content_category: Risk Management Process

category_confidence: medium

specificity_confidence: medium

reasoning: The paragraph's primary and majority focus is on the company's internal cybersecurity risk management activities — application design, backup systems, monitoring, detection, anti-malware, training, and audits — with the management role and reporting chain appearing only in the final two sentences as supporting governance context, making Risk Management Process the best fit. The 'Head of IT department' is a named IT leadership role analogous to VP of IT/Security and qualifies as a firm-specific fact, elevating specificity to Firm-Specific; however, no second hard verifiable fact (date, dollar amount, headcount, named firm) exists to reach Quantified-Verifiable.

provider: anthropic


content_category: Board Governance

category_confidence: high

reasoning: The grammatical subject throughout is the Audit and Risk Committee performing board-level oversight of cybersecurity risk, placing this squarely in Board Governance. On specificity, the committee's full name 'Audit and Risk Committee' is not a generic 'Audit Committee' — the codebook explicitly excludes plain 'Audit Committee' as standard but includes 'Risk Committee' and 'ERM Committee' as firm-specific named committees; this combined name with the 'Risk' component constitutes one qualifying firm-specific fact, making Annotator C's Firm-Specific determination correct, while there are no second hard verifiable facts (no dates, dollar amounts, headcounts, or named third-party firms) to reach Quantified-Verifiable.


specificity_confidence: high

reasoning: The paragraph's opening sentence establishes board oversight as the central topic, and the subsequent sentences describe management's reporting mechanism as the means by which that oversight is exercised — the board is the grammatical and conceptual subject. All elements (periodic presentations, 'when material' updates, generic 'management', 'board of directors') appear on the ✗ NOT list, leaving no qualifying specific facts.


reasoning: The paragraph describes the company's own internal incident response structure, escalation tiers, and communication planning — squarely Risk Management Process with no actual incident, board, management, or vendor elements as the central topic. The two distinctly named internal teams (CIRT with its formal acronym, and the Cyber Security Watch Team) are analogous to the codebook's 'Named non-generic committees' and 'Named internal programs with unique identifiers' examples, making this Firm-Specific; however, there are no hard verifiable facts (dates, dollar amounts, headcounts, named third-party firms) that would elevate it to Quantified-Verifiable, so Annotator A's Generic Boilerplate label understates the specificity while Annotators B and C correctly identify Firm-Specific.


reasoning: The paragraph describes Garmin's own internal cybersecurity risk management program—how risks are assessed, identified, and managed, and how it integrates with internal teams—making Risk Management Process the clear category with no ambiguity. Specificity is Sector-Adapted because the only qualifying fact is the named NIST Cybersecurity Framework; the third-party providers are unnamed, the internal teams described ('product development and technology management teams') are too generic to meet the ✓ IS threshold for firm-specific team compositions, and no CISO or other cybersecurity-specific title is mentioned, so Annotator C's Firm-Specific rating is not supported by the codebook.


reasoning: The paragraph describes Cheniere's internal cybersecurity risk management activities—assessments, audits, cross-functional exercises, penetration testing, and training—making Risk Management Process the clear category, with third-party involvement as a supporting component. On specificity, Annotator C's Firm-Specific rating is not warranted: 'Cyber Incident Response Plan' lacks a unique identifier (e.g., a parenthetical acronym or distinctive proprietary name) that would distinguish it from the ✗ NOT list entry of 'incident response plan,' and every other element in the paragraph (penetration tests, compromise assessments, annual training, security maturity assessments) appears explicitly on the ✗ NOT list as common practices or generic cadences, leaving no qualifying ✓ IS facts.


reasoning: The paragraph describes the company's own internal ERM program and how cybersecurity risks are integrated into it, clearly placing it in Risk Management Process; board reporting appears only as one bullet-point objective, not the main focus. Applying the decision test: there are no hard verifiable facts (no dates, dollar amounts, headcounts, named third-party firms, or named tools), no ✓ IS facts (the 'ERM program' is a generic program name with no unique identifier, 'Atleos' is the company's own name which is explicitly excluded, and 'Board of Directors' and 'executive leadership' are on the ✗ NOT list), and no named recognized standards — making this Generic Boilerplate that could be inserted unchanged into any large company's filing by substituting the company name.


