content_category: Strategy Integration

category_confidence: high

specificity_confidence: high

reasoning: This paragraph discusses cybersecurity risks and concludes with a materiality assessment that cybersecurity threats have not materially affected the company - this is a standalone materiality conclusion with no incident narrative, which maps to Strategy Integration per the tiebreakers.

provider: minimax

stage: benchmark


content_category: Risk Management Process

reasoning: The paragraph describes the company's internal processes for assessing, identifying, and managing cybersecurity risks within its enterprise risk management system. While third-party service providers are mentioned, they are only a component of the internal risk management process rather than the central topic, which would classify as Third-Party Risk.


content_category: None/Other

reasoning: This paragraph is a cross-reference directing readers to the Risk Factors section for cybersecurity threat information. It contains no substantive disclosure about governance, processes, incidents, or strategy - only a pointer to another section of the filing.


reasoning: The paragraph describes the company's internal risk management processes: ERM integration, annual enterprise risk assessments, risk categorization, monitoring cadence, and reporting to leadership/board. This is a description of internal processes, not board governance (the board is mentioned only as a recipient of reports, not as the grammatical subject), and not strategy integration (no financial or business impact discussion).


reasoning: The paragraph describes the company's internal risk management processes, including a multi-stakeholder team composition and various monitoring/assessment methods. The specific departmental composition (Legal, Compliance, Finance) qualifies as firm-specific as it identifies a unique organizational structure at this company.


reasoning: The paragraph describes the company's internal information security programs and risk management processes, including framework adoption. It does not describe an actual incident, focus on board/management roles, discuss vendors, or address financial/materiality aspects. The mention of specific frameworks (ISO, NIST) makes this Sector-Adapted rather than firm-specific, as it contains no unique company details.


reasoning: The paragraph describes the company's internal risk management processes including ERM integration, cybersecurity policies, and the CISO's role in the security program. While it mentions the Board and CISO, these are contextual to the internal process description rather than being the primary subject. The mention of the FFIEC framework elevates it to Sector-Adapted level.


reasoning: This paragraph provides a standalone materiality conclusion about cybersecurity threats (they have not materially affected the company to date) with no incident narrative. It references risk factors but does not describe internal processes, board oversight, or specific management roles. The mention of third-party CROs/CMOs is generic boilerplate terminology in the pharmaceutical industry, not a firm-specific fact.


reasoning: The paragraph describes the company's internal risk management processes including threat intelligence review, risk assessment, and control evaluation. While it mentions an InfoSec team and third-party service providers, these are described generically without any firm-specific details, named frameworks, specific dates, dollar amounts, or named entities that would elevate the specificity.


content_category: Management Role

reasoning: The paragraph primarily describes management-level cybersecurity governance structure, with detailed focus on the VP, IT Data Security role, reporting lines to CTO, and the Cybersecurity Committee composition. While the Board is mentioned, the grammatical focus and detailed content center on management roles and organizational structure. The mention of specific roles (VP, IT Data Security) and named committee (Cybersecurity Committee) with specific composition goes beyond generic boilerplate.


content_category: Board Governance

reasoning: The paragraph's grammatical subject is the board/audit committee discussing oversight responsibilities, which clearly falls under Board Governance. However, the roles mentioned (VP of Operation & Information Technology, Head of Information Technology) are generic IT roles, not cybersecurity-specific titles like CISO. There are no specific dates, dollar amounts, named frameworks, or other hard verifiable facts - only generic references to quarterly reporting and ad-hoc updates.


reasoning: This is a forward-looking risk factor statement about potential future cybersecurity threats with no substantive disclosure about actual cybersecurity governance, processes, incidents, or strategy. It contains standard boilerplate language that could appear in any company's filing.


reasoning: The paragraph's grammatical subject is the Audit Committee, and the content focuses on board oversight responsibilities (receiving reports, overseeing risk assessment). All elements are standard governance structures and vague cadences with no specific dates, named frameworks, or firm-specific details.


reasoning: The paragraph describes the company's internal cybersecurity processes: vulnerability management, monitoring, and an incident response plan aligned with the NIST framework. While it references NIST (a recognized standard), it contains no firm-specific details such as named providers, products, dates, or certifications.


reasoning: The paragraph describes the company's internal cybersecurity risk management practices including incident response planning, tabletop exercises, business continuity planning, and employee training. These are generic internal processes with no company-specific details, named frameworks, or verifiable facts.


reasoning: The paragraph's grammatical subjects are 'The Board', 'The Audit Committee', and 'the Cybersecurity Risk Subcommittee' — all board-level entities. The content focuses on board oversight responsibilities, committee structure, and member qualifications for cybersecurity risk, which is the defining characteristic of Board Governance.


content_category: Third-Party Risk

reasoning: The paragraph is centered on third-party service provider oversight—describing requirements imposed on vendors (certification, security measures, breach reporting). This matches the 'Third-Party Risk' category where requirements imposed ON vendors is the central topic. The paragraph contains no specific dates, dollar amounts, headcounts, named third-party firms, named products, or any other hard verifiable facts—it is entirely generic boilerplate about vendor oversight that could appear in any company's filing.


reasoning: The paragraph's grammatical subjects are the Audit Committee and full Board, describing their oversight responsibilities for cybersecurity risk. This is board governance content - specifically committee oversight, reporting cadences, and risk monitoring roles.


reasoning: The paragraph focuses on the Audit Committee's oversight responsibilities for cybersecurity risk management, with the Audit Committee and Board as the grammatical subjects. It describes the board's governance role through its committee structure, which is the defining characteristic of Board Governance.


reasoning: The paragraph's primary grammatical subjects are the board of directors and audit committee, with the audit committee having 'oversight responsibility for risks and incidents relating to cybersecurity threats.' The mention of management (CISO, CLO, CFO) is brief and in service of describing the board's oversight structure, making Board Governance the dominant category per the tiebreaker.


reasoning: The paragraph's primary grammatical subjects are the Board of Directors and Audit Committee, and the content focuses on their oversight role in cybersecurity - clearly establishing Board Governance as the category. The specificity is Sector-Adapted because it names the NIST Cybersecurity Framework as the underlying standard but contains no firm-specific details.


reasoning: The paragraph's grammatical subjects are predominantly 'Our Board of Directors' (6 mentions) discussing the Board's risk oversight function, with the HSE Director mentioned as the management role that reports to the Board. The specific facts of 'Heat Waves employee' (a division/subsidiary name), 'over five years' (specific duration), and the cybersecurity-specific title 'Health, Safety, and Environmental Director' distinguish this from generic boilerplate.


reasoning: The paragraph describes the company's internal incident response process with specific roles (Senior Director of Information Security), named committees (Technology Risk Management Committee, Materiality Committee), and specific timeframes (24 hours). This is clearly about the company's own risk management procedures, not board governance, third-party risk, or incident disclosure.


reasoning: The paragraph describes the IT Department's internal cybersecurity risk management policies and procedures including vulnerability management, security assessments, and penetration testing. While third-party provider oversight is mentioned, it is only one component of the internal processes rather than the central topic. The paragraph names the NIST framework, which makes it Sector-Adapted.


reasoning: The paragraph describes the company's internal risk management processes including policy development, control implementation, risk assessments, and framework adoption. It focuses on the company's own processes rather than board oversight, management roles, or third-party vendor management. The specificity is Sector-Adapted because it names two recognized security frameworks (CIS Controls and PCI DSS) but contains no firm-specific details like named roles, dates, dollar amounts, or unique identifiers.


reasoning: The paragraph's grammatical subjects are third-party providers, service providers, vendors, and third-party consultants. The central topic is vendor oversight: assessing security standards, requiring security terms, ensuring insurance coverage, imposing security requirements (notification, encryption, data disposal), and engaging third parties for penetration testing. While penetration testing is a security practice, here it's framed as part of vendor oversight (leveraging third-party consultants), making Third-Party Risk the primary category.


reasoning: The paragraph describes the Trustee's internal cyber risk management program, protocols, and processes - all internal risk management activities. While it mentions a third-party vendor performs an annual assessment, vendor oversight is not the central topic; it's incidental to describing the internal program. For specificity, despite mentioning 'best practices and standards,' no specific framework (NIST, ISO, etc.) is named. The paragraph contains only generic descriptions (cyber risk management program, robust cybersecurity protocols, employee training, third-party vendor) that could appear in any company's filing.


reasoning: The paragraph's grammatical subject is the CDIO/CISO (a management role), and the primary focus is on identifying this role, its qualifications, prior experience at named companies, reporting structure, and team composition. Board oversight (TCRC meetings) is mentioned only briefly as a supporting detail.


reasoning: The paragraph mentions past cybersecurity incidents but only to conclude they had no material impact—per tiebreakers, this is Strategy Integration, not Incident Disclosure, since it does not describe what happened. It contains no specific facts: no named roles (CISO is not mentioned), no specific dates, no frameworks, no dollar amounts, no named products, and no named third-party firms—only generic references to 'consultants' and 'the board of directors.'


reasoning: The paragraph's grammatical subjects are the Board of Directors and Audit Committee, and it describes their oversight role, reporting cadence, and escalation procedures. There are no specific facts - 'quarterly' is a generic cadence, CEO/CFO are standard C-suite roles, and the managed service provider is unnamed.


