content_category: Strategy Integration

category_confidence: high

specificity_confidence: high

reasoning: The paragraph primarily addresses whether cybersecurity has materially affected the business, which aligns with Strategy Integration, and contains no specificity-relevant facts.

provider: bytedance-seed

stage: benchmark


content_category: Management Role

fact: the Company's CISO, Chief Risk Officer, and Chief Information and Technology Officer

reasoning: The paragraph primarily describes the management roles responsible for cybersecurity risk assessment and management, and the named roles (CISO, Chief Risk Officer, Chief Information and Technology Officer) are firm-specific facts.


content_category: None/Other

reasoning: The paragraph is a cross-reference to another section and does not contain substantive cybersecurity content, resulting in 'None/Other' category with 'Generic Boilerplate' specificity.


reasoning: The paragraph is a cross-reference to other sections and does not provide substantive cybersecurity information, resulting in 'None/Other' category. No specificity-relevant facts are present, leading to 'Generic Boilerplate' specificity.


reasoning: The paragraph is a forward-looking disclaimer and cross-reference, not addressing any of the six substantive cybersecurity questions.


reasoning: The paragraph is a cross-reference to another section and does not address any of the six substantive cybersecurity categories, resulting in 'None/Other' with no specific facts, hence 'Generic Boilerplate'.


reasoning: The paragraph is a cross-reference to another section and does not contain substantive cybersecurity content, thus classified as 'None/Other' with Generic Boilerplate specificity.


content_category: Third-Party Risk

reasoning: The paragraph primarily addresses managing third-party cyber risks, classifying it as Third-Party Risk. The mention of a 'vendor third-party risk management program' demonstrates domain expertise, leading to a specificity level of Domain-Adapted.


reasoning: The paragraph addresses whether cybersecurity has materially affected the business, falling under Strategy Integration. It contains no specific facts, resulting in Generic Boilerplate.


content_category: Board Governance

fact: Board of Directors (the "Board"), through its Cybersecurity Committee

reasoning: The paragraph primarily describes the Board's oversight of cybersecurity through its Cybersecurity Committee, classifying it as 'Board Governance'. The mention of the Cybersecurity Committee elevates the specificity to 'Firm-Specific'.


reasoning: The paragraph assesses the materiality of cybersecurity threats to the business, aligning with Strategy Integration. No specific facts elevate the specificity level.


reasoning: The paragraph describes the company's structure and notes cybersecurity threats are tailored, but contains no substantive cybersecurity measures or processes, resulting in content_category None/Other. No qualifying facts for specificity, so it is Generic Boilerplate.


reasoning: The paragraph primarily describes the third-party risk management program, making 'Third-Party Risk' the content category. No specific facts are present, so specificity is Generic Boilerplate.


reasoning: The paragraph is a general commitment to protecting IT assets and data, which does not fit any of the substantive cybersecurity content categories.


fact: Chief Information Officer (CIO), who is a member of the Company's Executive Committee

fact: Chief Information Security Officer (CISO) are responsible for assessing and managing cybersecurity risks

reasoning: The paragraph primarily describes management's roles and responsibilities for cybersecurity, aligning with 'Management Role'. Specific facts include named executive roles (CIO, CISO) and their committee membership, driving 'Firm-Specific' specificity.


reasoning: The paragraph states a conclusion about the material impact of cybersecurity incidents on the company, aligning with Strategy Integration, and contains no specificity-relevant facts.


reasoning: The paragraph assesses the material impact of cybersecurity on the company, aligning with Strategy Integration, and contains no specificity-relevant facts.


reasoning: The paragraph is a forward-looking disclaimer and cross-reference, not addressing any of the six substantive cybersecurity questions, resulting in 'None/Other'. There are no specific facts to elevate specificity, leading to 'Generic Boilerplate'.


reasoning: The paragraph primarily addresses the material impact of cybersecurity risks, fitting 'Strategy Integration'. It contains no specificity-relevant facts, resulting in 'Generic Boilerplate'.


reasoning: The paragraph primarily addresses the business and financial impact of cybersecurity, aligning with Strategy Integration. It contains no qualifying facts for specificity above Level 1, resulting in Generic Boilerplate.


reasoning: The paragraph primarily describes the Board of Directors' oversight of cybersecurity risks, including its role in the Enterprise Risk Management program and engagement with third-party experts, classifying it as Board Governance. No specific facts elevate the specificity beyond Generic Boilerplate.


content_category: Incident Disclosure

fact: during March 2021

fact: engaged leading forensic information technology firms

fact: $ 2.4 million

type: quantified

reasoning: The paragraph primarily describes a real cybersecurity incident, including its timing, remediation, and financial impact, qualifying as Incident Disclosure. The presence of specific date, named firms, and quantified costs drives the specificity to Quantified-Verifiable.


reasoning: The paragraph discusses general cybersecurity risks but does not address any of the six substantive content categories, resulting in 'None/Other'. It contains no specific facts, leading to 'Generic Boilerplate'.


fact: Head of Cyber Security

reasoning: The paragraph primarily describes the board's delegation of cybersecurity oversight to the Audit Committee and related reporting, aligning with Board Governance. The mention of 'Head of Cyber Security' is a firm-specific fact, driving specificity to Firm-Specific.


content_category: Risk Management Process

fact: endpoint detection and response

fact: network anomaly detection

fact: multi-factor authentication

reasoning: The paragraph primarily describes the cybersecurity program's activities, aligning with Risk Management Process. The use of specific cybersecurity tools and practices elevates specificity to Domain-Adapted.


reasoning: The paragraph describes the business's reliance on technology and data storage but does not address cybersecurity oversight, management roles, risk processes, third-party risk, incidents, or strategy, resulting in 'None/Other' with 'Generic Boilerplate' specificity.


fact: cybersecurity due diligence and review of contractual terms

reasoning: The paragraph primarily addresses managing third-party cyber risks, fitting 'Third-Party Risk'. It uses cybersecurity-specific terms like 'Third-Party Risk Management (TPRM) program' and 'cybersecurity due diligence', indicating domain expertise.


reasoning: The paragraph primarily describes the board's oversight of cybersecurity, including the Audit Committee's role and management reporting, thus content_category is 'Board Governance'. No specificity-relevant facts, so specificity is 'Generic Boilerplate'.


reasoning: The paragraph primarily addresses managing third-party cyber risks, making 'Third-Party Risk' the content category. No facts elevate specificity beyond Generic Boilerplate.


fact: Vice-President of Information Technology (VPIT)

fact: Director - Information Security (DIS)

reasoning: The paragraph primarily describes the board's oversight of cybersecurity, including reports from the Audit Committee and briefings from VPIT and DIS, classifying it as Board Governance. Specificity is Firm-Specific due to the named roles (VPIT, DIS).


reasoning: The paragraph primarily describes the board's oversight of cybersecurity, including coordination with management and the Audit Committee, and reporting lines, leading to 'Board Governance'. There are no specific facts elevating specificity above Level 1, resulting in 'Generic Boilerplate'.


fact: lost revenue of approximately $ 80 million to $ 85 million and operating earnings of $ 35 million to $ 40 million

reasoning: The paragraph primarily describes a cybersecurity incident, including its timing, impact, and remediation, making it Incident Disclosure. The specific date and quantified financial impact drive the specificity to Quantified-Verifiable.


reasoning: The paragraph primarily describes the cybersecurity program's activities such as assessing, identifying, managing risks, and detecting/preventing threats, falling under Risk Management Process. It has no specific facts elevating specificity beyond Generic Boilerplate.


fact: CISO

fact: Cybersecurity Executive Steering Body

fact: Audit Committee of the Board of Directors

reasoning: The paragraph describes board oversight of cybersecurity, including reporting lines and committee involvement, primarily answering 'How does the board oversee cybersecurity?'. Specific facts include named roles, teams, and committees, elevating specificity to Firm-Specific.


fact: In 2017, we experienced a material cybersecurity incident following a criminal attack on our systems that involved the theft of personal information of U.S., Canadian and U.K. consumers

reasoning: The paragraph primarily describes a real cybersecurity incident, making 'Incident Disclosure' the appropriate category. The specific 2017 incident details drive the specificity to 'Quantified-Verifiable'.


fact: threat intelligence and other information obtained from governmental, public or private sources, including external advisors engaged by us

fact: alerts and reports produced by security tools deployed in the IT environment

reasoning: The paragraph primarily describes how management is informed about and monitors cybersecurity risks and incidents, falling under Management Role. It contains domain terms like 'threat intelligence' and 'security tools' that indicate domain expertise, leading to Domain-Adapted specificity.


fact: two-factor authentication (2FA)

fact: real-time threat monitoring

fact: Tier-1 cloud service providers

fact: enhanced encryption

reasoning: The paragraph primarily describes the company's cybersecurity programs and processes, which aligns with 'Risk Management Process'. It includes domain-specific terms like two-factor authentication (2FA) and real-time threat monitoring, indicating Domain-Adapted specificity.


