reasoning: This paragraph describes the scope of disruptions from a real cyber incident (system shutdowns, operational impacts like inventory replenishment and order fulfillment delays), recovery actions (resuming operations, restoring IT systems), and residual effects, directly matching Incident Disclosure criteria including response actions. No specific dates, named systems/products, roles, committees, firms, or quantifiable metrics are present; all references use vague terms like 'some,' 'certain,' 'minor,' resulting in Generic Boilerplate.


content_category: Strategy Integration

category_confidence: high

specificity_confidence: high

reasoning: This paragraph focuses on the financial impact, preliminary expense estimates, and materiality assessment of an incident without describing the incident itself, what happened, or response actions, fitting Strategy Integration. It contains a unique quantified estimate and specific cost categories tied to this company's incident, qualifying as Firm-Specific but not reaching two+ independently verifiable facts for Quantified-Verifiable.

provider: x-ai


reasoning: Paragraph discusses business/financial impacts, materiality assessments, and cyber insurance related to a cybersecurity incident without any incident narrative or response details, aligning with Strategy Integration. No named entities, dates, frameworks, roles, or verifiable facts present, making it generic boilerplate.


content_category: Incident Disclosure

reasoning: This paragraph describes a real cybersecurity incident with detection date, response actions (investigation, IR plan activation, system shutdown), ejection date, and notifications to law enforcement, clearly fitting Incident Disclosure. It contains two specific dates, qualifying as Quantified-Verifiable.


reasoning: This paragraph details the scope, impacts (website offline, delayed IT communications, no material effect on IP or customer data), and ongoing response to a specific cybersecurity incident involving unauthorized action by a former executive officer, fitting Incident Disclosure; tiebreaker prioritizes incident narrative over financial impact assessment.


reasoning: The paragraph provides a materiality assessment and financial guidance related to the incident's business impact without any incident narrative or response details, fitting Strategy Integration. It contains three specific, externally verifiable dates, qualifying as Quantified-Verifiable.


reasoning: The paragraph focuses on remediation costs, insurance recoveries, and a materiality assessment concluding no material impact on financial condition or operations, fitting Strategy Integration for business/financial impact and standalone materiality conclusions without incident narrative. No specific facts like dates, amounts, named entities, or frameworks are present, making it generic boilerplate.


reasoning: Paragraph details a real cybersecurity incident at third-party CDK Global, including specific date, named systems affected, restoration status, and ongoing disruptions, clearly fitting Incident Disclosure over Third-Party Risk as it centers on the event narrative rather than oversight processes.


reasoning: Paragraph describes a real ransomware incident with dates, scope (internal IT systems), origin (third-party firewall vulnerability), and response (engaged experts, system improvements), clearly fitting Incident Disclosure over Strategy Integration due to the narrative focus. Two specific dates qualify as two+ verifiable facts for Quantified-Verifiable.


reasoning: This paragraph describes response actions and operational impacts from a specific cybersecurity incident, including halting and restarting operations at named locations, durations of disruption, and restoration timeline, which fits Incident Disclosure. It contains multiple verifiable facts such as specific locations (Mexico, domestic), quantified durations (two weeks twice), and restoration date (mid-June).


reasoning: This paragraph focuses on the business, operational, and financial impacts of an incident, including expected costs, insurance coverage, and materiality assessments, without describing the incident itself or response actions, aligning with Strategy Integration. It contains no named entities, dates, frameworks, roles, or verifiable metrics, making it generic boilerplate.


reasoning: This paragraph describes a real cybersecurity incident at a third-party vendor (CDK), including timeline (starting June 19, 2024), affected systems (DMS, CRM), scope, and response status, directly matching Incident Disclosure criteria with a clear narrative of events. Multiple externally verifiable facts (dates, named firm, named systems) exceed the threshold for Quantified-Verifiable.


reasoning: The paragraph details financial and business impacts (delayed transactions, revenue shifts from Q4 2023 to Q1 2024, lost revenue, one-time expenses) resulting from 'the incident' without describing the incident itself or response actions, aligning with Strategy Integration. No incident narrative present, distinguishing it from Incident Disclosure per tiebreakers.


reasoning: This paragraph describes a real cybersecurity incident with detection date, scope (IT systems, data encryption, manufacturing shutdown), response actions (containment, investigation, incident response plan), and ongoing impacts, clearly fitting Incident Disclosure over others like Strategy Integration. It includes one firm-unique verifiable fact (specific date), qualifying as Firm-Specific but not Quantified-Verifiable due to lacking a second such fact like named firms or products.


reasoning: The paragraph details financial impacts and arrangements (waivers, added capital) to fund cybersecurity incident remediation, fitting Strategy Integration as it covers business/financial effects without describing the incident itself or internal processes.


reasoning: Paragraph details a real cybersecurity incident including detection date, unauthorized access to systems, and response actions like investigation with experts, fitting Incident Disclosure; tiebreaker prioritizes incident narrative over material impact mention.


reasoning: This paragraph describes a real cybersecurity incident including unauthorized access, detection, response actions (activating incident response plan, taking systems offline, engaging external experts, notifying law enforcement, halting production), fitting Incident Disclosure. No specific facts like dates, named systems, firms, or quantifiable details are present; all elements are vague or generic (e.g., 'certain systems,' 'various locations,' 'leading external cybersecurity experts'), matching Generic Boilerplate.


reasoning: Paragraph details a real cybersecurity incident with detection date, response actions (incident response protocols, network isolation, engaging a firm, notifications), matching Incident Disclosure criteria over Strategy Integration due to incident narrative. Contains one verifiable fact (specific date), qualifying as Firm-Specific.


reasoning: Paragraph details an actual incident's ongoing investigation, threat actor actions, lack of data exfiltration evidence, notifications to law enforcement and regulators, and materiality assessment, aligning with Incident Disclosure per tiebreaker for incident narrative plus financial impact. No named entities, dates, frameworks, roles, or verifiable facts present, making it Generic Boilerplate.


reasoning: Paragraph describes a real cybersecurity incident with date, unauthorized access details, response actions (activating process, notifying law enforcement, retaining experts), scope, and remediation, clearly fitting Incident Disclosure over others like Strategy Integration due to narrative focus and tiebreaker rules. Contains one verifiable firm-specific fact (exact incident date), meeting Firm-Specific criteria but not Quantified-Verifiable (lacks second fact like named firm or amount).


reasoning: Paragraph describes a real cyberattack on Change Healthcare services, impacts to consumers/providers/pharmacy/claims/payments, response actions like mitigation, restoration, and investigation with law enforcement, fitting Incident Disclosure. Contains one firm-unique fact (named Change Healthcare), making it Firm-Specific but not Quantified-Verifiable.


reasoning: This paragraph describes a real cybersecurity incident including detection date, scope (Canadian operations), and response actions like isolation and engaging professionals, fitting Incident Disclosure perfectly. It has one verifiable date and a firm-specific operational area but lacks a second verifiable fact like named firms or amounts, making it Firm-Specific.


reasoning: Paragraph states a standalone materiality conclusion that no prior incidents have materially affected the company but future threats could, with no incident narrative or process details, fitting Strategy Integration. No named entities, frameworks, dates, roles, or verifiable facts present, confirming Generic Boilerplate.


reasoning: This paragraph details an actual cybersecurity incident, including unauthorized access by a cybercrime organization, data exfiltration of customer/employee PII from a limited portion of the retail business environment, and response actions like engaging experts and notifying authorities, fitting Incident Disclosure. No named entities, dates, frameworks, roles, or verifiable specifics; vague terms like 'limited portion,' 'some information,' and 'external cybersecurity experts' make it Generic Boilerplate.


reasoning: This paragraph describes a specific cybersecurity incident including the date of detection, unauthorized access to IT systems, response actions like activating incident procedures and engaging experts, and operational disruptions, fitting Incident Disclosure. It contains one firm-unique verifiable fact (exact date), making it Firm-Specific rather than higher levels.


content_category: Board Governance

reasoning: The paragraph describes the board of directors' oversight of cybersecurity risks and delegation to the audit committee, making the board and committee the grammatical subjects, which fits Board Governance. No other category is more applicable as it focuses on governance structure rather than internal processes or incidents.


content_category: None/Other

reasoning: This paragraph is a cross-reference to the risk factors section in Item 1A, providing no substantive cybersecurity disclosure itself, which fits 'None/Other'.


content_category: Risk Management Process

reasoning: The paragraph describes the company's internal activities for monitoring data protection laws and updating processes to manage cybersecurity risks and ensure compliance, which aligns with Risk Management Process as it focuses on the company's own processes. No specific facts, frameworks, roles, or unique details are present, making it generic boilerplate.


reasoning: The paragraph details the company's internal cybersecurity risk management processes, including biannual enterprise risk reviews involving the CISO and CIO, mitigation plans with cross-functional collaboration, and annual Board review of ERM, which aligns with Risk Management Process. It focuses on the company's own processes rather than board oversight or other categories.


content_category: Management Role

reasoning: The paragraph focuses on the Chief Technology Officer's identification, qualifications (experience), responsibilities, and reporting line to the General Counsel, making 'Management Role' the clear fit as the management role is the grammatical subject.


reasoning: The paragraph centers on Mr. Gharib's specific responsibilities in cybersecurity, such as hiring personnel, integrating risks into strategy, approving budgets, and reviewing assessments, fitting the Management Role category as it identifies and details a management figure's qualifications and duties.


