reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a materiality assessment (backward-looking and forward-looking), which aligns with Strategy Integration; specificity is Level 1 because it contains no specific facts—only generic boilerplate language about risks and cross-references, with no domain terms, firm-specific details, or verifiable claims.


content_category: None/Other

category_confidence: high

specificity_confidence: high

reasoning: The paragraph is a list of cybersecurity-related entities with no description of governance, management, or processes, so it primarily answers none of the substantive questions and falls under None/Other. Since it is classified as None/Other, specificity is always Generic Boilerplate per the rules.

provider: xiaomi

stage: benchmark


content_category: Third-Party Risk

reasoning: The paragraph primarily addresses third-party risk management by discussing outreach to providers and mitigation measures for cyberattacks, but it contains no specific facts (e.g., named vendors, quantifiable details, or verifiable claims), making it generic boilerplate with no domain expertise, firm-specific information, or externally verifiable elements.


reasoning: The paragraph primarily answers how third-party cyber risks are managed by describing relationships with service providers for cybersecurity assistance, fitting the Third-Party Risk category. It contains no specific facts—such as named vendors, quantified details, or domain-specific practices—making it generic boilerplate for specificity.


reasoning: The paragraph is a cross-reference to the Risk Factors section, answering none of the substantive cybersecurity questions and falling under None/Other; it contains no specific facts, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily addresses how third-party cyber risks are managed through supplier assessments, directly answering the Third-Party Risk question. It contains no specific facts, domain terms, or verifiable claims, using only generic process language, so specificity is Level 1.


reasoning: The paragraph primarily addresses how the company manages third-party cybersecurity risks through due diligence and contractual provisions, fitting the Third-Party Risk category. It contains no specific facts, domain terms, or verifiable claims, making it generic boilerplate with Level 1 specificity.


content_category: Board Governance

reasoning: The paragraph primarily addresses how management reports to the audit committee on cybersecurity risks, which is a governance oversight structure, fitting Board Governance. No specific facts (e.g., names, dates, verifiable claims) are present, so specificity is Generic Boilerplate.


content_category: Strategy Integration

reasoning: The paragraph primarily answers how cybersecurity risks could affect business outcomes by stating a forward-looking conclusion about material impact, which aligns with Strategy Integration. It contains no specific facts, dates, numbers, or verifiable claims, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily addresses how third-party cyber risks are managed through diligence, monitoring, and contractual requirements, fitting the Third-Party Risk category. It contains no firm-specific or verifiable facts, and the language is generic process description without domain-specific terminology that passes the ERM test, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how the board oversees cybersecurity through annual reporting from the ISO, which is a governance-chain description focused on oversight structure. For specificity, it contains no verifiable or firm-specific facts—terms like 'annual reporting' and 'Information Security Program' are generic and would be used by any enterprise risk management professional, so it is Generic Boilerplate.


reasoning: The paragraph primarily answers how third-party cyber risks are managed by describing vendor assessment requirements and contract terms, fitting Third-Party Risk; no specific facts (e.g., named roles, verifiable claims, or domain-specific terms beyond generic process descriptions) are present, so specificity is Generic Boilerplate.


content_category: Risk Management Process

reasoning: The paragraph primarily answers what the company does to address cybersecurity threats by expending resources on risk management, strategy, and governance, which aligns with Risk Management Process. It contains no specific facts, dates, numbers, or verifiable claims, so specificity is Generic Boilerplate.


reasoning: The paragraph directly answers how the board oversees cybersecurity by describing the Audit Committee's role and update mechanisms, fitting Board Governance. It contains no specific facts—such as domain terms, firm-specific roles, or verifiable claims—so specificity is Generic Boilerplate.


reasoning: The paragraph primarily answers how the board oversees cybersecurity, focusing on oversight structure and information flow, which aligns with Board Governance. It contains no specific facts that elevate specificity above Level 1, as it uses generic governance language without verifiable claims, firm-specific details, or domain expertise demonstrations.


content_category: Management Role

fact: over 20 years of information security experience

fact: over four years as a director in the information security management practice of a big four accounting firm

fact: B.S. in Network Security

reasoning: The paragraph primarily addresses how management is organized for cybersecurity, detailing the CISO's role, qualifications, reporting line, and the ISSC structure, which aligns with Management Role; specificity is Level 4 due to verifiable facts like the CISO's experience years and degree, which an external party could confirm.


reasoning: The paragraph primarily answers how third-party cyber risks are managed through vendor assessments, contractual rights, and monitoring, making it Third-Party Risk; it contains only generic process descriptions without domain-specific terminology, firm-specific details, or verifiable claims, so specificity is Level 1.


reasoning: The paragraph primarily answers how third-party cyber risks are managed, focusing on contractual security addenda and incident reporting from subcontractors, which aligns with Third-Party Risk. It contains no specific facts, domain terms, or verifiable claims, making it generic boilerplate with no elevation above Level 1 specificity.


reasoning: The paragraph primarily addresses how the company manages third-party cybersecurity risks, which is the central topic of Third-Party Risk; no specific facts are present, making it generic boilerplate language with no domain-specific or verifiable claims.


reasoning: The paragraph primarily answers how third-party cyber risks are managed by describing vendor oversight and assessment, making it Third-Party Risk. It contains no specific facts (e.g., named roles, verifiable claims, or domain-specific terms that pass the ERM test), so it is generic boilerplate.


reasoning: The paragraph primarily answers how the board oversees cybersecurity by describing delegation to the Audit Committee, fitting Board Governance. It contains no specific facts (e.g., names, dates, verifiable claims), so specificity is Generic Boilerplate.


reasoning: The paragraph primarily addresses how third-party cyber risks are managed through vendor oversight and certification requirements, fitting the Third-Party Risk category; it contains no firm-specific facts, verifiable claims, or domain terminology that passes the ERM test, making it generic boilerplate.


reasoning: The paragraph is a cross-reference to another section of the filing, which does not answer any substantive cybersecurity question and is classified as None/Other. It contains no specific facts, so specificity is Generic Boilerplate.


fact: CIO has led IT efforts since 2016

fact: CIO has more than 20 years of experience

reasoning: The paragraph primarily answers how management is organized for cybersecurity, focusing on the CIO's role and experience, which is Management Role; it contains verifiable facts like the CIO's tenure since 2016 and more than 20 years of experience, driving specificity to Level 4.


reasoning: The paragraph primarily answers how management is organized for cybersecurity by detailing the Director, IT's responsibilities, fitting Management Role. It contains no specific facts that elevate specificity above Level 1, as all content is generic and lacks domain terminology, firm-specific details, or verifiable claims.


reasoning: The paragraph primarily answers how the board oversees cybersecurity through the Audit Committee's briefings and involvement with the COO, which is a governance-chain description defaulting to Board Governance. No specific facts (e.g., verifiable claims, firm-specific roles, or domain terms) are present, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily addresses how third-party cyber risks are managed through due diligence and oversight, central to Third-Party Risk category. It contains no specific facts—only generic terms like 'risk-based approach' and 'due diligence' that fail the ERM test for domain expertise, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily addresses how the board oversees cybersecurity through Audit Committee education and expertise, which is a governance-chain description, so it falls under Board Governance. It contains no specific facts that elevate specificity above generic boilerplate, as it lacks domain-specific terminology, firm-unique details, or externally verifiable claims.


reasoning: The paragraph is a cross-reference to another section and does not describe any substantive cybersecurity disclosure, so it fits None/Other. It contains no specific facts, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily addresses the material impact of cybersecurity on the business through a negative assertion about materiality, which aligns with Strategy Integration per Rule 5. It contains no specific facts—only generic, speculative language—so specificity is Level 1.


reasoning: The paragraph primarily answers how cybersecurity affects the business through materiality assessments (e.g., 'have not materially affected' and 'reasonably likely to materially affect'), fitting Strategy Integration. It contains no specific facts that elevate specificity above Level 1, as the assessment details and negative assertions are not externally verifiable or distinguishing firm-specific information.


reasoning: The paragraph describes David Shear's career history and roles without any cybersecurity context, so it does not answer any of the six substantive cybersecurity questions, falling under None/Other. Since it contains no cybersecurity-specific facts, specificity is Generic Boilerplate.


reasoning: The paragraph is a forward-looking disclaimer about potential breaches without describing any substantive cybersecurity process or role, so it fits None/Other; it contains no specific facts that elevate specificity above generic boilerplate, as 'Koichi' is not given a title or verifiable role, and the language is generic any ERM professional could use.


reasoning: The paragraph is a cross-reference to risk factors in Item 1A and does not answer any substantive cybersecurity questions, so it is classified as None/Other. No specific facts are present in the text, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how third-party cyber risks are managed, describing the program for vendor oversight and contractual obligations, which central topic fits Third-Party Risk. It contains no specific facts (e.g., names, dates, numbers, or verifiable claims), so specificity is Generic Boilerplate.


reasoning: The paragraph primarily describes oversight structure with the Board and Audit Committee, answering how the board oversees cybersecurity, so it's Board Governance. It contains no specific facts—only generic language—making it Generic Boilerplate for specificity.


reasoning: The paragraph primarily describes information flow from a task force to the Audit Committee, which is about board oversight of cybersecurity risks, fitting Board Governance. It contains no specific facts such as named roles, dates, or verifiable claims, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily answers how third-party cyber risks are managed through vendor oversight and assessments, making it Third-Party Risk; it contains no specific facts (e.g., named roles, verifiable claims, or domain-specific terms that pass the ERM test), so specificity is Generic Boilerplate.