content_category: Management Role

reasoning: The paragraph's grammatical subject throughout is the CDIO — a specific named management role (equivalent to CIO, which appears on the IS list) — and it describes qualifications, reporting scope, prior title, and tenure, all squarely fitting Management Role. Specificity is Firm-Specific rather than Quantified-Verifiable: only one hard verifiable fact exists (January 2022, a specific date), as 'over 20 years' is an approximate/vague quantifier that does not meet the hard-fact threshold, and named roles per the codebook explicitly do not count toward the QV threshold — so Annotator C's Level 4 rating is not supported.


reasoning: Although the grammatical subject is 'Management,' the entire substance of the sentence is about the Audit Committee receiving cybersecurity briefings — this is the briefing-cadence disclosure that defines Board Governance. Per the tiebreaker, when board oversight is the main focus (even with management as the actor), Board Governance is the correct category. Both 'Management' and 'Audit Committee' appear on the ✗ NOT list, leaving no qualifying specific facts and making this Generic Boilerplate.


reasoning: The paragraph opens with the CIO as the grammatical subject and continuously returns to the CISO's oversight, qualifications, and team activities, making Management Role the dominant framing per the codebook's 'assign when a management role is the grammatical subject' rule; the described processes are subordinate to characterizing what these roles do. Specificity is Firm-Specific rather than Quantified-Verifiable because only one hard verifiable fact exists (38 years, a specific number), while named roles (CIO, CISO) and the 24/7 SOC are Firm-Specific qualifiers but explicitly excluded from the two-fact QV threshold per the codebook.


reasoning: The paragraph's primary subject and thrust is the audit committee and Board of Directors overseeing the cybersecurity program and receiving reports — the incident escalation chain (ISO → executives → audit committee) is presented as part of that board-level oversight structure, consistent with the tiebreaker 'management mentioned briefly + board oversight as main focus → Board Governance.' The ISO and CISO are cybersecurity-specific titles qualifying as firm-specific facts, but no hard verifiable facts (dates, dollar amounts, named third-party firms) exist to reach Quantified-Verifiable.


content_category: Third-Party Risk

reasoning: The paragraph is entirely focused on the company's vendor qualification and oversight processes—pre-engagement review, tier-level determination, and due diligence on critical vendors—making Third-Party Risk clearly the correct category. Although 'Risk Dependency Assessment' and 'Critical Vendors' are capitalized, they are common TPRM industry terminology (not unique named programs with firm-specific identifiers), and no named firms, dates, dollar amounts, or frameworks appear; after applying the validation step, no qualifying specific facts survive, so Generic Boilerplate is the correct level.


reasoning: Although 'Management' is the grammatical subject, the Management Role category requires content about specific role identification, qualifications, or reporting lines (CISO/CTO/CIO). This paragraph describes the activities management performs — assessing, monitoring, mitigating, and maintaining cybersecurity programs — which is the substance of Risk Management Process. Annotator C's reading is too literal; the codebook's tiebreaker 'assign when a management role is the grammatical subject' is meant to resolve ambiguity between Management Role and Board Governance, not to reclassify procedural content whenever 'management' appears as the subject.


reasoning: The paragraph's central topic is vendor/supplier oversight — due diligence, monitoring, and recertification of third-party cybersecurity controls — which squarely fits Third-Party Risk. The named 'Third-Party Risk Management Program' follows the exact same descriptive naming pattern the codebook explicitly excludes (e.g., 'incident response plan,' 'cybersecurity program') and carries no unique internal identifier like an acronym; any financial institution could call its vendor oversight program a 'Third-Party Risk Management Program,' so after filtering no qualifying specific facts remain, yielding Generic Boilerplate.