reasoning: The paragraph focuses on identifying specific management roles (CIO, Information Security Director), their qualifications, experience, and the supporting Cybersecurity Team, making 'Management Role' the clear fit as these are the grammatical subjects. No board oversight, processes, incidents, or vendors are discussed.


reasoning: The paragraph centers on the Audit Committee's oversight role for cybersecurity risks and briefings from senior IT leadership to the Audit Committee and CFO, with the board committee as the grammatical subject. Named committee and role qualify as firm-specific facts, but organizational structure alone does not reach Quantified-Verifiable.


reasoning: The paragraph identifies the chief financial officer as having primary responsibility for cybersecurity risks and describes their reporting to the Nomination and Corporate Governance Committee, which directly matches the Management Role category focused on management roles and reporting lines.


reasoning: The paragraph details the company's internal CDRM organization, led by the Global CISO, and its cybersecurity program for risk identification, assessment, management, and mitigation, including adoption of the NIST framework, which aligns with Risk Management Process as it focuses on the company's own processes.


reasoning: The paragraph centers on the Board of Directors and Enterprise Risk Management Committee as subjects overseeing cybersecurity through training, reviews, approvals, and quarterly reports, fitting Board Governance precisely. It includes a named committee as a firm-specific fact but lacks two+ verifiable facts like dates or amounts for higher specificity.


reasoning: The paragraph details the Adviser's internal controls and procedures for assessing, identifying, classifying, escalating, and reporting cybersecurity threats and incidents, aligning with Risk Management Process as it focuses on the company's own processes. No board, management roles, vendors, incidents, or strategy elements are central.


reasoning: Paragraph details the company's internal cybersecurity incident response policy, escalation procedures, and handling by specific teams, aligning with Risk Management Process for IR planning. Names unique teams and committees (Incident Management Team, disclosure committee, Privacy and Security Subcommittee), qualifying as Firm-Specific without two+ externally verifiable facts like dates or amounts.


reasoning: The paragraph focuses on identifying the CISO and CTO, their qualifications, tenure, certifications, and experience levels, directly matching the 'Management Role' category definition where management roles are the grammatical subject.


reasoning: The paragraph states there were no material cybersecurity incidents or expenses (including no penalties/settlements) in the last two fiscal years and assesses no material concerns from specific threats, which are standalone materiality conclusions with financial impact references and no incident narrative, fitting Strategy Integration. It includes one firm-unique verifiable timeframe, qualifying as Firm-Specific.


reasoning: The paragraph provides standalone materiality conclusions (no material impact on business strategy, operations, or financial condition) and mentions a general strategy update, fitting Strategy Integration per tiebreakers. No named entities, frameworks, dates, roles, or verifiable facts; entirely generic boilerplate language.


reasoning: The paragraph details the company's own internal processes for threat and vulnerability assessments, risk prioritization, mitigation strategies, and incident response planning, fitting Risk Management Process. It contains no named frameworks, roles, dates, or unique facts, making it Generic Boilerplate.


reasoning: The paragraph details the company's own internal processes for cybersecurity training, employee testing, penetration testing, and assessments to manage risks, fitting Risk Management Process. It includes one firm-specific fact: the 'Cybersecurity Team'.


reasoning: The paragraph details the integration of the cybersecurity program into the company's internal risk management systems, including ERM, business continuity, and other programs, focusing on their own processes for managing cybersecurity threats, which matches Risk Management Process; third-party risk is mentioned only as one integrated component, not centrally. No frameworks, named roles, committees, dates, systems, or other unique verifiable facts are present, rendering it generic boilerplate.


reasoning: Paragraph describes the company's internal processes for evaluating and addressing cybersecurity risks through dedicated teams and integration into business processes, fitting Risk Management Process. It includes firm-specific named role (CSO) and teams, qualifying as Firm-Specific.


reasoning: This paragraph addresses the potential materiality of cybersecurity risks, expenditure of resources including cyber insurance, and states no past material incidents, aligning with Strategy Integration for business/financial impact and materiality assessments without any incident narrative.


reasoning: The paragraph details the company's engagement of external experts for audits, threat assessments, and penetration testing as part of its own cybersecurity risk management processes, making internal processes the central topic with third parties as a component (per tiebreaker). No named entities, frameworks, dates, or unique facts present, confirming generic boilerplate.


reasoning: The paragraph centers on the Board establishing a Cybersecurity Committee for oversight of cybersecurity risks and highlights the chair's specific expertise, directly matching Board Governance criteria for board/committee oversight and cyber expertise.


reasoning: The paragraph describes the Audit Committee's reporting to the Board on cybersecurity activities, Board briefings from management, and presentations from specific officers, making the Board and committee the grammatical subjects focused on oversight. This directly matches 'Board Governance' criteria for board/committee oversight of cyber risk and briefing cadence.


reasoning: The paragraph centers on the AGM board of directors overseeing the risk management program including cybersecurity, fitting Board Governance as the board is the grammatical subject. It includes a firm-unique named entity (AGM) plus frameworks, meeting Firm-Specific criteria with one unique fact but not two+ verifiable facts for higher specificity.


reasoning: The paragraph provides a standalone materiality conclusion stating no cybersecurity threats in 2023 materially affected or are likely to affect business, results, or financial condition, fitting Strategy Integration per guidelines. No incident narrative or other process details are described.


reasoning: The paragraph details the company's internal cybersecurity risk management program, including committee meetings, employee training, and policies, making 'Risk Management Process' the best fit as it focuses on their own processes. Vendor management is mentioned only as an example policy, not centrally. Specificity is Firm-Specific due to named role, committee, and quantified policies, but lacks two+ externally verifiable facts like dates or dollar amounts beyond organizational details.


reasoning: The paragraph focuses on the Board of Directors assigning the Audit Committee responsibility for cybersecurity risk oversight, including annual reviews and incident reporting, which directly matches Board Governance criteria where the board or committee is the grammatical subject.


reasoning: The paragraph identifies a specific individual (Jack Wang) in a management role with qualifications and reporting lines to executive officers and the Board, making 'Management Role' the clear fit as management roles are the grammatical subjects. No other category like Board Governance or Risk Management Process dominates.


reasoning: The paragraph describes the company's internal processes for continuous risk identification, assessment, and management of cybersecurity threats, fitting Risk Management Process. No specific frameworks, roles, dates, or unique facts are mentioned, making it generic boilerplate.


reasoning: The paragraph states no material cybersecurity incidents or immaterial expenses/penalties in the last three fiscal years, which is a standalone materiality conclusion without incident narrative, fitting Strategy Integration. No specific facts like named roles, dates, amounts, or frameworks are present, making it Generic Boilerplate.


reasoning: This paragraph details the company's incident response plan, including processes for triage, investigation, containment, and remediation, which are core elements of internal risk management processes. Third-party providers are mentioned as a component of the company's plan, not as the central focus of vendor oversight.


reasoning: This paragraph is a cross-reference to the Risk Factors section with no substantive cybersecurity disclosure, fitting 'None/Other' category.


reasoning: The paragraph details the company's internal risk identification, cross-functional stakeholder meetings, strategy development for threat mitigation and incident response, and escalation procedures, aligning with Risk Management Process as the company's own processes are the central topic. It contains no named frameworks, roles, committees, dates, or other firm-specific facts, making it Generic Boilerplate.


reasoning: Paragraph states no material past cybersecurity impacts for a specific fiscal year and notes potential future material risks, aligning with standalone materiality conclusions in Strategy Integration without incident narrative or process details.


reasoning: The paragraph details the company's internal audit program, including annual risk assessments that evaluate cybersecurity risks and report to business leaders, making it a clear description of their own internal risk management processes. No frameworks, named roles, committees, dates, or other unique firm-specific facts are mentioned, rendering it generic boilerplate.


reasoning: The paragraph focuses on the identification, reporting lines, and responsibilities of the CISO and CTO, with these management roles as the grammatical subjects, fitting 'Management Role'. It contains named roles and organizational details unique to the company but lacks two or more externally verifiable facts like dates or amounts, making it Firm-Specific.


reasoning: The paragraph details the company's internal processes for vulnerability assessment via third-party ethical hacks, penetration tests, and program reviews to improve controls, fitting Risk Management Process as third parties are a component of internal processes rather than the central vendor oversight topic. No frameworks, named roles, committees, dates, systems, or other verifiable facts are present, resulting in Generic Boilerplate.


reasoning: Paragraph discusses potential material adverse effects from hypothetical cybersecurity incidents and mentions cybersecurity insurance coverage limitations, fitting Strategy Integration which includes cyber insurance and materiality assessments without incident narrative. It uses generic, conditional boilerplate language with cross-reference to Risk Factors, containing no specific facts, frameworks, or unique company details.


reasoning: The paragraph details the company's use of third-party firms to support internal processes such as crisis simulations, monitoring, incident response, detection, forensics, and threat intelligence sharing, which aligns with Risk Management Process; vendors are mentioned as components rather than the central focus.


content_category: Third-Party Risk

reasoning: The paragraph centers on the company's processes for assessing, selecting, overseeing, and managing risks from third-party vendors, suppliers, and service providers, making vendor oversight the primary topic rather than a mere component of broader internal processes.


reasoning: The paragraph identifies the Chief Financial Officer directing the IT department for cybersecurity risk assessment and management, details their qualifications, and notes reporting to the Audit Committee, making 'Management Role' the best fit as it centers on management roles and reporting lines rather than the process itself.


reasoning: This paragraph details the company's internal cybersecurity risk management processes, including assessment of third-party service provider risks as a component, fitting 'Risk Management Process' per tiebreakers. Vendor oversight is integrated into broader processes, not the central standalone topic.