reasoning: The paragraph primarily answers how third-party cyber risks are managed, focusing on vendor oversight and contractual requirements, which aligns with Third-Party Risk. It contains no specific facts that elevate specificity above Level 1, as it uses generic risk management language without domain-specific terms, firm-unique details, or verifiable claims.


content_category: Incident Disclosure

fact: Ransomware incident detected on December 15, 2020

reasoning: The paragraph primarily answers what happened in a specific cybersecurity incident (real event on December 15, 2020), so it is classified as Incident Disclosure; it contains a verifiable fact (specific date of incident detection), driving Quantified-Verifiable specificity.


reasoning: The paragraph primarily answers the question about cybersecurity's material impact on business outcomes with a backward-looking assertion, aligning with Strategy Integration per Rule 5. It contains no specific facts (e.g., verifiable claims, firm-specific details, or domain expertise terms), so specificity is Generic Boilerplate.


reasoning: The paragraph is a cross-reference to risk factors and does not describe any substantive cybersecurity disclosure, so it falls under None/Other; it contains no specific facts that elevate specificity above generic boilerplate, as it only points to another section without providing new information.


reasoning: The paragraph primarily answers how the board oversees cybersecurity through delegation and reporting lines, fitting Board Governance; it contains no specific facts (e.g., no domain terms, firm-specific details, or verifiable claims), making it generic boilerplate.


reasoning: The paragraph primarily answers how third-party providers are used in the cybersecurity risk management process, aligning with Risk Management Process; it contains no specific facts, names, numbers, or verifiable claims, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily answers how cybersecurity affects business outcomes by stating a materiality conclusion (have not materially affected and are not reasonably likely to materially affect), which aligns with Strategy Integration per Rule 5. It contains no specific cybersecurity facts—such as domain terms, firm-specific details, or verifiable claims—so specificity is Generic Boilerplate.


fact: On March 7, 2024, UnitedHealth Group issued a statement regarding the Change Healthcare incident

fact: UnitedHealth Group expects to begin testing and reestablish connectivity beginning March 18, 2024

reasoning: The paragraph primarily answers what happened in a cybersecurity incident by describing a real event involving Change Healthcare and its impact on the company, fitting Incident Disclosure. Specificity is Level 4 due to externally verifiable dates (March 7 and March 18, 2024) in UnitedHealth Group's statement.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a conclusion about no material impact to date, fitting Strategy Integration per the SI materiality rule; it contains no specific facts beyond generic cybersecurity language, so specificity is Level 1.


reasoning: The paragraph primarily answers 'What does the cybersecurity program do?' by describing its integration into the enterprise risk management process and sharing of methodologies, which aligns with Risk Management Process; no specific facts are present that elevate specificity above generic boilerplate, as the language is common to enterprise risk management and lacks domain-specific or verifiable claims.


reasoning: The paragraph is a cross-reference to Item 1A Risk Factors, providing no substantive cybersecurity disclosure, so it's None/Other. It contains no specific facts, making it Generic Boilerplate.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a materiality conclusion about past and future impacts, which aligns with Strategy Integration. It contains no specific facts—no verifiable claims, firm-specific details, or domain terminology that passes the ERM test—making it generic boilerplate.


reasoning: The paragraph primarily addresses third-party risk management by describing vendor security assessments and ongoing monitoring, which is central to the Third-Party Risk category. It contains no specific facts—such as named vendors, dates, or verifiable claims—so specificity is Generic Boilerplate (Level 1).


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a materiality assessment (has not affected and may affect in the future), which aligns with Strategy Integration per Rule 5. It contains no specific facts—no domain terms, firm-specific details, or verifiable claims—so specificity is Generic Boilerplate.


reasoning: The paragraph primarily answers how third-party cyber risks are managed through franchisee and licensee obligations, central to Third-Party Risk. It contains no specific facts that elevate specificity above Level 1, as it uses general language without domain-specific terms, firm-specific details, or verifiable claims.


reasoning: The paragraph primarily describes incident response procedures and coordination, which falls under Risk Management Process; it contains no specific facts (e.g., named roles, quantified data, or domain-specific tools) that elevate specificity above generic boilerplate language.


reasoning: The paragraph focuses on a management role's responsibilities and qualifications for cybersecurity, directly answering 'How is management organized to handle cybersecurity?' which is Management Role. It contains no specific facts (e.g., no verifiable claims, firm-specific titles with security qualifiers, or domain expertise terms), so specificity is Generic Boilerplate.


reasoning: The paragraph primarily answers how the board oversees cybersecurity through joint responsibility and quarterly updates, fitting Board Governance. No specific facts are present—language is generic and boilerplate, with no domain terms, firm-specific details, or verifiable claims, so specificity is Level 1.


reasoning: The paragraph primarily answers how the board oversees cybersecurity by describing quarterly updates from the security team to the Audit Committee/Board, which is Board Governance. It contains no specific facts (e.g., names, dates, numbers, or verifiable claims), so it is Generic Boilerplate.


reasoning: The paragraph primarily answers how the board oversees cybersecurity through the Audit Committee's quarterly reviews and engagement, which is clearly Board Governance. It contains no specific facts, domain terms, or verifiable claims, making it generic boilerplate with no elevated specificity.


reasoning: The paragraph primarily answers how the cybersecurity program involves external service providers for evaluating and enhancing policies, which is part of the risk management process per Rule 3; no specific facts are present, making it generic boilerplate with no domain terms, firm-specific details, or verifiable claims.


reasoning: The paragraph primarily answers the question of how cybersecurity affects the business by stating a conclusion about materiality (no material impact), which aligns with Strategy Integration per Rule 5. It contains no specific cybersecurity facts, domain terms, or verifiable claims, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily answers how the board oversees cybersecurity, focusing on delegation to the Audit Committee and information flow, which aligns with Board Governance; specificity is Level 1 because the text contains no domain terms, firm-specific details, or verifiable claims, making it generic boilerplate.


reasoning: The paragraph primarily answers how cybersecurity affects business finances through materiality assessments (stating no material effect and no reasonable likelihood), fitting Strategy Integration per Rule 5; it contains no specific facts—no verifiable claims, firm-specific details, or domain expertise terms—so specificity is Generic Boilerplate.


reasoning: The paragraph is a cross-reference to risk factors and does not answer any substantive cybersecurity question, so it is classified as None/Other. No specific facts are present—only generic risk language and a cross-reference—so specificity is Level 1.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a conclusion about no material impact, which is Strategy Integration per Rule 5. It contains no specific facts (e.g., no domain terms, firm-specific details, or verifiable claims), so specificity is Generic Boilerplate.


reasoning: The paragraph primarily addresses how materiality is assessed for cybersecurity incidents, which is a core aspect of Strategy Integration as it relates to business impact; it contains no specific facts about the company's cybersecurity posture, making it Generic Boilerplate.


reasoning: The paragraph primarily answers how the board oversees cybersecurity, describing oversight structure and reporting lines, which fits Board Governance. It contains no domain-specific terminology or verifiable facts, making it generic boilerplate for specificity.


reasoning: The paragraph primarily answers how cybersecurity affects business outcomes by stating a negative assertion about no material incidents and immaterial expenses, which aligns with Strategy Integration per Rule 5. It contains no specific facts (e.g., verifiable claims, firm-specific details, or domain terminology) that would elevate specificity above Level 1.


reasoning: The paragraph primarily addresses board oversight of cybersecurity, fitting Board Governance, as it describes the coordination between the Board and Audit Committee in receiving reports and managing risks. For specificity, no facts elevate above Level 1; terms like 'annual reports' and 'cybersecurity risks' are generic governance language without domain-specific practices, verifiable claims, or firm-unique details.


category_confidence: medium

reasoning: The paragraph primarily addresses the company's forward-looking policy for disclosing material cybersecurity incidents, which is a standard disclaimer not fitting the six substantive questions, so it is classified as None/Other. For specificity, there are no domain terms, firm-specific facts, or verifiable claims, making it generic boilerplate.


reasoning: The paragraph primarily describes board and committee oversight of cybersecurity, answering 'How does the board oversee cybersecurity?' which aligns with Board Governance; specificity is Generic Boilerplate because the language is generic with no verifiable facts, firm-specific details, or domain expertise beyond common risk management terms.


reasoning: The paragraph describes the audit committee's oversight of cybersecurity through reports from management, directly answering how the board oversees cybersecurity, which fits Board Governance. It contains no specific cybersecurity practices, tools, or verifiable facts, making it generic boilerplate with no elevated specificity.


reasoning: The paragraph primarily answers the question of whether cybersecurity incidents have affected business outcomes, stating a negative assertion about incident history, which under Rule 5 is classified as Strategy Integration. No specific facts are present that elevate specificity above Level 1, as it contains only generic language about incident absence without verifiable or firm-specific details.


reasoning: The paragraph is a generic summary emphasizing proactive approach and leadership involvement without answering any specific cybersecurity question, so it falls under None/Other. No specific facts are present to elevate specificity above Level 1, as it lacks domain terms, firm-specific details, or verifiable claims.


reasoning: The paragraph states generic goals for cyber incident response without answering any substantive cybersecurity questions (e.g., governance, management, processes), so it is classified as None/Other. It contains no specific facts—no domain terms, firm-specific details, or verifiable claims—so specificity is Generic Boilerplate.


reasoning: The paragraph is a cross-reference to another section with no substantive cybersecurity disclosure, so it falls under None/Other; it contains no specific facts, making it generic boilerplate at Level 1.


reasoning: The paragraph primarily answers how the board oversees cybersecurity through the Audit Committee's oversight structure, fitting Board Governance. It contains no specific facts that elevate specificity above generic boilerplate, as all language is standard governance terminology without firm-specific or verifiable details.