reasoning: The paragraph contains a negative assertion about not experiencing a material incident and a cross-reference, with no substantive cybersecurity program details, resulting in 'None/Other'. No specific facts are present, leading to 'Generic Boilerplate'.


fact: automated event-detection notifications or similar technologies which are monitored by our security operations team

fact: notifications from employees or third-party providers

fact: incident response team investigates the incident, determines the nature of the event and assesses the severity of the event and sensitivity of any compromised data

reasoning: The paragraph describes the process of detecting and investigating cybersecurity incidents, which aligns with Risk Management Process. It includes domain-specific terms like 'security operations team' and 'incident response team', indicating Domain-Adapted specificity.


reasoning: The paragraph primarily discusses the potential material adverse effect of future cyber threats/incidents on the business, which aligns with Strategy Integration. It contains no specificity-relevant facts, resulting in Generic Boilerplate.


fact: a 24/7 security operations center

fact: a robust insider threat protection program

fact: educate and train employees at least annually

reasoning: The paragraph primarily describes the cybersecurity program's activities, including incident response, security operations, and training, making it Risk Management Process. The presence of specific systems, programs, and quantified training drives the specificity to Quantified-Verifiable.


fact: cybersecurity protocols

fact: isolated computer workstations

reasoning: The paragraph primarily describes the Trust's cybersecurity protocols, which aligns with the Risk Management Process category. It includes domain-specific terms like 'cybersecurity protocols', 'isolated computer workstations', and 'two-factor or independent authorizations', indicating Domain-Adapted specificity.


fact: Our Board of Directors has delegated oversight of risks related to cybersecurity to two Board committees, the Audit Committee and the Aerospace Safety Committee

fact: Our Chief Information Officer and Senior Vice President, Information Technology & Data Analytics (CIO) and our Chief Security Officer (CSO) provide presentations to the Audit Committee on cybersecurity risks at each of its bimonthly meetings

fact: The Audit Committee has designated one of its members with expertise in cyber risk management to meet regularly with management and review our cybersecurity strategy and key initiatives and progress toward our objectives

fact: The Aerospace Safety Committee provides oversight of the risks from cybersecurity threats related to our aerospace products and services

fact: Both committees brief the full Board on cybersecurity matters discussed during committee meetings, and the CIO provides annual briefings to the Board on information technology and data analytics related matters, including cybersecurity

reasoning: The paragraph primarily describes the Board of Directors' oversight of cybersecurity through its committees, fitting 'Board Governance'. It includes specific named committees and roles, driving 'Firm-Specific' specificity.


fact: Enterprise Cybersecurity Management Review Group (Enterprise Cybersecurity MRG)

fact: Chief Information Security Officer

reasoning: The paragraph describes the oversight structure of the Enterprise Cybersecurity Management Review Group, which reports to the Audit Committee and Board, aligning with Board Governance. Named committee and role details drive specificity to Firm-Specific.


reasoning: The paragraph primarily addresses the material impact of cybersecurity incidents on the business, fitting 'Strategy Integration'. It contains no specificity-relevant facts, so specificity is 'Generic Boilerplate'.


fact: detective surveillance controls

fact: phishing

fact: social engineering

fact: incident response

fact: disaster recovery procedures

reasoning: The paragraph primarily describes the company's cybersecurity program activities, aligning with 'Risk Management Process'. It includes domain-specific terms like 'layered technical protective capabilities' and 'phishing', indicating 'Domain-Adapted' specificity.


fact: Executive Vice President/ Chief Information Security Officer (with over 25 years' experience in cybersecurity risk management)

fact: Chief Information Officer (with over 27 years' experience in technology risk management)

reasoning: The paragraph primarily describes management roles and leadership structure, justifying 'Management Role'. The quantified experience of the CISO and CIO drives 'Quantified-Verifiable' specificity.


fact: Enterprise & Technology Security ('E&TS') organization

fact: Chief Information Security Officer ('CISO')

fact: CSIRT

fact: Product Security Incident Response Team ('PSIRT')

fact: Business Information Security Officers ('BISO')

reasoning: The paragraph primarily describes the management structure and roles (E&TS, CISO, CSIRT, PSIRT, BISO) within IBM's cybersecurity organization, making 'Management Role' the primary category. The specificity is Firm-Specific due to the inclusion of named roles and teams unique to IBM.


reasoning: The paragraph discusses the company's data handling and threat environment but does not answer any of the six substantive cybersecurity questions, resulting in 'None/Other' category. It contains no specificity-relevant facts, leading to 'Generic Boilerplate' specificity.


fact: two members of the audit committee have obtained certifications in cybersecurity oversight

fact: each quarter, the chief information officer and chief information security officer report to the audit committee on cybersecurity risks and controls

reasoning: The paragraph primarily describes the board's oversight of cybersecurity, including audit committee involvement and reporting lines, leading to the content_category 'Board Governance'. The specificity is 'Firm-Specific' due to the mention of two audit committee members with cybersecurity certifications and named roles reporting to the committee.


fact: security operations center

fact: Chief Information Security Officer (CISO)

fact: Cybersecurity Incident Response Plan

fact: cybersecurity crisis response team

reasoning: The paragraph primarily describes cybersecurity program activities such as threat identification, assessment, monitoring, and incident response processes, aligning with Risk Management Process. Specific facts include named roles (CISO), a named program (Cybersecurity Incident Response Plan), and a named team (cybersecurity crisis response team), driving Firm-Specific specificity.


reasoning: The paragraph describes the board's delegation of cybersecurity oversight to the Audit Committee and reporting lines, primarily answering how the board oversees cybersecurity. The specific fact of 'Senior Director of Governance & Information Security' elevates specificity to Firm-Specific.


reasoning: The paragraph primarily provides cross-references and generic statements about reviewing a plan, not addressing the six substantive questions, and contains no specificity-relevant facts.


reasoning: The paragraph primarily describes the company's cybersecurity risk management system, including proactive safeguards, incident response procedures, and oversight, aligning with 'Risk Management Process'. No specific facts elevate the specificity beyond Generic Boilerplate.


fact: In April 2022, we experienced a cybersecurity incident that temporarily disrupted a subset of our hospital operations and involved the exfiltration of certain confidential company and patient information

fact: We incurred significant costs to remediate the issues, sustained lost revenues from the associated business interruption and incurred other related expenses

fact: Following this incident, we implemented certain changes to our information systems and processes meant to provide additional protections to our environment, including enhancements to our Security Operations Center, system backups, training practices, detection tools and capabilities, and implementation of new tools and processes, among others

fact: we continue to face a heightened risk of cybersecurity threats targeting healthcare providers, including ransomware attacks, which may materially impact our operations

fact: Threat actors continue to proliferate, adapt and devote significant effort to attacking the information systems and electronically transmitted and stored data of healthcare providers and related entities

reasoning: The paragraph primarily describes a real cybersecurity incident, including its nature, impact, and remediation, leading to the content category 'Incident Disclosure'. The presence of specific dates, quantified costs, and detailed incident details drives the 'Quantified-Verifiable' specificity level.


reasoning: The paragraph primarily addresses third-party risk management through vendor vetting and mitigation, with no specificity-relevant facts to elevate beyond Generic Boilerplate.


fact: TEP's Enterprise Cybersecurity team

fact: Certified Information Systems Security Professional (CISSP)

fact: Global Industrial Cyber Security Professional (GICSP)

fact: Electricity Information Sharing and Analysis Center

fact: Cybersecurity and Infrastructure Security Agency

fact: internal cybersecurity tools

fact: network monitoring

fact: vulnerability scanning

reasoning: The paragraph describes the Enterprise Cybersecurity team's activities in managing cybersecurity risk, primarily answering 'what does the cybersecurity program do,' classifying it as Risk Management Process. Specificity is Firm-Specific due to the named team and domain terms.


fact: documented process to oversee, identify and mitigate cybersecurity risk associated with Seaboard's use of new third-party service providers

fact: prior to onboarding a third-party service provider, designated information security personnel from each segment will work with the internal business sponsors to perform a cybersecurity risk assessment

fact: determine the potential impact on Seaboard's systems, data and networks if an identified cybersecurity breach were to occur

fact: risk assessments are documented, and reports are shared with the Information Security Team and others responsible for accepting the risk tolerance and monitoring the risks going forward

reasoning: The paragraph primarily addresses managing third-party cybersecurity risks, making 'Third-Party Risk' the content category. The use of cybersecurity-specific terms like 'cybersecurity risk assessment' and 'systems, data and networks' indicates Domain-Adapted specificity.


fact: a security incident and event manager interface that uses behavioral analytics and provides live metrics and reports of attempted breaches and logs of firewalls, authentication attempts, emails, anti-malware, attempted intrusions and applications

fact: periodic tests to assess our processes and procedures and the threat landscape, which include... engagement of third-party experts for external and internal penetration testing and system security assessments

reasoning: The paragraph primarily describes cybersecurity processes and procedures, including tools and testing, falling under Risk Management Process. The use of specific cybersecurity tools and practices demonstrates domain expertise, leading to a Domain-Adapted specificity.


