content_category: Board Governance

category_confidence: high

specificity_confidence: high

reasoning: The paragraph opens with and centers on the board of directors' oversight of cybersecurity risks, then describes briefing cadence (periodic presentations and updates when material) to that board; this matches the Board Governance definition where the board is the primary grammatical subject and focus. Annotators A and C are correct; Annotator B misapplies the tiebreaker because no specific management roles are identified and management is mentioned only in service of board reporting.

provider: x-ai


content_category: Risk Management Process

reasoning: This paragraph exclusively describes the company's internal IR planning and escalation processes, with CIRT and the Cyber Security Watch Team as the grammatical subjects, so Risk Management Process is the clear category (no board, vendors, actual incidents, or financial impacts). It is Firm-Specific because naming the unique internal teams CIRT and Cyber Security Watch Team with defined roles qualifies as a specific fact under the IS list, unlike purely generic program descriptions.


content_category: Management Role

reasoning: The paragraph has the CDIO (a management role) as the consistent grammatical subject and details its identification, responsibilities, qualifications, and reporting structure, directly matching the 'Management Role' definition. The presence of two hard verifiable facts (specific date of January 2022 and quantified 20+ years of experience) qualifies it as Quantified-Verifiable per the decision test, aligning with Annotator C.


specificity_confidence: medium

reasoning: Board committee is the grammatical subject and the paragraph focuses on its oversight of cybersecurity risks, matching Board Governance exactly. I agree with Annotator C: the codebook explicitly lists Risk Committee as non-generic while carving out only plain "Audit Committee" as standard, so naming the "Audit and Risk Committee" qualifies as a firm-specific fact (no hard verifiable facts reach Quantified-Verifiable).


category_confidence: medium

reasoning: The paragraph's primary topic and opening sentences describe the company's own internal processes (application design to minimize impact, back-up systems, monitoring/detection, anti-malware, employee training, audits, and a trained response group), which directly matches Risk Management Process. The Head of IT role and reporting lines are mentioned but are not the grammatical subject or central focus of the overall paragraph.


reasoning: The paragraph's grammatical subject and central topic is the company's own internal ERM program that integrates cybersecurity risk assessment, framework, roles, oversight, reporting, and training, making Risk Management Process the clear category (Board reporting is only one brief component). I agree with Annotator A's reasoning because it correctly identifies the internal-process focus while noting the incidental Board mention does not shift the category.


reasoning: The paragraph's grammatical subject and central topic are the company's own internal processes for assessments, audits, risk mitigation exercises, maturity evaluations, and training programs (with third-party testing as one supporting element), which directly matches Risk Management Process per the tiebreakers.


reasoning: The grammatical subject is 'Management' describing its action of updating the Audit Committee and executives on incidents, which fits Management Role per the explicit tiebreaker (management roles as main focus even when board oversight is mentioned). This matches Annotator A's reasoning and the codebook's grammatical-subject rule, whereas B and C incorrectly prioritize the object of the sentence.


reasoning: The paragraph opens with and repeatedly uses CIO and CISO as grammatical subjects while detailing their responsibilities, qualifications (including 38 years of experience), and direct actions such as operating the SOC; this matches the Management Role definition and tiebreaker that processes described in support of named roles do not shift the category to Risk Management Process.


reasoning: The paragraph centers on the company's own cybersecurity risk management program, risk assessment/identification/management activities, and integration with internal teams, with third-party services mentioned only as a supporting component; this matches Risk Management Process per the tiebreakers. It names the NIST framework without qualifying firm-specific facts from the ✓ IS list (e.g., no cybersecurity-specific titles, dates, or quantified items) or two hard verifiable facts, making it Sector-Adapted per the decision test and calibration examples.


reasoning: The paragraph has a specific management role (Executive Vice President, Senior Operations Officer / Senior Bank Operations Officer) as the grammatical subject throughout, detailing her qualifications, experience, and cybersecurity oversight responsibilities, which directly matches the Management Role definition.


reasoning: The paragraph's core topic is the company's own internal processes for identifying/assessing risks, monitoring exposures, implementing mitigation, and maintaining programs, which directly matches Risk Management Process. Annotators A and B are correct; 'Management' is a generic term per the codebook (explicitly in the ✗ IS NOT list) and the text does not identify any specific cybersecurity role, qualifications, or reporting lines required for the Management Role category.