reasoning: The paragraph primarily answers how cybersecurity affects business outcomes by stating a conclusion about no material impact, which aligns with Strategy Integration per Rule 5. No specific facts are present—only generic materiality assertions and cross-references—so specificity is Level 1.


reasoning: The paragraph primarily answers how the cybersecurity program is evaluated and enhanced through expert reviews and external engagement, which aligns with Risk Management Process; it contains no specific facts (e.g., no domain terms, firm-specific roles, or verifiable claims) that elevate specificity above generic boilerplate.


reasoning: The paragraph primarily addresses how third-party cyber risks are managed through auditor engagement and vendor requirements, fitting Third-Party Risk; it contains no specific facts like named entities, quantifiable data, or verifiable claims, so specificity is generic boilerplate.


reasoning: The paragraph primarily answers how cybersecurity affects the business by discussing material impact assessments and referencing risk factors, fitting Strategy Integration; it contains no specific facts (e.g., no verifiable claims, firm-specific details, or domain expertise terms) that elevate specificity above generic boilerplate.


reasoning: The paragraph primarily answers how the board oversees cybersecurity through quarterly and annual reports, fitting Board Governance; it contains no firm-specific or verifiable facts, so specificity is Generic Boilerplate.


reasoning: The paragraph is a cross-reference to risk factors in Item 1A, which does not answer any substantive cybersecurity question and falls under None/Other; it contains no specific facts, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily states a conclusion about the absence of material cybersecurity incidents to date, which aligns with Strategy Integration under Rule 5 (negative assertion about material impact); no specific facts are present, making it generic boilerplate with no domain-adapted, firm-specific, or verifiable claims.


reasoning: The paragraph primarily answers how third-party cyber risks are managed through due diligence and contractual obligations, central to the Third-Party Risk category. Specificity is Level 1 because the paragraph contains no domain terms, firm-specific facts, or verifiable claims—it uses generic risk management language without cybersecurity expertise or distinguishing details.


reasoning: The paragraph primarily addresses executive management's responsibilities for cybersecurity oversight and strategy, which aligns with Management Role. It contains no specific facts—such as named roles, dates, or verifiable claims—so specificity is Generic Boilerplate.


reasoning: The paragraph describes the activities of the cybersecurity program (monitoring, tool use, incident response), directly answering what the program does, so it is Risk Management Process. It contains no specific facts—no named tools, roles, dates, or verifiable claims—so specificity is Generic Boilerplate.


reasoning: The paragraph primarily answers what the cybersecurity program does by describing risk identification and assessment processes integrated with overall risk management, which aligns with Risk Management Process. It lacks any specific facts, domain terminology beyond generic terms, firm-specific details, or verifiable claims, making it generic boilerplate for specificity.


reasoning: The paragraph primarily answers how third-party cyber risks are managed through vendor oversight, fitting Third-Party Risk; it contains no specific facts, so it is generic boilerplate with no domain-adapted, firm-specific, or verifiable claims.


reasoning: The paragraph primarily answers how third-party cyber risks are managed through security assessments and ongoing reviews, which is the central topic of Third-Party Risk; it contains no specific facts, domain terms, or verifiable claims, so specificity is Level 1 (Generic Boilerplate).


reasoning: The paragraph is generic boilerplate stating a commitment to cybersecurity without addressing any substantive questions like governance, management roles, or specific processes; it contains no specific facts, so specificity is Level 1.


reasoning: The paragraph primarily addresses materiality assessments of cybersecurity risks on business outcomes, fitting Strategy Integration; it contains no specific facts that elevate specificity above generic boilerplate, as all assertions are negative and non-verifiable.


reasoning: The paragraph primarily describes the cybersecurity program's framework and procedures, answering what the risk management process does, so it is classified as Risk Management Process. For specificity, the paragraph contains only generic boilerplate language with no domain-specific terms that pass the ERM test, no firm-specific facts, and no verifiable claims, resulting in Level 1.


reasoning: The paragraph primarily states a conclusion about no material cybersecurity incidents and discusses investment in mitigation, which directly answers the Strategy Integration question per Rule 5. It contains no specific facts (e.g., no domain terms, firm-specific details, or verifiable claims), so specificity is Level 1.


reasoning: The paragraph primarily addresses the business impact of cybersecurity risks and includes a negative assertion about incidents, which aligns with Strategy Integration per Rule 5; no specific facts are present, as the language is speculative and generic, resulting in Level 1 specificity.


reasoning: The paragraph primarily answers whether cybersecurity has affected the business by stating a negative materiality assertion ('have not experienced a cybersecurity incident that resulted in a material adverse impact'), which aligns with Strategy Integration per Rule 5. It contains no specific facts that elevate specificity above Level 1, as it relies on generic disclaimers, cross-references, and boilerplate language without domain terms, firm-specific details, or verifiable claims.


reasoning: The paragraph primarily answers how cybersecurity affects business outcomes by stating that challenges have materially impaired operations or financial standing, which is an assessment under Strategy Integration. No specific facts are present—such as domain terms, firm-specific details, or verifiable claims—so specificity is Generic Boilerplate.


fact: COO

reasoning: The paragraph primarily answers how management is organized for cybersecurity by describing the COO's role, reporting line, and experience, falling under Management Role; specificity is driven by the verifiable claim of 'over 15 years of experience in cybersecurity,' which sets a checkable threshold.


reasoning: This paragraph primarily answers how cybersecurity affects the business by stating a conclusion about no material incidents, which aligns with Strategy Integration per Rule 5. It contains no specific facts—no domain terms, firm-specific details, or verifiable claims—making it Generic Boilerplate.


reasoning: The paragraph primarily describes the cybersecurity program's processes, technologies, and engagements, answering 'what does the cybersecurity program do,' which aligns with Risk Management Process; it contains no specific facts that elevate specificity above generic boilerplate, as it uses high-level, generic language without domain-specific terms, firm-specific details, or verifiable claims.


reasoning: The paragraph directly answers how third-party cyber risks are managed through due diligence and compliance, making it Third-Party Risk. It contains no specific facts—such as named standards, firm-specific roles, or verifiable claims—so it is generic boilerplate for specificity.


fact: CTO has over 10 years of experience overseeing cybersecurity functions

fact: COO has over 5 years of experience overseeing cybersecurity and IT functions

reasoning: The paragraph primarily answers how the board oversees cybersecurity through delegation to the Audit Committee and management reporting, fitting Board Governance; specificity is driven by verifiable quantified experience claims for the CTO and COO, which are externally checkable.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a conclusion about no material impact to date, with a subordinate mention of past incidents, making it Strategy Integration; it contains no specific facts (e.g., no quantified data, named entities, or domain-specific details), so specificity is Generic Boilerplate.


reasoning: The paragraph primarily answers how cybersecurity affects business outcomes by stating conclusions about materiality (e.g., no material incidents in 2023, risks not likely to materially affect business), which aligns with Strategy Integration under Rule 5. It contains no specific facts—only generic assertions and cross-references—so specificity is Level 1 (Generic Boilerplate).


reasoning: The paragraph primarily answers how third-party cyber risks are managed through vendor assessments and security requirements, central to Third-Party Risk. No specific facts (e.g., named vendors, quantified requirements, or verifiable claims) are present, so specificity is Generic Boilerplate.


fact: In October 2023, we experienced a cybersecurity incident where user information was accessed and downloaded from 23andMe.com accounts without authorization

reasoning: The paragraph primarily answers what happened in a specific cybersecurity incident (October 2023 event with details on access and response), fitting Incident Disclosure. Specificity is Level 4 due to the verifiable date of the incident, which is an externally confirmable fact.


reasoning: The paragraph is a cross-reference to risk factors in another section and does not answer any substantive cybersecurity question, so it is classified as None/Other; with no specific facts present, it is generic boilerplate.


reasoning: The paragraph states a negative conclusion about the absence of material cybersecurity incidents, which directly answers how cybersecurity affects business outcomes, so it's Strategy Integration per Rule 5. No specific facts are present—no domain terms, firm-specific details, or verifiable claims—so specificity is Level 1 Generic Boilerplate.


reasoning: The paragraph is a cross-reference to risk factors and does not describe any substantive cybersecurity disclosure, fitting None/Other. No specific facts are present, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily answers how cybersecurity affects business outcomes through materiality assessments, fitting Strategy Integration per Rule 5; it contains no specific facts (e.g., verifiable claims, firm-specific details, or domain expertise terms), so specificity is Generic Boilerplate.


reasoning: The paragraph is a cross-reference to risk factors and does not describe any cybersecurity measures, governance, incidents, or assessments, so it falls under None/Other. It contains no specific facts, making it Generic Boilerplate (Level 1).


reasoning: The paragraph describes general cybersecurity threats and Okta's commitment to protection but does not answer any substantive question about governance, management, processes, incidents, or strategy, making it None/Other. It contains no specific facts about Okta's cybersecurity posture, so it is Generic Boilerplate.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a materiality assessment (no prior incidents have materially affected operations), which aligns with Strategy Integration; it contains no specific facts—such as quantified data, domain terms, or firm-specific details—so it is Generic Boilerplate.


reasoning: The paragraph primarily answers how the board oversees cybersecurity, describing oversight by independent board members, quarterly reviews, and incident engagement policy, which aligns with Board Governance. It contains no specific facts that elevate specificity above Level 1, as it uses generic governance language without verifiable claims, domain-specific terminology, or firm-distinguishing details.


reasoning: The paragraph primarily answers the question of how cybersecurity affects the business by stating a conclusion that no prior incidents have materially affected the company, which aligns with Strategy Integration per Rule 5; it contains no specific facts (e.g., no verifiable claims, domain terms, or firm-specific details), so specificity is Generic Boilerplate.