fact: Cybersecurity team

fact: formal risk assessments with respect to certain of the Company's third-party service providers

fact: data security controls and policies

fact: reassessments of its third-party risk assessments

fact: contractual language with third-party service providers that includes clear terms involving the collection, use, sharing and retention of user data

reasoning: The paragraph primarily addresses third-party risk management through risk assessments and contractual language, and the presence of 'Cybersecurity team' (named team) and domain terms like 'data security controls and policies' drives specificity to Firm-Specific.


fact: Chief Information Security Officer ("CISO")

fact: meets at least quarterly with each of the Board of Directors, the EXCO, and the Senior Leadership Team ("SLT")

fact: performing tabletop exercises at least annually with the Board, the EXCO and the SLT to evaluate our incident response processes

reasoning: The paragraph primarily describes the board's oversight of cybersecurity through the CISO's meetings and tabletop exercises, and the specific fact of the Chief Information Security Officer (CISO) being the leader elevates specificity to Firm-Specific.


reasoning: The paragraph addresses the materiality of cybersecurity risks to the business, classifying it as Strategy Integration. It contains no specific facts, resulting in Generic Boilerplate.


fact: CSO

fact: tools and processes designed to assist in identifying, containing and remediating cybersecurity incidents

fact: employee trainings on our privacy, cybersecurity and information management policies

fact: phishing tests

fact: company-wide awareness of cybersecurity risk through broad-based communications and educational initiatives

reasoning: The paragraph describes the activities of the cybersecurity program, including incident response, training, and awareness, primarily answering 'what does the cybersecurity program do?' (Risk Management Process). The presence of 'CSO' (named role) and specific cybersecurity practices elevates specificity to Firm-Specific.


reasoning: The paragraph primarily describes the cybersecurity program's role in safeguarding data and systems, directly answering 'what does the cybersecurity program do?', classifying it as Risk Management Process. No specificity-relevant facts are present, leading to Generic Boilerplate.


fact: cybersecurity dashboard

fact: threat detection rates

fact: response times

fact: external penetration tests

fact: process audits

reasoning: The paragraph primarily describes the Audit Committee's oversight of cybersecurity, including briefings and metrics, falling under 'Board Governance'. It includes cybersecurity-specific terms like 'cybersecurity dashboard', 'threat detection rates', and 'external penetration tests', indicating domain expertise.


reasoning: Paragraph primarily discusses cybersecurity risks and a cross-reference, not answering any of the six substantive questions; no specific facts to elevate specificity.


fact: The Company's information security efforts are led by our Chief Information Security Officer ("CISO")

fact: The CISO meets at least quarterly with each of the Board of Directors, the ELT, and the Senior Leadership Team ("SLT")

fact: performing tabletop exercises at least annually with the Board and with the SLT to evaluate our incident response processes

reasoning: The paragraph primarily describes the board's oversight through the CISO and quarterly meetings, aligning with Board Governance. The mention of the Chief Information Security Officer (CISO) as the leader elevates specificity to Firm-Specific.


reasoning: The paragraph describes activities related to managing cybersecurity risks, including reviewing regulatory communications and monitoring emerging issues, aligning with Risk Management Process. No specificity-relevant facts are present, resulting in Generic Boilerplate.


fact: Eversource has implemented formal screening processes for any applicable vendors by the Company's Cyber Security Group as part of the Procurement process

fact: Vendors are risk ranked based on the type of work being performed

fact: Periodic rescreening is performed on critical vendors

fact: Vendors are required to attest to their business continuity programs and provide evidence of appropriate insurance and indemnification agreements

fact: The Company bars sourcing from countries included on the Department of Homeland Security's list of Prohibited Nations to further protect the Company's supply chain

fact: The Company maintains cyber insurance which covers breaches of networks and operational technology

reasoning: The paragraph primarily addresses managing third-party cyber risks, making 'Third-Party Risk' the content category. The inclusion of firm-specific details like the Cyber Security Group, specific vendor screening processes, and requirements for vendors drives the specificity to Firm-Specific.


reasoning: The paragraph primarily addresses whether cybersecurity has materially affected the business or finances, classifying it as Strategy Integration. It contains no specific facts, resulting in Generic Boilerplate.


reasoning: The paragraph primarily addresses the material impact of cybersecurity risks on the business, aligning with Strategy Integration. It contains no specificity-relevant facts, resulting in Generic Boilerplate.


fact: defense-in-depth approach

fact: National Institute of Standards and Technology Cyber Security Framework

type: framework

fact: Written Information Security Program

fact: vulnerability scanning

fact: penetration testing

fact: incident response

fact: disaster recovery

fact: encryption

fact: multi-factor authentication

fact: third-party risk management

fact: due diligence

fact: continuous monitoring

fact: cyber risk scoring

reasoning: The paragraph primarily describes the cybersecurity program's approach, components, and alignment, falling under Risk Management Process. Specificity is Firm-Specific due to the 'Written Information Security Program' and domain terms.


fact: CSO

reasoning: The paragraph primarily describes the cybersecurity program's activities, fitting 'Risk Management Process'. The mention of 'CSO' is a firm-specific fact, elevating specificity to 'Firm-Specific'.


fact: mandates that our key third-party service providers undergo an annual SOC 1 audit

fact: reviews all SOC1 audit reports to ensure our third-party service providers are maintaining adequate IT security and business process controls

reasoning: The paragraph primarily addresses managing third-party cyber risks, classifying it as Third-Party Risk. It includes domain terms like SOC 1 audit, leading to a Domain-Adapted specificity level.


fact: Enterprise Risk Management Committee (

fact: executives appointed by the Board

fact: annual reviews of third-party SOC1 reports

reasoning: The paragraph primarily describes the board's oversight through the Enterprise Risk Management Committee and Audit Committee, classifying it as Board Governance. Specificity is Firm-Specific due to the mention of the Enterprise Risk Management Committee and SOC1 reports.


fact: network and perimeter defense

fact: infrastructure security

fact: cloud security

fact: endpoint protection

fact: data protection

fact: identity management

fact: network segmentation

fact: periodic cybersecurity assessments

fact: integration of cybersecurity threat intelligence

reasoning: The paragraph describes the cybersecurity program's activities, including tools and assessments, primarily answering 'What does the cybersecurity program do?' (Risk Management Process). It uses specific cybersecurity terms like network segmentation and endpoint protection, indicating Domain-Adapted specificity.


reasoning: The paragraph states a conclusion about cybersecurity not materially affecting the business, fitting Strategy Integration. It contains no specificity-relevant facts, resulting in Generic Boilerplate.


reasoning: The paragraph states a conclusion about whether cybersecurity has materially affected the company's business strategy, results of operations, or financial condition, which aligns with Strategy Integration. There are no specific facts to elevate specificity beyond Generic Boilerplate.


reasoning: The paragraph describes the cybersecurity program's role in identifying and addressing material risks, aligning with Risk Management Process. It contains no specificity-relevant facts, resulting in Generic Boilerplate.


fact: In February 2023, we experienced a cyberattack that resulted in the temporary interruption of our systems, disclosure of certain confidential information, litigation and governmental inquiries

fact: February 2023

reasoning: The paragraph primarily describes a real cybersecurity incident, making 'Incident Disclosure' the appropriate category. The specific date (February 2023) and details of the incident are verifiable facts, leading to a 'Quantified-Verifiable' specificity level.


reasoning: The paragraph primarily describes the process of responding to cybersecurity incidents, which is a key component of the risk management process. It contains no specific facts that elevate specificity above Level 1.


fact: sustained a cybersecurity attack in May 2022 involving ransomware

fact: engaging a team of third-party forensic experts

fact: restored network systems

fact: not paying any ransomware

reasoning: The paragraph primarily describes a real cybersecurity incident, making 'Incident Disclosure' the primary category. Specific facts like a specific date, named third-party experts, and restored systems drive the 'Quantified-Verifiable' specificity.


reasoning: The paragraph primarily addresses how cybersecurity affects the business or finances, qualifying as Strategy Integration. There are no specific facts to elevate specificity, resulting in Generic Boilerplate.


fact: administered under the supervision of our EVP, Chief Digital and Innovation Officer (CDIO) and Vice President (VP) of Platforms, Infrastructure and Cybersecurity

fact: both our CDIO and VP of Platforms, Infrastructure, and Cybersecurity have over 20 years of related experience

reasoning: The paragraph primarily describes management's oversight and roles, and the quantified experience fact drives the specificity level.


reasoning: The paragraph addresses the material impact of cybersecurity on the business, classifying it as Strategy Integration. It contains no specific facts, resulting in Generic Boilerplate.


reasoning: The paragraph describes processes for assessing, identifying, and managing cybersecurity risks, primarily answering 'What does the cybersecurity program do?', classifying it as Risk Management Process. It contains no domain terms, firm-specific facts, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily addresses the impact of cybersecurity on the company's business strategy and financial condition, aligning with Strategy Integration. There are no specific facts that elevate specificity beyond Generic Boilerplate.