reasoning: The paragraph contains generic boilerplate language about cybersecurity threats, their commonality across industries and third parties, and hypothetical material impacts, with no substantive disclosure on processes, roles, incidents, or strategies. It fits None/Other as it lacks any specific cybersecurity governance or management details.


reasoning: The paragraph emphasizes the board of directors' overall oversight of cybersecurity risk management and reporting of significant incidents to the audit committee and board, making board/committee oversight the primary grammatical subject and central topic. While it mentions management responsibilities and the Vice President of Operations, these support the governance structure rather than shifting to another category.


reasoning: This paragraph details the company's internal processes for cybersecurity risk management, including integration into its Enterprise Risk Management framework and a dedicated program to protect critical systems, fitting the Risk Management Process category. No frameworks, named roles, dates, or other unique facts are present, confirming Generic Boilerplate specificity.


reasoning: The paragraph focuses on the Board of Directors and Audit Committee's oversight of cybersecurity risks, including update frequencies, making Board Governance the clear fit as board/committee are the grammatical subjects. It includes firm-specific elements like the named Audit Committee and its composition, qualifying as Firm-Specific but not reaching Quantified-Verifiable without two+ verifiable facts like dates or amounts.


reasoning: The paragraph focuses on the Board and audit committee's oversight responsibilities, delegation, and reporting cadence for cybersecurity risks, with the board/committee as the grammatical subjects, fitting Board Governance. It names the 'audit committee' as a firm-specific entity, meeting Firm-Specific criteria without frameworks or multiple verifiable facts.


reasoning: The paragraph focuses on the identification, tenure, and qualifications of specific management roles (Vice President of Information Systems and Chief Financial Officer) in overseeing cybersecurity risks, directly matching the Management Role category. No other category is as applicable, as it centers on personnel rather than processes, board, or incidents.


reasoning: The paragraph focuses on the identification, qualifications, and reporting lines of the Director of Cybersecurity and Head of Information Technology to the executive committee, making 'Management Role' the clear fit as management roles are the grammatical subjects.


reasoning: The paragraph focuses on the Board's oversight of cybersecurity risks and delegation to the Audit Committee, which reviews policies and has members with relevant experience, making Board Governance the clear fit as board/committee actions are the grammatical subjects. It includes one firm-specific fact (named Audit Committee), qualifying as Firm-Specific but not Quantified-Verifiable due to lacking two+ verifiable facts.


reasoning: The paragraph describes the company's own internal processes for monitoring, vulnerability remediation, incident response planning via tabletop exercises, penetration testing, and employee training, which aligns with Risk Management Process; third-party penetration testing is a minor component, not central. It includes a named internal policy unique to the company, qualifying as Firm-Specific, with no frameworks, dates, metrics, or named firms/products for higher levels.


reasoning: The paragraph details the company's implementation of the NIST Cybersecurity Framework and adoption of internal policies aligned with regulatory guidance, which directly matches Risk Management Process as it focuses on the company's own framework adoption and internal processes. It names a specific framework but lacks any firm-unique facts like roles, dates, or committees.


reasoning: The paragraph details the company's own internal processes and measures for managing cybersecurity risks, including incident response plans, risk assessments, encryption, monitoring, and training, which aligns with Risk Management Process. It lacks any named frameworks, roles, dates, systems, or unique facts, qualifying as Generic Boilerplate.


reasoning: The paragraph details the company's internal processes for monitoring, assessing, and escalating cybersecurity incidents via its information security team and incident response plan, aligning with Risk Management Process. It is not primarily about board oversight, management roles, or third parties.


reasoning: This paragraph details the company's internal vulnerability assessment program, review process, and enterprise-wide cybersecurity risk management framework, focusing on vulnerability management and preventative measures, which fits Risk Management Process. It contains no named frameworks, roles, dates, or other firm-specific or verifiable facts, qualifying as Generic Boilerplate.


reasoning: Paragraph describes the company's internal processes for monitoring, incident detection, severity assessment, triage, and response escalation via its Security Operations Center, which aligns with Risk Management Process. No frameworks, named roles, committees, dates, systems, or other unique verifiable facts are present; descriptions like 'incident severity matrix' and 'predefined severity tiers' are generic boilerplate applicable to any company.


reasoning: The paragraph details the company's own internal processes and measures for managing cybersecurity risks, such as vulnerability management, incident response, monitoring, and employee training, making 'Risk Management Process' the best fit; vendor risk management is mentioned only as one component among many. No frameworks, named roles, dates, or other specific facts are present, confirming Generic Boilerplate.


reasoning: Paragraph details a real cybersecurity incident with date detected, unauthorized access to IT system, data encryption, and specific response actions like internal investigation and engaging specialists, matching Incident Disclosure. Contains one firm-unique verifiable fact (specific incident date), qualifying as Firm-Specific.


category_confidence: medium

reasoning: Paragraph describes internal processes including business continuity/disaster recovery plans, incident response readiness testing via annual tabletop exercises, and cyber insurance review, which align with risk management and IR planning; ambiguity with Strategy Integration due to explicit cyber insurance mention but core focus is on company's own incident handling procedures.


reasoning: Paragraph describes a real cybersecurity incident with detection date, scope (portions of IT systems), and specific response actions (investigation, IR plan activation, system shutdown, law enforcement notification), clearly fitting Incident Disclosure. Contains one verifiable firm-specific fact (exact date), qualifying as Firm-Specific.


reasoning: This paragraph describes the ongoing status, unknown full scope, and material impact on business operations of a specific cybersecurity incident, directly fitting Incident Disclosure criteria including financial impact considerations tied to a real event (tiebreaker prioritizes Incident Disclosure over Strategy Integration). No specific facts like dates, names, or metrics are present, making it generic boilerplate.


reasoning: Paragraph describes a real cybersecurity incident including detection of unauthorized activity, containment/remediation steps, a specific isolation action on a dated timeline, and response involving experts, law enforcement, and regulators, fitting Incident Disclosure. Contains one firm-unique verifiable fact (specific date), qualifying as Firm-Specific but not Quantified-Verifiable due to lacking a second fact.


reasoning: The paragraph primarily describes the company's internal cybersecurity risk management processes, including a risk-based approach to assessing, identifying, and managing risks, and integration into overall risk management strategy, with board oversight as contextual. This aligns with Risk Management Process as the company's own processes are the central topic, not board as grammatical subject.


reasoning: The paragraph describes the company's internal processes for overseeing cybersecurity risks associated with third-party service providers, which falls under Risk Management Process per tiebreakers (internal processes mentioning vendors as a component). It also includes boilerplate materiality statements but the core topic is risk oversight processes rather than standalone strategy or pure third-party focus.


reasoning: The paragraph details incident response actions (notifying law enforcement, assessing regulatory obligations, future notifications based on investigation) for a real cybersecurity incident referenced in the Item 1.05 filing, which aligns with Incident Disclosure; the materiality assessment is tied to this specific event rather than standalone.


reasoning: This paragraph describes the details of a cybersecurity incident, including unauthorized access, data exfiltration of personally identifiable information, and ongoing response actions like notifications, fitting the Incident Disclosure category. No specific facts such as dates, named systems, roles, or quantifiable details are present, making it Generic Boilerplate.


reasoning: This paragraph details investigation findings and ongoing response to a specific cybersecurity incident, including absence of malware or ongoing access by the threat actor, which matches Incident Disclosure criteria for describing a real event and response actions. It contains no named entities, dates, frameworks, roles, or verifiable facts, making it Generic Boilerplate.


reasoning: The paragraph focuses on business/operational and financial impacts, materiality assessments for specific periods, and ongoing risks from the incident, without describing the incident details or response actions, aligning with Strategy Integration per guidelines and tiebreakers.


reasoning: Paragraph describes a real cybersecurity incident with timeline, scope (SharePoint files), and response actions (investigation with experts, containment), clearly fitting Incident Disclosure over others like Strategy Integration due to incident narrative. Contains three verifiable facts (two specific dates and named system), meeting Quantified-Verifiable criteria.


reasoning: Paragraph describes the scope, operational impacts, recovery status, and financial quantification of a specific cybersecurity incident, directly matching Incident Disclosure with tiebreaker for incident narrative plus financial impact.


reasoning: This is a standard forward-looking statement disclaimer with no reference to cybersecurity or any substantive disclosure, directly matching the 'None/Other' category for forward-looking disclaimers and non-cybersecurity content.


reasoning: Paragraph details response actions (contain/remediate) and incident scope/outcomes (systems unaffected, no unauthorized transactions or fund transfers, members continued operations) for a real event, clearly fitting Incident Disclosure. Lacks any named entities, dates, frameworks, roles, or verifiable metrics, rendering it Generic Boilerplate.


reasoning: This paragraph details a real cybersecurity incident, including the date of awareness, nature of the unauthorized access (illegal access and data encryption), and specific response actions (containment, internal investigation, external specialists, access restriction), clearly fitting Incident Disclosure. It includes one verifiable firm-specific fact (exact date), qualifying as Firm-Specific with no additional quantifiable elements like named firms or metrics.


reasoning: This paragraph details an actual cybersecurity incident involving unauthorized activity on the company's IT systems, including detection, containment, assessment, remediation, and a specific action taken on December 20, 2023, which matches Incident Disclosure criteria.


reasoning: Paragraph quantifies the material financial impact of the Incident on Q2 business operations and EPS without describing the incident itself or response actions, aligning with Strategy Integration's focus on business/financial impact and materiality assessments.