reasoning: The paragraph describes Equifax's internal incident detection and response process, which is a core component of enterprise risk management. It discusses their operational plans, regular reviews, and exercises - all internal processes rather than board oversight, management roles, or third-party vendor management.


reasoning: The paragraph's grammatical subject is consistently 'The Board' and describes the Board's oversight activities including receiving presentations, incident notifications, and annual discussions about cybersecurity risk management. This clearly falls under Board Governance.


content_category: Incident Disclosure

reasoning: This paragraph describes an actual cybersecurity incident including specific date (October 2023), what happened (unauthorized access to user accounts), scope (information accessed and downloaded from 23andMe.com accounts), and response actions (password resets, two-factor verification, Security Operations enhancements). This clearly falls under Incident Disclosure as it describes a real event with narrative details.


reasoning: The paragraph describes the company's internal cybersecurity processes and tools (SIEM interface with behavioral analytics, penetration testing) as generic practices that could apply to any company. While it mentions 'third-party experts,' this is not a named firm, and there are no specific dates, dollar amounts, named products, or other firm-specific identifiers.


reasoning: The paragraph describes the company's internal ERM committee structure and its quarterly risk management processes, including cybersecurity considerations. The mention of specific cybersecurity-specific roles (CISO, CDO) and a named internal committee (ERM) distinguishes this from generic boilerplate.


specificity_confidence: medium

reasoning: The paragraph focuses on the CISO's qualifications, responsibilities, and expertise, which aligns with the Management Role category. The 'over 20 years' experience and Master's degree are specific facts unique to this company's disclosure, though only one approximate numeric fact is present, preventing Quantified-Verifiable rating.


reasoning: The paragraph describes the company's internal cybersecurity assessment and vulnerability management processes performed by specific internal teams (Longbridge's technology team and operational risk management group), which are the grammatical subjects of the risk management activities described.


reasoning: The paragraph's main point is the materiality conclusion that no cybersecurity risks materially affected the company during fiscal 2025. While it briefly mentions past intrusions, it provides no incident details (dates, scope, response) - the mention is only to contextualize the risk assessment. The reference to Risk Factors and the limitations disclaimer reinforce this as a strategy/financial impact disclosure.


reasoning: The paragraph discusses the financial/materiality impact of a past cybersecurity incident and provides forward-looking materiality disclaimers. While it mentions a past incident (August 2020), the primary focus is on business strategy and financial condition impact, not describing what happened in the incident. The tiebreaker rule applies: paragraph ONLY discusses financial cost or materiality WITHOUT describing the event → Strategy Integration.


reasoning: The paragraph's grammatical subjects are the ISC committee and the CISO, with the CISO's role and qualifications as the central topic. This fits Management Role. The paragraph contains firm-specific details: a named committee (AAM Information Security Council), a specific cybersecurity role (CISO), and named certifications that are unique to this individual's qualifications.


reasoning: The paragraph describes internal security processes: employee training, third-party oversight, security assessments, and monitoring. While third-party risk is mentioned, it's presented as a component of the company's internal risk management approach rather than as a standalone third-party risk management topic. The cybersecurity insurance mention is brief and not the central focus.


reasoning: The paragraph describes the company's internal cybersecurity risk management program, including framework adoption (NIST CSF, SOX) for identifying, assessing, and managing cybersecurity risks. This is a clear description of internal processes, not board oversight, vendor management, or incident disclosure.


reasoning: This paragraph is a forward-looking materiality assessment stating they have not experienced a material cyber incident and are not aware of risks likely to materially affect the business. It contains no incident narrative, no governance details, no management roles, and no process descriptions - only a boilerplate materiality conclusion with a cross-reference to risk factors.


reasoning: Paragraph describes the company's internal risk management processes for assessing and managing cybersecurity threats, including framework adoption (NIST) and ERM integration. It names a recognized framework (NIST CSF) but contains no firm-specific details - no named roles, dates, dollar amounts, or unique identifiers.


reasoning: The paragraph's grammatical subjects are 'the Board' and 'its committees' (specifically the Audit Committee), and the content focuses on board oversight of cybersecurity risk, reporting cadences, and committee responsibilities. This is classic board governance language. For specificity: the paragraph contains only generic governance references ('the Board', 'Audit Committee', 'management', 'periodic meetings') with no named frameworks, specific dates, cybersecurity-specific roles (CISO/CTO), named products, dollar amounts, or any other fact from the IS list. Audit Committee is explicitly excluded from being a specific fact per the guidelines.


reasoning: The paragraph's primary focus is on the CISO role - detailing the CISO's qualifications, certifications, education, and reporting structure. While board oversight is mentioned briefly, the grammatical subject and main topic are the management role (CISO), not the board.


reasoning: The paragraph describes the company's general internal processes for assessing and managing cybersecurity risks aligned with industry standards, but contains no specific facts such as named frameworks, roles, dates, or firm-specific details that would elevate it beyond generic boilerplate.


reasoning: The paragraph discusses the company's internal cybersecurity controls, risk mitigation efforts, and the limitations of preventive measures — this is about the company's own risk management processes rather than governance, third-party risk, or incident disclosure.


reasoning: The paragraph's grammatical subjects are 'Our CIO and other senior leaders' and 'They' (referring to the CIO/leaders), focusing on their activities of reviewing assessments, monitoring metrics, and leading the response plan. While the Audit Committee and Board are mentioned, they are objects of reporting/notification, not the central topic.


reasoning: The paragraph describes the company's internal processes for managing cybersecurity risk: using external experts for evaluation/testing, conducting employee training, and senior management reviewing/refining policies. This is internal risk management, not vendor oversight (Third-Party Risk) or board governance.


reasoning: The paragraph describes the company's planned internal risk management processes including identification, assessment, and treatment of cybersecurity risks, as well as vulnerability management and penetration testing - all internal processes rather than board governance or third-party risk oversight.


reasoning: This paragraph describes an actual cybersecurity incident in detail - what happened (nation-state actor gained access), when (late November 2023), scope (small percentage of employee emails including senior leadership and specific departments), and ongoing activities (accessing source code repositories). This is clearly an incident disclosure as it narrates the actual event rather than just discussing financial impact or materiality.


reasoning: The paragraph describes the company's internal processes for managing cybersecurity risk: framework adoption (NIST), risk assessments, monitoring tools, cross-functional collaboration, quarterly reviews, and integration into an internal policy. This is clearly about the company's own internal risk management processes rather than board oversight, management roles, or third-party vendor management.


reasoning: This paragraph describes an actual cybersecurity incident that occurred on March 10, 2024, including what happened (unauthorized access to portions of the information environment), when it was detected, immediate response actions (initiated incident response and business continuity protocols, containment measures), and operational impact (disruption to a portion of the business). This is a narrative description of a real event.


reasoning: This paragraph describes an actual cybersecurity incident - it specifies the date of determination (March 10, 2024), describes what happened (unauthorized access by third party), the company's response actions (initiated protocols, containment measures), and operational impact (disruption to portion of business). This is clearly an incident narrative.


reasoning: This paragraph describes an actual cybersecurity incident with specific details about what happened (former employee obtained customer data), the scope (up to 33 million accounts), and what data was affected. It includes incident response actions (engaged external forensic experts, cooperating with Korean regulators) and describes the operational scope of the breach.


reasoning: This paragraph describes an actual cybersecurity incident with narrative details including the detection date, unauthorized access to IT systems, response actions (activated incident procedure, engaged external experts, notified law enforcement), and operational impact on business applications. The specific date (May 6, 2024) qualifies as a firm-specific fact, making this more than generic boilerplate.


reasoning: The paragraph describes the company's own internal cybersecurity processes: incident response planning, risk assessments, vulnerability scanning, penetration testing, mitigation measures, and IT team monitoring/reporting. No board oversight, no named management roles (CISO/CTO), no third-party vendor discussion as central topic, and no actual incident described. All content is about internal risk management processes.


reasoning: The paragraph describes an actual cybersecurity incident including what happened (third party removed, systems impacted, data stolen/destroyed), scope (billing and label making functions affected), and response actions (solutions implemented, operations continued). However, it contains no specific dates, dollar amounts, headcounts, named third-party firms, or named tools/products that would elevate it to Firm-Specific or Quantified-Verifiable.


reasoning: This paragraph describes an actual cybersecurity incident with specific details: dates (February 4-5, 2024), unauthorized access to systems, data exfiltration (client information, PII, administrative data), and response actions (activated incident response process, engaged external experts, notified law enforcement).


reasoning: The paragraph focuses on board and committee oversight structure, specifically describing the Audit Committee's delegation to a Cybersecurity Subcommittee established in 2023, which is a named committee unique to Booking Holdings.


reasoning: This paragraph describes an actual cybersecurity incident including the detection date (May 6, 2024), what happened (unauthorized third-party access to IT systems), response actions (activated incident response procedure, engaged external experts, notified law enforcement), and operational impact (disruptions to business applications). This is clearly an incident disclosure as it narrates the event itself. The specific date is one hard verifiable fact, making it Firm-Specific but not Quantified-Verifiable since there's only one such fact (no dollar amounts, headcounts, named third-party firms, or named products).


reasoning: Paragraph describes an actual cybersecurity incident in detail: what happened (website defacement by bad actor), when (August 25, 2025), the Company's response actions (restored from backups, took website down, placed temporary page, reviewed entire web platform), and scope (wytecintl.com). This is a narrative of a real event with specific dates and actions.