fact: Chief Information Security Officer (CISO)

fact: 30 years of information technology experience, with 17 years focused specifically on information security and risk management

reasoning: The paragraph primarily describes the CISO's responsibilities, aligning with Management Role. The quantified experience and named role drive the high specificity level.


fact: Atmos Energy currently conducts cyber assessments on potential vendors that will have access to information technology systems, data or facilities that house such systems or data

fact: Following approval, those vendors are contractually required to manage their cybersecurity risks and provide notification in the event of a cybersecurity incident

reasoning: The paragraph primarily addresses managing cybersecurity risks associated with third-party service providers, making 'Third-Party Risk' the content category. The specific practices of Atmos Energy conducting cyber assessments on potential vendors and contractually requiring risk management and incident notification drive the specificity to 'Firm-Specific'.


reasoning: The paragraph primarily addresses the materiality of cybersecurity threats to the company's operations and financial condition, fitting 'Strategy Integration'. It contains no specificity-relevant facts, resulting in 'Generic Boilerplate'.


fact: Board of Directors oversees cybersecurity-related policy and strategy

fact: CISO provides a cybersecurity dashboard that is reviewed by the Board at every regularly scheduled Board meeting, which includes key performance indicators for cybersecurity process maturity, operational performance, and enterprise performance toward Transportation Security Administration (TSA) compliance

fact: CIO and/or CISO presents to the Board bi-annually regarding the cybersecurity risks and strategies, including as part of the Board's annual long-term strategy session

fact: Audit Committee, comprised of independent directors, reviews the implementation and effectiveness of cybersecurity risk management protocols and reviews the effectiveness of cybersecurity as part of the Company's accounting and internal control policies

fact: CIO presents to the Audit Committee bi-annually, as well as periodically in conjunction with any internal audits related to cybersecurity

fact: Management has protocols by which cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, are reported to the Board, as well as ongoing updates regarding any such incident until it has been addressed

reasoning: The paragraph primarily describes the Board of Directors' oversight of cybersecurity, including reviews by the Board and Audit Committee, and the specificity is due to domain terms like cybersecurity dashboard, key performance indicators, and TSA compliance.


fact: VF's CISO

fact: CSBDO

fact: cybersecurity and information security training and compliance program

fact: cyber incident response plan

fact: CISO has over thirty years of experience as a cybersecurity professional

fact: CSBDO has nearly twenty years of experience enabling digital transformation for global companies

fact: members of VF's information security, IT and privacy teams

fact: maintains a cybersecurity risk insurance policy

reasoning: The paragraph primarily describes the cybersecurity program's activities, including risk management, incident response, training, and program components, aligning with 'Risk Management Process'. The presence of quantified facts (e.g., 30 years of experience) drives the 'Quantified-Verifiable' specificity level.


fact: require all vendors who handle our data as well as vendors who provide technology and data services – including hardware, software, staffing, and support – to maintain certain security protections including, but not limited to, compliance with applicable data protection laws and implementation of administrative, physical, and technical safeguards to protect our data, including how our data is stored, accessed, and transmitted

fact: all providers within these service categories must execute a data security addendum that articulates specific security standards, cybersecurity insurance, and mandatory incident reporting protocols applicable to the underlying provision of services

reasoning: The paragraph primarily addresses third-party cyber risk management, and the mention of specific security standards, cybersecurity insurance, and incident reporting protocols demonstrates domain expertise.


reasoning: The paragraph primarily addresses managing third-party cyber risks, fitting 'Third-Party Risk'. It contains no specific facts that elevate specificity beyond Generic Boilerplate.


reasoning: The paragraph primarily states a conclusion about cybersecurity's effect on business outcomes, classifying it as Strategy Integration. It contains no specificity-relevant facts, resulting in Generic Boilerplate.


reasoning: The paragraph primarily addresses contractual requirements for third parties, making 'Third-Party Risk' the clear category. No specific facts elevate specificity, resulting in 'Generic Boilerplate'.


fact: defense in depth strategy

fact: data loss prevention technology

fact: advanced transport layer security encryption

fact: phishing, malware and social engineering testing

reasoning: The paragraph primarily describes the cybersecurity program's activities, aligning with Risk Management Process. Domain terms like 'defense in depth strategy' and 'phishing' drive the specificity to Domain-Adapted.


reasoning: The paragraph primarily addresses the management of cybersecurity risks associated with third-party service providers, making 'Third-Party Risk' the content category. No specific facts elevate the specificity beyond Generic Boilerplate.


fact: On February 22, 2024, we disclosed the occurrence of a cybersecurity incident

reasoning: The paragraph primarily describes a cybersecurity incident, including its timing and investigation, making it Incident Disclosure. The specific date of the incident disclosure drives the Quantified-Verifiable specificity level.


fact: John Bresney, EVP & CIO, reports directly to our Chief Executive Officer and is responsible for all of our IT operations, including oversight of the SVP of Enterprise Strategy and Execution's implementation of our cybersecurity program and enforcement of our cybersecurity policies

fact: Robert McKenna, SVP of Enterprise Strategy and Execution, reports to our CIO and leads the implementation of our cybersecurity program, enforcement of our cybersecurity policies, technology planning, projects driving IT strategy, and enterprise IT risk management

fact: Christopher Cunniff, SVP and CRO, reports formally to the Chief Financial Officer and on an interim-basis to our Chief Executive Officer, leads our Reinsurance and ERM teams, and chairs the ERC and the Emerging Risk Committee

fact: We have employed John Bresney for approximately 30 years

fact: We have employed Robert McKenna for approximately 21 years in related positions of increasing responsibility

fact: We have employed Christopher Cunniff for approximately six years

fact: John Bresney has a bachelor's degree in information systems and business, a Master's Certificate in Project Management, and a Columbia University CIO Program Certificate

fact: Robert McKenna has a master's degree in business administration, a Certificate in Project Management, and is a Certified Insurance Counselor

fact: Christopher Cunniff has a bachelor's degree in mathematics, is a fellow of the Casualty Actuarial Society, and is a member of the American Academy of Actuaries

reasoning: The paragraph primarily describes the roles and expertise of key management members responsible for cybersecurity, fitting 'Management Role'. Quantified facts like employment durations and verifiable certifications drive the 'Quantified-Verifiable' specificity.


fact: overseen by the Vendor Management Committee

fact: due diligence analysis by the Corporation's Vendor Management team

reasoning: The paragraph primarily addresses how third-party cyber risks are managed, qualifying as 'Third-Party Risk'. Specificity is 'Firm-Specific' due to the named 'Vendor Management Committee' and 'Vendor Management team'.


reasoning: The paragraph discusses integrating cybersecurity risk into enterprise risk management and cross-references other disclosures, not answering any of the six substantive questions, and contains no specificity-relevant facts.


reasoning: The paragraph addresses the material impact of cybersecurity on the business and finances, aligning with Strategy Integration. No specific facts are present to elevate specificity beyond Generic Boilerplate.


fact: during 2023

fact: global incident involving Progress Software Corporation (

fact: MOVEit Transfer

fact: third party prominent financial institution vendor

fact: Bank's customers who use online and mobile banking

fact: cyber insurance

fact: 2023 fiscal year

reasoning: The paragraph primarily describes a real cybersecurity incident, making 'Incident Disclosure' the content category. The presence of specific dates, named systems, and verifiable details drives the specificity to 'Quantified-Verifiable'.


fact: As of October 31, 2024

reasoning: The paragraph states a conclusion about the material impact of cybersecurity incidents, aligning with Strategy Integration. The specific date 'October 31, 2024' is a verifiable fact, determining the specificity level.


fact: Vice President of Cybersecurity

reasoning: The paragraph primarily describes the board's oversight of cybersecurity, including the Audit Committee and regular briefings, and the presence of 'Vice President of Cybersecurity' as a firm-specific fact drives the specificity.


fact: Chief Information Security Officer (CISO)

fact: Risk Committee

fact: annual reports on the performance of the firm's cybersecurity risk metrics

reasoning: The paragraph primarily describes the Board's Risk Committee overseeing cybersecurity risk and receiving reports from the CISO, aligning with 'Board Governance'. Specificity is 'Firm-Specific' due to the mention of the Chief Information Security Officer and Risk Committee.


fact: in 2023, one of our third-party vendors experienced a cybersecurity incident due to a previously unknown (i.e., zero-day) vulnerability in a popular file sharing software the vendor used called MOVEit Transfer

fact: zero-day vulnerability

reasoning: The paragraph primarily describes actual cybersecurity incidents, including their nature, scope, and impact, qualifying as 'Incident Disclosure'. The specific date (2023), named system (MOVEit Transfer), and domain term (zero-day vulnerability) drive the 'Quantified-Verifiable' specificity level.