reasoning: The paragraph is a definitional statement about 'systems' and does not answer any substantive cybersecurity questions (e.g., governance, management, risk processes), so it falls under None/Other. It contains no specific facts—no domain terms that demonstrate expertise, no firm-specific details, and no verifiable claims—so specificity is Generic Boilerplate.


reasoning: The paragraph primarily answers what the cybersecurity program does by describing its integration into enterprise risk management, aligning with Risk Management Process. No specific facts (domain terms, firm-specific details, or verifiable claims) are present, so specificity is generic boilerplate.


reasoning: The paragraph primarily answers how third-party cyber risks are managed through weekly calls and issue resolution, central to Third-Party Risk category. It contains no domain-specific terms, firm-specific facts, or verifiable claims, so specificity is Generic Boilerplate.


reasoning: The paragraph is a general disclaimer about the company's lack of resources to handle cybersecurity risks, without describing any governance, management roles, processes, or specific incidents, so it fits None/Other. No specific facts are present to elevate specificity beyond Level 1.


reasoning: The paragraph primarily answers how management is organized to handle cybersecurity by describing the Director's responsibilities and experience, and review process with the CFO, aligning with Management Role. It contains no specific facts such as names, numbers, or verifiable claims, making it Generic Boilerplate for specificity.


reasoning: The paragraph primarily answers speculative risk questions about potential business impacts, but it does not describe any substantive cybersecurity measures, processes, or assessments; it references risk factors and is forward-looking, fitting None/Other. Specificity is Level 1 because no specific facts (domain terms, firm-specific, or verifiable) are present—only generic risk language.


reasoning: The paragraph primarily answers how the board oversees cybersecurity by describing delegation to the Audit Committee, fitting Board Governance. No specific facts are present—such as domain terms, firm-specific details, or verifiable claims—making it generic boilerplate with no elevation above Level 1.


reasoning: The paragraph is a cross-reference to risk factor disclosures, answering no substantive cybersecurity question about governance, management, or incidents, so it falls under None/Other. It contains no specific facts, domain terms, firm-specific details, or verifiable claims, making it Generic Boilerplate.


reasoning: The paragraph primarily answers whether cybersecurity has materially affected the business through a backward-looking materiality assertion, which aligns with Strategy Integration; specificity is Generic Boilerplate because the paragraph contains no specific facts—only generic risk language and a non-verifiable negative assertion.


fact: Use of Namecheap for hosting services

fact: Use of GoDaddy for hosting services

fact: Use of Cloudflare for hosting services

reasoning: The paragraph primarily addresses third-party risk by discussing vendor oversight for hosting services, and it contains verifiable claims by naming specific third-party providers (Namecheap, GoDaddy, Cloudflare), which elevates specificity to Quantified-Verifiable.


reasoning: The paragraph primarily describes the incident response plan, which answers what the cybersecurity program does, fitting Risk Management Process; it contains no specific facts (e.g., no domain terms, firm-specific details, or verifiable claims) that elevate specificity above generic boilerplate.


reasoning: The paragraph primarily answers how the board oversees cybersecurity risks, describing governance structure through the Board and Audit Committee, so Board Governance. It contains no specific facts (e.g., no domain terms showing expertise, no firm-specific details, no verifiable claims), making it generic boilerplate.


reasoning: The paragraph primarily addresses how the board oversees cybersecurity, fitting Board Governance, and contains no specific facts (e.g., no named individuals, dates, or verifiable claims), making it generic boilerplate with no elevated specificity.


reasoning: The paragraph primarily addresses board oversight of cybersecurity by describing the delegation to the Audit Committee and information flow, fitting Board Governance. It contains no specific facts—such as domain terminology, firm-specific details, or verifiable claims—so it remains generic boilerplate.


fact: vulnerability scanning

fact: misconfigurations

fact: cybersecurity questionnaire

fact: security controls in contracts

reasoning: The paragraph primarily addresses third-party cybersecurity risk management through vendor assessments, contractual controls, and monitoring, fitting Third-Party Risk; specificity is driven by domain-specific terms like 'vulnerability scanning' and 'cybersecurity questionnaire' that demonstrate cybersecurity expertise, but no firm-specific or verifiable facts are present.


reasoning: The paragraph primarily answers how the board oversees cybersecurity through the Audit Committee and full Board, fitting Board Governance. It contains no specific facts beyond generic governance terms, so specificity is Generic Boilerplate.


reasoning: The paragraph describes operational use of IT/OT systems without addressing cybersecurity governance, management, risks, or other substantive questions, so it is categorized as None/Other. No specific facts are present that demonstrate domain expertise, firm-specific details, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily serves as a forward-looking disclaimer with a cross-reference to Risk Factors, answering no substantive cybersecurity question (e.g., governance, management, processes, incidents, etc.), hence None/Other. It contains no specific facts that elevate specificity above Level 1, as it lacks domain terms, firm-specific details, or verifiable claims, making it Generic Boilerplate.


reasoning: The paragraph primarily answers how third-party cyber risks are managed, focusing on assessing and overseeing risks from vendors and service providers, which aligns with the Third-Party Risk category. It contains no specific facts (e.g., named roles, dates, or verifiable claims), so it is Generic Boilerplate.


reasoning: The paragraph primarily addresses how the company collaborates with third-party vendors on cybersecurity, which is the central topic of third-party risk management. No specific facts are present—language is generic and would be used by any enterprise risk management professional—so specificity is Level 1.


reasoning: The paragraph primarily addresses how cybersecurity insurance manages financial risk, aligning with Strategy Integration; it contains no specific facts, domain terms, or verifiable claims, making it generic boilerplate.


fact: over 20 years of experience in information security, risk management, and compliance

reasoning: The paragraph primarily answers how management is organized for cybersecurity, focusing on the DIT's role and qualifications, so it's Management Role; specificity is driven by the verifiable claim of 'over 20 years of experience,' which is a lower-bound fact that could be externally checked.


reasoning: The paragraph primarily describes the company's information security processes for identifying and managing cybersecurity risks, which aligns with Risk Management Process; it contains no specific facts, tools, or verifiable claims, making it generic boilerplate.


reasoning: The paragraph is a general statement of commitment to protecting IT assets without answering any specific cybersecurity question about governance, management, processes, or incidents, so it falls under None/Other. No specific facts are present, making it Generic Boilerplate.


reasoning: The paragraph primarily addresses the business and financial implications of cybersecurity risks, including materiality assessments and potential impacts, which aligns with Strategy Integration; it contains no specific facts such as domain terms, firm-specific details, or verifiable claims, making it generic boilerplate.


reasoning: The paragraph primarily answers how third-party cyber risks are managed through vendor assessments and breach notification requests, making it Third-Party Risk; no specific facts (e.g., named roles, quantified data, or verifiable claims) are present, so it is generic boilerplate.


fact: threat intelligence

reasoning: The paragraph primarily describes the governance chain from the Audit Committee to the Board and management for cybersecurity oversight, fitting Board Governance. It contains the domain-specific term 'threat intelligence,' which demonstrates cybersecurity expertise and elevates specificity to Domain-Adapted, as it passes the ERM test for domain terminology.


reasoning: The paragraph primarily answers how the board oversees cybersecurity through delegation to the Audit Committee, fitting Board Governance, and contains no specific facts (e.g., no named roles, dates, or verifiable claims), so it is generic boilerplate.


reasoning: The paragraph primarily answers what the cybersecurity program does by describing processes like assessments, aligning with Risk Management Process; it contains no specific facts (e.g., numbers, names, verifiable claims), so specificity is Generic Boilerplate.


reasoning: The paragraph primarily answers whether cybersecurity has materially affected the business through a negative assertion about no material incidents and immaterial expenses, which aligns with Strategy Integration per Rule 5. It contains no specific facts (e.g., domain terms, firm-specific details, or verifiable claims) that elevate specificity above generic boilerplate, as the language is standard and lacks any cybersecurity expertise or unique company details.


reasoning: The paragraph primarily answers how the board oversees cybersecurity through briefings and Audit Committee support, fitting Board Governance. It lacks any specific facts like verifiable claims, firm-unique details, or domain-specific terminology, making it Generic Boilerplate.


fact: ISO 27001 framework

fact: least-privilege principle

fact: phishing awareness exercises

fact: security-by-design principles

reasoning: The paragraph primarily answers what the cybersecurity program does by describing risk management processes like framework adoption, access control, and training, fitting Risk Management Process. Specificity is Level 2 due to domain-specific terms (e.g., ISO 27001, least-privilege) that demonstrate cybersecurity expertise beyond generic ERM language.


reasoning: The paragraph primarily answers how cybersecurity affects business finances through materiality conclusions, fitting Strategy Integration; it contains no domain terms, firm-specific details, or verifiable claims, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily describes the cybersecurity program's components (risk assessments, training, tools, incident response plan, monitoring), answering 'What does the cybersecurity program do?' for Risk Management Process; no specific facts are present, making it generic boilerplate with no elevated specificity.


reasoning: The paragraph primarily addresses how third-party cyber risks are managed through vendor assessments for data security, which is central to the Third-Party Risk category. No specific facts are present, such as named roles, quantified data, or verifiable claims, so it is classified as Generic Boilerplate.


fact: 28 years of experience in information technology

fact: Prior to joining NW Natural, Mr. Fellon served as Director of Information Technology at Puget Sound Energy in Bellevue, Washington from 2016 to September 2024

reasoning: The paragraph primarily addresses how management is organized for cybersecurity, detailing Brian Fellon's role, qualifications, and reporting line, which aligns with Management Role. Specificity is Level 4 due to the verifiable claim of 28 years of experience and specific prior employment details that can be externally confirmed.