reasoning: The paragraph describes the company's own internal cybersecurity oversight, risk-informed decision-making process, and employee training programs — all squarely within Risk Management Process. No named cybersecurity-specific roles (CISO, CIO, etc.), named frameworks, named tools, named third-party firms, specific dates, or verifiable numbers are present; 'Software Engineer' and 'IT Team' do not appear on the ✓ IS list, and phishing/secure data handling training is explicitly excluded as generic practice, making the entire paragraph Generic Boilerplate.


reasoning: The paragraph centers on a named management role (CIO Jovan Kangrga), his credentials, and his reporting lines, making Management Role the clear category. The paragraph contains at least two independently verifiable quantified facts — 'over 13 years of total experience' and 'over 40 years of combined team experience' — consistent with the calibration example treating years-of-experience figures as hard quantified facts (cf. 'The CISO has 17 years of experience'), which pushes this to Quantified-Verifiable over Annotators B and C's Firm-Specific assessment.


reasoning: The paragraph describes the company's internal risk assessment and IT stratification process centered on the MLPS framework, with third-party involvement as one component rather than the central topic, making Risk Management Process the clear category. Specificity is Sector-Adapted because MLPS is a recognized named standard, but after filtering the ✗ NOT list, no firm-unique facts remain: 'JiuGe Technology' is a company self-reference, 'CFO' is explicitly excluded as generic C-suite, 'third party' is unnamed, and 'IT Manager' does not appear among the codebook's cybersecurity-specific titles (CISO, CTO, CIO, VP of IT/Security, etc.), making it too generic to elevate to Firm-Specific.


reasoning: The paragraph's grammatical subject throughout is the Senior Operations Officer executive, describing her qualifications, tenure, and cybersecurity oversight responsibilities — a clear Management Role disclosure. Two specific numeric durations (35 years total experience and 24 years in role) qualify as exact durations per the IS list and are analogous to the calibration example ('17 years of experience' treated as a hard verifiable fact), giving us two hard facts that push the paragraph to Quantified-Verifiable over Firm-Specific; Annotator B's Firm-Specific rating underweights the two distinct quantified durations.


reasoning: The paragraph's grammatical subject throughout is the VP of IT and their qualifications, supporting team, and responsibilities, squarely fitting the Management Role category. Specificity is Firm-Specific rather than Quantified-Verifiable: the named frameworks (NIST, CIS, ISO 27001) do not count toward the QV threshold per the codebook, and 'over 20 years' is an approximate duration, unlike the calibration example of '17 years' which is exact — leaving only one qualifying hard fact (the cybersecurity-specific VP of IT role), which is sufficient for Firm-Specific but not QV.


content_category: Strategy Integration

reasoning: The paragraph's central substantive content is a materiality conclusion ('such risks have not materially affected our business, financial conditions, results of operations or reputation to date') combined with a discussion of potential business/financial impacts — both of which the codebook explicitly places in Strategy Integration. While it ends with a cross-reference and uses risk-factor language, the None/Other category requires NO substantive disclosure at all, and a standalone materiality conclusion is expressly assigned to Strategy Integration; the vague mention of past incidents does not constitute an incident narrative sufficient for Incident Disclosure. No named entities, dates, frameworks, or firm-specific details appear, so the paragraph is Generic Boilerplate.


reasoning: The paragraph's grammatical focus is the company's own approach to 'developing, implementing, and maintaining robust cybersecurity measures' for its systems — squarely Risk Management Process. While it's introductory and highly generic, it does constitute some substantive disclosure about the company's intent to manage cyber risk (unlike a pure section header), so None/Other is too dismissive; and the business-dependency framing in Strategy Integration is secondary to the risk-management framing. Nothing qualifies as a specific fact — no named roles, frameworks, dates, tools, or firms — making this Generic Boilerplate.


reasoning: The paragraph is squarely about the Audit Committee's oversight of cybersecurity risk, with the committee as the primary grammatical subject. Annotator B's proposed fact — 'cybersecurity and data privacy leadership team' — is a generic descriptive label, not a uniquely named team or specific departmental composition like the calibration example 'Legal, Compliance, and Finance'; it appears on the ✗ NOT list pattern of generic program/team names and could appear verbatim in any company's filing. After filtering, no qualifying ✓ IS facts remain: 'Audit Committee' is explicitly excluded, cadences ('annual', 'quarterly', 'regular') are excluded, and 'Internal Audit team' and 'executive leadership team' are generic, leaving the paragraph as Generic Boilerplate.