fact: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and broader enterprise IT environment

fact: a team principally responsible for managing (i) cybersecurity risk assessment processes, (ii) security controls and (iii) response to cybersecurity incidents

fact: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of security controls

fact: cybersecurity awareness training for users and senior management, including through the use of third-party providers for regular mandatory trainings

fact: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents

fact: a risk management process for third-party service providers, suppliers and vendors, which includes a rigorous vetting process and ongoing monitoring mechanisms designed to ensure their compliance with cybersecurity standards

reasoning: The paragraph primarily describes the components and activities of the cybersecurity program, aligning with 'Risk Management Process'. It demonstrates cybersecurity expertise through specific program details, justifying 'Domain-Adapted' specificity.


fact: CISO provides quarterly updates each year to RCSC on cybersecurity matters

fact: RCSC meetings include discussions of specific risk areas throughout the year including, among others, those relating to cybersecurity

fact: These reports include an overview of the cybersecurity threat landscape

fact: key cybersecurity initiatives to improve the Company's risk posture

fact: changes in the legal and regulatory landscape relative to cybersecurity

fact: overviews of certain cybersecurity incidents that have occurred within the Company and within the industry

reasoning: The paragraph describes board committee (RCSC) oversight of cybersecurity through meetings and CISO updates, aligning with Board Governance. Specific facts include named roles and committees, leading to Firm-Specific specificity.


fact: denial of service attacks which attempt to interrupt service to customers

fact: malicious software attacks on computer systems which attempt to allow unauthorized entrance

fact: security assessments on our higher risk third party service providers

reasoning: The paragraph primarily addresses managing risks from third-party cyber threats and service providers, making 'Third-Party Risk' the content category. The mention of specific threat types and security assessments demonstrates domain expertise, leading to a specificity level of Domain-Adapted.


fact: On February 21, 2024, Change Healthcare... notified us of a cybersecurity incident affecting some of its systems

fact: Change Healthcare, a subsidiary of UnitedHealth Group that acted as an intermediary for processing of our payment claims for all payors

reasoning: The paragraph primarily describes a specific cybersecurity incident, including its nature, impact, and response, leading to the Incident Disclosure category. Specific facts like a specific date and named firm drive the Quantified-Verifiable specificity level.


fact: led by our CDO and our CISO

fact: collectively over 25 years of prior work experience

fact: ISACA Certified Information Security Manager

fact: ISC2 Certified Information Systems Security Professional certifications

reasoning: The paragraph primarily describes the roles and qualifications of the CDO and CISO, aligning with Management Role. The inclusion of their experience and certifications drives the specificity to Firm-Specific.


reasoning: The paragraph describes the Audit Committee and Risk Committee of the Board monitoring cybersecurity governance and coordinating on information security matters, primarily answering how the board oversees cybersecurity, thus content_category is Board Governance. No specific facts elevate specificity, so it's Generic Boilerplate.


fact: Chief Information Security Officer ("CISO")

fact: Audit Committee (the "Audit Committee") of the Board

reasoning: The paragraph primarily describes the Audit Committee's oversight of cybersecurity, aligning with Board Governance. The mention of the CISO and Audit Committee as specific roles/committees drives the Firm-Specific specificity level.


fact: assess, identify, and manage material risks from cybersecurity threats

fact: maintain and enhance our information security and controls

fact: detect security incidents and protect sensitive data

fact: security measures and procedures

specificity_confidence: medium

reasoning: The paragraph primarily addresses how cybersecurity affects the business or finances, aligning with 'Strategy Integration'. It includes domain terms like 'information security and controls' and 'security measures and procedures', indicating domain expertise.


fact: Chief Capability Officer (CCO), Chief Information Officer (CIO) and Chief Information Security Officer (CISO)

reasoning: The paragraph primarily describes the Audit Committee's oversight of cybersecurity, aligning with 'Board Governance'. The inclusion of specific named roles (CCO, CIO, CISO) elevates the specificity to 'Firm-Specific'.


fact: Senior Manager of our Enterprise IT Security Risk and Compliance team

fact: over 30 years of IT experience

fact: over 20 years specializing in cybersecurity

reasoning: The paragraph primarily describes the Senior Manager's role, responsibilities, and qualifications, aligning with 'Management Role'. Quantified experience details drive the 'Quantified-Verifiable' specificity.


reasoning: The paragraph describes the Audit Committee's oversight of cybersecurity risks, aligning with Board Governance. No specific facts elevate specificity beyond Generic Boilerplate.


fact: As of February 28, 2024, we have not identified any compromise or unauthorized access of our systems or networks

fact: The Change Healthcare incident has not affected our operations, except the submission of payment claims

reasoning: The paragraph primarily describes a specific cybersecurity incident, including its nature, response, and impact, qualifying as Incident Disclosure. Specific facts include a named firm, specific dates, and details of the incident's impact, driving a Quantified-Verifiable specificity level.


reasoning: The paragraph discusses the importance of cybersecurity governance in managing security and risk but does not directly answer any of the six substantive questions, resulting in a content_category of None/Other. It contains no specific facts, leading to a specificity of Generic Boilerplate.


fact: the Company's CIO and CISO are informed about and monitor significant cybersecurity threats and incidents through the Company's internal cybersecurity reporting structure

fact: Our CDT team is responsible for monitoring and detecting cybersecurity threats and incidents

fact: Our CDT team, overseen by our CISO, is also responsible for the mitigation and remediation of cybersecurity incidents

fact: the discovery is communicated to the Incident Response team, which includes our CISO and other senior members of the CDT function

fact: The Incident Response team evaluates the severity of the cybersecurity threat or incident and shares its findings with our CISO

reasoning: The paragraph primarily describes the roles and responsibilities of the CIO, CISO, and CDT/Incident Response teams in managing cybersecurity, making it Management Role. The inclusion of specific named roles and teams drives the Firm-Specific specificity level.


reasoning: The paragraph states a conclusion about whether cybersecurity threats have materially affected the business, classifying it as Strategy Integration. It contains no specificity-relevant facts, resulting in Generic Boilerplate.


reasoning: The paragraph primarily provides a cross-reference to another section in the filing, not addressing any of the substantive cybersecurity questions, and contains no qualifying facts for specificity.


fact: In 2021, we suffered a ransomware attack on our information technology systems

fact: ransomware attack

fact: information technology systems

reasoning: The paragraph primarily describes a real cybersecurity incident (ransomware attack in 2021) with specific details, and includes verifiable facts like a specific date and named system, driving the specificity level.


fact: engage and retain external assessors and consultants to help improve our security, stay aligned with industry best practices, evaluate external threats and, on an as-needed basis, perform forensic reviews of cybersecurity-related incidents or independent security assessments

reasoning: The paragraph primarily addresses third-party cyber risk management, and contains domain terms related to cybersecurity practices involving external assessors and consultants.


fact: an incident in August 2023 that affected certain of our information systems and resulted in temporary disruptions to parts of our operations

reasoning: The paragraph primarily describes a specific cybersecurity incident (August 2023) and its impact, classifying it as Incident Disclosure. The specific date and incident details drive the specificity to Quantified-Verifiable.


fact: ransomware

fact: phishing attempts

reasoning: The paragraph discusses cyber risk factors but does not fit any substantive content category, so it is 'None/Other'. The inclusion of domain terms like 'ransomware' and 'phishing attempts' elevates specificity to 'Domain-Adapted'.


fact: Board and Audit Committee

fact: Information Security and Compliance teams

fact: CIO

fact: Vice President of Information Security

fact: Information Technology Senior Leadership Team

reasoning: The paragraph primarily describes the board's oversight of cybersecurity, including regular briefings and discussions, leading to the content_category 'Board Governance'. The presence of named committees, roles, and teams drives the specificity to 'Firm-Specific'.


fact: Third Party Risk Management (TPRM) program

fact: integrated into our procurement process

fact: policies and standards requiring that we perform cybersecurity due diligence reviews on our vendors based on the risk profile of a particular supplier or service provider or the service they provide

fact: monitor certain of our principal suppliers and service providers on an ongoing basis by using an outside-in, hacker perspective of a company's cybersecurity posture through an external service provider

reasoning: The paragraph primarily addresses managing third-party cyber risks, making 'Third-Party Risk' the content category. The mention of the company's specific TPRM program, its integration into procurement, and specific monitoring methods drives the firm-specific specificity level.


fact: the management positions responsible for assessing and managing cybersecurity risks include our Director of Cybersecurity and our Chief Information Officer ("CIO")

fact: our CIO is responsible for ensuring that we have a cybersecurity risk management program in place that is fully aligned with business requirements and strategy

fact: our CIO and Director of Cybersecurity both have over 20 years of cybersecurity oversight experience

fact: our CIO previously served as CIO for a New York Stock Exchange listed manufacturing company prior to joining the Company

fact: our Director of Cybersecurity has experience developing and implementing cybersecurity programs for multiple manufacturing firms

reasoning: The paragraph primarily describes management roles and responsibilities, including the CIO and Director of Cybersecurity, their experience, and reporting lines. The specificity is high due to quantified experience and named firms.


reasoning: The paragraph primarily describes the Board and its Audit Committee's oversight of cybersecurity, aligning with 'Board Governance'. There are no qualifying facts for specificity, resulting in 'Generic Boilerplate'.


