content_category: None/Other

category_confidence: high

specificity_confidence: high

reasoning: Paragraph is a cross-reference to Item 1A Risk Factors with no substantive cybersecurity content or description, fitting None/Other. No domain terms, firm-specific facts, or verifiable claims present, resulting in Generic Boilerplate specificity.

provider: x-ai

stage: benchmark


reasoning: Paragraph is a cross-reference to Item 1A Risk Factors, matching N/O rule for cross-references with no substantive cybersecurity content. No specific facts of any level found, confirming Generic Boilerplate specificity.


reasoning: This paragraph is a generic commitment statement without describing any oversight structure, roles, processes, incidents, or impacts, fitting None/Other as boilerplate with no substantive cybersecurity disclosure. No domain terms, firm-specific facts, or verifiable claims are present, confirming Generic Boilerplate specificity.


reasoning: This is a cross-reference to another section of the filing, which falls under None/Other as it contains no substantive cybersecurity content or description of processes, roles, or incidents. No domain terms, firm-specific facts, or verifiable claims are present anywhere in the paragraph, confirming Generic Boilerplate specificity.


reasoning: This paragraph is a forward-looking disclaimer with speculation on risks and a cross-reference to Item 1A, fitting None/Other as it lacks substantive cybersecurity disclosure per Rule 5 and N/O threshold. No specific facts of any level are present, resulting in Generic Boilerplate specificity.


content_category: Third-Party Risk

reasoning: The paragraph primarily describes the company's third-party risk management program, including vetting, monitoring, and reviews for vendor cybersecurity compliance, directly answering the Third-Party Risk question as the central topic. No domain-specific terminology, firm-unique facts, or verifiable claims are present, resulting in Generic Boilerplate specificity.


content_category: Strategy Integration

reasoning: This paragraph primarily states a conclusion about no material past or likely future cybersecurity incidents affecting business outcomes, directly matching Strategy Integration per Rule 5 (backward- and forward-looking materiality assessments). No domain terms, firm-specific facts, or verifiable claims are present anywhere, resulting in Generic Boilerplate specificity.


content_category: Board Governance

fact: Vice-President of Information Technology ("VPIT")

fact: Director - Information Security ("DIS")

reasoning: Paragraph describes Audit Committee reporting to the Board on cybersecurity and Board receiving presentations from specific officers, directly answering board oversight structure (BG per Rule 1). Firm-specific named roles VPIT and DIS elevate specificity to Firm-Specific (Level 3); no domain terms or verifiable claims.


reasoning: This paragraph states a conclusion about no material past or likely future cybersecurity impacts on business or finances, directly matching SI per Rule 5 (negative assertion and forward-looking materiality). No domain terms, firm-specific facts, or verifiable claims present (date is reporting context, negative assertion not externally verifiable), so Generic Boilerplate.


content_category: Incident Disclosure

fact: cybersecurity incident during March 2021

fact: $2.4 million incremental one-time costs for the year ended December 31, 2021, net of insurance recoveries

type: quantified

reasoning: Paragraph primarily describes a real past cybersecurity incident including timing (March 2021), nature (systems outage), response (engaged forensic firms, restored systems), and impacts (business delays, $2.4M costs), directly answering 'What happened in a cybersecurity incident?' making it Incident Disclosure. Specificity reaches Quantified-Verifiable due to specific date (March 2021) and quantified cost ($2.4 million).


fact: cybersecurity dashboard featuring key metrics such as threat detection rates and response times

fact: external penetration tests

fact: process audits

reasoning: Paragraph describes Audit Committee oversight of cybersecurity risks, including information flow from Director of IT and external reports, directly answering 'How does the board oversee cybersecurity?' (BG). Specificity driven by domain-specific terms like threat detection rates, response times, penetration tests, and process audits passing ERM test (Level 2); no firm-specific roles (Director of IT lacks security qualifier) or verifiable claims.


reasoning: Paragraph describes business activities handling sensitive data and funds, explaining heightened cyber targeting without detailing any governance, processes, incidents, or materiality assessments; pure speculation on risks fits None/Other per Rule 6 and Rule 5. No domain terms passing ERM test, firm-specific facts, or verifiable claims anywhere, yielding Generic Boilerplate.