reasoning: Paragraph details a real cybersecurity incident with detection date, response actions (incident response protocols, investigation, engaging a cybersecurity firm, notifying regulators/law enforcement, containment), clearly fitting Incident Disclosure over others like Strategy Integration.


reasoning: Paragraph assesses the incident's lack of material impact on operations and financial condition as a standalone materiality conclusion without any incident narrative, fitting Strategy Integration per guidelines. No named entities, dates, frameworks, or unique facts; purely boilerplate language.


reasoning: Paragraph details a real cybersecurity incident including operational impacts (shipping, receiving, manufacturing) and response actions (interim measures, investigation, notifications), fitting Incident Disclosure; no financial materiality standalone conclusion. No named roles, committees, dates, systems, firms, frameworks, or quantifiable metrics; impacts are described generically without unique verifiable facts.


reasoning: This paragraph describes the scope and details of a real cybersecurity incident, including the number of affected consumers and data not compromised, which matches Incident Disclosure. It contains one quantified verifiable fact (35.5 million consumers) and company-specific practices, making it Firm-Specific but not reaching Quantified-Verifiable due to lacking a second verifiable fact.


reasoning: This is a standalone materiality conclusion stating no material impact from the cybersecurity incident on business or financials, with no incident narrative, matching Strategy Integration. No specific facts, frameworks, or unique details present, making it generic boilerplate.


reasoning: This paragraph discusses financial expenses, materiality assessment of no material impact on financial condition or operations, and ongoing business risks from 'this incident,' aligning with Strategy Integration as it focuses on business/financial impact and standalone materiality conclusion without incident narrative. No specific facts, frameworks, roles, or verifiable details present, making it generic boilerplate.


reasoning: Paragraph describes impacts (no material operational effects but material Q1 expenses) and response actions (notified federal law enforcement, cyber insurance) for a specific cybersecurity incident, fitting Incident Disclosure per guidelines and tiebreaker for incident narrative + financial impact.


reasoning: Paragraph describes regulatory delays in incident disclosure, collaboration with law enforcement, and apprehension of a suspect, which are incident response actions tied to a real cybersecurity event, fitting Incident Disclosure. Contains multiple verifiable facts including two specific dates and a named government agency.


reasoning: Paragraph details the scope of data exfiltration (additional data including PII and PHI from a patient support subsidiary) discovered during an investigation, describing a real incident without planning or generic processes. No named entities, dates, frameworks, roles, or verifiable facts present; descriptions like 'Company subsidiary' and data types are standard and non-unique.


reasoning: Paragraph describes response actions to a cybersecurity incident, including launching an investigation with forensic investigators, notifying law enforcement, regulatory authorities, and users, fitting Incident Disclosure criteria. No named entities, dates, frameworks, or verifiable facts present, resulting in Generic Boilerplate specificity.


reasoning: This paragraph describes a real ransomware incident including date, scope (internal IT systems), and response actions like containment and engaging experts, fitting Incident Disclosure. It contains one firm-unique verifiable fact (specific date), making it Firm-Specific but not Quantified-Verifiable.


reasoning: This paragraph describes actual response actions to a cybersecurity incident, including system restoration, retaining experts, law enforcement collaboration, notifications, and scope (limited to Change Healthcare systems), fitting Incident Disclosure. It contains one firm-unique fact (named system), making it Firm-Specific but not Quantified-Verifiable.


reasoning: Paragraph details a real cybersecurity incident including unauthorized access to the company's environment/files, misdirection of a specific $250,000 wire payment, and deletion of email messages, with no recovery of the payment, clearly fitting Incident Disclosure over other categories.


reasoning: The paragraph quantifies financial impacts (expenses and lost revenue) from a cybersecurity incident as part of fiscal closing, aligning with Strategy Integration's emphasis on business/financial effects rather than incident details, processes, or governance; medium confidence due to potential overlap with Incident Disclosure given the incident reference.


reasoning: Paragraph assesses business operations and financial materiality of an incident with a standalone conclusion of no material impact, fitting Strategy Integration; no incident narrative or response details present. Mentions Dropbox Sign as a unique named system, qualifying as Firm-Specific with one verifiable fact.


reasoning: Paragraph details a real cybersecurity incident including date, unauthorized access to a limited portion of the environment, response actions (activated plan, external experts, remediation, restoration), and no material impact, directly matching Incident Disclosure with incident narrative taking precedence over impact mention.


reasoning: Paragraph details the scope of data exfiltrated in a cybersecurity incident, specifying IT and financial information prepared for the Form 10-K, fitting Incident Disclosure as it describes a real event's impact without broader strategy or materiality conclusions.


reasoning: This paragraph describes the details of an actual cybersecurity incident, including data exfiltration, ongoing investigation of scope and sensitive information, and evaluation of required notifications, which aligns with Incident Disclosure. It lacks any named entities, dates, frameworks, roles, or verifiable facts, qualifying as Generic Boilerplate.


reasoning: Paragraph describes a real cybersecurity incident with unauthorized activity, detection, containment actions including a specific date of system isolation, expert retention, law enforcement coordination, and resumption of operations, directly matching Incident Disclosure criteria.


reasoning: This paragraph describes a real cybersecurity incident with details on what happened (unauthorized access and exfiltration of call/text logs), timeline, scope, and response actions (incident response activation, external experts), clearly fitting Incident Disclosure. It contains multiple verifiable specific dates and a named system unique to AT&T, exceeding two verifiable facts for Quantified-Verifiable.


reasoning: This paragraph details a real cybersecurity incident, including the date of identification (June 9, 2025), unauthorized access to information systems, discovery via employee communications from a threat actor, and activation of the incident response plan, which matches Incident Disclosure criteria.


reasoning: This paragraph is a standard forward-looking statement disclaimer with no reference to cybersecurity or any substantive disclosure, directly matching the 'None/Other' category description for forward-looking disclaimers and non-cybersecurity content.


reasoning: Paragraph assesses business/operational and financial impacts of a specific incident via materiality conclusions without any incident narrative (what happened, scope, response details), fitting Strategy Integration per guidelines and tiebreakers. No named entities, dates, frameworks, roles, or verifiable facts present; all language is boilerplate (e.g., 'certain expenses', 'material impact').


reasoning: This paragraph details a real cybersecurity incident with a specific date of detection, description of suspicious activity on IT systems, and response actions like isolation and external investigation, clearly fitting Incident Disclosure. No other categories apply as it is not about processes, governance, or strategy.


reasoning: Paragraph details a real cybersecurity incident with timing, unauthorized access to company data, and specific response actions (investigation, experts, counsel, law enforcement notification), clearly fitting Incident Disclosure. Includes one verifiable firm-specific fact (date), meeting Firm-Specific criteria but not reaching Quantified-Verifiable without a second fact.


reasoning: Paragraph details a specific cybersecurity incident's scope (lost production in domestic/Mexico ops for two weeks), response costs ($600k to experts), and financial materiality, fitting Incident Disclosure with tiebreaker for incident narrative + financial impact.


reasoning: Paragraph assesses potential financial materiality of an incident with a standalone conclusion of no expected material impact, without any incident narrative or response details, fitting Strategy Integration. Contains one firm-specific verifiable date (reporting period), qualifying as Firm-Specific.


reasoning: Paragraph details a real cybersecurity incident including detection date, scope on IT systems, immediate response actions (investigation, incident response plan, system shutdown), and ejection of threat actor, clearly fitting Incident Disclosure. Contains specific dates unique to this incident, meeting Firm-Specific but not two+ distinct verifiable facts for Quantified-Verifiable.


reasoning: This paragraph details a real cybersecurity incident, including the detection date, exfiltration of data from information systems (potentially containing personal information), and immediate response actions like containment and investigation with external assistance, clearly fitting Incident Disclosure. No other category applies as there is no mention of governance, processes, or financial impacts.


reasoning: Paragraph assesses financial impact and materiality of an incident without any incident narrative, description of events, or response actions, matching standalone materiality conclusions in Strategy Integration. No specific facts, frameworks, or unique company details present, confirming Generic Boilerplate specificity.


reasoning: The paragraph describes specific response actions taken to an actual cybersecurity incident, including threat containment, security enhancements, expert engagement, and notifications to authorities, fitting Incident Disclosure. No named entities, dates, frameworks, or verifiable facts are present, making it Generic Boilerplate.


reasoning: Paragraph provides an update on the real Change Healthcare cyberattack, including response actions like data assessment, notifications, and service restoration progress, directly matching Incident Disclosure criteria with reference to prior reports.


reasoning: Paragraph details company response to 'the incident' including stakeholder communication, adherence to process-based safety standards under a named company system, and ongoing operations, which describes incident response actions for a real event.


reasoning: This is a standalone materiality conclusion stating the incident is not reasonably likely to materially affect the company's financial condition or operations, with no incident narrative, matching Strategy Integration per tiebreakers. No specific facts, frameworks, or unique details present, making it generic boilerplate.


reasoning: This paragraph details the company's specific response actions to an actual cybersecurity incident, including activating its response plan, internal investigation with external advisors, taking systems offline, notifying law enforcement, and ongoing restoration and data assessment, aligning with Incident Disclosure criteria.


reasoning: Paragraph details a real cybersecurity incident including ransomware encryption, unauthorized data disclosure, specific dates, and management's materiality assessment, clearly fitting Incident Disclosure over Strategy Integration due to the incident narrative. Contains multiple verifiable facts like two specific dates and subsidiary location, meeting Quantified-Verifiable criteria.