reasoning: The paragraph's bulk describes the company's own internal processes — backup systems, monitoring, anti-malware, employee training, audits, and a trained response group — making Risk Management Process the dominant topic; the Head of IT role and reporting line appear only in the final two sentences as supporting organizational context, not as the primary subject. The 'Head of IT department' functions analogously to a Director of IT Security (a ✓ IS title) and is the single firm-specific fact lifting this above Generic Boilerplate.


reasoning: The grammatical subject is 'Senior management' and the central claim is about management's responsibility for creating and recommending risk appetite metrics; the Board of Directors appears only as the approving recipient, not as the subject performing oversight. Per the tiebreaker rule, 'Board oversight mentioned briefly + management roles as main focus → Management Role,' so Annotators A and B are correct and Annotator C's Board Governance label misreads the paragraph's focus. No CISO or other cybersecurity-specific title, no named committee, no framework, no dates, and no quantified facts are present, confirming Generic Boilerplate.


reasoning: The paragraph is fundamentally describing how the company's risk management program is structured and executed — the chain from company to Manager to IT Service Provider is the framing device, not a focused review of vendor oversight controls; the codebook tiebreaker 'internal processes mentioning vendors as one component → Risk Management Process' applies here. SOC 2 is the only named standard or verifiable cybersecurity-specific fact; the IT Service Provider is unnamed (disqualifying it from Firm-Specific or QV), and 'no employees' is a structural business fact not squarely within the ✓ IS headcount examples (which the codebook illustrates as cybersecurity-team headcounts), so Sector-Adapted is the correct level.


reasoning: The paragraph is structured around how cybersecurity is integrated into the enterprise risk management process, using 'For example' to introduce three operational sub-processes (IT security team reviews, penetration testing, CTO reporting); the Board and Audit Committee appear as downstream recipients of those processes rather than as the grammatical subjects organizing the disclosure, making Risk Management Process the better fit even though Board Governance elements are present. The CTO title (a ✓ IS cybersecurity-specific role) is the qualifying specific fact for Firm-Specific; no two hard verifiable facts (dates, dollar amounts, named firms, headcounts) exist to reach Quantified-Verifiable.


reasoning: The paragraph describes the company's internal cybersecurity approach including consultant updates, intelligence gathering, and security tools — all components of its own risk management process rather than central vendor oversight. The 'over 30 years of experience' figure is attributed to an explicitly unnamed 'third-party security expert consultant,' which falls squarely in the ✗ NOT list under 'Unnamed entities: third-party experts, external consultants'; because the consultant has no name, the experience figure is not independently verifiable and therefore cannot elevate specificity above Generic Boilerplate.


reasoning: The CEO is the grammatical subject overseeing the cybersecurity program and leading incident response, which fits Management Role even though CEO is a generic C-suite title; the second sentence elaborates on the team they lead rather than describing a standalone internal process or framework. The specific cross-functional composition (especially 'mining operations' alongside legal, compliance, software engineering) constitutes a named team composition under the ✓ IS list, lifting the paragraph to Firm-Specific despite the CEO title itself being excluded as a generic fact.


reasoning: The paragraph centers on the company's own (absent) internal cybersecurity processes, resource limitations, and basic incident-response reporting mechanism, which fits Risk Management Process; third-party reliance is framed as an explanation of their internal deficiency rather than as a vendor-oversight topic. No qualifying specific facts exist — 'incident response plan' and 'Board of Directors' are explicitly on the ✗ NOT list, and no named frameworks, roles, firms, dates, or numbers appear, making this Generic Boilerplate; Annotator A's Firm-Specific rating is unsupported.