reasoning: Paragraph asserts no material past impact from cybersecurity breaches and warns of potential future material effects on business/financials, directly answering Strategy Integration's question per materiality rule (backward- and forward-looking assertions); cross-references are secondary. No domain terms, firm-specific facts, or verifiable claims anywhere, yielding Generic Boilerplate specificity.


reasoning: Paragraph describes general business risks from handling personal data and facing external/internal cyber threats, which is speculative without any cybersecurity measures, governance, or processes, fitting None/Other per Rule 6; no domain terms, firm-specific facts, or verifiable claims found anywhere, resulting in empty specific_facts and Generic Boilerplate.


content_category: Risk Management Process

fact: security incident and event manager interface

fact: behavioral analytics

fact: firewalls

fact: authentication attempts

fact: anti-malware

fact: penetration testing

fact: system security assessments

reasoning: Paragraph details processes for incident identification/response, monitoring tools, and testing, directly answering 'What does the cybersecurity program do?' → Risk Management Process; includes multiple domain-specific cybersecurity terms (SIEM interface, behavioral analytics, firewalls, anti-malware, pen testing) that demonstrate expertise beyond generic ERM language → Domain-Adapted.


reasoning: Paragraph primarily states conclusions about no material cybersecurity impacts to date and potential future effects, directly answering how cybersecurity affects business/financial outcomes per SI materiality rule (negative assertion and forward-looking). No domain terms, firm-specific facts, or verifiable claims present; generic threat descriptions and boilerplate processes do not elevate specificity.


reasoning: Paragraph details Board delegation of cybersecurity oversight to the Audit Committee, update frequency from officers, and reporting to the Board, directly answering Board Governance oversight structure per governance-chain rules. Specificity is Firm-Specific due to the firm-unique 'Senior Director of Governance & Information Security' role, a Director-level title with security qualifier.


fact: two-factor authentication (2FA)

fact: enhanced encryption

fact: real-time threat monitoring

fact: endpoint protection

fact: remote access protocols

reasoning: Paragraph details the cybersecurity program's activities like monitoring, software updates, BYOD policy, infrastructure simplification, cloud migration, and specific protections (2FA, encryption, endpoint protection), directly answering 'What does the cybersecurity program do?' → RMP. Multiple domain-specific terms (2FA, encryption, real-time monitoring, endpoint protection) pass ERM test for Domain-Adapted, no firm-specific roles/committees or verifiable quantities.


fact: CIO

reasoning: This paragraph primarily describes Board oversight of cybersecurity risks, information flow from management (CIO) to the Board via Audit Committee, fitting Board Governance per governance-chain rules. Specificity reaches Firm-Specific due to the named CIO role (VP-level IT leadership), with no domain terms or verifiable facts elevating higher.


reasoning: The paragraph states that past cybersecurity incidents have not materially affected the company's financial position, results of operations, or cash flows, directly answering a Strategy Integration question per Rule 5 (backward-looking materiality assessment) rather than detailing incidents or processes. No domain terms passing the ERM test, firm-specific facts, or verifiable claims are present anywhere in the paragraph, confirming Generic Boilerplate specificity.


fact: In 2017, experienced a material cybersecurity incident

fact: criminal attack involving theft of personal information of U.S., Canadian and U.K. consumers

reasoning: Paragraph primarily describes a real past cybersecurity incident (2017 Equifax breach: timing, nature as criminal attack, scope to specific countries' consumers), fitting Incident Disclosure over Strategy Integration as the hypotheticals are boilerplate speculation per Rule 5. Specificity reaches Quantified-Verifiable due to the verifiable 2017 incident date and specific scope details that an external party could confirm.


content_category: Management Role

fact: CISO

fact: Chief Risk Officer

reasoning: Paragraph describes specific management leaders (CISO, Chief Risk Officer, Chief Information and Technology Officer) responsible for cybersecurity risk assessment and management, directly answering 'How is management organized?' per MR category and person-removal test. Specificity driven by multiple named executive roles qualifying as firm-specific facts (Level 3), with no domain terms or verifiable claims elevating higher.