reasoning: This paragraph details a real cybersecurity incident, including the date it was discovered (February 21, 2024), data exfiltration from information systems, and specific response actions like containment and investigation with assistance, clearly fitting Incident Disclosure over other categories. It includes one firm-specific verifiable fact (the date), qualifying as Firm-Specific per the decision test.


reasoning: This paragraph describes an actual cybersecurity incident involving file exfiltration, ongoing investigation into sensitive/personal information, and evaluation of notifications, fitting Incident Disclosure as it details a real event and response actions without financial impact narrative. No specific facts like dates, named systems, or quantifiable details are present, making it Generic Boilerplate.


reasoning: This paragraph is a standard legal disclaimer regarding the non-filed status of Item 7.01 under securities laws, containing no cybersecurity-related content or substantive disclosure.


reasoning: This paragraph details response actions to a specific cybersecurity incident, including containment, ongoing remediation efforts, and collaboration with experts to reinforce systems, which aligns with Incident Disclosure criteria for describing real events and incident response.


reasoning: Paragraph assesses the materiality of a cyber incident's impact on business operations and financial condition, matching standalone materiality conclusions under Strategy Integration with no incident narrative. No named entities, dates, frameworks, roles, or verifiable facts present, confirming Generic Boilerplate.


reasoning: Paragraph details the company's subsidiary's response to a real cybersecurity incident, including activation of protocols, containment (network offline), third-party investigation, law enforcement notification in Singapore, system restoration, and affected party notifications, which matches Incident Disclosure. Specificity is Firm-Specific due to the unique verifiable detail of Singapore law enforcement notification, with no frameworks or additional facts reaching higher levels.


reasoning: This paragraph details an actual cybersecurity incident, including the scope of unauthorized access to specific user data and what was not compromised, clearly fitting Incident Disclosure over other categories like Strategy Integration. It contains multiple verifiable facts: a precise user count and specific data fields (notably car registration numbers unique to this car-sharing company), meeting the threshold for Quantified-Verifiable.


reasoning: The paragraph discusses incorporating cybersecurity risk management into overall enterprise risk management programs with shared methodologies, reporting, and governance, directly fitting Risk Management Process due to ERM integration. It contains no named entities, frameworks, roles, dates, or unique details, qualifying as Generic Boilerplate.


reasoning: This paragraph is a forward-looking disclaimer about potential cybersecurity incidents and a cross-reference to Risk Factors, providing no substantive disclosure on governance, processes, incidents, or strategy.


reasoning: The paragraph describes the company's own internal cybersecurity risk management process, including a risk-based approach to evaluating third-party vendors as a component, which fits Risk Management Process per tiebreakers (internal processes mentioning vendors). No specific facts, frameworks, roles, or verifiable details are present, making it generic boilerplate.


reasoning: The paragraph focuses on the Committee's oversight of cybersecurity risks through receiving periodic reports and updates from management on incidents, and reporting to the full Board, which directly matches 'Board Governance' as the board committee is the grammatical subject.


reasoning: The paragraph focuses on the board of directors' oversight of cybersecurity risks and its receipt of updates from the audit committee, directly matching the Board Governance category as the board is the grammatical subject.


reasoning: The paragraph focuses on the board of directors and its audit committee as the subjects overseeing cybersecurity risk management, directly matching Board Governance. It includes a named committee (audit committee), qualifying as Firm-Specific with one unique fact.


reasoning: The paragraph provides a standalone materiality assessment of a cybersecurity incident's impact on financial condition and results of operations, with no incident narrative or description of what happened, fitting Strategy Integration per guidelines and tiebreaker. No specific facts, frameworks, roles, dates, or quantifiable details are present, making it generic boilerplate.


reasoning: Paragraph assesses financial materiality and business impact of an incident on the Company and subsidiary Targus, with a standalone materiality conclusion and no incident narrative, fitting Strategy Integration per guidelines and tiebreakers. Named subsidiary Targus is a firm-unique fact, but lacks a second verifiable fact like dates or amounts for higher specificity.


reasoning: This paragraph describes the results of remediation and response actions to a cybersecurity incident, including removal of the third party from IT systems, restoration of access, and confirmation of data integrity, which aligns with Incident Disclosure. It contains no named entities, specific dates, frameworks, roles, or verifiable metrics, rendering it Generic Boilerplate.


reasoning: The paragraph describes ongoing investments and enhancements to the company's internal controls and processes for protecting systems and data, which aligns with the company's own risk management processes. No specific details, roles, frameworks, or incidents are mentioned, making it generic boilerplate.


reasoning: The paragraph provides a generic, boilerplate statement on dependence on IT systems and third-party technologies without detailing any specific risk management processes, board oversight, vendor management, incidents, or strategies, resulting in no substantive disclosure.


reasoning: The paragraph details the company's own cyber risk management program for identifying, assessing, managing, mitigating, and responding to threats, integrated with enterprise risk management, which aligns with 'Risk Management Process'. It contains no named frameworks, roles, dates, or other specific facts, qualifying as Generic Boilerplate.


reasoning: The paragraph focuses on the identification, experience, and joining date of a specific executive cybersecurity role, directly matching the Management Role category definition.


reasoning: This paragraph discusses the company's implementation of a cybersecurity program as part of its enterprise risk management to assess, identify, and manage cybersecurity risks, directly matching 'Risk Management Process' as it focuses on internal processes without mentioning board, management roles, vendors, incidents, or strategy.


reasoning: The paragraph describes the design and purpose of the company's own cybersecurity program to protect information systems, which aligns with Risk Management Process as it focuses on internal risk management and strategy without mentioning boards, incidents, or third parties.


reasoning: The paragraph outlines oversight responsibilities for data privacy and cybersecurity policies, including evaluation of the Cybersecurity Committee's composition and performance, which directly pertains to board or committee governance of cyber risks.


reasoning: The grammatical subjects are management roles ('head of the ITS Department' and 'executive management') responsible for assessing and managing cybersecurity risks, directly matching 'Management Role'. The named role 'head of the ITS Department' is a firm-unique fact, qualifying as Firm-Specific with no additional verifiable facts for higher specificity.


reasoning: The paragraph centers on the Board of Directors as the subject receiving quarterly reports from the CISO and CIO on cybersecurity threats, risks, and mitigation processes, which matches Board Governance criteria for board oversight and briefing cadence.


reasoning: The paragraph describes Mr. Tao's general professional experience in business consultation and marketing with no reference to cybersecurity, roles, processes, or incidents, making it non-substantive cyber disclosure.


reasoning: The paragraph details the company's own internal incident response and recovery frameworks, including testing frequency and methods, which aligns with Risk Management Process covering IR planning. It contains firm-unique details like the biannual testing cadence, qualifying as Firm-Specific.


reasoning: The paragraph describes the audit committee's reporting to the board on cybersecurity activities and the board's receipt of briefings on cyber risk management, making the board/committee the grammatical subjects fitting Board Governance perfectly.


reasoning: This paragraph provides generic boilerplate description of cybersecurity vulnerabilities and common threats like malware, ransomware, and phishing, with no mention of board oversight, management roles, internal processes, incidents, or strategy; it lacks substantive disclosure fitting any other category.


reasoning: Paragraph describes general strategic and material risk oversight by the board and executive officers with no reference to cybersecurity, qualifying as non-cybersecurity content with no substantive cyber disclosure.


reasoning: The paragraph centrally describes the company's process for reviewing and monitoring key third-party IT providers' cybersecurity measures, including use of a specific tool, making Third-Party Risk the most applicable category. Vendor oversight is the primary focus, not a mere component of broader internal processes.


reasoning: The paragraph details the company's internal adoption of a PII policy and structured employee cybersecurity training (annual education, quarterly testing), which aligns with Risk Management Process as it focuses on the company's own processes. No named frameworks, roles, committees, dates, or other unique verifiable facts are present, making it generic boilerplate applicable to many filings.


reasoning: This is a standalone materiality conclusion affirming no cybersecurity incidents have materially affected the company, which aligns with Strategy Integration per the guidelines. No incident narrative or other process details are present.


reasoning: This paragraph provides a detailed description of the scope of 'The Incident,' specifying data affected and what was not compromised (e.g., no access to customer funds or private keys), clearly fitting Incident Disclosure as it describes a real event's details. No specific facts like dates, named roles, committees, systems, firms, or metrics are present, only generic data types and terms, making it Generic Boilerplate.


reasoning: Paragraph focuses on the qualifications and expertise of the company's information technology team in cybersecurity, aligning with Management Role as it describes management-level qualifications. Lacks any named roles, frameworks, dates, or unique facts, making it generic boilerplate.


reasoning: The paragraph focuses on identifying specific management roles (CIO and Director of IT Security, Risk and Compliance) and their qualifications/experience, making 'Management Role' the best fit as these roles are the grammatical subjects.


reasoning: The paragraph discusses cybersecurity risk management as an integral part of the company's overall enterprise risk management program, directly matching 'ERM integration' under Risk Management Process. No named entities, frameworks, dates, roles, or other specific facts are present, making it generic boilerplate.


reasoning: The paragraph introduces the company's cybersecurity program as a critical element of its overall risk management approach, directly aligning with descriptions of internal risk management processes. It contains no named entities, frameworks, dates, roles, or unique facts, making it generic boilerplate.


reasoning: Paragraph describes the eradication phase of incident response, a component of the company's internal IR planning processes under Risk Management Process. No named frameworks, roles, dates, or company-specific details present, making it generic boilerplate.


reasoning: The paragraph focuses on the 'internal cybersecurity coordinator' role, its responsibilities, collaboration with the IT team, and reporting line to the CEO, making 'Management Role' the best fit as it identifies a management cybersecurity position and reporting structure.