reasoning: This paragraph describes a specific cybersecurity incident with detailed timeline (detection in January 2024, unauthorized access starting late November 2023, access removed January 13), scope (email accounts of senior leadership, cybersecurity, legal functions), and response actions (law enforcement notification, regulatory notification). The three specific dates qualify this as Quantified-Verifiable.


reasoning: The paragraph describes an actual cybersecurity incident with narrative details: unauthorized access to personal information (names, DOB, SSN/tax IDs), scope limited to third-party provider environment, law enforcement notification, and customer notification plans. This is clearly an incident disclosure with event description.


reasoning: The paragraph's grammatical subject is the Information Security Officer role, discussing the ISO's reporting structure, responsibilities, and qualifications—this clearly falls under Management Role. It contains firm-specific facts: the specific reporting relationship (ISO reports to CRO) and a specific number of years of experience (20+ years), which are unique to this company's disclosure.


reasoning: This paragraph describes an actual cybersecurity incident including unauthorized access, data exfiltration (images of video meetings and computer screens), threat actor demands for payment, and response actions taken. While it mentions potential financial impact and insurance, the primary focus is describing what happened in the incident itself, making Incident Disclosure the appropriate category. The paragraph lacks specific verifiable facts - no incident dates, no dollar amounts, no named third parties or tools, making it Generic Boilerplate.


reasoning: This paragraph is a standard forward-looking statements safe harbor disclaimer common to all SEC filings. It mentions 'the Incident' only as part of disclaiming forward-looking statements about it, with no substantive cybersecurity disclosure content.


reasoning: This paragraph describes an actual cybersecurity incident with specific details: the date of the attack (February 3, 2025), what happened (network access, encryption of applications, file exfiltration), current remediation status, and operational impacts (product limitations, delayed back-office functions). The specific date is the key firm-specific fact, but there is only one hard verifiable fact, not two or more required for Quantified-Verifiable.


reasoning: This paragraph describes an actual cybersecurity incident including the threat actor's unauthorized access, operational impact (production halt), and data exfiltration. It provides narrative details about what happened, the scope of affected systems/facilities, and response actions taken.


reasoning: The paragraph describes the company's internal training and awareness programs for cybersecurity risk management, which is a core internal process. It contains no firm-specific details—no named roles, programs with unique identifiers, dates, or other verifiable facts—and consists entirely of generic security practices that could apply to any company.


reasoning: This paragraph discusses financial materiality and expected costs related to an incident without describing what actually happened in the incident. Per tiebreakers, discussing financial cost/materiality without incident narrative = Strategy Integration. It contains no specific dates, dollar amounts, named firms, or other hard verifiable facts—just standard SEC materiality language ('reasonably likely to have a material impact') that could appear in any company's filing.


reasoning: This paragraph describes an actual cybersecurity incident at VF Corporation, including what happened (unauthorized access, encryption of IT systems, data theft including personal data), when it occurred (December 13, 2023), scope (some IT systems, personal data), and response actions (investigation with external experts, activating incident response plan, law enforcement notification). This is clearly an Incident Disclosure as it provides a narrative of a real event.


reasoning: This paragraph describes the operational impacts of a disclosed cybersecurity incident at VF Corp, including disrupted inventory replenishment, delayed order fulfillment, cancelled orders, and recovery progress. However, it contains no hard verifiable facts (specific dates, dollar amounts, named third-party firms, or named products/tools) and no firm-specific identifiers beyond the company name and generic references to 'Original Report' and 'certain brands'.


reasoning: This paragraph discusses the financial/materiality impact of a previously disclosed incident (slower vehicle sales, expected adverse impact on Q2 2024 earnings) without describing what happened in the incident itself. Per tiebreakers, paragraphs that ONLY discuss financial cost, insurance, or materiality of an incident WITHOUT describing the event → Strategy Integration.


reasoning: This paragraph describes an actual cybersecurity incident including what happened (website and email systems disrupted), when it occurred (July 25, 2024), how it happened (former executive officer deliberately deactivated website), scope (impact on IT and email communications), and response actions (restoration, containment, remediation). This is clearly an Incident Disclosure as it provides a detailed narrative of a real event.


reasoning: This paragraph describes an actual cybersecurity incident with specific details: two specific dates (December 12, 2023 and May 2023), a named threat actor (Midnight Blizzard/Cozy Bear), and specific scope details. This is clearly an incident disclosure as it narrates what happened, when, the threat actor identity, and the scope of the breach.


reasoning: The paragraph's grammatical subject is the Director, IT Infrastructure & Security, describing their role, qualifications, reporting lines, and the team they lead. While the Board is mentioned in the reporting structure, the primary focus is on management roles and organizational structure, not board oversight.


reasoning: This paragraph describes an actual cybersecurity incident with narrative details: the date of discovery (April 5, 2024), what happened (unauthorized access to file systems), response actions (activated incident response protocols, containment measures), and operational impact (temporary interruption in business operations). This is clearly an Incident Disclosure as it describes a real event with specific details about scope and response.


reasoning: This paragraph describes an actual cybersecurity incident with specific dates (December 13, 2023 detection and December 15, 2023 threat actor ejection), response actions (investigation, incident response plan activation, system shutdown), and cooperation with law enforcement - all elements of incident disclosure.


reasoning: This paragraph discusses financial impact, insurance reimbursement expectations, and materiality assessment of the incident without describing what happened in the incident itself. The focus is on business/financial outcomes rather than incident details.


reasoning: The paragraph describes the company's internal incident response practices—specifically that incident assessments are conducted with CEO, CFO, and MSP—which is an internal process for risk assessment and response, not board governance, not a disclosed incident, and not strategy integration (no financial/materiality assessment of a specific event). No specific dates, named entities, frameworks, or firm-specific details are present.


reasoning: This paragraph focuses exclusively on financial materiality assessment and forward-looking guidance regarding the incident's impact, not on describing the incident itself. It contains three specific dates (two fiscal quarter ends and a press release date) that an outsider could independently verify, meeting the Quantified-Verifiable threshold.


reasoning: While the paragraph describes operational impacts from an incident, it focuses primarily on financial materiality ($388,000 cost estimate, material impact on results) and restoration status rather than describing the incident event itself (no attack vector, no unauthorized access description). The financial and business impact is the main point, making Strategy Integration appropriate per tiebreaker rules.


reasoning: Paragraph focuses on management roles (CISO, CITO, CEO), their qualifications, expertise, and reporting structure — making Management Role the clear category. Contains multiple firm-specific facts including named cybersecurity-specific roles, specific experience duration (17 years), and 15+ named certifications, which exceeds the threshold for Firm-Specific.


reasoning: This paragraph discusses the financial/materiality impact of the cybersecurity incident and insurance coverage, but does not describe what happened in the incident. It contains only boilerplate materiality language with no specific dates, dollar amounts, named third parties, or other verifiable facts unique to this company.


reasoning: This paragraph describes an actual cybersecurity incident in detail: it specifies what happened (unauthorized access, data encryption), when it was detected (July 10, 2024), the scope of impact (manufacturing facilities shut down, retail/e-commerce operational but order fulfillment impacted), and response actions taken (containment, investigation, incident response plan activation, system shutdown). This is a clear incident narrative with specific operational impacts.


reasoning: This paragraph discusses financial impact, cost estimates ($180M-$400M range), and materiality assessment of the incident without describing what happened in the incident itself. Per tiebreakers, paragraphs that ONLY discuss financial cost or materiality without incident narrative map to Strategy Integration.


reasoning: This paragraph discusses only the financial impact (delayed revenue recognition, lost revenue, one-time expenses) without describing what happened in the incident itself. Per tiebreakers, financial impact discussions without incident narrative classify as Strategy Integration. The paragraph contains no specific verifiable facts—no dollar amounts, specific dates, named firms, or quantified metrics—just vague references to 'certain transactions' and 'one-time expenses'.


reasoning: Paragraph focuses on the VP of IT role as the grammatical subject throughout, describing their responsibilities, reporting structure, qualifications, and the team they lead. This is Management Role - not Board Governance (the board is only mentioned as a recipient of updates, not as the actor).


reasoning: This paragraph describes an actual cybersecurity incident with specific details: the date the disruption began (June 19, 2024), the vendor (CDK Global), the specific systems affected (DMS, CRM, sales/inventory/accounting functions), the current restoration status, and the uncertainty around full restoration timeline. This is a narrative description of what happened, not just financial impact or process discussion.


reasoning: This paragraph describes an actual cybersecurity incident including unauthorized access, response actions (activating incident response plan, taking systems offline, engaging external experts), and operational impact (halting production operations). No specific dates, dollar amounts, named firms, or other verifiable facts are present.


reasoning: This paragraph discusses only the financial cost, insurance coverage, and materiality of an incident without describing what happened in the incident (no dates, no narrative of the event). Per tiebreakers, this is Strategy Integration. It contains no specific facts—no named third-party firms, specific dates, dollar amounts, or firm-specific details—and could apply to any company's disclosure.


reasoning: The paragraph describes a cybersecurity incident including unauthorized access by a cybercrime organization, data exfiltration scope (customer and employee PII), and response actions (notifications to affected parties, regulators, and law enforcement), which constitutes incident disclosure content.