reasoning: The paragraph primarily answers what the cybersecurity program does by describing policies, processes, incident response, and third-party assessments, which aligns with Risk Management Process. It contains no specific facts—such as domain terms, firm-specific details, or verifiable claims—so specificity is Generic Boilerplate.


reasoning: The paragraph primarily answers what happened in a cybersecurity incident by describing a real ransomware attack, its scope, impact, and remediation, fitting Incident Disclosure. It lacks any specific, verifiable facts such as dates, quantified impacts, or named entities, making it generic boilerplate with no facts elevating specificity above Level 1.


reasoning: The paragraph discusses general IT investments for business strategy and operations without mentioning cybersecurity, so it does not answer any of the six substantive cybersecurity questions and falls under None/Other. It contains no specific facts, dates, names, or verifiable claims, making it generic boilerplate with no elevated specificity.


reasoning: The paragraph primarily answers how the board oversees cybersecurity through the Audit Committee's interaction with management, which is a governance-chain structure defaulting to Board Governance. It contains no specific facts—such as domain terms, firm-unique details, or verifiable claims—elevating it above generic boilerplate language, as it uses standard risk management phrasing without demonstrating cybersecurity expertise or unique company information.


reasoning: The paragraph primarily answers how the board oversees cybersecurity through committee structures, fitting Board Governance; it contains no specific facts, domain terms, or verifiable claims, making it Generic Boilerplate.


reasoning: The paragraph is a general statement about the threat environment and does not answer any specific cybersecurity question related to governance, management, processes, incidents, or business impact, so it is classified as None/Other. No specific facts are present, such as domain terms, firm-specific details, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers what the cybersecurity program does by describing proactive measures to detect, investigate, and prevent incidents, aligning with Risk Management Process; however, it contains no specific facts that elevate specificity, as all language is generic risk disclosure without domain-specific terms or verifiable claims.


reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a materiality assessment (no material incidents in 2023), which fits Strategy Integration per Rule 5. It contains no specific facts, domain terminology, or verifiable claims, so specificity is Level 1 (Generic Boilerplate).


fact: The CISO and other members of the Security Governance Committee are selected from the Adviser's business groups.

fact: The CISO has over 20 years of cybersecurity and technology management experience.

reasoning: The paragraph primarily addresses management organization and roles, specifically the selection process for the CISO and committee members and the CISO's qualifications, fitting Management Role; specificity is Level 4 due to the verifiable claim of 'over 20 years of experience,' which is a hard lower bound that can be externally checked.


reasoning: The paragraph primarily answers whether cybersecurity has materially affected business outcomes through a negative assertion about past incidents, which falls under Strategy Integration per Rule 5. It contains no specific facts—no verifiable claims, firm-specific details, or domain terminology that passes the ERM test—so specificity is Generic Boilerplate.


reasoning: The paragraph primarily describes cybersecurity risk management procedures within enterprise risk management, answering what the cybersecurity program does, which aligns with Risk Management Process. It contains no specific facts, domain terminology, or verifiable claims, making it generic boilerplate with no elevated specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business through materiality assessments, fitting Strategy Integration; it contains no specific facts that elevate specificity beyond generic boilerplate, as it relies on negative assertions and disclaimers without verifiable details.


reasoning: The paragraph primarily answers the question of how cybersecurity affects the business by stating a backward-looking materiality conclusion, which aligns with Strategy Integration per Rule 5. It contains no specific facts—no domain terms that demonstrate expertise, no firm-specific details, and no verifiable claims—so specificity is Generic Boilerplate.


reasoning: The paragraph primarily addresses board oversight of cybersecurity risks and incidents through the Audit Committee, which is Board Governance. Specificity is Generic Boilerplate because it contains no verifiable claims, firm-specific details, or domain-expertise terms that pass the ERM test.


reasoning: The paragraph primarily answers how third-party cyber risks are managed through vendor review processes, fitting Third-Party Risk. It contains no specific facts, domain terms, or verifiable claims, as the language is generic and applicable to any vendor risk management, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers what the cybersecurity program does by describing the company's activity in monitoring legislative developments for compliance, which falls under Risk Management Process; it contains no specific facts such as domain terms, firm-specific details, or verifiable claims, making it generic boilerplate.


reasoning: The paragraph primarily addresses third-party risk management by describing engagement and oversight of an IT consultant for cybersecurity purposes, fitting the Third-Party Risk category. It contains no specific facts that elevate specificity above generic boilerplate, as it lacks quantified claims, named entities, or domain-specific terminology that demonstrates cybersecurity expertise beyond what an enterprise risk management professional would naturally use.


reasoning: The paragraph primarily answers how cybersecurity affects business through a materiality assessment (stating no incidents have had or are likely to have a material impact), fitting Strategy Integration; specificity is Level 1 because it contains no domain terms, firm-specific facts, or verifiable claims—only generic statements and a cross-reference.


fact: employee interactions with suspicious websites

fact: forensic investigation

reasoning: The paragraph primarily answers what happened in a cybersecurity incident, describing its nature, containment, and investigation, so it is classified as Incident Disclosure; for specificity, it contains domain terms like 'suspicious websites' and 'forensic investigation' that demonstrate cybersecurity expertise, elevating it to Level 2.


reasoning: The paragraph primarily addresses board oversight of cybersecurity, including committee assignment and information flow, which aligns with Board Governance. It contains no specific facts—such as named individuals, verifiable claims, or domain-specific terms—that would elevate specificity beyond generic boilerplate language.


reasoning: The paragraph is a forward-looking disclaimer and cross-reference to risk factors, which does not answer any substantive cybersecurity question and thus falls under None/Other. As per guidelines, None/Other paragraphs always receive Generic Boilerplate specificity, so no specific facts are listed.


reasoning: The paragraph is a forward-looking disclaimer and cross-reference to the Risk Factors section, with no specific cybersecurity facts, so it falls under None/Other and is Generic Boilerplate.


reasoning: The paragraph primarily describes a real cybersecurity incident involving unauthorized email access and fund diversion, answering 'what happened,' so it is classified as Incident Disclosure. It contains no specific facts such as verifiable dates, numbers, or named entities, and the language is generic incident reporting without domain expertise or firm-specific details, so specificity is Generic Boilerplate.


fact: identity management and access control safeguards

fact: encryption of data in transit and at rest

fact: system and network security and monitoring

fact: information protection and governance

fact: ongoing systems and equipment maintenance

reasoning: The paragraph primarily answers what the cybersecurity program does by listing specific protective measures, aligning with Risk Management Process. The domain-specific terms like encryption and access control demonstrate cybersecurity expertise, driving the Domain-Adapted specificity level.


fact: more than 20 years' experience in financial services

fact: Certified Information Systems Security Professional from ISC2 Organization

reasoning: The paragraph primarily answers how management is organized for cybersecurity by detailing the Director of IT's qualifications and responsibilities, fitting Management Role. Specificity is Level 4 due to verifiable facts like the lower-bound experience claim and named certification, which are externally checkable.


reasoning: The paragraph primarily answers how third-party cyber risks are managed through a TPRM program, making it Third-Party Risk; it contains no firm-specific or verifiable facts, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily answers how the board oversees cybersecurity through the governance chain (Board → Audit Committee → Management), which is Board Governance; it contains no domain-specific terms, firm-specific details, or verifiable claims, making it generic boilerplate.


fact: CISO has over 20 years of experience in information security

fact: CISO received CIO Executive Education Certificate from Stanford University

reasoning: The paragraph primarily addresses management organization and roles (CISO and steering committee), answering 'How is management organized to handle cybersecurity?'—thus Management Role. Specificity is Level 4 due to verifiable claims like 'over 20 years of experience' and a named certificate from Stanford, which external parties could confirm.


reasoning: The paragraph primarily answers how third-party cyber risks are managed through contractual obligations and processes, central to Third-Party Risk. It uses generic risk management language without domain-specific terms, firm-specific details, or verifiable claims, so specificity is Level 1.


reasoning: The paragraph primarily answers 'What does the cybersecurity program do?' by describing incident response activities, aligning with Risk Management Process. It contains no specific facts—only generic process descriptions—so specificity is Level 1.


reasoning: The paragraph is a cross-reference to another section with no substantive cybersecurity disclosure, answering none of the six key questions, and contains no specific facts, making it generic boilerplate.


reasoning: The paragraph primarily answers whether cybersecurity has affected business outcomes through a negative assertion ('have not experienced any material cybersecurity breaches'), which per Rule 5 is classified as Strategy Integration. It contains no specific facts that elevate specificity above Level 1, as it uses generic boilerplate language without domain terms, firm-specific details, or verifiable claims.


reasoning: The paragraph primarily describes the reporting topics in management briefings to the audit committee, which is part of cybersecurity risk management activities (e.g., policy updates, threat assessment), not governance structure or management roles. It contains no firm-specific or verifiable facts, only generic cybersecurity terms, so specificity is Level 1.


reasoning: The paragraph primarily answers how third-party cyber risks are managed, focusing on vendor oversight measures like attest reports and contractual safeguards, with no specific facts (e.g., named roles, dates, or verifiable claims) that elevate it above generic boilerplate language.


reasoning: The paragraph is a generic forward-looking statement about cybersecurity exposure and commitment, not answering any specific question like governance or processes, so None/Other; no specific facts, domain terms, or verifiable claims are present, making it Level 1 Generic Boilerplate.


reasoning: The paragraph primarily answers whether cybersecurity has materially affected the business, which aligns with Strategy Integration per the materiality rule; it contains no specific facts, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily addresses how third-party cyber risks are managed through vendor oversight and requirements, fitting the Third-Party Risk category; it contains no specific facts such as names, dates, numbers, or detailed processes, making it generic boilerplate with no elevated specificity.