reasoning: The paragraph centers on the Board receiving regular updates from the Audit Committee and Cybersecurity team regarding cybersecurity risks, indicators, and remediation, making the board the grammatical subject and fitting Board Governance. It includes firm-specific named entities (Audit Committee, Cybersecurity team) but lacks two or more externally verifiable facts like dates or amounts, confirming Firm-Specific.


reasoning: The paragraph identifies specific management roles (CIO and VP of Information Security) and their responsibilities in overseeing cybersecurity, directly matching the 'Management Role' category definition. Named roles provide firm-specific details but do not include two or more externally verifiable facts like dates or quantities, confirming Firm-Specific level.


reasoning: The paragraph details aspects of the company's internal cybersecurity programs, including threat intelligence, industry/government engagement, and external expert testing of controls and capabilities, which aligns with Risk Management Process as it focuses on the company's own processes rather than board oversight, incidents, or third-party focus.


reasoning: The paragraph describes the Board and Audit Committee's receipt of regular reports from management on cybersecurity risks and updates on incidents, making board/committee oversight the central topic and grammatical subject. This fits 'Board Governance' precisely.


reasoning: The paragraph discloses no significant cybersecurity incidents or financial impacts (expenses, penalties, settlements) for two specific fiscal periods, qualifying as a standalone materiality conclusion under Strategy Integration with no incident narrative.


reasoning: The paragraph identifies the CFO serving as CISO and describes their role in managing cybersecurity processes, making 'Management Role' the most applicable category as it centers on CISO identification and responsibilities. Risk Management Process is secondary since the processes are mentioned but the focus is on the management role performing them.


reasoning: The paragraph describes management's monitoring of cybersecurity processes (prevention, detection, mitigation, remediation), which aligns with internal risk management processes; mentions of service providers and ISP personnel are components, not the central topic per tiebreakers. No frameworks, named roles, committees, dates, or other verifiable facts are present, making it generic boilerplate.


reasoning: The paragraph describes the company's own internal incident response plan, including ongoing review, refinement, and updates based on lessons learned and best practices, which fits Risk Management Process. No specific facts, frameworks, roles, or unique company details are present, making it generic boilerplate.


reasoning: The paragraph describes the company's internal processes for employee training and phishing simulations, which directly fits Risk Management Process as it covers awareness and incident training. No board, management roles, vendors, incidents, or strategy elements are mentioned.


reasoning: This is a standalone materiality conclusion asserting no material cybersecurity incidents as of specific dates, with no incident narrative, aligning with Strategy Integration. Two specific dates qualify it as Quantified-Verifiable.


reasoning: The paragraph details how cybersecurity updates flow from CSO/CISO to the Global Security Steering Committee, which reports quarterly to the Board and Audit Committee, emphasizing board and committee oversight and briefing cadence.


reasoning: The paragraph describes the company's recognition of the importance of developing, implementing, and maintaining cybersecurity measures to protect systems and data, which aligns with the company's own internal risk management processes. No board, management roles, incidents, or third-parties are mentioned.


reasoning: The paragraph describes cyber insurance coverage to mitigate financial losses from cyber incidents, which aligns with Strategy Integration's inclusion of cyber insurance and financial impact mitigation. It contains no named entities, frameworks, dates, or unique company-specific details, making it generic boilerplate.


reasoning: The paragraph describes the company's own internal processes for identifying, assessing, and managing cybersecurity risks to its systems and data, which fits Risk Management Process. Third-party services are mentioned only as a component of the systems covered, not as the central topic.


reasoning: The paragraph describes the company's own internal strategies for assessing, identifying, and managing cybersecurity risks, including monitoring tools and user training, fitting Risk Management Process. It lacks any named frameworks, roles, dates, or unique facts, making it Generic Boilerplate.


reasoning: The paragraph details the company's internal processes for threat analysis, policy definition, protection implementation, monitoring, and incident response by cybersecurity professionals, which aligns with Risk Management Process as it focuses on the company's own operations. No named roles, frameworks, dates, or other unique facts are present, making it generic boilerplate.


reasoning: The paragraph describes the company's internal cybersecurity training program for employees and contractors, including communication of security policies and practices, which fits Risk Management Process as it details an own internal process. No specific facts, frameworks, roles, or dates are mentioned, making it generic boilerplate.


reasoning: Paragraph details employee training and a risk management process including due diligence and monitoring of third-party providers, which describes the company's internal processes with vendors as a component, fitting Risk Management Process per tiebreakers.


reasoning: Paragraph provides a standalone materiality conclusion on past cybersecurity incidents and expenses (no material incidents, immaterial costs, zero penalties/settlements), fitting Strategy Integration per tiebreakers. Contains two verifiable facts: specific time period ('last three fiscal years') and quantified zero penalties/settlements.


reasoning: The paragraph describes the company's own internal cybersecurity risk management framework for identifying, assessing, mitigating risks, and protecting information assets, directly matching Risk Management Process. It contains no named frameworks, roles, dates, or other unique facts, making it Generic Boilerplate.


reasoning: The paragraph describes the Board of Directors' oversight of cybersecurity through quarterly updates and annual discussions in enterprise risk management, making 'Board Governance' the clear fit as the board is the grammatical subject. No specific facts like named committees, roles, dates, or frameworks are present, confirming Generic Boilerplate specificity.


reasoning: The paragraph identifies specific management executives (CFO, COO, CEO) and their cybersecurity responsibilities, making 'Management Role' the clear fit as these roles are the grammatical subjects. Naming these C-suite roles with company-unique responsibility assignments qualifies as Firm-Specific, as it details organizational structure beyond generic terms.


reasoning: The paragraph describes the company's establishment of an internal multi-disciplinary team for cybersecurity awareness, training, and information sharing, which is part of its own risk management processes. It contains two verifiable facts: a specific year (2023) and a named internal program/team (CyberSmart Defender Network).


reasoning: The paragraph details the company's own internal IRP and annual tabletop exercises for incident response preparation and improvement, which aligns with Risk Management Process as it focuses on IR planning. No named entities, frameworks, dates, roles, or verifiable facts are present, confirming Generic Boilerplate specificity.


reasoning: The paragraph provides generic, high-level goals for cybersecurity without detailing any board oversight, management roles, internal processes, incidents, third-party risks, or strategy integration, making it non-substantive disclosure.


reasoning: The paragraph discusses the company's planned comprehensive process for identifying, assessing, and managing cybersecurity risks as part of its broader risk management system, directly matching Risk Management Process. It includes one firm-unique fact (BDTP TM as a named system), qualifying as Firm-Specific with no additional verifiable facts for higher specificity.


reasoning: This paragraph provides a standalone materiality conclusion regarding the incident's impact on financial condition or results of operations, with no incident narrative, fitting Strategy Integration per guidelines and tiebreaker. It contains no specific facts, frameworks, or unique company details, making it Generic Boilerplate.


reasoning: The paragraph details the company's internal multi-layered cybersecurity program, including administrative, physical, technical measures, and incident response plan, which fits Risk Management Process as it focuses on their own processes without mentioning vendors centrally or board/management as subjects.


reasoning: This is a standalone materiality conclusion stating no cybersecurity threats materially affected or are likely to affect business strategy, results of operations, or financial condition, which fits Strategy Integration. The cross-reference to Risk Factors is ancillary and does not change the category.


reasoning: The paragraph focuses on the company's own internal cybersecurity risk assessment and management processes, which are implemented by specific management individuals, aligning with Risk Management Process as the company's processes are the central topic. It contains named roles unique to the company, qualifying as Firm-Specific but not reaching Quantified-Verifiable without additional verifiable metrics like dates or amounts.


reasoning: The paragraph details ongoing response actions to a specific cybersecurity incident, including forensic analysis and investigation, which aligns with Incident Disclosure criteria for describing real event response without incident narrative details.


reasoning: The paragraph directly addresses the day-to-day management of cybersecurity by IT staff and their qualifications (lack of specialized training), making 'Management Role' the most applicable category as management roles are the grammatical subject. No named roles, committees, frameworks, dates, or other verifiable firm-specific facts are present, rendering it generic boilerplate.


reasoning: This paragraph details incident response actions such as restoring systems, retaining experts, working with law enforcement, and notifying regulators, which aligns with Incident Disclosure for a real event. It contains no named entities, dates, frameworks, or unique facts, qualifying as Generic Boilerplate.


reasoning: This paragraph provides a standalone materiality conclusion regarding the Incident's impact on financial condition and operations, with no incident narrative or other process details, fitting Strategy Integration per guidelines. No specific facts, frameworks, or unique company details are present, confirming Generic Boilerplate specificity.


reasoning: This is a standalone materiality conclusion stating the incident is not reasonably likely to materially impact financial condition or results of operations, which fits Strategy Integration per guidelines. No incident details or narrative are provided, distinguishing it from Incident Disclosure.


reasoning: The paragraph focuses on cyber insurance reimbursement for costs and losses from a cyber incident, which aligns with business/financial impact and cyber insurance under Strategy Integration, without describing the incident itself or other processes.


reasoning: This paragraph provides a standalone materiality conclusion regarding the incident's lack of material impact on operations and finances, with no incident narrative or description of events, fitting Strategy Integration per guidelines. It contains no specific facts, frameworks, or unique details, making it Generic Boilerplate.


reasoning: Paragraph describes the company's own internal cybersecurity programs including policies, procedures, assessments, monitoring, response plans, and testing, fitting Risk Management Process. Names the specific bank subsidiary maintaining these programs, qualifying as a firm-specific fact.