reasoning: The paragraph primarily addresses managing third-party cyber risks, fitting 'Third-Party Risk' category. The mention of a specific Third Party Risk Management (TPRM) program is a firm-specific fact, elevating specificity to Firm-Specific.


fact: The Security and Technology Risk Leadership Committee provides leadership and oversight of our cybersecurity program

fact: It is chaired by our CISO

fact: composed of Company technology leaders as well as a cross-functional group of representatives from other departments

fact: Our Privacy and Data Governance Committee provides leadership and oversight of our privacy and data governance programs

fact: It is chaired by our Chief Privacy Officer

fact: composed of a cross-functional group across approximately 20 departments

reasoning: The paragraph primarily describes management-level committees' leadership, composition, and meeting cadence, aligning with Management Role. Quantified and firm-specific facts like 'approximately 20 departments' and 'chaired by our CISO' drive the specificity to Quantified-Verifiable.


fact: The Company's Vice President of Information Technology, Security and Business Intelligence is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program

fact: The Vice President of Information Technology, Security and Business Intelligence has served in various roles in information technology and information security for over 18 years

fact: holds a master's degree in business administration from Boston University, a master's degree in electrical and computer engineering from Utah State University, and a bachelor's degree in electronics engineering from Mumbai University

fact: The Company's Information Technology team has specific professional certifications and has over 10 years of experience with managing risks arising from cybersecurity threats

reasoning: The paragraph primarily describes the management role of the Vice President of Information Technology, Security and Business Intelligence, including their responsibilities and qualifications, leading to 'Management Role' category. The specificity is Firm-Specific due to the detailed, firm-unique facts about the Vice President's experience and the IT team's qualifications.


fact: generally aligned with the National Institute on Standards and Technology Cybersecurity Framework

fact: multi-factor authentication, access controls, email filtering, firewalls, intrusion prevention and detection systems, partitioning and encryption of information, backup and data recovery procedures, malware defenses, disaster recovery and incident plan responses, hardware and software updates and patching

reasoning: The paragraph primarily describes the cybersecurity program's activities, aligning with 'Risk Management Process'. It includes domain-specific cybersecurity terms, driving 'Domain-Adapted' specificity.


reasoning: The paragraph states a conclusion about cybersecurity not materially affecting the company's business strategy, results of operations, or financial condition, classifying it as Strategy Integration. There are no specific facts to elevate specificity beyond Generic Boilerplate.


fact: implemented an IT vendor risk management policy

fact: established a third-party risk management program

fact: conduct pre-onboarding security assessments and annual re-assessments of our service providers

fact: collect, track, and manage third-party security controls based upon the risk presented to the business

fact: any issues identified during assessment are tracked through to remediation

reasoning: The paragraph primarily describes how third-party cyber risks are managed, fitting 'Third-Party Risk'. It demonstrates domain expertise through specific cybersecurity practices like pre-onboarding and annual re-assessments, leading to 'Domain-Adapted' specificity.


fact: Our Chief Security and Trust Officer, who reports to our Executive Vice President, Operations

fact: has served in various roles in information technology and information security for over 25 years

reasoning: The paragraph primarily describes the Chief Security and Trust Officer's role and responsibilities, classifying it as Management Role. The specificity is driven by the quantified experience of over 25 years.


fact: full Board also receives briefings from our CISO on cybersecurity matters annually

fact: Board members periodically receive presentations on cybersecurity matters from external experts

reasoning: The paragraph describes the board's oversight of cybersecurity through briefings from the CISO and external experts, classifying it as 'Board Governance'. The mention of 'CISO' and 'external experts' as specific elements drives the 'Firm-Specific' specificity.


fact: Information Security and Data Management Committee chaired by SHUSA's Chief Technology Officer, which includes the CEO, the heads of the Company's businesses, representatives of the Company's second LOD, and Internal Audit representatives among its members

fact: The members of the Board of Directors are senior individuals that are experienced in identifying and managing risks including running companies with IT functions, inclusive of cybersecurity, reporting to them

reasoning: The paragraph primarily describes the board's oversight of cybersecurity, including management committees and the board's experience, classifying it as Board Governance. The specificity is Firm-Specific due to named committees and board role details.


reasoning: The paragraph primarily addresses how cybersecurity could affect the business or finances, classifying it as Strategy Integration. There are no specific facts to elevate specificity beyond Generic Boilerplate.


fact: Our CISO, Chief Legal Officer, and Chief Financial Officer comprise our Core Cybersecurity Management Team (the 'CCMT')

fact: The CCMT has oversight of Teradata's CIRP

reasoning: The paragraph primarily describes the management team's structure and responsibilities, making 'Management Role' the primary category. The named team (CCMT) and roles (CISO, Chief Legal Officer, Chief Financial Officer) are firm-specific, driving specificity to 'Firm-Specific'.


fact: The Corporate Risk Committee of our Board of Directors oversees our information technology systems, including information security

fact: the Audit Committee of our Board of Directors oversees adequacy and effectiveness of our controls and procedures, including those designed to assess, identify and manage material risks from cybersecurity threats and incidents

fact: at least bi-annually, our CIO and/or CISO report on cybersecurity matters to the Corporate Risk Committee

fact: updates are provided to our Board of Directors at regular board meetings

fact: The CIO also provides updates annually or more frequently as appropriate to our Board of Directors

reasoning: The paragraph primarily describes the board's oversight of cybersecurity through committees and reports, and includes named committees and roles, supporting the Board Governance category.


reasoning: The paragraph is a general statement about the importance of cybersecurity and providing an overview, not addressing any of the specific content categories. It contains no specific facts, so it is None/Other with Generic Boilerplate.


fact: Our ISC members includes our CIO and our Director of IT Security, Risk and Compliance

fact: combined 20 years of risk management experience encompassing cybersecurity and technology security

reasoning: The paragraph primarily describes management roles (ISC members, CIO, Director of IT Security, Risk and Compliance) and their experience, classifying it as Management Role. The 20 years of combined experience is a verifiable quantified fact, driving the specificity level.


fact: security measure protocols

fact: security frameworks

reasoning: The paragraph primarily addresses managing third-party cyber risks, making 'Third-Party Risk' the content category. The mention of 'security measure protocols' and 'security frameworks' demonstrates domain expertise, leading to a 'Domain-Adapted' specificity level.


fact: dedicated department within its Enterprise Risk Management division

fact: evaluates cybersecurity risks associated with the Company's third-party service providers with the Bank's Information Technology Department

reasoning: The paragraph primarily addresses managing third-party cyber risks, classifying it as Third-Party Risk. The mention of a dedicated department in Enterprise Risk Management and collaboration with the Bank's Information Technology Department are firm-specific facts, leading to Firm-Specific specificity.


reasoning: The paragraph addresses the impact of cybersecurity on the company's business strategy, operations, and financial condition, aligning with Strategy Integration. No specific facts are present, resulting in Generic Boilerplate.


reasoning: The paragraph primarily describes cybersecurity processes to assess, identify, and manage material risks, aligning with Risk Management Process. It contains no specificity-relevant facts, resulting in Generic Boilerplate.


fact: Our Chief Information Officer (CIO) has more than 30 years of experience working in information technology including chief information officer roles in the financial services, banking, healthcare, and hospitality sectors

fact: Supporting the CIO is a dedicated cybersecurity team

fact: This cybersecurity team collectively holds the following degrees and certifications: Master's in Cybersecurity, Certified Information Systems Security Professional, Certified Information Security Manager, Microsoft Certified Cybersecurity Architect Expert, Graduate Certificates in Enterprise Cybersecurity and Data Science, Security+ and Certified Information Systems Auditor

reasoning: The paragraph primarily describes management's organization and roles, justifying 'Management Role'. The presence of quantified experience and verifiable certifications drives 'Quantified-Verifiable' specificity.


reasoning: The paragraph addresses whether cybersecurity risks have materially affected the business or financials, aligning with Strategy Integration. It contains no specificity-relevant facts, resulting in Generic Boilerplate.


fact: cross-functional effort involving our end-user, Legal, Privacy and Information Security teams

reasoning: The paragraph primarily addresses how third-party cyber risks are managed, and the mention of 'Information Security teams' is a firm-specific fact, driving the specificity level.


fact: Incident Response Team comprised of members from the major business areas in the Bank

reasoning: The paragraph primarily describes the risk management process, including the Incident Response Team and processes for assessing material impact. The specificity is Firm-Specific due to the mention of the Incident Response Team.


reasoning: The paragraph is a cross-reference to another section and does not provide substantive cybersecurity information, thus falling under 'None/Other' with Generic Boilerplate specificity.


fact: assess third-party vendors as a part of our vendor onboarding and continued due diligence which includes processes to assess information security posture

fact: maintaining an effective security management program; abiding by information handling and asset management requirements; and notifying us in the event of any known or suspected cyber incident

fact: conduct (or engage a third party to conduct) reviews of third-party hosted applications with a specific focus on any sensitive data shared with third parties

fact: a System and Organization Controls (SOC) 2 or ISO 27001 (Information and Security Certification) or similar report

reasoning: The paragraph primarily addresses managing cybersecurity risks associated with third-party service providers, qualifying as 'Third-Party Risk'. The mention of specific security processes and standards like SOC 2 and ISO 27001 demonstrates domain expertise, leading to 'Domain-Adapted' specificity.


