlights their qualifications and experience. Although it lists cybersecurity activities, the main point is the roles and credentials of the management members.


reasoning: The paragraph primarily explains how the company evaluates, monitors, and responds to cybersecurity risks posed by vendors and other external parties, making third-party risk the central topic. It includes cybersecurity-specific practices such as third-party security risk assessments and monitoring of provider incidents, but does not provide firm-unique or externally verifiable details.


reasoning: This paragraph is an executive biography describing Mr. Smith’s business roles, career history, and appointment dates, but it does not address cybersecurity governance, management, processes, incidents, third-party risk, or strategy impact. Because it is non-cybersecurity content, it falls under None/Other.


reasoning: The paragraph primarily describes what the company’s cybersecurity program does: monitoring threats, escalating potential incidents, using defensive controls, assessing effectiveness, and training employees. Its specificity comes from cybersecurity-domain practices and a named framework, but it does not provide firm-unique or externally verifiable facts such as named personnel, committees, vendors, dates, or quantified details.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from third-party service providers and business partners, making third-party risk the central topic. It includes cybersecurity-specific practices such as third-party risk assessments and monitoring incidents involving providers, but no firm-unique or externally verifiable facts.


reasoning: This paragraph is a hypothetical risk statement about possible consequences of a cyberattack, not a description of governance, management, processes, third-party risk, a real incident, or an actual materiality assessment. It is generic forward-looking risk language, so None/Other is the best fit.


reasoning: The paragraph primarily describes what the company’s cybersecurity program does, including assessments, training, phishing testing, incident response, backups, and third-party risk procedures, so it is best classified as Risk Management Process. Its specificity is Domain-Adapted because it uses cybersecurity-specific frameworks and practices, but it does not provide a verifiable company-unique fact that would raise it to Firm-Specific or Quantified-Verifiable.


reasoning: The paragraph primarily describes what the cybersecurity program does: monitoring information systems, using security measures and audits, and maintaining an incident response plan. Although it names the SVP IT, the substance centers on cybersecurity activities rather than management qualifications or board oversight.


reasoning: The paragraph only notes that a Chief Risk Officer supports the ERM structure with broader risk management oversight, without describing any cybersecurity-specific governance, management role, or process. Because it lacks substantive cybersecurity content, it is best classified as None/Other.


reasoning: The paragraph is centrally about how the company manages cybersecurity risks arising from third-party service providers, including onboarding diligence, imposed supplier security requirements, and review of hosted applications. It uses cybersecurity-specific third-party oversight concepts and named standards, but does not provide firm-unique or externally verifiable facts about UCB itself.


reasoning: The paragraph primarily provides a materiality assessment that cybersecurity threats and prior incidents have not materially affected, and are not reasonably likely to materially affect, the company's business strategy, results of operations, or financial condition. The remaining language is generic cautionary and cross-reference disclosure rather than discussion of governance, management, or specific risk processes.


reasoning: The paragraph primarily provides a materiality-oriented assessment that the company has not experienced recent material cybersecurity incidents and that future incidents could materially affect its business strategy, results of operations, or financial condition. It does not describe governance, management structure, or concrete cybersecurity processes, and the language is largely standard cautionary boilerplate.


reasoning: The paragraph primarily describes the oversight chain: the Risk Committee provides assurance to management and the Board regarding identified risks and mitigating controls. Although it references a cybersecurity plan, the main purpose is to explain governance and reporting rather than the operational details of the cybersecurity program.


reasoning: The paragraph primarily describes how cybersecurity risk assessment is incorporated into the company's overall risk management process and what areas are reviewed each year. Although it mentions the Audit Committee's oversight, the main focus is the process for identifying and managing cybersecurity-related risks rather than board governance.


reasoning: This paragraph is a biographical description of the company's Chief Human Resources Officer and does not describe cybersecurity oversight, management, processes, third-party risk, incidents, or cyber-related business impact. Because it is non-cybersecurity content, it falls under None/Other.


reasoning: The paragraph primarily describes how the board oversees cybersecurity through its committees and how information about incidents flows to the board. Although management is mentioned, the focus is on board-level oversight structure rather than management organization or program activities.


reasoning: The paragraph primarily describes management-level cybersecurity leadership roles, responsibilities, and qualifications of the CRO, CIO, and CISO. Its main purpose is to explain how management is organized and experienced in overseeing cybersecurity, not to describe board oversight or the cybersecurity program itself.


reasoning: The paragraph primarily provides a materiality-oriented assessment of cybersecurity's effect on the company, including the statement that there have been no material cybersecurity incidents to date and that threats could materially affect business strategy, results of operations, or financial condition. It does not describe governance, management roles, or operational cybersecurity processes.