fact: On June 13, 2023, Brunswick disclosed an IT security incident

fact: Normal global business operations resumed over the course of nine days

fact: lost revenue of approximately $80 million to $85 million

fact: operating earnings of $35 million to $40 million

reasoning: This paragraph primarily describes a specific cybersecurity incident including date, scope, response actions, operational recovery timeline, and financial impacts, directly answering 'What happened in a cybersecurity incident?' making it Incident Disclosure (incident frame dominant per Rule 4). Specificity reaches Quantified-Verifiable due to multiple verifiable facts like the June 13, 2023 date, nine-day recovery, and specific financial loss ranges.


reasoning: Paragraph primarily describes steps to monitor and manage cybersecurity risks from third-party service providers via a new vendor risk program, making Third-Party Risk the central topic. No domain-specific terminology, firm-unique facts (e.g., named programs or roles), or verifiable claims (e.g., dates, quantities) present, resulting in Generic Boilerplate specificity.


fact: Cybersecurity Executive Steering Body

reasoning: Paragraph describes reporting flow from CISO to management steering body to Board Audit Committee, primarily answering how the board oversees cybersecurity via governance chain (BG per Rule 1). Specificity driven by firm-specific named role (CISO) and named management-level committee (Cybersecurity Executive Steering Body), reaching Firm-Specific level with no higher verifiable facts.


fact: automated event-detection notifications or similar technologies monitored by security operations team

fact: incident response team investigates, determines nature, assesses severity and sensitivity of compromised data

reasoning: This paragraph details the processes for detecting and analyzing cybersecurity incidents, including monitoring by a security operations team and incident response activities, directly answering 'What does the cybersecurity program do?' thus Risk Management Process. It demonstrates domain expertise through cyber-specific vocabulary like 'security operations team' and 'automated event-detection notifications' that pass the ERM test, setting specificity to Domain-Adapted with no higher-level facts.


fact: Enterprise & Technology Security (E&TS) organization

fact: Chief Information Security Officer (CISO)

fact: CSIRT

fact: Product Security Incident Response Team (PSIRT)

fact: Business Information Security Officers (BISO)

reasoning: Paragraph primarily describes management-level roles, teams, and responsibilities (E&TS, CISO, CSIRT, PSIRT, BISOs), fitting Management Role per person-removal test and Rule 1 distinction from Board Governance. Specificity reaches Firm-Specific due to multiple named roles and teams like CISO, CSIRT, and PSIRT, with no higher verifiable facts like quantities or dates.


reasoning: Paragraph lists specific oversight activities (reviewing regulatory info sec reports and monitoring emerging risks/frameworks), directly answering how the board/committee oversees cybersecurity risks, fitting Board Governance per governance-chain default. No domain terms passing ERM test, firm-specific facts, or verifiable claims present; generic boilerplate language yields Level 1 specificity.


fact: high-severity cybersecurity incidents

fact: cybersecurity risk assessment results

fact: independent third-party technology experts to test the Company's information technology systems, including cybersecurity

reasoning: Paragraph primarily describes Board oversight of cybersecurity risks via ERM program, management briefings, escalation processes, and third-party testing, directly answering 'How does the board oversee cybersecurity?' (BG). Specificity reaches Domain-Adapted due to cyber-specific terms like 'high-severity cybersecurity incidents' and 'cybersecurity risk assessment results' that pass ERM test, showing domain expertise; no firm-specific roles/committees or verifiable facts present.


fact: identity and access management, cyber defense operations, security engineering

fact: Executive Vice President/ Chief Information Security Officer

fact: Chief Information Officer

fact: over 25 years' experience in cybersecurity risk management

fact: over 27 years' experience in technology risk management

fact: penetration testing

fact: incident response

fact: threat intelligence

reasoning: Paragraph primarily describes management's organizational structure, leadership roles (CISO, CIO), qualifications, team composition, and reporting lines, fitting Management Role per person-removal test and BG/MR rule. Specificity reaches Quantified-Verifiable due to verifiable experience years ('over 25 years', 'over 27 years') and firm-specific named roles, with domain terms like 'cyber defense operations' and 'penetration testing' also present.


fact: security operations center

fact: Cybersecurity Incident Response Plan

fact: cybersecurity crisis response team

fact: Public Disclosure Committee

reasoning: Paragraph primarily describes cybersecurity monitoring, incident escalation, response processes, and disclosure protocols (RMP), with substantive program details remaining after person-removal test; firm-specific facts like CISO role and named committees/teams (Crisis Response Team, Public Disclosure Committee) drive Firm-Specific level, augmented by domain term 'security operations center'.