reasoning: The paragraph primarily answers whether cybersecurity has affected business outcomes by stating no material incidents, which aligns with Strategy Integration per Rule 5. For specificity, it contains no verifiable or firm-specific facts, and the listed threat types (e.g., ransomware, phishing) are generic without demonstrating domain expertise, so it is Generic Boilerplate.


reasoning: The paragraph primarily answers how cybersecurity affects business outcomes by stating conclusions about past incidents not having material impact, fitting Strategy Integration. It contains no specific facts—no domain terms, firm-specific details, or verifiable claims—so specificity is Generic Boilerplate.


fact: Security threat intelligence system

fact: Vulnerability management tools

fact: Patch management standard

fact: Security Operations Center

fact: Event correlation

fact: Incident response capabilities

reasoning: The paragraph primarily describes cybersecurity program activities like threat intelligence and patch management, answering 'What does the cybersecurity program do?' for Risk Management Process. Specificity is Level 2 because it uses domain-specific terms (e.g., Security Operations Center, event correlation) that demonstrate cybersecurity expertise, but lacks firm-specific or verifiable facts.


reasoning: The paragraph primarily answers what the cybersecurity program does by listing key elements like risk assessments, security team responsibilities, and incident response plans, fitting Risk Management Process; it uses generic risk management language without specific cybersecurity domain terms or verifiable facts, so specificity is Generic Boilerplate.


fact: VP of IT has over 24 years of experience in IT and information security

fact: NVP of Finance and Cybersecurity Response Committee have over 50 years of collective experience managing enterprise risks

reasoning: The paragraph primarily answers how management is organized for cybersecurity by describing roles and qualifications, fitting Management Role; specificity is driven by verifiable claims of specific experience years (over 24 and over 50), which are hard numbers that could be externally checked.


reasoning: The paragraph primarily describes the cybersecurity program's activities—risk assessment, policies, protective measures, monitoring, and incident response—answering 'What does the cybersecurity program do?' for Risk Management Process. For specificity, it uses generic risk management language without any domain-specific terms, firm-unique facts, or verifiable claims, making it Generic Boilerplate.


reasoning: The paragraph primarily discusses the potential business impact of cybersecurity incidents and insurance coverage, which aligns with Strategy Integration; it contains no specific facts, domain terms, or verifiable claims, making it generic boilerplate.


reasoning: The paragraph primarily answers what the cybersecurity program does by describing periodic assessments and policy adjustments, fitting Risk Management Process; it contains no specific facts (e.g., domain terms, firm-specific details, or verifiable claims), so specificity is Generic Boilerplate.


reasoning: The paragraph primarily answers what the cybersecurity program does by describing procedures for mitigating internal risks and employee communication, fitting Risk Management Process. It contains no specific facts—such as domain terminology, firm-specific details, or verifiable claims—so specificity is Generic Boilerplate.


reasoning: The paragraph primarily answers how third-party cyber risks are managed, detailing processes for vendor oversight and assessments, which directly fits the Third-Party Risk category. For specificity, no domain terms, firm-specific facts, or verifiable claims are present; the language is generic and would be understood by non-security professionals, resulting in Level 1 boilerplate.


reasoning: The paragraph primarily answers the question of how cybersecurity affects the business by stating a backward-looking materiality assessment ('have to date not materially affected us'), which aligns with Strategy Integration per Rule 5. It contains no specific facts—no verifiable claims, firm-specific details, or domain terminology—so specificity is Level 1 (Generic Boilerplate).


reasoning: The paragraph primarily answers how the board is updated on cyber matters, focusing on governance structure and reporting flows, which aligns with Board Governance. For specificity, it uses generic risk management language without domain-specific terms or verifiable facts, resulting in Generic Boilerplate.


reasoning: The paragraph primarily answers how management is organized to handle cybersecurity by describing management-level committees, reporting lines, and roles (e.g., CIO and Head of Operational Risk), which aligns with Management Role; specificity is Generic Boilerplate because no domain terms, firm-specific facts, or verifiable claims are present—all language is generic about committees and reporting.


reasoning: The paragraph primarily answers what the cybersecurity program does by describing implemented measures and policies, aligning with Risk Management Process; it contains no specific facts that elevate specificity, as it uses generic language common in enterprise risk management without domain-specific details or verifiable claims.


reasoning: The paragraph primarily answers what the cybersecurity program does by describing the Incident Response Plan's framework, coordination, and annual evaluation, aligning with Risk Management Process. It contains no specific facts that elevate specificity above Level 1, as terms like 'Incident Response Plan' and 'Chief Operations Officer' are generic and not distinguishing or verifiable.


fact: information security organization

fact: technical threats

fact: information technology security infrastructure

fact: patching and vulnerability management

fact: cybersecurity incidents

fact: annual cybersecurity tabletop exercise

fact: incident preparedness

fact: supplier management

fact: security awareness training

fact: cybersecurity personnel/staffing

fact: cybersecurity threat assessment

reasoning: The paragraph primarily answers how the board oversees cybersecurity through management reports and briefings, fitting Board Governance; specificity is driven by multiple domain-specific cybersecurity terms (e.g., patching, tabletop exercise) that demonstrate expertise beyond generic risk management, elevating it to Level 2.


fact: Randy Jepsen has over 25 years of experience in the IT industry (verifiable lower bound)

fact: Randy Jepsen has 19 years of tenure at Smith Douglas and The SMART Builder Solutions

fact: Russell Devendorf previously oversaw IT and risk management of a publicly traded homebuilder from 2008 to 2017

reasoning: The paragraph primarily answers how management is organized for cybersecurity, detailing roles, responsibilities, and qualifications, which aligns with Management Role; specificity is driven by verifiable facts like specific experience years and timeframes, elevating it to Quantified-Verifiable.


fact: Members hold CISSP certification

fact: Members hold CCNP certification

fact: Members hold CISA certification

fact: Members hold CySA+ certification

reasoning: The paragraph primarily answers how management is organized for cybersecurity by detailing the team's qualifications and certifications, fitting Management Role; specificity is Level 4 because the named certifications (e.g., CISSP) are externally verifiable claims.


fact: encryption

fact: data loss prevention technology

fact: authentication technology

fact: entitlement management

fact: access control

fact: anti-virus and anti-malware software

fact: transmission of data over private networks

fact: National Institute of Standards and Technology Cybersecurity Framework

reasoning: The paragraph primarily describes the cybersecurity program's tools, technologies, and framework adoption, answering 'what the program does' for Risk Management Process; specificity is Domain-Adapted because it uses cybersecurity-specific terms like encryption and NIST CSF that demonstrate domain expertise beyond generic risk management language.


fact: Security incident in January 2023

reasoning: The paragraph primarily describes a real cybersecurity incident (January 2023 event), fitting Incident Disclosure; the specific date 'January 2023' is an externally verifiable fact, driving specificity to Quantified-Verifiable.


reasoning: The paragraph primarily answers how third-party cyber risks are managed through vendor assessments and audits, central to Third-Party Risk. Specificity is driven by the firm-specific mention of 'Information Technology Automated Solutions (ITAS)', a named internal department that distinguishes Alcoa's cybersecurity structure.


fact: Senior Director of Information Technology

fact: over 25 years of work experience

reasoning: The paragraph primarily answers 'How is management organized to handle cybersecurity?' by describing specific management roles and their qualifications, fitting Management Role. Specificity is Level 4 due to the verifiable claim of 'over 25 years of work experience,' which is a quantified lower bound that can be externally checked.


fact: Over 15 years' experience in the information technology and cybersecurity field

fact: Over 15 years' experience in auditing information security

fact: BA in math and computer science from Ohio Wesleyan University

fact: Holds an Information Systems Auditor certification

fact: Completed a CISO Academy Workshop

reasoning: The paragraph primarily answers how management is organized for cybersecurity by detailing the Senior Director's qualifications and experience, fitting Management Role; specificity is Level 4 due to multiple verifiable claims like specific years of experience, education, and certifications that external parties could confirm.


fact: Director of IT Infrastructure and Security has over 30 years of experience

fact: Director maintains GIAC Security Essentials certification

fact: Director maintains GIAC Certified Enterprise Defender certification

fact: Director maintains GIAC Certified Incident Handler certification

fact: Director maintains GIAC Certified Windows Security Administrator certification

fact: Director maintains GIAC Critical Controls Certification

fact: Director reports to Vice President of Information Technology

fact: Vice President of Information Technology has over 19 years of experience

fact: Vice President of Information Technology holds Certified Information Systems Security Professional (CISSP) certification

reasoning: The paragraph primarily answers how management is organized for cybersecurity, detailing leadership roles, qualifications, and reporting lines, so it is classified as Management Role; specificity is Level 4 due to multiple verifiable facts such as specific years of experience and named certifications that an external party could confirm.


fact: ransomware attack

fact: forensic analysis

fact: persistence mechanisms

specificity_confidence: medium

reasoning: The paragraph primarily describes a real ransomware incident, answering what happened, so Incident Disclosure. It contains domain-specific cybersecurity terms like 'ransomware' and 'forensic analysis,' which demonstrate expertise beyond generic risk management, hence Level 2 specificity.


reasoning: The paragraph primarily addresses board oversight of cybersecurity through the Audit Committee's role, fitting Board Governance; it contains no specific facts that elevate specificity above generic boilerplate, as mentions like 'Chief Innovation Officer' are not quantified or uniquely verifiable in a cybersecurity context.