reasoning: The paragraph describes the Risk Committee's oversight of cybersecurity risks, primarily answering how the board oversees cybersecurity, thus falling under Board Governance. There are no qualifying facts to elevate specificity beyond Generic Boilerplate.


reasoning: The paragraph primarily addresses third-party cyber risk management, and there are no specific facts to elevate beyond Generic Boilerplate.


fact: developed an enhanced Employee Self Service portal

reasoning: The paragraph primarily describes the board's oversight of cybersecurity, including the audit committee's role and briefings, classifying it as Board Governance. The mention of the 'enhanced Employee Self Service portal' is a firm-specific fact, driving specificity to Firm-Specific.


fact: Our CIO and his security management team possess primary responsibility for identifying, assessing, monitoring, and managing our cybersecurity risks

fact: Our Board of Directors directly oversees cybersecurity risks, which includes conducting an annual review of the Company's cybersecurity risks, management's actions to identify and detect threats, management's action plans for response and recovery situations, and review of recent enhancements to the Company's defenses and strategic cybersecurity roadmap

fact: the Audit Committee receives quarterly cybersecurity updates, which include a review of new processes implemented to monitor cyber risks, and a summary of any recent threats and the Company's response to those threats

reasoning: The paragraph primarily describes the board's oversight of cybersecurity, including annual reviews and the Audit Committee's quarterly updates, classifying it as Board Governance. The specificity is Firm-Specific due to named roles (CIO, security management team) and a named committee with quarterly updates.


reasoning: The paragraph discusses general cybersecurity risks but does not fit into the other content categories, and there are no specific facts to elevate specificity beyond Generic Boilerplate.


fact: Chief Risk Officer

reasoning: The paragraph primarily describes the role of the Chief Risk Officer, a management position, making 'Management Role' the primary category. The mention of 'Chief Risk Officer' as a named role drives the specificity to 'Firm-Specific'.


reasoning: The paragraph primarily addresses the potential material impact of cybersecurity incidents on the business, aligning with Strategy Integration. It contains no specificity-relevant facts, resulting in Generic Boilerplate.


reasoning: The paragraph primarily addresses the management of third-party cyber risks, making 'Third-Party Risk' the content category. There are no specific facts that elevate specificity beyond Generic Boilerplate.


fact: vendor due diligence process that is designed to assess vendor control environments and evaluate risks associated with vendor access to the Company's confidential data and systems

fact: assessing and managing the cyber risks associated with engaging third-party vendors

fact: reviewing their information security practices

reasoning: The paragraph primarily addresses managing third-party cyber risks, making 'Third-Party Risk' the content category. The use of domain-specific terms like 'vendor due diligence process' and 'cyber risks associated with engaging third-party vendors' indicates Domain-Adapted specificity.


fact: advanced security measures

fact: regular system audits

fact: well-defined incident response plan

reasoning: The paragraph primarily describes the cybersecurity program's processes, including monitoring, advanced security measures, and incident response, classifying it as Risk Management Process. It contains domain terms like 'advanced security measures' and 'regular system audits', indicating Domain-Adapted specificity.


fact: Adrian J. Holt, age 55, is Senior Vice President and Chief Human Resources Officer

fact: Mr. Holt was appointed to his current position effective May 2023

reasoning: The paragraph primarily describes the management role of Adrian J. Holt, including his position, responsibilities, and appointment date, driving the specificity level to Firm-Specific.


reasoning: The paragraph primarily addresses whether cybersecurity risks have materially affected the company's business strategy, results of operations, or financial condition, falling under Strategy Integration. It contains no specificity-relevant facts, resulting in Generic Boilerplate.


fact: incident response plan and related policies and protocols which outline procedures for identifying, reporting and responding to cybersecurity incidents

fact: regularly updated to address new threats and tested through crisis simulation exercises

fact: incident response team who is trained to handle a wide range of security events

fact: collaborates with external cybersecurity experts when necessary

reasoning: The paragraph primarily describes the cybersecurity program's incident response activities, falling under Risk Management Process. It includes domain-specific terms like 'incident response plan', 'crisis simulation exercises', and 'cybersecurity experts', indicating Domain-Adapted specificity.


fact: Chief Information Officer ("CIO") is a peer to the CSO, also reporting to the CFO

fact: Zebra's current CIO was appointed to the role in March 2022

fact: has nearly 20 years of experience in managing IT functions

fact: CIO and his team are responsible for executing cybersecurity risk mitigation plans

reasoning: The paragraph primarily describes the CIO's role, reporting structure, and responsibilities, fitting 'Management Role'. Specific facts like March 2022 appointment, nearly 20 years of experience, and CIO title drive the Quantified-Verifiable specificity.


fact: The Audit Committee of the Board oversees the ERM annual risk assessment

reasoning: The paragraph primarily describes the board's oversight through the Audit Committee of the ERM annual risk assessment, aligning with Board Governance. The mention of the Audit Committee of the Board elevates specificity to Firm-Specific.


fact: engage external parties to supplement our internal capabilities and to assess our cyber maturity and readiness on a periodic basis

fact: party to a managed services agreement with an external party for incident response

fact: engage an external party for comprehensive cybersecurity assessment, opportunity prioritization, initiative road mapping and cyber project delivery

fact: engage additional external parties to assist with critical cyber-related infrastructure such as firewall maintenance and upgrade initiatives

fact: assess all third-party service providers for their qualifications before engaging them and monitor such providers throughout the term of the engagement

reasoning: The paragraph primarily addresses third-party cyber risk management, with specific details about engaging external parties, types of services, and assessment/monitoring practices driving the firm-specific specificity level.


fact: third party security risk assessment

fact: cybersecurity team continuously monitors and addresses cybersecurity threats and incidents at third-party service providers

reasoning: The paragraph primarily addresses managing third-party cyber risks, making Third-Party Risk the primary category. The presence of 'cybersecurity team' (firm-specific) and 'third party security risk assessment' (domain term) drives specificity to Firm-Specific.


fact: Cybersecurity Sub-Committee of the Board of Directors

reasoning: The paragraph primarily describes the board's oversight structure, including the Audit Committee and Cybersecurity Sub-Committee, leading to the content category 'Board Governance'. The mention of the Cybersecurity Sub-Committee is a firm-specific fact, driving the specificity to 'Firm-Specific'.


fact: a committee known as the Cyber ERM (Enterprise Risk Management) Committee has been established

reasoning: The paragraph describes the Cyber ERM Committee's role in overseeing cybersecurity and reporting to the Audit Committee and Board, aligning with Board Governance. The named Cyber ERM Committee is a firm-specific fact, driving specificity to Firm-Specific.


reasoning: The paragraph primarily discusses how cybersecurity risks could affect business outcomes, including delays in operations, sales, and financial reporting, aligning with Strategy Integration. It contains no specificity-relevant facts, resulting in Generic Boilerplate.


reasoning: The paragraph discusses offering identity protection services but does not address cybersecurity governance, management, risk processes, third-party risks, incidents, or strategy integration, so it is 'None/Other'. It contains no specificity-relevant facts, resulting in 'Generic Boilerplate'.


fact: in August 2023

fact: 429,252 Umpqua Bank customers

fact: MOVEit, a filesharing software

reasoning: The paragraph primarily describes a real cybersecurity incident with specific details, and the presence of specific dates, a quantified number of affected customers, and a named system drives the specificity to Quantified-Verifiable.


fact: Chief Information Officer

reasoning: The paragraph primarily describes management's responsibilities for cybersecurity risk management and the Chief Information Officer's experience, classifying it as Management Role. The mention of the Chief Information Officer elevates specificity to Firm-Specific.


fact: Retrieval-Masters Credit Bureau, Inc. d/b/a/ American Medical Collections Agency (AMCA)

fact: a security incident AMCA experienced that may have involved certain personal information about some of the Company's patients

reasoning: The paragraph primarily describes a real cybersecurity incident, so content_category is Incident Disclosure. The specific date, named firm, and details about the incident's nature drive the specificity to Quantified-Verifiable.


fact: On October 11, 2023, we announced that we had experienced disruptions in our Information Technology (IT) infrastructure and applications resulting from a cybersecurity incident

fact: The incident... caused disruption of our business operations for approximately three days

fact: we experienced no material financial impact to our business

reasoning: The paragraph primarily describes a specific cybersecurity incident, including its nature, impact, and remediation, leading to the Incident Disclosure category. The presence of specific dates, quantified disruption duration, and financial impact drives the specificity to Quantified-Verifiable.