reasoning: Paragraph assesses business and financial impacts of 'the Incident' (operations not disrupted, potential losses from revenue/expenses/remediation), fitting Strategy Integration for materiality and impact without incident narrative. No specific facts like dates, roles, or named entities; all boilerplate conditional language.


reasoning: The paragraph addresses potential material financial impact and ongoing forensic assessment without describing the incident details, aligning with Strategy Integration's inclusion of business/financial impact and materiality assessments; no incident narrative present to trigger Incident Disclosure.


reasoning: This paragraph provides a standalone materiality conclusion regarding the incident's impact on operations and financial condition, with no incident narrative or other details, fitting Strategy Integration per guidelines and tiebreakers. No specific facts, frameworks, or unique company details are present, confirming Generic Boilerplate specificity.


reasoning: The paragraph describes cybersecurity insurance coverage and future guidance on assessment, aligning with Strategy Integration (cyber insurance and business/financial impact). It lacks any named entities, frameworks, dates, roles, or unique company facts, making it generic boilerplate.


reasoning: Paragraph describes an actual cybersecurity incident (threat actor access and exfiltration of limited data including PII) and response actions (notifications to affected parties and regulators), matching Incident Disclosure. Lacks any named entities, dates, frameworks, roles, or verifiable facts, making it Generic Boilerplate.


reasoning: Paragraph focuses on qualifications of an individual (likely a named executive), identifies specific management roles (CTO, senior director), and their reporting lines to the Audit Committee, fitting Management Role; the brief risk program mention is secondary and generic.


reasoning: Paragraph discusses ongoing business and financial risks (litigation, customer behavior, regulatory scrutiny, insurance costs) stemming from a cybersecurity incident, fitting Strategy Integration's focus on business/financial impacts and cyber insurance, without any incident narrative or response details.


reasoning: This paragraph describes incident response actions, specifically notifying law enforcement and regulatory bodies about 'the matter,' which fits Incident Disclosure as it includes response actions for a real event. No other category applies, as it lacks board oversight, processes, or strategy details.


reasoning: This paragraph contains a standalone materiality conclusion regarding the incident's lack of material impact on operations and financial condition, which aligns with Strategy Integration. It lacks any incident narrative or other category-specific elements.


reasoning: The paragraph discusses waivers under Credit and Lease Agreements with no reference to cybersecurity, qualifying as non-cybersecurity content under None/Other.


reasoning: The paragraph assesses the materiality of an incident's impact on operations and financials without any incident narrative or details, directly matching standalone materiality conclusions under Strategy Integration. No named entities, dates, frameworks, roles, or verifiable facts are present, confirming Generic Boilerplate specificity.


reasoning: This paragraph details specific incident response actions, including notifying law enforcement and regulatory bodies about 'the matter,' which qualifies as Incident Disclosure per the inclusion of response actions to a real event. No other category fits as centrally, and it lacks vendor focus or internal processes.


reasoning: This paragraph provides a standalone materiality conclusion regarding the incident's impact on financial condition and operations, with no incident narrative, fitting Strategy Integration per guidelines. It contains no specific facts, frameworks, or unique company details, making it Generic Boilerplate.


reasoning: Paragraph assesses the incident's lack of material operational disruption and ongoing evaluation of financial, legal, reputational impacts and remediation costs, aligning with Strategy Integration's focus on business/financial impacts and materiality conclusions without any incident narrative. No named entities, dates, frameworks, or verifiable facts present, confirming Generic Boilerplate.


reasoning: Paragraph discusses financial and operational materiality of an incident without describing the incident itself, matching standalone materiality conclusions in Strategy Integration. No named entities, dates, frameworks, or unique facts present, making it generic boilerplate.


reasoning: The paragraph describes response actions to a specific cybersecurity incident ('this incident'), including closing access and notifying customers, fitting Incident Disclosure. No named entities, dates, frameworks, roles, or verifiable facts present, making it generic boilerplate incident response language.


reasoning: The paragraph describes an executive resignation and interim appointment in the Korean subsidiary with no reference to cybersecurity risks, incidents, processes, or governance, making it non-substantive cyber disclosure.


reasoning: Paragraph details response actions (containment, restoration of IT environment and operations) to a real cybersecurity incident, fitting Incident Disclosure. No named entities, dates, frameworks, or unique firm facts; uses vague terms like 'the incident' and 'core information technology environment,' making it Generic Boilerplate.


reasoning: Paragraph narrates a real cybersecurity incident with dates of notification and confirmation of exposure, centrally describing the event per Incident Disclosure category. Contains three verifiable facts (two specific dates and named subsidiary), exceeding the threshold for Quantified-Verifiable.


reasoning: The paragraph addresses financial impacts (direct costs for incident response) and cyber insurance recoveries, which aligns with Strategy Integration's focus on business/financial impact and cyber insurance, without describing the incident itself or any processes. No named entities, dates, frameworks, or verifiable facts are present, confirming Generic Boilerplate specificity.


reasoning: This paragraph describes ongoing investigation, undetermined scope of affected data, and response actions including collaboration with a cyber insurance provider, which fits Incident Disclosure as it details real incident response without a full narrative. No specific facts like dates, named entities, or quantifiable details are present, making it Generic Boilerplate.


reasoning: Paragraph describes an ongoing cybersecurity incident investigation, scope assessment of exfiltrated personal information, and planned notifications, which matches Incident Disclosure criteria for real event response actions. No named entities, dates, frameworks, roles, or verifiable facts present, making it Generic Boilerplate.


reasoning: The paragraph describes response actions to a specific cybersecurity incident, including containment and system restoration, which fits Incident Disclosure as it covers real event response without financial details or other topics.


reasoning: Paragraph describes response actions to a specific cybersecurity incident (investigation, engaging experts, notifying law enforcement) and includes financial impact assessment, fitting Incident Disclosure per tiebreaker for incident narrative + financial impact. No specific facts like dates, named firms, or unique details present, making it generic boilerplate.


reasoning: Paragraph focuses on financial materiality assessment of an incident ('reasonably likely to have a material impact') and ongoing analysis, matching Strategy Integration for standalone materiality conclusions without incident narrative or description of the event itself.


reasoning: This paragraph provides a standalone materiality conclusion regarding the financial impact of an incident without any narrative details about the incident itself, fitting Strategy Integration. No specific facts, frameworks, or unique company details are present, making it generic boilerplate.


reasoning: The paragraph assesses the business and financial impact of an incident via standalone materiality conclusions without any incident narrative or response details, directly matching Strategy Integration. No specific facts, frameworks, roles, or verifiable details are present, making it Generic Boilerplate.


reasoning: This paragraph details ongoing incident response actions, including investigation and forensic analysis into potential data exfiltration by threat actors, which describes elements of a real cybersecurity incident. No specific facts, dates, names, or frameworks are present, rendering it generic boilerplate.


reasoning: The paragraph references an actual ongoing cybersecurity incident ('the disruption,' 'the incident'), describes limited scope (inaccessibility of certain networks and transactional services), and notes response action (providing updates via status page), fitting Incident Disclosure over None/Other despite brevity and cross-reference.


reasoning: Paragraph describes the scope and actions of a specific cybersecurity incident (access, exfiltration, encryption on non-production systems), fitting Incident Disclosure. No named entities, dates, frameworks, roles, or verifiable facts present, making it Generic Boilerplate.


reasoning: Paragraph describes a real cybersecurity incident including date, nature (system outage), and response (activating incident response team), matching Incident Disclosure criteria exactly.


reasoning: The paragraph discusses assessing the financial and operational impact of an incident, including a materiality determination that cannot yet be made, fitting Strategy Integration for business/financial impact and materiality assessments without incident narrative. No specific incident details are provided, ruling out Incident Disclosure.


reasoning: Paragraph describes operational scope and impacts from a cybersecurity incident (disruptions to online ordering, shops open, deliveries uninterrupted) in an Item 1.05 filing, fitting incident disclosure despite lacking 'what happened' details or response actions. Not Strategy Integration as no financial impacts, materiality assessments, or insurance mentioned.


reasoning: This paragraph describes post-incident response actions including system restoration, ongoing minor impacts, and closure of the authorities' investigation for a specific cyber incident, fitting Incident Disclosure. No named entities, dates, frameworks, roles, or verifiable facts are present, making it Generic Boilerplate.


reasoning: The paragraph details a specific incident response action (mailing notification letters based on investigation findings), which qualifies as Incident Disclosure including response actions to a real event. It contains no named entities, dates, frameworks, roles, or verifiable facts beyond generic language, resulting in Generic Boilerplate.


reasoning: This paragraph details a real cybersecurity incident with a specific date, cause (systems outage from cyber attack), and response (activating incident response team), clearly fitting Incident Disclosure. It does not describe general processes or other categories.


reasoning: The paragraph describes a real cybersecurity incident including the nature of the access (threat actor to IT system with sensitive personal information) and response actions (notifications to affected parties and regulators), fitting Incident Disclosure. No specific facts like dates, named systems, or quantifiable details are present, making it Generic Boilerplate.


reasoning: The paragraph details the operational impacts of a specific cybersecurity incident (shipping, receiving, manufacturing, back office) and response measures (temporary fixes, restoration), qualifying as Incident Disclosure. It lacks any named entities, dates, frameworks, or verifiable facts unique to the company, making it Generic Boilerplate.


reasoning: Paragraph narrates a real cybersecurity incident including date of awareness and unauthorized access to systems, directly matching Incident Disclosure criteria. Contains one firm-unique verifiable fact (specific date), qualifying as Firm-Specific per decision test.