reasoning: The paragraph describes the company's internal ERM process with cybersecurity as a risk category and includes Board reporting, which is squarely a Risk Management Process / ERM integration topic with the Board playing a secondary, recipient role. Annotator B's Firm-Specific rating is incorrect: the 'enterprise risk management committee' is described with an indefinite article and lowercase descriptor — a generic organizational label, not a proper named committee like 'the ERM Committee' or 'the Cybersecurity Committee'; no named frameworks, cybersecurity-specific titles, specific dates, or other ✓ IS facts appear anywhere in the paragraph, leaving only boilerplate governance language that could be inserted into any company's filing unchanged.


reasoning: The paragraph describes how Liberty Broadband participates in risk-assessment and risk-management processes—even though these are delivered via a services agreement with a parent entity, the grammatical subject and central topic is the company's own risk management framework, not vendor oversight. Annotator B's Third-Party Risk categorization misapplies the tiebreaker: the codebook reserves that label for oversight imposed ON vendors, whereas here Liberty is a related party providing services as a mechanism for the company's own internal processes. No facts from the ✓ IS list survive filtering—'Liberty' and 'GCI' are related entities, not external firms like Mandiant, and no frameworks, roles, dates, or tools are named.


reasoning: The paragraph's dominant focus is the potential business and financial consequences of a cyberattack, culminating in an explicit materiality conclusion ('could have a material adverse impact on our financial condition and results of operations'); under the codebook tiebreaker, a standalone materiality conclusion with no incident narrative maps to Strategy Integration rather than None/Other, which is reserved for paragraphs with no substantive cybersecurity disclosure at all. No named entities, frameworks, dates, or specific facts are present, making this Generic Boilerplate.


reasoning: The paragraph identifies the types of data the company collects and stores and asserts that secure maintenance of IT systems is critical to operations — substantive disclosure about the scope of assets under protection, which contextualizes the company's risk management posture rather than being a mere header or disclaimer. Annotator B's 'None/Other' characterization is too strict: the paragraph does contain substantive content (data inventory rationale, CIA framing) even if it stops short of describing specific processes. All three annotators agree on Generic Boilerplate — there are no named roles, frameworks, dates, tools, or figures that would elevate specificity.


reasoning: Although the CEO is the grammatical subject, the substantive focus of the paragraph is the Audit Committee's oversight mechanism — receiving regular briefings on cybersecurity risks with a defined minimum frequency — which is the hallmark of Board Governance disclosure. Applying the tiebreaker, board oversight is the central topic and the CEO is described only as the informing agent in that oversight structure, not in terms of qualifications or reporting lines. All named entities (CEO, Audit Committee) and the cadence ('once per year', 'regular basis') fall on the ✗ NOT list, yielding no qualifying specific facts and Generic Boilerplate specificity.


reasoning: The paragraph describes the company's own internal cybersecurity risk management processes — assessments, penetration testing, vulnerability scanning, NIST framework adoption, and third-party audits — making Risk Management Process the clear fit; the vendor relationship with Harley-Davidson is framed as a component of those internal processes, not the central topic. Specifying Harley-Davidson by name (a unique, identifiable firm in this MSA arrangement) clears the Firm-Specific threshold, though the absence of a second hard verifiable fact (no specific dates, headcounts, or dollar amounts) prevents elevation to Quantified-Verifiable, aligning with Annotators B and C and not A.


reasoning: The paragraph's central topic is Centuri's own internal cybersecurity processes — framework adoption, policy/procedure implementation, operational risk assessments, a risk register, and third-party evaluations — all of which squarely fit Risk Management Process; the brief mention of the Executive Leadership Team is incidental rather than making board governance the main subject. On specificity, NIST CSF is a named recognized standard (qualifying for Sector-Adapted), but the other elements — 'quarterly,' 'Executive Leadership Team,' 'cybersecurity team,' and 'Cybersecurity Risk Register' — are either generic cadences, standard titles, or common risk-management terms described with an indefinite article, none of which constitute a firm-unique identifier under the codebook's IS list, so the paragraph does not rise to Firm-Specific.