reasoning: Paragraph describes an actual cybersecurity incident with specific date of discovery, named product affected, data accessed scope, and response actions taken. Contains two hard verifiable facts (specific date + named product) meeting Quantified-Verifiable threshold.


reasoning: This paragraph describes an actual cybersecurity incident with specific details: the detection date (February 6, 2024), what was discovered (unauthorized activity), response actions taken (network isolation, engaging a cybersecurity firm), and operational impact (disruption to business processes). This is a narrative description of a real event, not just a materiality conclusion or process description.


reasoning: This paragraph describes an actual cybersecurity incident (ransomware on August 16, 2025) with specific dates, what happened (vulnerability in third-party firewall), scope (certain internal IT systems), and response actions (engaged cybersecurity experts, improved systems). This is clearly an incident disclosure as it describes a real event with narrative details.


reasoning: This paragraph discusses financial arrangements (waiver of interest/lease payments) to fund remediation efforts, not the incident itself. Per tiebreaker rules, financial cost discussions without incident narrative = Strategy Integration. Multiple hard verifiable facts present: specific dates (Jan 29, 2020; March 16, 2020; March 2025), named entities (BH Finance LLC, BH Media Group, Inc.), and dollar amount ($3.7M) meet the Quantified-Verifiable threshold.


reasoning: The paragraph describes the company's internal cybersecurity program - its tools, processes, controls, certifications, and procedures - which is the core of risk management. The mention of a third-party firm is just one component, not the central topic. While it mentions maintaining ISO 27001 certification (a firm-specific fact), the paragraph is predominantly a description of standard security practices that could apply to any company in the sector, making it Sector-Adapted.


reasoning: Paragraph describes an actual cybersecurity incident with specific details: date of discovery (October 15, 2025), nature of attack (unauthorized access with encryption and monitoring software), scope (portions of internal corporate IT systems, business applications), and response actions (activated incident response, notified law enforcement, retained external experts, took systems offline). This matches the definition of Incident Disclosure as it describes what happened, when, how, and the company's response.


reasoning: The paragraph's grammatical subjects are the CIO and Information Security Director, describing their qualifications, experience, and responsibilities in leading the cybersecurity program. This is a clear Management Role disclosure.


reasoning: The paragraph's grammatical subjects are the Board of Directors and Audit Committee, and the content describes board oversight activities (annual reviews, quarterly meetings, reporting cadences). This is classic board governance content. Regarding specificity: while 'CSO' is a cybersecurity-specific title, the paragraph otherwise describes standard governance structures (Board, Audit Committee) and generic cadences (annually, quarterly) that appear in virtually every company's disclosures. No specific dates, dollar amounts, headcounts, named third-party firms, or named products/tools are present. The CSO reference alone does not make this firm-specific since the overall governance description is boilerplate.


reasoning: The paragraph's grammatical subjects are 'the board of directors' and 'the audit committee', discussing their oversight responsibilities for cybersecurity risks. This is a standard governance disclosure with no company-specific details — all terms (board, audit committee, management) are generic and could appear in any 10-K filing.


reasoning: This paragraph describes an actual cybersecurity incident - the unprecedented cyberattack on Change Healthcare and the U.S. health system, including what systems were impacted (pharmacy, medical claims, payment services) and response actions (mitigating impact, restoring services, investigating with law enforcement). It contains no specific dates, dollar amounts, named third-party firms, or other hard verifiable facts that would elevate it beyond generic boilerplate.


reasoning: This paragraph describes an actual cybersecurity incident including the date of detection (May 6, 2024), what happened (unauthorized third-party access to IT systems), response actions (activated incident response procedure, engaged external experts, notified law enforcement), and scope of impact (disruptions to business applications including financial and operating reporting systems). The specific date qualifies as a firm-specific fact, though only one hard verifiable fact is present, precluding Quantified-Verifiable rating.


reasoning: The paragraph describes the company's internal processes for managing cybersecurity risks, including monitoring laws, implementing compliance changes, and maintaining data/systems availability — all internal risk management activities.


reasoning: This paragraph is a cross-reference directing readers to Item 1A Risk Factors for cybersecurity threat disclosures. It contains no substantive cybersecurity governance, management, risk processes, or incident information - only a standard pointer to another section.


reasoning: This paragraph describes an actual cybersecurity incident including specific detection date (March 14, 2024), geographic scope (Canadian operations), response actions taken, and operational impact. This is clearly an Incident Disclosure as it narrates what happened, when, and the company's response. It contains one hard verifiable fact (specific date) plus company-specific operational details, making it Firm-Specific rather than Quantified-Verifiable (which requires two or more hard facts like named third-party firms, dollar amounts, or specific headcounts).


reasoning: Paragraph describes an actual cybersecurity incident including what was exfiltrated (client files with personal information), scope (end-users), response actions (engaged experts, analyzing impact, notifying clients), and current status (data not released). No specific dates, dollar amounts, headcounts, percentages, named third-party firms, or named products/tools are provided — only vague quantifiers like 'limited number' and 'significant number'.


reasoning: The paragraph's grammatical subject is the chief financial officer, who has primary responsibility for cybersecurity risk. The Nomination and Corporate Governance Committee is mentioned only briefly as a recipient of updates, making this primarily about a management role rather than board governance.


reasoning: The paragraph's primary focus is on the Audit Committee's central role in cybersecurity oversight, with the grammatical subject being 'the audit committee of the Board.' The mention of senior IT leadership and CFO is brief and in service of explaining how board oversight functions, making Board Governance the appropriate category.


reasoning: This paragraph describes the scope and nature of data involved in a cybersecurity incident - specifically what records were accessed, what information was included/excluded, and the affected customer population. This is core incident disclosure content describing the data compromise. No specific dates, dollar amounts, headcounts, percentages, named third-party firms, or named products/tools are present - only generic descriptions like 'nearly all' and 'publicly available online tools'.


reasoning: The paragraph describes the company's internal assessment approach to cybersecurity incidents (no material incidents incurred, conclusion about no evidence of material concern), which falls under risk management processes. It contains no specific dates, named firms, dollar amounts, or other verifiable facts—the time reference 'the last two fiscal years' is vague and the mention of 'a professional cybersecurity investigation firm' is generic with no named entity.


reasoning: The paragraph focuses on identifying specific named management roles (CISO and CTO), their qualifications, tenure, and reporting responsibilities. The grammatical subjects are the CISO and CTO, making Management Role the primary category.


reasoning: The paragraph's grammatical subject is the AGM board of directors, and the topic is board oversight of cybersecurity risk within the ERM framework. This is clearly board governance content.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes and organizational structure. While it mentions the NIST framework (sector-adapted), the primary focus is on the company's own processes—specifically how its CDRM organization operates under the Global CISO to manage cybersecurity risks—which clearly falls under Risk Management Process rather than Management Role where the main topic would be the role itself.


reasoning: This paragraph describes the aftermath and impact assessment of a cybersecurity incident — it explains what happened (website offline, delayed communications), the scope of impact (no material impact on IP protection, no unauthorized access to customer/stakeholder info), and ongoing response (continuing investigation). However, it contains no specific dates, named entities, dollar amounts, or other hard verifiable facts — only vague references like 'a period of time' and generic descriptions.


reasoning: The paragraph describes the company's internal incident response policy and escalation procedures to management and committees, which falls under risk management processes. However, it contains no specific facts - 'Incident Management Team', 'disclosure committee', and 'Privacy and Security Subcommittee' are generic organizational terms that could appear in any company's disclosure, and no specific dates, dollar amounts, headcounts, named third-party firms, or cybersecurity-specific roles are mentioned.


reasoning: The paragraph describes the Adviser's internal processes for assessing, identifying, and managing cybersecurity threats, including controls and procedures for incident classification and escalation. This is a description of the company's own risk management framework rather than board oversight, specific roles, vendor management, or incident disclosure. It contains no specific dates, dollar amounts, named frameworks, roles, tools, or other identifiable details - only generic language about 'comprehensive, cross-functional approach' and 'controls and procedures' that could appear in any filing.


reasoning: This paragraph is a forward-looking materiality statement about potential cybersecurity risks. It does not describe any actual incidents, discuss board governance, management roles, internal processes, vendor oversight, or substantive cybersecurity disclosure. It merely states they face risks that could materially affect them and references a risk factors section.


reasoning: The paragraph describes the company's internal risk management approach, specifically how the enterprise risk management team works with the CSO and IT risk management to evaluate and address cybersecurity risks. This is about internal processes, not board governance, management roles identification, or financial/materiality matters.


reasoning: Paragraph describes an actual cybersecurity incident including investigation status, threat actor access scope (no customer data taken), law enforcement reporting, and operational/financial impact assessment. Contains no specific dates, named entities, dollar amounts, or other verifiable facts.


reasoning: The paragraph describes the company's internal risk management process - how cybersecurity risks are reviewed biannually with participation from CISO, CIO, business segment representatives, and executive management. This is clearly about internal processes rather than board oversight, vendor management, or incident disclosure. The mention of CISO and CIO (cybersecurity-specific titles not on the generic C-suite exclusion list) provides firm-specific identification.


reasoning: This paragraph describes the actual cybersecurity incident: operational halt duration, geographic scope of impact, response actions (new IT infrastructure, cybersecurity experts), and restoration timeline. This is incident disclosure, not strategy integration, because it describes what happened during the incident rather than just financial or materiality impact.