fact: ransomware

fact: phishing attacks

fact: social engineering

fact: operational technology

fact: layered technical protective capabilities

fact: detective surveillance controls

reasoning: Paragraph describes the cybersecurity risk assessment program, listing specific threats and key program aspects like controls, training, and procedures, directly answering 'What does the cybersecurity program do?' (RMP); domain terms like ransomware, phishing, layered capabilities demonstrate cybersecurity expertise (Level 2), with no firm-specific roles/committees or verifiable quantities (no Level 3/4).


fact: Cybersecurity Committee

category_confidence: medium

reasoning: The paragraph primarily describes the Board's oversight of cybersecurity through its Cybersecurity Committee, answering the Board Governance question per governance-chain rules despite mentions of the program (RMP) and past impacts (SI); specificity is Firm-Specific due to the named Cybersecurity Committee, with no higher verifiable facts.


reasoning: Paragraph describes the incident response process including containment, remediation, third-party assistance, notifications, and annual reviews, directly answering 'What does the cybersecurity program do?' (RMP); generic governance mentions (Board, Audit Committee) are secondary. No domain terms passing ERM test, no firm-specific roles/committees beyond excluded generics (Audit Committee), and no verifiable facts like numbers, dates, or named firms, resulting in Generic Boilerplate specificity.


reasoning: Paragraph describes how the management team monitors cybersecurity risks and incidents via briefings and information sources, directly answering 'How is management organized to handle cybersecurity?' (MR); person-removal leaves process description but core focus is management's role. Specificity driven by 'threat intelligence' as a domain term passing ERM test (cyber-specific practice), no firm-specific roles or verifiable claims.


reasoning: The paragraph lists components of the cybersecurity program (risk assessments, team responsibilities, external providers, training, incident response plan, third-party vetting), primarily answering 'What does the cybersecurity program do?' making it Risk Management Process; third-party risk is one element, not central. No domain terms pass the ERM test (all generic like 'risk assessments,' 'security controls,' 'incident response plan'), no firm-specific roles/teams/numbers, no verifiable facts, so Generic Boilerplate.


fact: Third-Party Risk Management (TPRM) program

reasoning: Paragraph centrally describes management of third-party cybersecurity risks via due diligence, contracts, new vendor reviews, and ongoing monitoring, directly answering the Third-Party Risk question (high confidence; central topic overrides any RMP overlap per Rule 3). Specificity driven by named internal TPRM program as a firm-specific fact (Level 3), with no domain terms passing ERM test or verifiable claims (high confidence).


fact: phishing attempts, ransomware and other forms of malware

reasoning: Paragraph primarily states a conclusion on no material cybersecurity incidents to date (negative assertion) and references potential business impacts, directly answering Strategy Integration's question per Rule 5. Specificity reaches Domain-Adapted due to domain-specific threat types like phishing and ransomware that pass the ERM test; no firm-specific roles or verifiable claims present.


fact: Chief Information Officer and Senior Vice President, Information Technology & Data Analytics (CIO)

fact: Chief Security Officer (CSO)

fact: Chief Engineer

fact: Chief Aerospace Safety Officer

fact: Chief Product Security Engineer

fact: Aerospace Safety Committee

reasoning: Paragraph describes board-level oversight structure, delegation to specific committees (Audit and Aerospace Safety), briefing frequencies, and reporting from named executives, directly answering 'How does the board oversee cybersecurity?' → Board Governance. Multiple named VP-level+ cybersecurity/IT roles and the non-generic Aerospace Safety Committee elevate to Firm-Specific (Level 3), with no verifiable hard facts like dates/numbers for Level 4.


fact: Risk Management Committee

fact: CISO

fact: Managing Committee

reasoning: Paragraph describes board-level oversight of cybersecurity risks through committees like the Risk Management Committee and Cybersecurity and Technology Subcommittee, including briefing frequencies and delegation, directly answering 'How does the board oversee cybersecurity?' → Board Governance. Specificity reaches Firm-Specific due to named committees (Risk Management Committee, Cybersecurity and Technology Subcommittee) and roles (CISO, Managing Committee), with no verifiable quantified facts like dates, headcounts, or named external firms.