reasoning: The paragraph's grammatical subjects are the CIO and VP of Information Security, describing their qualifications and tenure — directly matching the Management Role category. Specificity reaches Quantified-Verifiable because the paragraph contains two quantified experience figures ('nearly 30 years' and 'more than 20 years') plus a named certification (CISSP), which parallels the codebook's calibration example ('The CISO has 17 years of experience and holds CISSP and CISM certifications → Quantified-Verifiable'); the approximate nature reduces confidence slightly but the weight of multiple quantified datapoints supports QV over Firm-Specific.


reasoning: The paragraph describes ProAssurance's internal security monitoring, training, access controls, and AI guidelines — all squarely within Risk Management Process. On specificity, Annotator B identifies 'Information Systems Security department' as a firm-specific fact, but the codebook's ✓ IS list requires 'named non-generic committees' or specific team compositions showing membership diversity (e.g., 'Legal, Compliance, and Finance'); a generically titled IT security department is not a uniquely identifying organizational entity and could appear in virtually any company's filing. After filtering: no named standards, no cybersecurity-specific titled roles (CISO, CIO, etc.), no named tools or firms, no specific dates, and no qualifying committee or team composition — only common-practice language (penetration testing, phishing simulations, quarterly training, firewalls), which the codebook explicitly excludes. The paragraph is therefore Generic Boilerplate.


content_category: None/Other

reasoning: The paragraph is a fragmented cross-reference directing readers to Item 1A risk factor disclosures for the substantive materiality discussion; the appended phrase about 'risk management processes and an area of focus for our Board and management' is pure boilerplate with no independent disclosure. Per the codebook, cross-references with no substantive disclosure belong in None/Other, and None/Other always receives Generic Boilerplate.


reasoning: Although the paragraph opens by identifying management roles, the dominant content—occupying the majority of the text—describes the Information Security Team's internal processes for identifying, assessing, and managing cybersecurity risks through monitoring, threat analysis, audits, vulnerability assessments, and tabletop exercises; the role identification is context-setting for the process description. The codebook's tiebreaker directs 'Management Role' when a management role is the grammatical subject, but here the subject quickly shifts to 'Our Information Security Team' and 'It' for the substantive content, making Risk Management Process the more accurate assignment. At least one IS-list fact (VP, Cybersecurity and CIO) is present, qualifying as Firm-Specific, but no hard verifiable facts (dates, dollar amounts, named third-party firms, headcounts) exist to reach Quantified-Verifiable.


reasoning: Although the paragraph touches on potential business impact (sales, production, cash flows), which superficially resembles Strategy Integration language, its substance is purely a forward-looking risk disclaimer ('could inhibit') with no actual strategic or financial disclosure — it is simply asserting that IT dependence creates cyber risk exposure. The codebook's 'None/Other' explicitly covers forward-looking disclaimers with no substantive disclosure, and this paragraph — essentially a section preamble — provides no actionable or verifiable information about how the company actually integrates cybersecurity into its strategy, budget, or materiality framework.


reasoning: Although the VP of Information Technology is named in the opening sentence, the bulk of the paragraph describes the company's internal Cybersecurity Program operations — execution via internal/external experts, monitoring activities, threat intelligence sources, and executive management briefings — making Risk Management Process the dominant topic. Annotator A correctly identifies that management is introduced briefly as context, while the central focus is on how the program functions. For specificity, the VP of IT title is a ✓ IS cybersecurity-specific role and '25 years' is a specific number, but named roles do not count toward the Quantified-Verifiable threshold per the codebook, leaving only one hard verifiable fact, so Firm-Specific is correct, not QV (contra Annotator B).


reasoning: The IT Engineer is the explicit grammatical subject throughout the paragraph, and the paragraph centers on identifying who (IT Engineer + Cybersecurity Council composition) manages cybersecurity and what their responsibilities are — fitting the Management Role definition of identifying roles and reporting lines. While Risk Management Process is plausible since processes are described, the codebook instructs assigning Management Role when a management role is the grammatical subject, and the paragraph's primary purpose is establishing the management structure rather than detailing a standalone process. The Cybersecurity Council and Risk Management Committee are named non-generic committees (not merely 'Audit Committee'), qualifying as firm-specific facts; however, no hard verifiable facts (dates, dollar amounts, named third-party firms, headcounts) exist to reach Quantified-Verifiable.