reasoning: Paragraph describes an actual cybersecurity incident (unauthorized access to Company systems on June 30, 2024), including what happened, when it occurred, and the Company's response actions (contain, assess, remediate, investigation). Contains two specific hard dates that an outsider could independently verify.


reasoning: The paragraph's grammatical subject is the Chief Technology Officer, a management role, describing their responsibilities, qualifications, and reporting lines. This fits the Management Role category.


reasoning: The paragraph's grammatical subjects are the Board of Directors and the Cybersecurity Committee, describing board-level oversight of cybersecurity risks. It discusses the committee's establishment and the chair's qualifications for cybersecurity oversight, which is the essence of board governance.


reasoning: The paragraph describes the company's internal approach to cybersecurity risk management, specifically how it engages external experts to evaluate and test its own risk management systems. While third parties are mentioned, they are described as external resources supporting the company's internal processes rather than being the central topic of vendor oversight or third-party risk.


reasoning: The paragraph's grammatical subjects are 'Our Audit Committee' and 'the full Board', describing board oversight activities, briefings received, and board education on cybersecurity — all board governance topics.


reasoning: This paragraph discusses the potential materiality of cybersecurity risks, mentions cyber insurance costs, and notes they expend significant resources on cybersecurity - all related to business/financial impact assessment. It does not describe an actual incident, board oversight, or management roles. It contains no company-specific details, dates, dollar amounts, named frameworks, or other identifying information.


reasoning: The paragraph describes the company's general processes for assessing, identifying, and managing cybersecurity risks, which falls under internal risk management processes. It contains no specific facts—no named frameworks, roles, dates, dollar amounts, third-party firms, or tools—and is written in generic language that could appear in any company's disclosure.


reasoning: The paragraph describes the company's internal cybersecurity risk management program activities (Security Committee meetings, employee training, information security policies). While the Security Committee is mentioned, the grammatical subject is the program itself and its activities, not the board or board committee oversight - making Risk Management Process the appropriate category. Contains firm-specific details including a named committee and cybersecurity-specific role (head of Information Security).


reasoning: This paragraph describes a specific cybersecurity incident at a third-party vendor (CDK) and its direct operational impact on the company's information systems, including which systems were affected, what was restored, and the timeline of disruptions. While the incident occurred at a third party, the company is describing the real-world effects on its own operations, which constitutes an incident disclosure rather than general third-party risk management discussion.


reasoning: The paragraph identifies a specific individual (Jack Wang) at a named subsidiary (PeriShip Global) with primary responsibility for cybersecurity risk management, including his qualifications and reporting lines to executive officers and the Board. This is clearly about management roles and organizational structure.


reasoning: This paragraph provides a standalone materiality conclusion (no material incidents, immaterial expenses) with no incident narrative. It essentially states the company's assessment of cybersecurity incident impact without describing any actual event. This fits Strategy Integration as it addresses financial/materiality aspects rather than governance, processes, or incident details.


reasoning: Paragraph grammatical subjects are the Board of Directors and its Enterprise Risk Management Committee, with clear delegation of cybersecurity oversight to the committee and reporting cadences described. The Enterprise Risk Management Committee is a named committee that goes beyond standard generic governance (like Audit Committee), making this firm-specific rather than sector-adapted or generic boilerplate.


reasoning: The paragraph describes the company's internal risk assessment and vulnerability identification processes, which is the core of Risk Management Process. It contains only generic security terminology (risk assessment guidelines, mitigation strategies, incident response plans) with no specific dates, named frameworks, roles, or other identifiable details that would make it firm-specific.


reasoning: The paragraph focuses on management roles (VP of Information Systems and CFO) and their qualifications, experience, and oversight responsibilities for cybersecurity - clearly falling under Management Role. It contains multiple hard verifiable facts including specific tenure numbers (19 years, 6 years, 25 years), named certifications (GIAC), and a named board (GIAC Board), meeting the Quantified-Verifiable threshold.


reasoning: The paragraph's main point is a materiality conclusion (cybersecurity risks did not have a material impact), which is the core of Strategy Integration. It mentions past incidents only in passing without describing what happened, so it does not qualify as Incident Disclosure. The content is entirely generic with no named entities, frameworks, dates, or specific details.


reasoning: This paragraph discusses the materiality of cybersecurity threats to the company's financial condition and business strategy, with no description of actual incidents, governance processes, or specific management roles. It contains only generic boilerplate language about potential future impact.


reasoning: The paragraph describes Mr. Gharib's responsibilities as a manager overseeing cybersecurity functions (hiring, budgeting, incident preparation, process approval), which aligns with the Management Role category as the grammatical subject is a named individual in a management capacity. However, no cybersecurity-specific title (CISO, CTO, CIO) is provided, and no specific dates, dollar amounts, named frameworks, or other hard verifiable facts are present — it contains only generic responsibility descriptions that could appear in any company's filing.


reasoning: The paragraph describes the general components of an incident response plan (triage, assess severity, investigate, escalate, contain, remediate) in purely generic terms with no named frameworks, specific dates, named entities, or any firm-specific details that would differentiate this company's disclosure from any other company's filing.


reasoning: This paragraph is a forward-looking risk acknowledgment stating no material incidents occurred in 2023 and acknowledging inherent limitations in cybersecurity risk management. It contains no substantive disclosure about actual governance, processes, or incidents - only generic boilerplate risk language about potential future vulnerabilities.


reasoning: The paragraph focuses on the CISO and CTO roles, their reporting structure, and their responsibilities for cybersecurity oversight — making Management Role the primary topic.


reasoning: The paragraph's grammatical subjects are the IT department and CFO, discussing their responsibilities for cybersecurity risk assessment, their qualifications (70 years combined experience), and reporting lines to the Audit Committee. This focuses on WHO manages cyber risks rather than HOW the process works.


reasoning: The paragraph primarily discusses management responsibilities for cybersecurity risk, with the VP of Operations specifically named as overseeing cybersecurity programs. While board oversight is mentioned briefly at the start, the grammatical subject for most of the paragraph is management (Management is responsible..., Our cybersecurity programs are under the direction of...).


reasoning: The paragraph describes how the company uses external parties (advisory firms, ISACs, defense companies) to support its internal cybersecurity capabilities - this is part of the company's own risk management process, not vendor oversight. The focus is on internal preparedness and monitoring, not third-party risk management.


reasoning: The paragraph describes the company's internal risk management framework and various programs, which falls under internal processes for managing cybersecurity risk. No specific frameworks, roles, dates, or firm-specific details are mentioned—all language is generic boilerplate that could appear in any company's disclosure.


reasoning: The paragraph's central topic is explicitly third-party risks and vendor/supplier oversight - it discusses assessing third-party risks, managing risks from vendors/suppliers/business partners, and evaluating cybersecurity risks when selecting third-party service providers. This goes beyond being a mere component of internal processes.


reasoning: The paragraph describes the company's internal processes for managing cybersecurity risk (training, awareness, penetration testing, assessments) with no mention of board oversight, specific management roles, or third-party vendors. All practices mentioned are generic security practices with no specific dates, named frameworks, or firm-specific details.


reasoning: The paragraph's grammatical subjects are 'Board' and 'audit committee' throughout, describing board oversight responsibilities for cybersecurity risk. This is classic board governance content.


reasoning: The paragraph describes the company's internal cross-functional approach to identifying and addressing cybersecurity risks, including stakeholder meetings, strategy development, and incident escalation procedures. This is a description of the company's own risk management processes, not board governance, specific management roles, third-party oversight, or incident disclosure.


reasoning: Paragraph discusses Board and Audit Committee oversight of cybersecurity risks with generic governance language - 'The Board of Directors', 'Audit Committee', 'periodic updates', and 'at least an annual basis' are all standard boilerplate terms without company-specific details.


reasoning: This paragraph contains generic risk factor language about cybersecurity threats that could apply to any company. It discusses threats in general terms, mentions potential impact, and states the need to expend resources, but provides no substantive disclosure about board oversight, management roles, internal processes, specific incidents, or strategic integration. It is boilerplate forward-looking risk language.


reasoning: The paragraph focuses on the Board's oversight role and the Audit Committee's delegated responsibility for cybersecurity risk oversight, which is board governance content. It contains only generic governance language about board structure with no company-specific details.


reasoning: The paragraph focuses on financial/materiality implications of cybersecurity incidents, specifically mentioning that insurance may not fully cover costs. This is business impact and insurance discussion rather than governance, processes, or incident disclosure.


reasoning: The paragraph focuses on the Senior Vice President, IT Operations as the grammatical subject directing the information security team and their monitoring, assessment, and escalation responsibilities. The board and committee are mentioned only as recipients of escalation, not as the primary actors.


reasoning: Paragraph discusses Board of Directors assigning Audit Committee oversight responsibility for cybersecurity, which is board governance. Contains only generic elements: standard Audit Committee, vague 'at least annually' cadence, generic IRP reference, no specific dates/amounts/named entities.


reasoning: The paragraph's grammatical subject is the Director of Cybersecurity, focusing on their responsibilities, experience (20+ years), and reporting structure to management. While it mentions an executive committee, that's merely part of the reporting chain—the primary focus is on the management role.