content_category: Third-Party Risk

reasoning: Vendor oversight is the central topic of the entire paragraph (including the header and dedicated program description), so Third-Party Risk applies per the codebook's 'ONLY when vendor oversight is the CENTRAL topic' rule rather than as a sub-component of broader risk management. The named internal program qualifies as a firm-specific fact under the ✓ IS list (consistent with the ERM program example), making it Firm-Specific rather than Generic Boilerplate.


reasoning: The paragraph's primary focus and grammatical subjects are the audit committee assisting the Board in oversight of the cybersecurity program and both receiving regular reports on developments, with incident communication to the audit committee as a secondary element; this matches Board Governance per the code's emphasis on board/committee oversight even when management roles like ISO/CISO appear in escalation protocols.


reasoning: The paragraph's primary focus is the company's internal risk assessment and framework adoption (MLPS attributes, stratification of IT systems, effectiveness evaluation), making Risk Management Process the correct category; third-party performance is only a component and vendor oversight is not central.


reasoning: Vendor oversight is the central and exclusive topic of the entire paragraph (titled Third-Party Risk Management), including specific processes for qualifying vendors that access client data, rather than vendors being only one component of broader internal risk processes.


reasoning: The paragraph has the CIO (a management role) as the grammatical subject throughout, detailing his identification, qualifications, experience, team oversight, and reporting lines; this matches the Management Role definition exactly. Board and committee updates are mentioned only secondarily as part of the CIO/CLO responsibilities, so Board Governance does not apply.


reasoning: The paragraph's grammatical subject is explicitly 'Senior management' describing their responsibility to create and recommend cybersecurity risk appetite metrics, which directly matches the Management Role definition. Although the Board is mentioned as the approver, this is secondary and the tiebreaker assigns such cases to Management Role when management is the main focus (Annotators B and C are correct).


content_category: Strategy Integration

reasoning: The paragraph centers on business/financial impacts of potential cybersecurity incidents plus a materiality conclusion that risks have not materially affected the company (with only a vague non-narrative reference to past incidents), which directly matches Strategy Integration per the tiebreakers; Annotator C is correct while A/B over-applied None/Other to this substantive impact discussion.


reasoning: The paragraph centers on the VP of IT as the grammatical subject, detailing their leadership of cybersecurity strategy/oversight and professional qualifications, which directly matches the Management Role category definition.


reasoning: The paragraph's core is the company's acknowledgment of developing/implementing/maintaining cybersecurity measures to protect its own systems and data plus the link between growing IT dependence and heightened cyber risks, which aligns with Risk Management Process as the topic of internal practices; it is not focused on board oversight, a specific incident, vendor requirements as the central theme, or explicit business/financial impacts like insurance or materiality.


reasoning: The paragraph is Board Governance because the Audit Committee is the grammatical subject and primary focus when describing oversight of cybersecurity and IT risks, briefing cadences, and information flows from management teams. I agree with Annotator A's interpretation that the explicit reference to the 'cybersecurity and data privacy leadership team' (as a distinct provider of updates) qualifies as a specific team composition under the ✓ IS list, elevating it to Firm-Specific rather than generic boilerplate.


reasoning: The paragraph repeatedly uses the Board and Audit Committee as grammatical subjects when describing oversight, annual review cadence, and integration of cybersecurity into their evaluation of risks and the Advisor's program. This makes Board Governance the best match per the codebook's explicit assignment rule, even with supporting process details; Annotator C's interpretation is correct.


reasoning: The paragraph's final two sentences make a specific management role (Head of IT department) the grammatical subject, directly stating its cybersecurity oversight responsibilities and reporting lines up to the CEO and Audit Committee; this matches the Management Role definition more closely than Risk Management Process even though generic processes are described earlier.


reasoning: The paragraph's core topic is the company's risk management program for assessing/identifying/managing cybersecurity risks, explaining its outsourced structure via the Manager and IT Service Provider; vendor elements are a component of that process (not the central focus of oversight requirements imposed on vendors), so Risk Management Process applies per tiebreakers. I agree with Annotators A and B because the heading and content focus on risk management/strategy rather than standalone third-party risk.