reasoning: The grammatical subject of the operative sentence is 'Our approach to cybersecurity risk management,' which is described as integrated into a broader risk management framework — squarely a Risk Management Process disclosure. The Board is mentioned only as an overseer in a subordinate clause, not as the primary subject, so the codebook tiebreaker ('Board oversight mentioned briefly + [other focus] → [other category]') pushes this away from Board Governance. The paragraph contains no named frameworks, roles, dates, or firm-specific details, making it Generic Boilerplate.


reasoning: The paragraph describes the company's own internal security controls, testing regimens, monitoring practices, and team functions, which is squarely Risk Management Process. Although the paragraph mentions 'zero-trust principles' (a named security concept) and 'daily' vulnerability scans, these do not qualify as specific facts under the codebook: zero-trust is a security philosophy rather than a formally recognized standard like NIST or ISO 27001 (and thus does not trigger Sector-Adapted), 'daily' is a generic cadence without an exact date, the so-called team composition ('information security, technology, IT and operations personnel') is entirely within the IT sphere and not a cross-silo specific composition like 'Legal, Compliance, and Finance,' and the 'Information Security Program' lacks a unique identifier (unlike 'CIRP')—leaving no qualifying facts from the IS list.


reasoning: The paragraph describes the company's own internal security controls and recovery procedures (firewalls, antivirus/patching, cloud hosting, tape backups), making Risk Management Process the clear fit. Annotator C's Firm-Specific rating is incorrect: 'Layer 7 firewall' is a generic technology category (application-layer firewall), not a named product like Splunk or CrowdStrike Falcon; 'internal cloud system' is a descriptive phrase, not a named system; and 'daily'/'monthly' are generic cadences explicitly excluded by the codebook — none of these items appear on the ✓ IS list, so no qualifying specific fact exists and the paragraph is Generic Boilerplate.


reasoning: The paragraph's central function is a dual materiality conclusion — asserting no prior cybersecurity incident has materially affected the company while warning future threats are 'reasonably likely' to do so — which maps to the Strategy Integration tiebreaker for standalone materiality assessments without incident narratives. The fleeting mention of a 'cybersecurity risk management program' appears only as a disclaimer caveat, not as a substantive description of internal processes, so Risk Management Process is not the governing category. No specific facts from the ✓ IS list appear, making this Generic Boilerplate.


reasoning: The grammatical subject throughout is the Board and Audit Committee overseeing cybersecurity risks and receiving management updates, which is squarely Board Governance. Although 'Inland's incident response plan' names 'Inland,' Inland functions here as the affiliated sponsor/parent entity rather than a named cybersecurity service provider, and 'incident response plan' without a unique identifier appears on the ✗ NOT list; all remaining entities (Advisor, Sub-Advisor, Dealer Manager, Audit Committee) are generic role descriptors that could appear in any company's filing, leaving no qualifying ✓ IS facts after filtering.


reasoning: The paragraph describes the company's internal cybersecurity risk management program, including processes to identify, assess, manage, and mitigate threats as part of ERM, which is squarely Risk Management Process. Specificity is Generic Boilerplate: the mention of 'internal team of cybersecurity professionals and data privacy professionals' is a generic description of job-function types, not a named team, named department (like 'Legal, Compliance, and Finance'), or cybersecurity-specific title (like CISO), and 'external experts' is explicitly excluded by the ✗ NOT list — no qualifying specific facts remain.


reasoning: The dominant sentence describes requirements imposed ON vendors — verifying their ability to implement security measures and mandating breach reporting — which the codebook tiebreaker explicitly maps to Third-Party Risk rather than Risk Management Process. The brief second sentence about Board/Audit Committee oversight does not shift the central topic, and per the codebook both 'Board of Directors' and 'Audit Committee' are generic entities that cannot serve as qualifying specific facts.