reasoning: The paragraph primarily answers what the cybersecurity program does by describing insider threat controls and processes, fitting Risk Management Process. It contains no specific facts such as named tools, roles, dates, or verifiable claims, so specificity is Generic Boilerplate.


fact: endpoint protection

fact: remote access protocols

fact: enhanced encryption

fact: two-factor authentication (2FA)

fact: real-time threat monitoring

fact: formal policy for employees accessing corporate systems from personal devices (BYOD policy)

reasoning: The paragraph answers 'what the cybersecurity program does' by describing specific measures like endpoint protection and 2FA, fitting Risk Management Process; specificity is Domain-Adapted because it uses cybersecurity-specific terms that demonstrate expertise beyond generic risk management language.


fact: CISO has 27 years of cybersecurity experience

fact: 17 years of experience in the oil and gas industry

fact: One of less than 400 CISOs globally that has graduated from the FBI's CISO Academy

reasoning: The paragraph primarily addresses management organization and roles, including qualifications and reporting lines, fitting Management Role; specificity is Level 4 due to verifiable facts like the CISO's specific years of experience and FBI Academy graduation, which external parties could confirm.


fact: Global Director of IT has over 30 years of experience in various information technology roles

fact: Global Director of IT has over 20 years of experience as an IT Director

fact: CFO has over 10 years of experience in risk management at the Company and at similar companies

reasoning: The paragraph primarily answers how management is organized for cybersecurity, detailing roles and qualifications, so it is Management Role. Specificity is Level 4 due to verifiable experience claims like 'over 30 years' and 'over 10 years', which are hard numbers that can be externally checked.


reasoning: The paragraph primarily answers how the board oversees cybersecurity, describing the Audit Committee's oversight and the Cybersecurity Sub-Committee's role in incidents, which fits Board Governance. It contains no specific facts, dates, numbers, or verifiable claims, so it is Generic Boilerplate.


reasoning: The paragraph primarily answers how third-party cyber risks are managed through supplier oversight, which is central to Third-Party Risk. It contains no specific facts, dates, numbers, or verifiable claims, so specificity is Generic Boilerplate.


fact: engage third-party firms to conduct routine external and internal penetration testing

fact: developed processes to remediate identified vulnerabilities across a wide range of severities

fact: policies and procedures to oversee and identify cybersecurity risks associated with third-party service providers

fact: onboarding risk assessments prior to engagement

fact: maintain cybersecurity insurance coverage

reasoning: The paragraph primarily answers what the cybersecurity program does, describing activities like penetration testing, vulnerability remediation, and third-party risk policies, which align with Risk Management Process; specificity is Level 2 due to domain-specific terms such as penetration testing and vulnerability remediation that demonstrate cybersecurity expertise beyond generic risk management language.


fact: CDO and CISO roles

fact: Over 25 years of collective prior work experience

fact: ISACA Certified Information Security Manager (CISM) certification

fact: ISC2 Certified Information Systems Security Professional (CISSP) certification

reasoning: The paragraph primarily addresses how management is organized for cybersecurity, focusing on the CDO and CISO roles, their experience, and qualifications, fitting Management Role; specificity is driven by verifiable facts such as specific certifications and a quantified experience claim, which are externally checkable.


fact: CISO

fact: FedEx Executive Committee

fact: DTRC

fact: CyTOC

reasoning: The paragraph primarily answers how the board oversees cybersecurity through governance-chain elements like the Executive Committee and Board involvement in incident response, making Board Governance the best fit; specificity is driven by firm-specific facts such as named roles (CISO) and entities (FedEx Executive Committee, DTRC, CyTOC).


fact: Uses Ontrack software solution for risk monitoring and cybersecurity incident tracking

reasoning: The paragraph primarily describes the cybersecurity program's activities in risk monitoring and incident tracking using a specific tool, fitting Risk Management Process; the named software 'Ontrack' is an externally verifiable claim, elevating specificity to Level 4.


fact: cyber maturity assessment

fact: incident response managed services

fact: comprehensive cybersecurity assessment

fact: firewall maintenance initiatives

reasoning: The paragraph primarily answers how third-party cyber risks are managed through engagement and oversight of external providers, making Third-Party Risk the central topic. Specificity is Level 2 because it uses cybersecurity domain terms like 'incident response' and 'firewall maintenance' that demonstrate expertise beyond generic risk management language, passing the ERM test.


reasoning: The paragraph primarily answers how the board oversees cybersecurity, describing oversight structure and reviews with management, which aligns with Board Governance. It contains no specific facts that elevate specificity above Level 1, as it uses generic governance language without verifiable claims, firm-specific details, or domain-adapted terminology that passes the ERM test.


fact: In July 2018

fact: ransomware incident

fact: Dx information technology systems

reasoning: The paragraph primarily answers what happened in a cybersecurity incident by describing a specific ransomware event in July 2018, making it Incident Disclosure; the verifiable date 'July 2018' elevates specificity to Quantified-Verifiable.


reasoning: The paragraph primarily answers how the board oversees cybersecurity, detailing the Board's role, Audit Committee responsibilities, and reporting flows, which aligns with Board Governance. For specificity, it contains no verifiable or firm-specific facts (e.g., no named individuals, dates, or quantified claims), and the language is standard governance boilerplate without domain expertise terms, resulting in Generic Boilerplate.


fact: Head of Resources Management is also a member of the Board of Directors

fact: Head of Resources Management has more than 20 years directly assessing and managing cyber information technology and human resources systems

fact: CCO has more than 15 years managing information technology systems and databases

fact: CCO has 15-plus years supporting the Adviser's and Administrator's resource management department

reasoning: The paragraph primarily answers how management is organized to handle cybersecurity, focusing on specific roles and qualifications, so it is Management Role; specificity is Level 4 due to verifiable experience claims like 'more than 20 years' that can be externally checked against resumes or records.


reasoning: The paragraph primarily answers how third-party cyber risks are managed by discussing reliance on the hotel manager and franchisors for cybersecurity risk and mention of insurance, fitting Third-Party Risk. For specificity, it contains no facts that elevate above Level 1; 'Our Town' is a named third-party but not a cybersecurity-specific fact distinguishing the company's posture, and 'cybersecurity insurance' is generic risk management language that fails the ERM test for domain expertise.


fact: SOC

fact: SIEM

reasoning: The paragraph primarily answers what the cybersecurity program does by describing specific tools (SOC and SIEM) for monitoring and response, fitting Risk Management Process. For specificity, it uses domain-specific terms like SOC and SIEM that demonstrate cybersecurity expertise, elevating it to Level 2 as these concepts require domain knowledge beyond generic risk management.


reasoning: The paragraph primarily answers how management is organized to handle cybersecurity by stating the COO's oversight role, and it contains no specific facts (e.g., domain terms, firm-specific details, or verifiable claims) that elevate specificity above generic boilerplate.


reasoning: The paragraph primarily addresses how third-party cyber risks are managed through a Vendor Management Program, due diligence, and committee review, directly answering the Third-Party Risk question. It contains no firm-specific or verifiable facts, and the language is generic boilerplate applicable to any company's vendor risk management, so specificity is Level 1.


reasoning: The paragraph primarily addresses how Unisys manages third-party cyber risks through its TPRM program, due diligence, and monitoring, making Third-Party Risk the clear category. For specificity, it lacks any firm-specific or verifiable details—such as named leadership, quantified metrics, or domain-specific practices beyond generic descriptions—so it is considered generic boilerplate.


fact: security questionnaires

fact: vulnerability scans

reasoning: The paragraph primarily answers how the company manages cybersecurity risks from third-party providers through vendor assessments and contractual obligations, which is central to Third-Party Risk; specificity is Level 2 because it includes domain-specific terms like 'vulnerability scans' and 'security questionnaires' that demonstrate cybersecurity expertise beyond generic risk management language.


reasoning: The paragraph primarily answers how the board oversees cybersecurity through delegation to the Technology Committee, which is a governance-chain description fitting Board Governance. It contains no specific facts (e.g., no verifiable claims, firm-specific details, or domain expertise terms), so specificity is Generic Boilerplate.


fact: resumed over the course of nine days

fact: lost revenue of approximately $80 million to $85 million

fact: operating earnings of $35 million to $40 million

reasoning: The paragraph primarily describes a specific cybersecurity incident with timeline, response actions, and financial impact, fitting Incident Disclosure; specificity is Level 4 due to multiple verifiable facts like specific dates, duration, and quantified financial estimates.


fact: ransomware actors

fact: exfiltrated personal information

reasoning: The paragraph describes an actual incident investigation and response, directly answering what happened, so it's Incident Disclosure. It contains domain-specific cybersecurity terms like 'ransomware' and 'exfiltrated,' which demonstrate expertise beyond generic risk management, leading to Domain-Adapted specificity.


fact: ransomware attacks

fact: phishing attacks

fact: insider threats

fact: third-party attacks

fact: computer viruses

fact: malicious codes

fact: unauthorized access attempts

reasoning: The paragraph primarily answers what the cybersecurity program does by describing risk monitoring, strategy adjustment, and disaster recovery processes, aligning with Risk Management Process; specificity is driven by domain-specific terms like ransomware and phishing that demonstrate cybersecurity expertise, passing the ERM test for Level 2.


fact: Head of Information Technology for Latin America

fact: 25 years of experience

reasoning: The paragraph primarily answers how management is organized for cybersecurity by describing a leadership role and qualifications, fitting Management Role; the '25 years of experience' is a verifiable hard fact, driving specificity to Level 4.


fact: February 22, 2024 disclosure date

reasoning: The paragraph primarily describes a specific cybersecurity incident with a verifiable disclosure date, fitting Incident Disclosure; the date is an externally verifiable fact, driving Level 4 specificity.