reasoning: The paragraph describes the company's internal vulnerability assessment program, its review cadence, and its role as an enterprise-wide framework for cybersecurity risk management — clearly internal processes rather than board oversight, management roles, or third-party risk.


reasoning: The paragraph describes the company's internal information security operations, tools, and testing procedures — this is a classic Risk Management Process disclosure. It contains no specific dates, named products/tools, named third-party firms, or any other verifiable facts that would elevate it beyond generic boilerplate; all elements described (security tools, tabletop exercises, penetration testing, awareness training) are standard practices without company-specific identifiers.


reasoning: The paragraph describes the company's internal cybersecurity risk management program integrated with Enterprise Risk Management, focusing on identifying, managing, and assessing cybersecurity risks. This is a generic description of internal processes with no specific facts - it uses only standard terminology ('Enterprise Risk Management', 'cybersecurity risk management program', 'confidentiality, integrity, and availability') without any firm-specific details like named roles, dates, frameworks, or quantifiable metrics.


reasoning: This paragraph describes the company's internal cybersecurity risk management measures and processes (incident response plan, disaster recovery, risk assessments, encryption, network security, etc.), which is the core of the Risk Management Process category. It contains no company-specific details, no named frameworks, and no verifiable facts - all listed security measures are generic practices that could appear in any company's disclosure.


reasoning: This paragraph describes an actual cybersecurity incident including specific details: the date of detection (May 1, 2024), the nature of the unauthorized access, and specific response actions taken (initiated response protocols, engaged external experts, activated incident response plan, shut down IT systems, notified law enforcement).


reasoning: The paragraph describes a specific cybersecurity incident including the date of discovery (November 25, 2024), what the threat actor did (accessed IT system and encrypted data files), and the company's response actions (containment, assessment, remediation, internal investigation, engaging external specialists). This is an incident narrative describing what happened, not just financial impact or materiality.


reasoning: Paragraph describes the operational impact of a disclosed cybersecurity incident (material impact on business operations) and ongoing uncertainty about scope, which falls under incident disclosure. However, it contains no specific dates, dollar amounts, named entities, or other firm-specific details - only generic boilerplate language about ongoing investigations and potential material impact that could appear in any company's filing.


reasoning: This paragraph describes an actual cybersecurity incident: unauthorized activity on IT systems, detection, containment steps, system isolation on a specific date (December 20, 2023), engagement of experts, law enforcement involvement, and regulatory notifications — all describing what happened in a real event.


reasoning: Paragraph describes internal security testing and assessment processes using third parties as service providers - this is part of the company's own risk management program, not vendor oversight. Language is generic with no named entities, dates, or specific details.


reasoning: The paragraph explicitly states that cybersecurity risk management is 'under the oversight of our board of directors and the Audit Committee' - making board governance the grammatical subject and primary topic. While it mentions internal processes, the central point is about who provides oversight.


reasoning: This paragraph is a cross-reference directing readers to the Risk Factors section for more information. It contains no substantive cybersecurity disclosure about governance, processes, incidents, or strategy — only a pointer to another section.


reasoning: This paragraph describes an actual cybersecurity incident including the detection date, unauthorized activity, response actions taken (incident response protocols, disrupting activity, investigation, regulatory notifications), and containment outcome. The specific date February 6, 2024 makes it Firm-Specific, though it lacks multiple hard verifiable facts needed for Quantified-Verifiable level.


category_confidence: medium

reasoning: The paragraph primarily discusses cyber insurance coverage and financial protection mechanisms, with the VP of Finance and Treasurer's role in reviewing coverage as supporting context. The mention of continuity plans and tabletop exercises is secondary to the insurance focus.


reasoning: The paragraph's primary focus is the materiality assessment ('has not had a material impact' and 'not reasonably likely to materially impact financial condition'), which is the core of Strategy Integration. The brief mention of law enforcement notification is incidental to this main point. No specific dates, named entities, or hard facts are present - only generic boilerplate language about operational and financial impact.


reasoning: This paragraph discusses the financial/material impact of an incident (expenses, materiality to Q4 operations, various risks) without describing what happened in the incident itself. Per tiebreakers, when a paragraph ONLY discusses financial cost or materiality WITHOUT describing the event, it maps to Strategy Integration.


reasoning: This paragraph describes an actual cybersecurity incident including what happened (unauthorized access, data encryption), when it was discovered (November 25, 2024), and response actions taken (containment, assessment, remediation, internal investigation, external specialists).


reasoning: The paragraph describes the company's own internal efforts to implement the NIST Cybersecurity Framework and align with regulatory requirements, which is a risk management process. The grammatical subject is 'We' discussing the company's internal approach.


reasoning: Paragraph describes an actual cybersecurity incident with specific dates (May 2023, June 2023), specific system (SharePoint), and response actions (investigation, containment, remediation), meeting the criteria for Incident Disclosure with multiple verifiable facts.


reasoning: This paragraph is a standard forward-looking statement disclaimer with no cybersecurity content - it merely warns about risks and uncertainties in predictions about future events.


reasoning: The paragraph describes the company's internal Security Operations Center, its incident detection and response processes, severity assessment, and escalation protocols. This is a description of the company's own internal risk management infrastructure and procedures, not board oversight, management roles, third-party vendor oversight, or incident disclosure.


reasoning: The paragraph describes the company's internal cybersecurity risk management measures and processes (incident detection, vulnerability management, disaster recovery, etc.), which is the core of the Risk Management Process category. It contains no specific facts - all items listed are generic security practices common to any company, with no named frameworks, specific dates, dollar amounts, named roles, or other firm-specific details.


reasoning: This paragraph describes an actual cybersecurity incident including operational impacts (shipping, receiving, manufacturing production), evidence that files were taken, and response actions (interim measures, investigation, notification). However, it contains no specific dates, dollar amounts, headcounts, named third-party firms, or named products/tools that would elevate it beyond generic boilerplate.


reasoning: This paragraph discusses only the operational and financial materiality assessment of an incident without describing what happened in the incident (no dates, scope, access details, or response actions). Per tiebreakers, paragraphs that ONLY discuss financial cost, insurance, or materiality of an incident WITHOUT describing the event map to Strategy Integration.


reasoning: This paragraph describes an actual cybersecurity incident - it details unauthorized activity on company systems, the timeline of detection, and specific response actions taken (isolating systems from the Internet on December 20, 2023). This is a real event narrative with specific dates and actions, which is the hallmark of Incident Disclosure.


reasoning: The paragraph describes the investigation findings of an actual cybersecurity incident - what was not found (malware, ransomware, data destruction) and what continues to be investigated. This is the core of Incident Disclosure. However, it contains no specific dates, dollar amounts, named third-party firms, named products, or any other firm-specific identifiers - only generic language about investigation outcomes that could appear in any company's filing.


reasoning: This paragraph describes what happened in the incident - specifically what data was exfiltrated (IT-related and financial information) and provides scope details about the incident. The specific date of the fiscal year end (August 31, 2025) makes it Firm-Specific.


reasoning: This paragraph discusses the financial impact of a cybersecurity incident (additional expenses and lost revenue) without describing what happened in the incident itself. The focus is on business/financial consequences, which falls under Strategy Integration.


reasoning: The paragraph centrally discusses third-party vendor oversight, due diligence, and selection of service providers - the core elements of Third-Party Risk. It contains no specific dates, named vendors, dollar amounts, headcounts, or other verifiable facts that would elevate specificity beyond generic boilerplate.


reasoning: This paragraph discusses only the financial impact and materiality of the incident without describing what happened in the incident itself — it provides earnings figures and the estimated adverse impact but no incident narrative. Per tiebreakers, this is Strategy Integration. It contains two hard verifiable facts (specific dollar amounts for earnings and impact) plus a specific date, meeting the Quantified-Verifiable threshold.


reasoning: This paragraph discusses only the financial aftermath (material non-recurring expenses, cyber insurance) and regulatory notification without describing what happened in the incident. Per tiebreaker rules, financial/materiality discussion without incident narrative maps to Strategy Integration.


reasoning: This paragraph describes the operational impact of an actual cybersecurity incident, including specific systems affected (distribution, billing, collections, vendor payments), current status as of a specific date, and quantified revenue impact (5%). The two hard verifiable facts (specific date and specific percentage) meet the Quantified-Verifiable threshold.


reasoning: This paragraph describes an actual cybersecurity incident, including the scope (35.5 million consumers affected) and specific data types that were and were not stolen. This is a description of what happened in a real event, fitting the Incident Disclosure category.


reasoning: This paragraph discusses only the financial materiality and operational risks of an incident without describing what happened. Per tiebreakers, when a paragraph ONLY discusses financial cost, insurance, or materiality of an incident WITHOUT describing the event, it maps to Strategy Integration. The language is entirely boilerplate with no specific dates, dollar amounts, named entities, or other firm-specific details.


reasoning: Paragraph describes the company's internal audit program conducting annual risk assessments that include cybersecurity evaluation, with reporting to business team leaders. This is the company's own internal risk management process. No specific facts, frameworks, named roles, dates, or unique identifiers are present - all language is generic boilerplate.


reasoning: This paragraph describes an actual cybersecurity incident with specific details: unauthorized access to environment and files, a specific dollar amount ($250,000) wire fraud, and deletion of email messages. This is a clear incident narrative describing what happened.