fact: Head of Global IT

fact: IT Security Team

fact: cybersecurity team of a global consumer products company with a heavy online presence and with sales of services and goods to the U.S. government

fact: employees that have security certifications from reputable cybersecurity training organizations, including CompTIA

fact: over 20 years of combined infrastructure architecture experience, including PCI, SOC1 and SOC2 level compliance

reasoning: The paragraph primarily describes the roles and responsibilities of the Head of Global IT and IT Security Team, falling under Management Role. The presence of quantified experience (over 20 years) and firm-specific details drives the specificity to Quantified-Verifiable.


fact: Our IT Security team is led by our Director of IT Infrastructure and Security, who brings over 30 years of experience

fact: Director maintains the following internationally recognized certifications: Global Information Assurance Certification (GIAC) Security Essentials, GIAC Certified Enterprise Defender, GIAC Certified Incident Handler Certification, GIAC Certified Windows Security Administrator, and GIAC Critical Controls Certification

fact: Director reports to our Vice President of Information Technology

fact: Vice President of Information Technology has over 19 years of experience

fact: Vice President of Information Technology holds a Certified Information Systems Security Professional certification

reasoning: The paragraph primarily describes the roles, qualifications, and reporting lines of management (Director of IT Infrastructure and Security and Vice President of Information Technology), making it Management Role. The specificity is Quantified-Verifiable due to the presence of quantified experience and named certifications.


fact: The Chief Security Officer ("CSO") is the senior-most security professional responsible for the implementation of the Company's cybersecurity, product security, and corporate/physical security programs, and reports to the CFO

fact: The Company's current CSO has served in that role for Zebra since 2018

fact: He is a recognized leader in the field of cyber security with over 14 years of global executive cybersecurity experience

reasoning: The paragraph primarily describes the CSO's role, responsibilities, and experience, aligning with Management Role. Specific facts like the CSO's tenure since 2018 and 14 years of experience drive the specificity to Quantified-Verifiable.


reasoning: The paragraph primarily describes the cybersecurity program's activities (developing, maintaining, monitoring, updating systems/programs to mitigate incidents), classifying it as Risk Management Process. It contains no specificity-relevant facts, resulting in Generic Boilerplate.


fact: principles from the National Institute of Standards and Technology Cybersecurity Framework

fact: principles from the Center for Internet Security – Top 18 Critical Security Controls – Control Level Framework

fact: phishing tests conducted at least quarterly on a global basis, with additional periodic phishing tests conducted with high-risk employee groups

fact: individualized, biannual employee information security assessments

fact: maintenance of a cyber risk insurance policy

reasoning: The paragraph primarily describes the cybersecurity risk management program's processes, aligning with 'Risk Management Process'. The inclusion of specific frameworks and practices demonstrates cybersecurity expertise, leading to 'Domain-Adapted' specificity.


fact: threat intelligence services from multiple organizations

fact: Third-Party Risk Management program

reasoning: The paragraph primarily addresses third-party cyber risk management, making 'Third-Party Risk' the content category. The specificity is Firm-Specific due to the named 'Third-Party Risk Management program' and 'threat intelligence services' as domain terms.


fact: Travis Smith, age 51, is Executive Vice President, Additives & Functional Products, Manufacturing, WWE&C and HSE

fact: appointed to his current position effective January 2025

reasoning: The paragraph primarily describes Travis Smith's management role, responsibilities, and career progression. The specificity is Firm-Specific due to the named role and specific date.


fact: July 2018

fact: ransomware incident

fact: Dx information technology systems

fact: Company-wide operations

fact: no theft or misuse of patient or client data

fact: did not have a material effect on the Company

reasoning: The paragraph primarily describes a real cybersecurity incident, making 'Incident Disclosure' the primary category. The specific date 'July 2018' is a verifiable fact, driving the specificity to 'Quantified-Verifiable'.


reasoning: The paragraph primarily addresses managing third-party cyber risks, making 'Third-Party Risk' the content category. The mention of System Organization and Control Reports (SOC Reports) demonstrates domain expertise, leading to a 'Domain-Adapted' specificity level.


fact: CISO, who has a technical degree in computer science from an accredited public university

fact: over 20 years of information technology and cybersecurity experience in multiple industries, including financial services and defense

fact: team comprises security engineers, detection specialists, and business cybersecurity experts

reasoning: The paragraph primarily describes the incident response process, classifying it as Risk Management Process. The presence of quantified and firm-specific facts drives the specificity to Quantified-Verifiable.


fact: formalize our security due diligence process for each acquisition target

fact: independent testing of the target technology prior to closing the acquisition

fact: remediation by the target or attempt to ensure a remediation path post-closing

fact: contractual protections and liability parameters set forth in the purchase agreement

reasoning: The paragraph primarily addresses third-party security risk management, making 'Third-Party Risk' the content category. It demonstrates cybersecurity domain expertise through terms like 'security due diligence process' and 'independent testing of the target technology', leading to a 'Domain-Adapted' specificity level.


fact: ransomware

reasoning: The paragraph addresses materiality of cybersecurity incidents and insurance, fitting 'Strategy Integration'. The mention of 'ransomware' demonstrates domain expertise, leading to 'Domain-Adapted' specificity.


fact: evaluate third-party service providers' cybersecurity policies, procedures, and practices annually

fact: seek to mitigate third-party cybersecurity risk through contractual safeguards

fact: regular review of the internal control reports of such third parties

fact: incorporating third-party risk into our incident response plans

reasoning: The paragraph primarily addresses managing third-party cybersecurity risks, making 'Third-Party Risk' the content category. It uses cybersecurity-specific terms like 'cybersecurity policies, procedures, practices' and 'contractual safeguards', indicating domain expertise, leading to 'Domain-Adapted' specificity.


fact: The CRO, Chief Information Officer ("CIO") and CISO each have over 15 years experience in managing cybersecurity, information technology and other risk management processes

fact: The CRO, a member of RGA's Executive Committee

fact: The CRO has more than 30 years of experience

fact: serving as the Company's Global Chief Risk Officer

fact: The CIO, a member of RGA's Executive Committee

fact: The CISO, who is responsible for implementing the Company's cybersecurity risk management strategy

fact: oversees the Company's global security and privacy teams

reasoning: The paragraph primarily describes the roles, responsibilities, and experience of the CRO, CIO, and CISO, aligning with the Management Role category. The specificity is Firm-Specific due to firm-unique facts like named roles, committee memberships, and quantified experience.


fact: Chief Technology Officer

fact: Technology Leadership Centre

fact: IT and cybersecurity teams at our subsidiaries

fact: Chief Risk Officer

fact: corporate and subsidiary risk teams

fact: Risk Committee of the board of directors

fact: Controlling Department

fact: subsidiary internal audit functions

fact: Audit Committee of the board of directors

reasoning: The paragraph describes the cybersecurity risk governance model with three lines of defense, involving board-level committees and management roles, primarily answering how the board oversees cybersecurity, thus Board Governance. The presence of named roles and committees drives the specificity to Firm-Specific.


fact: The CISO has more than 20 years of experience in cybersecurity and information technology

fact: holds a Master's degree in Business Administration with a focus on Information Technology

fact: holds a Certified Information Security Manager (CISM) certification

fact: reports to Farmer Mac's Senior Vice President – Enterprise Risk Officer, who in turn reports to the Chief Executive Officer

reasoning: The paragraph primarily describes the CISO's role, responsibilities, qualifications, and reporting lines, making 'Management Role' the primary category. The presence of quantified experience, specific certifications, and named reporting lines drives the 'Quantified-Verifiable' specificity.


reasoning: The paragraph describes the board's oversight through the Audit Committee, including the ERM process and risk evaluation, classifying it as Board Governance. No facts elevate specificity above Level 1, resulting in Generic Boilerplate.


fact: risk assessments of suppliers, including with respect to cybersecurity

fact: monitor our suppliers using commercially available services that provide real-time security scoring of supplier technology services, threat intelligence, financial intelligence, geopolitical risk intelligence, and other considerations related to cybersecurity

fact: negotiate appropriate provisions with respect to cybersecurity in our contracts with suppliers

reasoning: The paragraph primarily addresses third-party cyber risk management, making 'Third-Party Risk' the content category. The mention of real-time security scoring, threat intelligence, and negotiating cybersecurity provisions in contracts demonstrates domain expertise, leading to a specificity level of Domain-Adapted.


fact: Board's Risk Management Committee, with support from its Cybersecurity and Technology Subcommittee, has primary oversight responsibility for cybersecurity risk

fact: Risk Management Committee and its Cybersecurity and Technology Subcommittee receive quarterly reports from management on cybersecurity issues

fact: Board's Risk Management Committee and Audit Committee also hold a joint meeting annually at which they receive a report from the Company's CISO on cybersecurity threats

fact: full Board holds periodic cybersecurity education sessions, which may feature the perspective of an outside expert

fact: annual executive-level crisis exercise that includes a cybersecurity component to test its resiliency response, completeness of playbooks, and communication protocols

fact: This exercise involves Board members, Managing Committee members, third-party companies, and regulators, as appropriate

reasoning: The paragraph primarily describes the board's oversight of cybersecurity through committees, reports, and exercises, aligning with 'Board Governance'. Specificity is 'Firm-Specific' due to named committees and specific exercise details.