reasoning: This paragraph primarily describes an actual cybersecurity incident, including its nature, affected data, timing, and customer notification steps. Although a vendor was involved, the central purpose is disclosure of what happened in the incident rather than the company's general third-party risk management approach.


reasoning: This paragraph primarily describes a real cybersecurity incident, including when it occurred, what systems were affected, and the investigation’s findings. Although it also states the incident was not material, the main focus is the event itself and its consequences.


reasoning: The paragraph primarily explains how the company addresses cybersecurity risks arising from third-party service providers, making third-party risk the central topic. It describes a high-level oversight structure for vendor-related cyber risk but does so in generic terms without named programs, committees, roles, or verifiable details.


reasoning: This paragraph is only a cross-reference to Risk Factors for discussion of cybersecurity risks and does not itself describe governance, management, processes, third-party risk controls, incidents, or strategy assessments. Under the rules, cross-references of this kind are classified as None/Other.


reasoning: The paragraph primarily explains who within management handles cybersecurity and why they are qualified, focusing on the Head of Global IT and the IT Security Team’s responsibilities and experience. Although it mentions acquisition-target diligence, that activity is presented as part of management’s role rather than as a standalone third-party risk program.


reasoning: The paragraph is primarily a high-level cautionary statement about cybersecurity risk and a cross-reference to Risk Factors, rather than a substantive description of board oversight, management roles, or concrete cybersecurity processes. Its references to systems and programs are too generic to meaningfully describe the company's risk management process.


reasoning: The paragraph primarily provides an assessment that the company has not had any material cybersecurity incidents, which is a business/materiality conclusion and therefore fits Strategy Integration. The rest of the paragraph is largely risk and insurance framing, with some cybersecurity-specific threat terminology such as ransomware, malware, and phishing.


reasoning: This paragraph primarily describes a real cybersecurity incident, including when it occurred, what happened, the response taken, and the operational effects. Although it notes no material financial impact, the dominant focus is the incident itself and its remediation timeline.


reasoning: The paragraph primarily explains how management is organized to handle cybersecurity through a named management-level committee and its responsibilities. Although it mentions reporting to the Audit Committee and Board, the main focus is the Cyber ERM Committee’s role in incident response and escalation.


reasoning: The paragraph describes actions taken in connection with an actual cybersecurity incident, including ongoing interaction with law enforcement/regulators and customer remediation measures. Its primary purpose is to update the status and response to that real event, which makes it an incident disclosure.


reasoning: The paragraph primarily describes how the company’s cybersecurity program operates by using external parties to perform incident response, assessments, and infrastructure support. Although it mentions evaluating and monitoring service providers, third-party risk is not the central topic; the focus is on augmenting internal cybersecurity capabilities.


reasoning: The paragraph primarily explains how management is organized to handle cybersecurity, focusing on the management team’s responsibilities and the CIO’s oversight role and experience. It does not meaningfully describe the underlying cybersecurity processes themselves, so Management Role is the best fit.


reasoning: The paragraph primarily describes the company's cybersecurity oversight structure across management, internal control functions, and board-level committees, which makes board oversight the central topic. It is firm-specific because it identifies specific roles, teams, and a named board Risk Committee within the company's three-lines-of-defense model.


reasoning: The paragraph primarily provides a materiality-style business impact assessment, including the statement that the company has not experienced any material adverse events related to a security breach or cyber-attack and describing potential operational and financial reporting consequences. It does not meaningfully describe governance, management structure, or a cybersecurity process.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from vendors and external platforms, making third-party risk the central topic. It describes vendor-related controls such as pre-acquisition diligence, contractual obligations, performance monitoring, and review of SOC Reports.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk posed by vendors and service providers, including requiring security controls and assessing compliance. Although it briefly mentions threat intelligence services, the central topic is oversight of third-party cyber risk.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from vendors and service providers, making third-party risk the central topic. It includes cybersecurity-specific practices such as evaluating providers' security measures, using contractual safeguards, and considering third-party risk in incident response, but it does not provide firm-unique or externally verifiable details.


reasoning: This paragraph describes a specific real-world cybersecurity incident, including when the company was notified, who was involved, and the resulting litigation and regulatory inquiries. Because it includes a specific date and a named third party, it contains externally verifiable facts.


reasoning: The paragraph primarily describes how cybersecurity risks are incorporated into the company's enterprise risk management and audit planning process, which is a risk management activity. Although it mentions reporting to the Audit Committee, the central focus is not board oversight but the inclusion of cyber risk within ERM.