reasoning: Paragraph describes the company's response to an actual cybersecurity incident including investigation, law enforcement engagement, and regulatory/user notifications. Contains no specific facts - 'industry-leading forensic investigators' is generic, no named firms, dates, dollar amounts, or other verifiable details unique to Dropbox.


reasoning: The paragraph describes an actual cybersecurity incident (ransomware on specific date), what happened, when it occurred, and response actions taken — this is the core definition of Incident Disclosure. It contains one specific fact (the date August 16, 2025), which is enough for Firm-Specific, but lacks a second hard verifiable fact (like a named third-party firm, dollar amount, or headcount) to reach Quantified-Verifiable.


reasoning: This paragraph describes an actual cybersecurity incident including what happened (unauthorized access and exfiltration of call logs), when it occurred (multiple specific dates), the scope (customer call and text records from specific date ranges), and response actions (activated incident response, retained external experts). The multiple specific dates qualify this as Quantified-Verifiable.


reasoning: Paragraph describes an actual cybersecurity incident: unauthorized access and exfiltration of data containing PII, with ongoing notification response. Contains no specific dates, dollar amounts, named entities, or other verifiable facts — all language is generic boilerplate.


reasoning: This paragraph describes the scope of a cybersecurity incident - specifically what types of data (PII, PHI) were exfiltrated and that most was maintained by a subsidiary providing patient support services. While it describes an actual incident, it contains no specific dates, dollar amounts, headcounts, named third-party firms, or named products/tools that would elevate it beyond generic boilerplate.


reasoning: This paragraph describes an actual cybersecurity incident with specific details: unauthorized activity on IT systems, containment and remediation actions, a specific date (December 20, 2023) when systems were isolated, engagement of experts and law enforcement, and the resumption of business operations. This is a narrative of what happened and how the company responded.


reasoning: Paragraph discusses the company's own internal processes for overseeing cybersecurity risks from third-party providers. While third-party providers are mentioned, they are a component of the company's internal risk management, not the central topic. The language is entirely boilerplate with no specific dates, frameworks, roles, or verifiable facts.


reasoning: Paragraph describes response actions (containment and remediation) and incident scope/outcome (systems not compromised, no unauthorized transactions, no monies transferred), which are core elements of incident disclosure. However, it contains no specific dates, dollar amounts, named entities, or other verifiable facts — only generic language describing what did not happen.


reasoning: The paragraph describes an actual cybersecurity incident - it states that certain files were exfiltrated, the company is investigating what sensitive information was accessed, and evaluating notification requirements. This describes what happened in the incident (exfiltration of files, ongoing investigation into scope), which is the core of Incident Disclosure.


reasoning: This paragraph describes response actions related to a cybersecurity incident, including DOJ determinations about disclosure delays, law enforcement involvement, and an apprehension. While it doesn't describe the incident itself (what happened, how, scope), it describes the aftermath and response to an actual event, which falls under Incident Disclosure.


reasoning: This paragraph is a standard forward-looking statement disclaimer with no cybersecurity content - it merely warns about risks and uncertainties in predictions about future events.


reasoning: This paragraph describes ongoing response actions to a real cybersecurity incident (Change Healthcare cyberattack), including data assessment, support for impacted individuals, provider/customer notifications, and service restoration progress. It references a specific date and named entity, making it firm-specific.


reasoning: This paragraph makes a standalone materiality conclusion about a cybersecurity incident without describing the incident itself. Per tiebreakers, this maps to Strategy Integration. It contains no specific dates, dollar amounts, named entities, roles, frameworks, or any other verifiable facts — only boilerplate materiality language.


reasoning: This paragraph discusses the financial/materiality impact of an incident on the company's operations and financial condition without describing what happened in the incident itself. Per tiebreakers, this is Strategy Integration, not Incident Disclosure.


reasoning: This paragraph describes an actual cybersecurity incident (network interruption) including what happened (systems disruption), response actions (restoring systems, engaging security experts, law enforcement involvement, stakeholder notifications), and scope (specific to Change Healthcare systems). The only firm-specific element is the naming of 'Change Healthcare systems' as the affected entity, which identifies a specific subsidiary - meeting the threshold for Firm-Specific but not Quantified-Verifiable as there are no hard verifiable facts like dates, dollar amounts, or named third-party firms.


reasoning: This paragraph describes an actual cybersecurity incident - it details what happened (unauthorized third party access), the scope (8.4 million users), and what specific data types were affected (names, phone numbers, car registration numbers, addresses, email addresses). This is a clear incident disclosure describing a real event.


reasoning: This paragraph discusses only the financial/materiality implications of the incident (expenses, potential material impact on financial condition/results) without describing what happened in the incident itself. Per tiebreakers, paragraphs that ONLY discuss financial cost, insurance, or materiality without describing the event → Strategy Integration.


reasoning: This paragraph discusses only the materiality/financial impact assessment of an incident without describing what happened in the incident. Per tiebreakers, paragraphs that ONLY discuss financial cost, insurance, or materiality of an incident WITHOUT describing the event map to Strategy Integration. The paragraph contains no specific dates of the incident, no named entities, no framework references, and no firm-specific details—it uses generic boilerplate language about potential material impact that could appear in any company's filing.


reasoning: Paragraph discusses business continuity (providing products/services), stakeholder communication, and operational status — this is about business/operational impact rather than describing what happened in the incident (no dates, scope, or technical details of the event).


reasoning: The paragraph describes a specific cybersecurity incident including when it occurred (June 9, 2025), how it was discovered (threat actor communications to employees), and initial response actions (activated incident response plan). This is clearly an incident disclosure as it narrates an actual event with temporal and procedural details. The specific date qualifies as a firm-specific fact, though the paragraph lacks additional hard verifiable facts to reach Quantified-Verifiable level.


reasoning: This paragraph describes the Company's response actions to an actual cybersecurity incident, including containment measures, third-party expert engagement, and regulatory notifications — all describing what happened in the incident.


reasoning: This paragraph describes an actual cybersecurity incident with specific details: a date (January 13, 2025), unauthorized access by a threat actor, activation of response plan, containment and remediation actions, and operational restoration timeline. This is a clear incident narrative.


reasoning: This paragraph provides a standalone materiality conclusion about a cybersecurity incident without describing the incident itself (no dates, scope, or response actions), which classifies as Strategy Integration per the tiebreaker rules.


reasoning: This paragraph discusses only the financial consequences and materiality of the incident (costs, lost production, material impact on financial condition) without describing what happened in the incident itself. Per tiebreakers, this is Strategy Integration. It contains multiple hard verifiable facts (specific dollar amount, specific duration, specific quarter-end date) meeting the Quantified-Verifiable threshold.


reasoning: This paragraph describes the actual cybersecurity incident in detail: what data was compromised (names, addresses, masked SSN, bank details, government IDs, corporate data), what was NOT compromised (passwords, private keys, customer funds), and confirms the incident scope. This is a factual description of a real event.


reasoning: Paragraph describes a specific cybersecurity incident with dates (March 11, 2026 and March 18, 2026), what happened (ransomware encryption, then unauthorized data disclosure), and the evolution of materiality assessment from not material to potentially material.


reasoning: This paragraph describes an actual cybersecurity incident - it states the company learned on February 21, 2024 that data was exfiltrated, and describes the response actions taken (containment, investigation with law enforcement and experts). This is clearly an incident disclosure as it narrates what happened, when, and initial response.


reasoning: This paragraph describes ongoing remediation actions following a cybersecurity incident, including containment, system reinforcement, and threat surveillance improvements — all directly tied to a specific disclosed event.


reasoning: The paragraph describes remediation activities and current status after a cybersecurity incident (third party removed from systems, access restored, data integrity confirmed), which falls under incident response actions. However, it contains no specific dates, named entities, or other verifiable facts to establish firm-specific details.


reasoning: The paragraph's grammatical subject is the board of directors, and the content focuses on board oversight responsibilities for cybersecurity risks, which clearly falls under Board Governance. The disclosure contains only generic governance language with no firm-specific details - it mentions standard 'board of directors,' 'audit committee,' and 'executive leadership team' without any cybersecurity-specific roles, named committees, specific dates, or other identifiable facts.


reasoning: This paragraph describes an actual cybersecurity incident with specific dates, what happened (unauthorized occurrences on IT systems), and response actions (containment, investigation, system shutdown, ejection). The specific dates qualify it as Firm-Specific, though both dates are the same day so only one distinct hard fact for Quantified-Verifiable threshold.


reasoning: This paragraph discusses the financial/materiality impact of an incident (Targus disruption) on the company's overall financial condition and results, including comparative EBITDA context. It does not describe what happened in the incident itself — no dates, access methods, scope of data, or response actions are disclosed.


reasoning: The paragraph describes internal cybersecurity risk management being incorporated into enterprise risk management programs with common methodologies and governance processes. This is describing the company's own internal risk management processes, not board oversight, specific roles, or third-party vendor management.


reasoning: This paragraph is a standard SEC legal disclaimer regarding filing status and incorporation by reference. It contains no cybersecurity content and is unrelated to any of the six cybersecurity categories.


reasoning: The paragraph discusses the company's dependence on software and computing infrastructure, including both internal and third-party systems, which relates to risk management approach. However, it contains no specific details, frameworks, roles, dates, or any firm-unique information - it's purely generic boilerplate that could appear in any company's filing.