reasoning: The paragraph centers on the company's own internal cybersecurity monitoring and risk management practices (updates, intelligence sources, security tools), with the consultant mentioned only as one component of those processes, so Risk Management Process applies per the tiebreakers. I agree with Annotator B: after removing details about the unnamed third-party consultant and the vague "over 30 years" (both on the ✗ NOT list), no qualifying ✓ IS facts remain and no standard is named, making it Generic Boilerplate.


reasoning: The paragraph's grammatical subjects and central topic are the company's internal processes (risk-informed decision-making, risk identification/mitigation, cybersecurity risk management program, and mandatory employee training), which directly matches Risk Management Process; it does not center on board/committee oversight, a specific CISO-style management role in isolation, or any incident.


reasoning: The paragraph has the CEO as the grammatical subject describing their pivotal role and briefing responsibilities, which matches the Management Role criteria. Annotator A's interpretation is correct per the explicit tiebreaker and grammatical-subject rules; the brief mention of the Audit Committee does not shift the primary focus to Board Governance.


reasoning: The paragraph's core topic is the company's internal incident response planning and cross-functional team structure, which aligns with Risk Management Process. CEO is explicitly listed as a generic C-suite title in the IS-NOT guidance and does not qualify as a cybersecurity-specific role for the Management Role category.


reasoning: The paragraph is squarely about identification and qualifications of cybersecurity management roles (CIO and VP of Information Security), making Management Role the clear category per the codebook. It meets Quantified-Verifiable via multiple specific numbers (years of experience) plus a named certification (CISSP), directly matching the provided calibration example of a CISO's 17 years and CISSP/CISM credentials.


reasoning: The paragraph's core topic is the company's own processes for assessing/identifying/managing cybersecurity risks (via participation in Liberty's framework), which directly matches Risk Management Process; vendor services are only a component, not the central focus as required for Third-Party Risk. No facts from the ✓ IS list survive filtering (Liberty/GCI are self-references/related entities, the services agreement is a generic cross-reference, and there are no dates/roles/frameworks/tools).


reasoning: The paragraph's grammatical subject and central focus are the company's own internal cybersecurity program updates, risk assessments, penetration testing, vulnerability scanning, and NIST-based risk management, with Harley-Davidson referenced only as one component of how they maintain that program (per tiebreaker: internal processes mentioning vendors as one component = Risk Management Process). It exceeds Sector-Adapted due to the unique Master Services Agreement with the specifically named Harley-Davidson, which is a firm-unique fact not found in generic disclosures.


reasoning: The paragraph exclusively addresses potential business, reputational, and financial impacts of a hypothetical cyberattack, including material adverse effects on financial condition and results of operations, which directly matches the Strategy Integration definition for business/financial impact and materiality discussions without any incident narrative.


reasoning: The paragraph focuses on the company's own internal processes for assessing cybersecurity risks, monitoring with firewalls/antivirus/patching, developing an internal cloud, and backup/recovery procedures, making Risk Management Process the correct category; third-party references are only a minor component about avoidance rather than central vendor oversight.


reasoning: The paragraph centers on the company's own (lack of) internal cybersecurity processes, personnel, resources, incident response planning, and third-party reliance as a component of its risk posture, which aligns with Risk Management Process per the tiebreakers; board reporting is mentioned only briefly and third-party elements do not focus on vendor oversight/contracts.


reasoning: The paragraph is entirely about the company's own internal processes for monitoring, threat detection, encryption, access controls, training, phishing simulations, and AI usage guidelines, so Risk Management Process is the correct category (no board, no incident, no central vendor oversight). Annotator A is correct that naming the 'Information Systems Security department' qualifies as a specific team/department fact per the IS list, and the detailed generative AI guidelines are also uniquely firm-specific, elevating it above Generic Boilerplate.


reasoning: The paragraph's primary topic is the company's own internal ERM process (including how cybersecurity fits as a risk category, risk identification/monitoring, and mitigation steps), making Risk Management Process the correct category; board reviews are mentioned but secondary and not the grammatical focus. I agree with Annotator C's interpretation because it correctly identifies the ERM integration emphasis and recognizes the named ERM committee as a firm-specific detail per the codebook, unlike A and B who treated all governance language as generic.


content_category: None/Other

reasoning: The paragraph provides only introductory context on data types collected and the general importance of IT system security to operations and strategy, without describing any risk assessment processes, frameworks, monitoring, board oversight, management roles, or incidents. This matches the None/Other definition for non-substantive disclosure (e.g., section intros or generic statements), making Annotator B's interpretation correct over A and C.