reasoning: The paragraph primarily describes board-level oversight of cybersecurity risks through the Risk Management Committee, answering 'How does the board oversee cybersecurity?' which aligns with Board Governance. It contains no specific facts—such as verifiable claims, firm-specific details, or domain expertise vocabulary—that would elevate specificity above generic boilerplate.


fact: CISO has over 30 years of industry experience

fact: CISO joined Visa in November 2015

fact: President of Technology joined Visa in November 2013

fact: President of Technology has over 30 years of experience

reasoning: The paragraph primarily answers how management is organized for cybersecurity by describing the CISO and President of Technology's roles and experiences, fitting Management Role; specificity is driven by verifiable facts like specific dates and quantified experience levels, elevating it to Level 4.


fact: Vice President of Cybersecurity

reasoning: The paragraph primarily addresses board oversight of cybersecurity, fitting Board Governance by describing the Board and Audit Committee's roles. Specificity is driven by the firm-specific mention of 'Vice President of Cybersecurity,' which distinguishes this company's cybersecurity leadership structure.


reasoning: The paragraph primarily describes the board's delegation of cybersecurity oversight to the Audit Committee and reporting lines, directly answering the Board Governance question; it contains no specific facts that elevate above generic boilerplate language, as it uses common governance terms without domain-specific details or verifiable claims.


fact: Incident occurred in March 2021

fact: Incurred $2.4 million in incremental one-time costs for year ended December 31, 2021

reasoning: The paragraph primarily answers what happened in a specific cybersecurity incident (real event in March 2021 with response and impact), fitting Incident Disclosure; specificity is Quantified-Verifiable due to the hard, verifiable fact of $2.4 million in costs.


fact: IASME Cyber Essentials framework

fact: approved by UK government NCSC

fact: ISO 27001 framework

fact: NIST framework

reasoning: The paragraph primarily answers what the cybersecurity program does by describing annual assessments and framework adoption, fitting Risk Management Process; it uses specific cybersecurity frameworks (IASME, ISO 27001, NIST) that demonstrate domain expertise, but lacks firm-specific or verifiable facts, so specificity is Domain-Adapted.


fact: ransomware

fact: denial-of-service

fact: persistent threats

fact: nation-state actors

reasoning: The paragraph primarily addresses the importance of cybersecurity and speculative business impact, which Rule 5 classifies as not Strategy Integration due to common speculative language, and it lacks specific governance, management, process, or incident details, fitting None/Other; for specificity, it uses domain-specific cybersecurity terms like ransomware and nation-state actors that demonstrate expertise beyond generic risk management, elevating it to Level 2.


fact: Company's CCO role

fact: dedicated monitoring platform with real-time threat detection

reasoning: The paragraph primarily answers how management is organized to handle cybersecurity, focusing on responsibilities, the CCO role, and information flows, which aligns with Management Role. Specificity is Firm-Specific because the CCO role is a cybersecurity leadership title that distinguishes this company's management structure, and the domain term 'real-time threat detection' supports higher specificity but the CCO role drives the level.


reasoning: The paragraph primarily answers how the board oversees cybersecurity through a governance chain (Board → ERM Committee → Audit Committee), fitting Board Governance; for specificity, it contains no firm-specific or verifiable facts, using generic risk management language that any enterprise risk professional could write, thus Level 1.


fact: penetration testing

fact: constant managed detection and response services

fact: intrusion prevention and detection applications

reasoning: The paragraph primarily addresses how third-party cyber risks are managed through vendor oversight and engagements with cybersecurity experts, fitting the Third-Party Risk category. Specificity is Domain-Adapted due to domain-specific terms like penetration testing and managed detection and response, which demonstrate cybersecurity expertise beyond generic risk management language.


fact: CISO has served in the role since 2015

fact: CISO role

fact: domain terms: application security, intrusion detection, penetration testing, complex threat modeling, unconventional cyber-attack vectors

fact: RCOC committee

reasoning: The paragraph primarily answers how management is organized for cybersecurity, focusing on the CISO's role, qualifications, and team oversight, which aligns with Management Role. It contains a verifiable fact about the CISO's tenure since 2015, elevating specificity to Quantified-Verifiable.


reasoning: The paragraph primarily addresses reliance on third-party cybersecurity protections and management's consideration of vendor safeguards, fitting Third-Party Risk. It contains no specific facts that elevate specificity above generic boilerplate, as it uses common risk management language without domain expertise, firm-specific details, or verifiable claims.


fact: October 28, 2023 announcement date of cybersecurity incident

fact: mid-December 2023 timeline for facilities returning to operational status

fact: $1.5 million expenses incurred related to the incident in Q1 fiscal 2024

reasoning: The paragraph primarily answers 'What happened in a cybersecurity incident?' by describing a real event with specific dates, impact, and remediation, making it Incident Disclosure; specificity is driven by multiple verifiable facts like exact dates and a quantified expense, elevating it to Level 4.


fact: We have experienced attempts to compromise our systems and/or data

fact: Attempts included phishing attacks, malware infections, and unauthorized access attempts

reasoning: The paragraph primarily answers how cybersecurity affects business through a materiality assessment (stating attempts would not have material adverse effects), fitting Strategy Integration; specificity is driven by firm-specific facts about past attempts and domain terms like phishing and malware, elevating it to Firm-Specific level.


fact: has served in this role for over four years

fact: has more than 25 years of experience in the aggregate

fact: including more than ten years with the Company

reasoning: The paragraph primarily describes the audit committee's oversight and management's reporting structure, which is a governance-chain focus, so Board Governance. Specificity is Level 4 due to verifiable claims about the SVP's tenure and experience, which are quantified lower bounds that could be externally checked.


fact: John Bresney holds a Master's Certificate in Project Management

fact: John Bresney holds a Columbia University CIO Program Certificate

fact: Robert McKenna is a Certified Insurance Counselor

fact: Christopher Cunniff is a fellow of the Casualty Actuarial Society

fact: Christopher Cunniff is a member of the American Academy of Actuaries

reasoning: The paragraph primarily describes management roles, responsibilities, and qualifications for cybersecurity, fitting Management Role; specificity is Level 4 due to multiple verifiable credentials and certifications that can be independently confirmed.


reasoning: The paragraph primarily answers how management is organized for cybersecurity, focusing on the CIO's coordination with other executives and reporting lines, which aligns with Management Role. It contains no specific facts that elevate specificity above generic boilerplate, as it lacks domain-specific terminology, firm-unique details, or verifiable claims.


fact: On July 10, 2024, we detected unauthorized occurrences

fact: the threat actor was ejected from our IT systems on July 10, 2024

reasoning: The paragraph primarily answers what happened in a specific cybersecurity incident, with dates and actions, making it Incident Disclosure. The specificity is Quantified-Verifiable due to the concrete date of July 10, 2024, which is an externally verifiable fact that elevates it above generic descriptions.


reasoning: The paragraph primarily answers how the board oversees cybersecurity by describing its responsibilities for reviewing controls and receiving updates, which falls under Board Governance. It contains no specific facts—such as verifiable claims, firm-unique details, or domain-specific terminology—so its specificity is Generic Boilerplate.


fact: compliance with applicable data protection laws

fact: implementation of administrative, physical, and technical safeguards

fact: cybersecurity insurance

fact: mandatory incident reporting protocols

reasoning: The paragraph primarily addresses third-party risk management by detailing vendor security requirements and contractual obligations, fitting the Third-Party Risk category. Specificity is driven by domain-specific terms like 'administrative, physical, and technical safeguards' and 'cybersecurity insurance,' which demonstrate cybersecurity expertise beyond generic risk language.


fact: 26 BTC transferred to threat actor's wallet

fact: Value of approximately $560,000 at the time

fact: Gryphon engaged with US Federal law enforcement for recovery

fact: Incident occurred in 2023

reasoning: The paragraph primarily answers what happened in a cybersecurity incident by describing a specific event with details on scope, timing, and response, so it is classified as Incident Disclosure; the specificity is Quantified-Verifiable due to verifiable facts like the exact amount of BTC transferred and engagement with named law enforcement.


fact: Obtained second ISO 27001 certification

reasoning: The paragraph primarily describes cybersecurity program activities like controls review, testing, and training, which answers 'What does the cybersecurity program do?' for Risk Management Process; specificity is driven by the verifiable claim of obtaining ISO 27001 certification, which is externally confirmable.


fact: over 30 years of experience in information technology and information security

fact: Certified Information Systems Security Professional (CISSP)

reasoning: The paragraph primarily addresses the management role by describing the Director of Information Security's qualifications, responsibilities, and reporting structure, which answers how management is organized for cybersecurity. Specificity is Level 4 due to verifiable claims like 'over 30 years of experience' (a lower bound that can be checked) and 'CISSP certification' (externally verifiable via (ISC)² registry).


reasoning: The paragraph primarily describes incident response actions (offering identity protection services and engagement with law enforcement), which aligns with Risk Management Process under incident response activities. No specific facts are present that elevate specificity above Level 1, as the content uses general terms without firm-specific details, domain expertise, or verifiable claims.


fact: forensic investigation completed on December 13, 2023

fact: last confirmed unauthorized activity on November 20, 2023

reasoning: The paragraph primarily answers what happened in a cybersecurity incident by describing unauthorized access, malware deployment, and specific dates, fitting Incident Disclosure; specificity is Level 4 due to verifiable dates that an external party could confirm.


reasoning: The paragraph primarily addresses how cybersecurity affects the business, mentioning material adverse effects on operations and resource expenditure, which aligns with Strategy Integration. It contains no specific facts that elevate specificity above generic boilerplate, as it lacks verifiable claims, firm-specific details, or domain expertise beyond common threat terminology.