reasoning: The paragraph focuses on the Group Head, Cybersecurity/Information Security Officer role, describing their qualifications and tenure. This is a management role disclosure, not board governance. The paragraph contains multiple firm-specific facts: a cybersecurity-specific title, a specific years of experience (28 years), and a specific year of joining (2020).


reasoning: The paragraph focuses on a board committee (the Committee) receiving periodic reports on cybersecurity risks and reporting to the full Board - this is board oversight of cyber risk, which maps to Board Governance. The language is entirely generic with no specific details: no named committee, no specific reporting cadence, no named roles, no dates, no firm-specific facts.


reasoning: The paragraph describes board oversight responsibilities including reviewing data privacy policies, overseeing compliance, and evaluating the Cybersecurity Committee's composition - clearly board governance functions. The mention of the Cybersecurity Committee as a specific named committee provides firm-specific detail.


reasoning: The paragraph describes response actions to an actual cybersecurity incident: activating the response plan, launching an investigation, taking systems offline, notifying law enforcement, and restoring systems. This is an incident narrative describing what happened, not just financial impact or materiality. All details are generic with no named entities, specific dates, or verifiable facts.


reasoning: The paragraph discusses materiality assessment and financial impact of the incident without describing what happened in the incident — this is Strategy Integration per the tiebreaker rules.


reasoning: Paragraph describes an actual cybersecurity incident where files were exfiltrated and systems accessed, including ongoing investigation into scope and notification requirements - this is incident disclosure content. However, it lacks hard verifiable facts (specific dates, named third parties, dollar amounts) that would elevate it to Quantified-Verifiable.


reasoning: This paragraph is a forward-looking disclaimer and cross-reference to Item 1A Risk Factors, containing no substantive cybersecurity disclosure about governance, processes, incidents, or strategy.


reasoning: This paragraph describes response actions to an actual cybersecurity incident at the subsidiary, including containment measures (taking network offline), investigation with third-party professionals, law enforcement notification, and notification of affected parties. This is describing what happened in relation to a real event, not internal processes. No specific dates, named third-party firms, dollar amounts, or other hard verifiable facts are present.


reasoning: This paragraph discusses only the financial/materiality impact of the cybersecurity incident without describing what happened in the incident. It contains standard materiality language that could appear in any company's filing with no specific dates, amounts, or firm-unique details.


reasoning: The paragraph describes the company's internal risk management process for evaluating third-party vendors. While vendors are mentioned, they are discussed as a component of the internal process (introduced by 'As part of our cybersecurity risk management process'), not as the central topic. This aligns with the tiebreaker: 'Internal processes mentioning vendors as one component → Risk Management Process'. The paragraph contains no specific facts—no named entities, dates, frameworks, titles, or quantifiable details—and could appear in any company's filing unchanged.


reasoning: The paragraph focuses on board and audit committee oversight of cybersecurity risk, which is the grammatical subject throughout. The audit committee is a standard committee (not a specialized cybersecurity or technology committee), and there are no firm-specific details such as named committees, specific dates, or cybersecurity-specific roles.


reasoning: This paragraph describes an actual cybersecurity incident with specific details about what happened (unauthorized access to data), when it occurred (March 27, 2024), and response actions taken. It clearly qualifies as Incident Disclosure as it narrates the incident event, detection, and containment efforts.


reasoning: The paragraph describes internal company policies and training programs for employees regarding cybersecurity and personal information protection. This is a discussion of the company's own internal risk management processes. The content contains no specific facts - it mentions generic practices (annual training, quarterly testing) that could apply to any company without named roles, specific dates, named programs, or other identifying details.


reasoning: The grammatical subject is 'The Board of Directors' and the paragraph describes board oversight activities (receiving reports, summaries, presentations on cybersecurity). This is clearly about board governance of cyber risk.


reasoning: The paragraph describes the company's general approach to cybersecurity risk management through a program that assesses, identifies, and manages threats. This is a generic statement about internal processes with no specific details such as named frameworks, roles, dates, or firm-specific facts.


reasoning: Paragraph discusses general ongoing investment in cybersecurity and internal controls designed to protect systems, which falls under internal risk management processes. However, it contains no specific details about what processes, frameworks, or specific measures are employed—it is entirely generic boilerplate that could appear in any company's filing.


reasoning: The paragraph describes the company's internal cyber risk management program and enterprise risk management processes, which are the company's own internal processes for managing cyber risk. No board oversight, management roles, third-party vendors, or incidents are mentioned. All language is generic boilerplate with no company-specific details, named frameworks, roles, dates, or other specific facts.


reasoning: The paragraph describes internal incident response and recovery frameworks with twice-yearly testing through simulations and tabletop exercises. While it mentions specific testing methods, these are common security practices without any firm-specific identifiers, named frameworks, dates, or quantifiable details.


reasoning: The paragraph focuses on management roles (CIO and Director of IT Security) and their qualifications, which is the core of Management Role. It contains firm-specific details: a named cybersecurity-specific position (Director of IT Security, Risk and Compliance) and a specific number (20 years experience), neither of which could be pasted into another company's filing unchanged.


reasoning: This paragraph is a section header or introductory statement describing CrowdStrike's general approach to cybersecurity risk management in highly generic terms. It contains no substantive disclosure about specific processes, frameworks, roles, or detailed risk management activities. The language ('passionate about', 'integral part of') is promotional rather than informative, and lacks any specific facts that would differentiate this from any other company's generic statement.


reasoning: This paragraph contains only generic boilerplate language about board and management oversight of risk with no cybersecurity-specific content, roles, processes, frameworks, or any other substantive disclosure.


reasoning: The paragraph describes internal processes for cybersecurity protection through third-party service providers, which is part of the company's risk management approach. While it mentions vendors, the focus is on the company's own security strategy using these providers, not on vendor oversight or requirements imposed on third parties.


reasoning: This paragraph describes Mr. Tao's professional background in business consultation and marketing but contains no cybersecurity-specific content, roles, or disclosures relevant to Item 1C. It is generic professional biography language that could apply to any executive.


reasoning: The paragraph identifies specific management roles (head of ITS Department, executive management) as the grammatical subjects with primary responsibility for cyber risk, which is a management role disclosure rather than board oversight or internal process description.


reasoning: Paragraph explicitly discusses vendor oversight: reviewing third-party providers' cybersecurity measures and using Security Scorecard to monitor them. This is the central topic, not a component of internal processes. Security Scorecard is a named product/tool, making this Firm-Specific.


reasoning: This paragraph is general cybersecurity risk disclosure language acknowledging vulnerabilities (viruses, malware, ransomware, phishing, social engineering) without describing any actual company processes, governance structures, incidents, or strategy. It contains no specific facts, named entities, frameworks, or company-specific details and reads as standard boilerplate found in virtually every public company's 10-K.


reasoning: The paragraph's grammatical subject is 'The Board' and it describes board oversight activities—receiving updates from the Audit Committee and Cybersecurity team on risk indicators, test results, and threats. This is board governance of cyber risk, not internal risk management processes or management roles.


reasoning: This paragraph makes a materiality determination about a cyber incident (stating impacts are not material to financial condition), which falls under Strategy Integration per the tiebreaker for standalone materiality conclusions. It contains no specific dates, dollar amounts, named entities, or any facts from the IS list — only generic boilerplate language about business operations and financial condition.


reasoning: This is a section header or introductory statement that sets up the company's cybersecurity program discussion but contains no substantive disclosure about actual practices, governance, incidents, or strategy — it merely indicates that key areas will follow.


reasoning: The paragraph's grammatical subjects are the audit committee and board of directors, and the topic is their oversight role receiving reports/briefings on cybersecurity - clearly board governance. The language is entirely generic boilerplate with no specific facts, dates, named roles, frameworks, or any firm-specific details.


reasoning: Paragraph describes the company's cybersecurity program purpose (protecting information/systems) — this is the company's own internal approach to managing cyber risk. However, it's extremely generic boilerplate with no specific processes, frameworks, or details.


reasoning: This paragraph makes a standalone materiality conclusion about cybersecurity incidents without describing any actual incident. It discusses financial impact (immaterial expenses) rather than incident details, making Strategy Integration the appropriate category. The language is generic boilerplate with no specific dates, named entities, or quantifiable facts.


reasoning: This is a negative assurance statement declaring no material cybersecurity incidents have occurred. While it references materiality, it does not describe an actual incident, discuss governance/processes, or provide firm-specific details—it is boilerplate language common to many disclosures.


reasoning: The paragraph's grammatical subjects are 'The Board and Audit Committee,' making board oversight the central topic. It contains no specific facts—no named frameworks, dates, dollar amounts, named roles, or quantifiable metrics—and relies entirely on generic governance language.


reasoning: The paragraph describes the company's internal incident response plan and its ongoing review and refinement process. This is about the company's own risk management processes rather than board oversight, management roles, third-party risk, or incident disclosure.


reasoning: The paragraph's grammatical subject is management roles (CIO and VP of Information Security), and it describes their responsibilities for the cybersecurity program, making Management Role the appropriate category.


reasoning: This paragraph discusses cyber insurance coverage as a financial mitigation tool, which falls under Strategy Integration (financial impact/budget). It does not describe an incident, internal processes, or governance structures.