fact: chief information security officer (CISO)

fact: chief information officer (CIO)

fact: chief risk officer (CRO)

fact: Two members of the audit committee have obtained certifications in cybersecurity oversight

reasoning: Paragraph describes board and audit committee oversight of cybersecurity, including briefing frequency, expertise (certifications), and reporting from executives like CISO/CIO/CRO, directly answering 'How does the board oversee cybersecurity?' (BG per Rule 1). Specificity reaches Quantified-Verifiable due to the hard number 'two members' with cybersecurity certifications and named C-level roles (CISO/CIO/CRO), verifiable via public filings or bios.


fact: Chief Information Security Officer ("CISO")

fact: ELT (Executive Leadership Team)

fact: Senior Leadership Team ("SLT")

fact: tabletop exercises to evaluate incident response processes

reasoning: Paragraph describes oversight structure with CISO briefing Board, ELT, and SLT quarterly and annual tabletops, answering 'How does the board oversee cybersecurity?' per governance-chain default to BG. Specificity reaches Firm-Specific due to named CISO role and SLT/ELT teams, with domain term in tabletops for incident response.


fact: Chief Information Security Officer (CISO)

fact: EXCO

fact: Senior Leadership Team (SLT)

reasoning: This paragraph primarily describes board and senior leadership oversight of cybersecurity through CISO-led quarterly meetings, annual tabletop exercises, and threat updates, answering 'How does the board oversee cybersecurity?' (BG per governance-chain default). Specificity reaches Firm-Specific due to named cybersecurity role (CISO) and committees/teams (EXCO, SLT); no domain terms pass ERM test and no verifiable claims present.


fact: Emergency Incident Response Team

reasoning: Paragraph primarily consists of cross-references to other SEC items (1A, 1B, 1C) and generic review language, fitting None/Other rather than a substantive category; no clear answer to a core cybersecurity question. Specificity driven by the named 'Emergency Incident Response Team' as a firm-specific named team elevating to Firm-Specific, with no higher verifiable facts.


fact: CSO

fact: phishing tests

reasoning: Paragraph primarily describes cybersecurity program activities including detection, reporting, security, mitigation, incident handling (identifying, containing, remediating), employee trainings, and phishing tests, with substantive RMP content remaining after person-removal test. Specificity reaches Firm-Specific due to named role 'CSO'; phishing tests adds domain terminology but does not exceed L3.


fact: Enterprise Risk Management Committee ("ERM Committee")

fact: SOC1 reports

reasoning: Paragraph primarily describes board oversight structure via delegation to the board-appointed ERM Committee (executives) that reviews cyber risks and reports annually to the Audit Committee, fitting Board Governance per governance-chain rule; ERM Committee is a firm-specific named committee (Level 3), and SOC 1 reports is domain terminology (Level 2), setting highest specificity to Firm-Specific.


reasoning: The paragraph primarily describes the adoption of safeguards, programs, policies, and procedures for protecting information assets and responding to security incidents, directly answering 'What does the cybersecurity program do?' (RMP), with brief board/management oversight (BG) and a materiality conclusion (SI) as secondary elements where most text favors RMP. No domain terminology passing the ERM test, firm-specific facts, or verifiable claims (e.g., reporting date negative assertion not QV) found anywhere, yielding Generic Boilerplate.


reasoning: Paragraph primarily states a conclusion on cybersecurity's lack of material impact to date and potential future effects, fitting Strategy Integration per Rule 5 (negative assertion of no material incidents). No domain terms, firm-specific facts, or verifiable claims anywhere, resulting in Generic Boilerplate specificity.


fact: Enterprise Cybersecurity Management Review Group (Enterprise Cybersecurity MRG)

fact: Chief Information Security Officer

reasoning: Paragraph primarily describes the structure, membership, responsibilities, and reporting lines of the management-level Enterprise Cybersecurity MRG steering committee and its interactions with the CISO, fitting Management Role per Rule 1 (management-level committee). Firm-specific facts include the named committee (MRG) and CISO role, elevating to Firm-Specific with no domain terms or verifiable claims present.


reasoning: The paragraph primarily describes the vendor management process for third-party oversight, including vetting cybersecurity-related vendors, making Third-Party Risk the central topic despite a minor materiality statement at the end (most text on TP). No domain terms passing ERM test, no firm-specific roles/committees/teams, and no verifiable facts like numbers or named entities, resulting in Generic Boilerplate specificity.