reasoning: This paragraph details the operational impact of a cybersecurity incident (website inaccessibility) and the company's response by creating a dedicated communications site, directly matching Incident Disclosure criteria including response actions. The specific URL is a firm-unique fact, qualifying as Firm-Specific with no additional verifiable facts for higher specificity.


reasoning: Paragraph describes actual incident response actions (activating process, determining cause as fourth-party vendor compromise), meeting criteria for Incident Disclosure with a real event narrative. No named entities, dates, frameworks, roles, or verifiable facts present, making it Generic Boilerplate.


reasoning: This paragraph provides a standalone materiality conclusion regarding the financial and operational impact of an incident, with no incident narrative or description of events, fitting Strategy Integration. It contains no specific facts, frameworks, or unique company details, making it generic boilerplate.


reasoning: This paragraph discusses ongoing assessment of material financial impact from 'the incident' without any incident narrative, fitting Strategy Integration for materiality assessments. No specific details, names, or verifiable facts present, confirming Generic Boilerplate.


reasoning: Paragraph discusses expected financial impacts and materiality conclusions for an incident without any narrative description of the event itself, aligning with Strategy Integration. Contains one firm-specific verifiable fact (Q4 2023 period), qualifying as Firm-Specific.


reasoning: Paragraph assesses the material impact of an incident on operations and financials without any incident narrative or description, matching standalone materiality conclusions under Strategy Integration. No named entities, dates, frameworks, or unique facts, confirming Generic Boilerplate.


reasoning: Paragraph details the scope and operational impact of a specific cybersecurity incident, including effects on financial and operating reporting systems for approximately six weeks, qualifying as Incident Disclosure per guidelines and tiebreaker for incident narrative. No named roles, committees, dates, systems, frameworks, or other verifiable facts; 'approximately six weeks' is a vague quantifier, resulting in Generic Boilerplate.


reasoning: Paragraph describes impacts and response actions (rebuilding website, enhancing protocols) to a specific cyber incident, fitting Incident Disclosure despite limited narrative; financial costs are secondary per tiebreaker prioritizing incident context over standalone Strategy Integration.


reasoning: The paragraph focuses on monitoring the timing and materiality of an incident, aligning with materiality assessments under Strategy Integration, especially as a standalone statement without any incident narrative or description.


reasoning: This paragraph details a real cybersecurity incident with date of notification, unauthorized activity on IT systems, and response steps, clearly fitting Incident Disclosure. It contains one firm-specific verifiable fact (exact date), qualifying as Firm-Specific.


reasoning: The paragraph details the company's internal processes for monitoring, developing, and mitigating cybersecurity risks through IT networks and infrastructure, aligning with Risk Management Process. It contains no named entities, frameworks, dates, roles, or verifiable facts, making it Generic Boilerplate.


reasoning: Paragraph describes temporary response measures (manual processing, alternative channels) during system restoration following a cybersecurity incident, directly matching Incident Disclosure criteria for response actions to a real event. No named entities, dates, frameworks, roles, or verifiable facts present, making it generic boilerplate applicable to any company.


reasoning: Paragraph details progress on incident response actions like interim measures and system restoration timeline for a specific subsidiary's systems, directly fitting Incident Disclosure criteria including response to a real event. Contains two externally verifiable facts (named system and date), meeting Quantified-Verifiable threshold.


reasoning: This paragraph details specific response actions taken after an unauthorized access incident, including notifying regulatory authorities and working with law enforcement, which aligns with Incident Disclosure criteria for real event response.


reasoning: The paragraph details the company's internal processes for evaluating cybersecurity incidents, escalation procedures, Incident Response Program, and Business Continuity Plans, fitting Risk Management Process; mentions of third-party vendors are a minor component, not central. It includes one firm-specific named role (CSO), qualifying as Firm-Specific with no frameworks or additional verifiable facts.


reasoning: This paragraph details a real cybersecurity incident including the date of detection, nature of the attempt (fraudulent fund obtainment), and detection method, clearly fitting Incident Disclosure. It includes one verifiable firm-specific fact (exact date), qualifying as Firm-Specific.


reasoning: Paragraph details the company's internal cybersecurity processes including threat assessment, layered security, training, tools, third-party assessments, and vendor risk management, making 'Risk Management Process' the best fit; third-party elements are integrated components, not central per tiebreakers.


reasoning: The paragraph details the company's own internal cybersecurity risk management processes, including adoption of the CIS framework, annual assessments, regular risk assessments integrated with ERM, infrastructure design, dedicated personnel, and training programs. Board committee review is mentioned as a component but not the central focus.


reasoning: The paragraph describes the company's own internal risk management processes, including framework adoption (NIST CSF), security controls, training, monitoring, third-party oversight as a component, and resiliency planning, which aligns with 'Risk Management Process' per guidelines and tiebreakers. It names one framework (NIST CSF) but lacks firm-specific or quantifiable facts, making it Sector-Adapted.


reasoning: The paragraph primarily describes the company's internal cybersecurity processes, including monitoring, penetration testing, training, team activities, and third-party risk assessments as integrated components, fitting Risk Management Process; third-party oversight is not central but part of overall processes per tiebreakers. It includes firm-unique named roles and a specific year, qualifying as Firm-Specific but lacking two+ externally verifiable facts like amounts or named firms for higher specificity.


reasoning: The paragraph centers on the Board's and Risk Committee's oversight of cybersecurity risks, including briefing cadence, reviews of penetration testing, and reporting protocols, making Board Governance the clear fit. It includes firm-specific elements like the named 'Risk Committee' and quarterly meeting cadence, qualifying as Firm-Specific but lacking two+ externally verifiable facts like dates or amounts for higher specificity.


reasoning: The paragraph centers on identifying the CISO and CTO, their qualifications, experience, reporting lines (CISO to CTO), and responsibilities, making 'Management Role' the most applicable category. It includes multiple verifiable facts like named roles, committees, prior firms (IBM, Axway, OWASP), specific projects (Security Shepherd), and quantified experience years.


reasoning: The paragraph outlines the company's overall cybersecurity program, including governance, cross-functional approach, technical safeguards, incident response planning, third-party risk (as one component), and training, which centrally describes the company's own internal risk management processes. Board and management mentions are embedded within this broader program description, not the primary focus.


reasoning: The paragraph provides a standalone materiality conclusion stating no material cybersecurity impacts in fiscal 2024, with hypothetical future risks and a cross-reference, fitting Strategy Integration per guidelines. It includes one firm-specific verifiable fact (fiscal 2024 period), qualifying as Firm-Specific.


reasoning: This paragraph is a generic forward-looking disclaimer about potential cybersecurity threats and their possible business impacts, with no substantive disclosure on governance, processes, incidents, or specific strategies, fitting 'None/Other'.


reasoning: The paragraph primarily describes the composition of the internal Risk Management Team with specific named executive roles and their responsibilities in monitoring cybersecurity risks and reporting to the Audit Committee, aligning with 'Management Role' as the management team is the main grammatical subject. While it touches on risk processes and board oversight, the focus on identifying management roles and reporting lines makes this the most applicable category.


reasoning: The paragraph details the company's own internal cybersecurity processes across identification/escalation, technical safeguards, incident response planning, third-party risk as one component, and employee training, fitting Risk Management Process. No named frameworks, roles, committees, dates, systems, or other unique firm-specific facts are present, making it generic boilerplate.


reasoning: The paragraph provides a generic description of reliance on IT infrastructure and lists common cyber risks like malware, phishing, and ransomware without referencing board oversight, management roles, internal processes, incidents, third-party focus, or strategy integration, making it non-substantive boilerplate fitting None/Other. No named frameworks, roles, dates, entities, or verifiable facts are present, confirming Generic Boilerplate.


reasoning: The paragraph details the company's internal cybersecurity risk management program, including policies, standards, processes for assessing and managing risks, and resource allocation to meet regulatory requirements, aligning with 'Risk Management Process'. It lists multiple specific named regulatory bodies, providing two or more externally verifiable facts.


reasoning: The paragraph details the company's own internal cybersecurity processes, including NIST framework adoption, management by a dedicated IT team led by named executives, specific controls like penetration testing and audits, and vendor due diligence as one component, fitting 'Risk Management Process'. Vendor oversight is not central, and no board, incidents, or strategy focus is present.


reasoning: The paragraph focuses on the Chief Information Officer's qualifications, experience, certifications, reporting cadence to senior management and the Audit Committee, and the senior leadership team's role in preparing the Risk Report, making 'Management Role' the most applicable category as management roles are the primary grammatical subjects.


reasoning: Paragraph describes the company's internal Cybersecurity Program, including risk assessment processes, incident response planning, and administration/oversight structure, making Risk Management Process the best fit despite detailed management roles and qualifications which are components of the process description. Some ambiguity with Management Role due to emphasis on personnel experience and reporting lines.


reasoning: The paragraph describes the company's overall cybersecurity program as part of its ERM approach, covering governance, collaborative processes, technical safeguards, incident response, third-party risk management (as one component), and training, which aligns with Risk Management Process. Third-party risk is not central but integrated into internal processes.


reasoning: The paragraph details the company's own internal processes for risk identification, mitigation using the NIST Framework, monitoring, protection measures, incident response planning (IRP, BCP), enterprise risk assessment, and ongoing adaptations, making Risk Management Process the best fit. It names one framework (NIST) but lacks firm-unique facts like named roles, dates, or systems, and no two+ verifiable facts.