reasoning: The paragraph's core topic is the company's own cybersecurity risk management approach and its integration into the broader risk management framework (ERM integration), making Risk Management Process the best fit. Board oversight is noted at the end but the grammatical subject is the company's approach, not the Board itself, so it does not qualify as Board Governance per the tiebreakers.


reasoning: This paragraph is primarily a cross-reference to risk factor disclosures in Item 1A and contains no substantive details on any cybersecurity governance, processes, incidents, or impacts; the brief generic mention of Board and management focus does not rise to Board Governance or Risk Management Process under the codebook's explicit inclusion of cross-references in None/Other.


reasoning: The paragraph focuses on business/financial impacts of a potential cyber-attack (disruption to sales, production, and cash flows) due to IT dependency, which aligns with Strategy Integration per the codebook. It exceeds None/Other because it offers substantive disclosure of operational consequences rather than a pure forward-looking disclaimer or header.


reasoning: The paragraph's core topic and grammatical subject is Centuri's own internal processes for cybersecurity reviews, policy/procedure implementation, operational risk assessments, and tracking via a named risk register, which directly matches Risk Management Process; third-party evaluations are only a supplementary element.


reasoning: The paragraph's core is a standalone materiality conclusion stating no prior cybersecurity incidents have materially affected the company, combined with forward-looking statements that future threats are reasonably likely to materially affect operations/results if realized; this directly matches the tiebreaker directing such content (without incident narratives or process details) to Strategy Integration. The brief reference to a 'cybersecurity risk management program' is a generic disclaimer, not a description of internal processes.


reasoning: The paragraph's primary grammatical subjects are the IT Engineer and Cybersecurity Council (including the Compliance Director), describing their coordination, implementation, monitoring, and reporting responsibilities, which directly matches the Management Role category. This is preferable to Risk Management Process because the codebook prioritizes when a management role is the grammatical subject and the tiebreaker for management roles as main focus; I agree with Annotator C's interpretation as it best follows these rules.


reasoning: The paragraph's grammatical subject and central topic are the company's own internal processes (preventative controls, penetration testing, vulnerability management, monitoring, and layered defenses), making Risk Management Process the clear category. I agree with Annotator A's interpretation that it lacks qualifying firm-specific facts from the IS list after filtering out generic practices, common cadences like 'daily' and 'regular', unnamed third-party references, and standard IT department mentions, so it remains Generic Boilerplate.


reasoning: The paragraph's core content and bulk describe the company's own internal processes for identifying/assessing/managing cybersecurity risks via monitoring, scans, audits, vulnerability assessments, and tabletop exercises, making Risk Management Process the best match. Management roles introduce the section but are not the central focus with qualifications or reporting lines; Annotator B's reasoning is correct per the codebook's 'when the company's OWN internal processes are the topic' guidance.


reasoning: This paragraph centers on the company's own cybersecurity risk management program and its integration into the broader ERM program with processes for identification/assessment/mitigation, which directly matches Risk Management Process. Annotator A is correct that the specified team composition of cybersecurity and data privacy professionals qualifies as a firm-specific fact per the codebook's explicit example of departmental compositions, elevating it above generic boilerplate.


reasoning: The paragraph's grammatical subject is the Board and Audit Committee performing oversight of cybersecurity risks, receiving reports/updates, and being notified in incidents, which directly matches the Board Governance definition. Annotators A and B are correct that no ✓ IS-list facts survive filtering (Audit Committee is explicitly generic, "incident response plan" is a listed generic program name, and references to Advisor/Sub-Advisor/Inland are company self-references that do not qualify).


reasoning: Vendor/supplier oversight is the central topic because the longer, more detailed first sentence focuses on requirements imposed on third-party service providers (evaluation for security measures, breach reporting obligations). Per tiebreakers, this is not merely one component of a broader internal process description, and the brief second sentence on board/Audit Committee responsibility does not make board oversight the grammatical or thematic focus of the paragraph.


reasoning: The paragraph's main topic and grammatical subject is the Cybersecurity Program itself along with the team's monitoring, prevention, detection, mitigation, management, and remediation processes (plus use of internal/external experts as one component), making Risk Management Process the best fit; the VP of IT is presented as the leader but is not the grammatical subject and functions as supporting detail rather than the central focus.