reasoning: The paragraph primarily describes what the company’s cybersecurity program does to identify, assess, monitor, and test cyber risk, which fits risk management process. Its references to vulnerability scans and penetration tests show cybersecurity-specific domain knowledge, but it does not include firm-specific or externally verifiable facts.


content_category: Third-Party Risk

category_confidence: high

specificity_confidence: medium

reasoning: The paragraph is primarily about how the company evaluates and oversees cybersecurity risks posed by vendors, suppliers, manufacturers, and other third-party service providers. It focuses on third-party diligence, contractual security requirements, and audits rather than the company’s broader internal cybersecurity program.

provider: openai

stage: benchmark


content_category: Board Governance

reasoning: The paragraph primarily describes how the board and its audit committee oversee cybersecurity risk, receive updates, and participate in governance decisions. Although it mentions strategic planning and management activity, the dominant focus is the board-level oversight structure and information flow.


content_category: Strategy Integration

specificity_confidence: high

reasoning: The paragraph primarily states a materiality conclusion that cybersecurity incidents have not materially affected, and are not reasonably likely to materially affect, the company’s business, results, or financial condition, which is Strategy Integration under the materiality rule. The cross-reference to Item 1A is secondary and does not add substantive cybersecurity detail.


reasoning: The paragraph primarily provides a materiality assessment, stating that known cybersecurity threats are not reasonably likely to materially affect the company’s business strategy, results of operations, or financial condition. Although it references a past phishing incident, the main purpose is the company’s conclusion about business impact rather than describing the incident itself.


content_category: Incident Disclosure

reasoning: This paragraph primarily describes an actual cyber/fraud-related event, including what happened, the response taken, and the financial loss incurred. Its focus is the incident itself rather than general governance or risk management processes.


content_category: None/Other

reasoning: This paragraph primarily serves as a cross-reference to Item 1A risk factors and provides only generalized statements about cyber risks and non-specific past threats/incidents. It does not substantively describe governance, management, processes, third-party risk, strategy impact, or a specific incident.


content_category: Risk Management Process

reasoning: The paragraph primarily describes what the cybersecurity program does—using controls, technologies, systems, and processes to prevent or mitigate data loss and security vulnerabilities—so it is about the risk management process. The mention of outside advisors is ancillary support to that program, not the central topic of third-party risk management.


reasoning: The paragraph is centrally about how the company manages cybersecurity and related risks arising from vendors and other third parties, which makes Third-Party Risk the best fit. It includes company-specific program and policy names, but no hard numbers, dates, or other clearly externally verifiable facts.


reasoning: The paragraph is primarily about how the company manages cybersecurity risks arising from vendors and software providers, including diligence, monitoring, and contractual requirements imposed on high-risk third parties. Although it includes an internal approval mechanism, the dominant focus is third-party cyber risk oversight.


category_confidence: medium

reasoning: The paragraph primarily describes the existence and general purpose of the company's cybersecurity program—monitoring and improving its cybersecurity posture—rather than board oversight, management roles, or a concrete business impact assessment. The references to operations and business strategy are contextual and do not amount to a materiality conclusion.


content_category: Management Role

reasoning: The paragraph primarily describes management personnel qualifications and experience relevant to handling cybersecurity-related risk, which is about management organization and capability rather than the cybersecurity program itself. It does not provide qualifying firm-specific or verifiable cybersecurity facts beyond generic officer experience language.


reasoning: The paragraph primarily addresses whether cybersecurity incidents have affected or are reasonably likely to affect the company’s business, operations, or financial condition, which is a strategy/materiality assessment. The rest of the text is largely speculative impact language and cross-references rather than substantive process or governance detail.


reasoning: The paragraph primarily describes the company's processes for assessing, identifying, and managing cybersecurity risks and integrating them into enterprise risk management, which is a risk management process disclosure. It uses broad, standard language without firm-specific roles, programs, technologies, or verifiable details.


reasoning: The paragraph primarily assesses the business and financial impact of cybersecurity events, stating that the February 2023 cyberattack and certain third-party cyberattacks did not have a material adverse impact on the company's financial position, results of operations, or liquidity. Although it references an actual incident, the dominant purpose is materiality and business-impact assessment rather than describing the incident itself.


reasoning: This paragraph primarily describes how the board and a board-level committee are informed about cybersecurity incidents, which is a board oversight and reporting-flow disclosure. The named Security & Technology Committee is a firm-specific governance detail.


reasoning: The paragraph primarily describes how the board oversees cybersecurity, including the information it receives and the reporting flow from management to the board. Although it mentions the Chief Information Officer, the main focus is board-level oversight rather than management organization or operational processes.


reasoning: The paragraph primarily describes how the Board and its committee oversee cybersecurity risk and receive information from management, which is board-level oversight. It includes firm-specific management roles involved in reporting, but does not provide quantified or externally verifiable facts.


reasoning: The paragraph primarily describes operational cybersecurity activities management may take to address identified risks, such as patching, configuration control, disabling vulnerable services, and updating scanning and detection tools. It focuses on what the cybersecurity program does rather than on board oversight, management structure, or a specific incident.


reasoning: The paragraph primarily describes how cybersecurity information is reported to and overseen by the board, including the scope of matters escalated to directors. It is Firm-Specific because it includes a cybersecurity-specific management role (ISO) and a concrete governance reporting structure, while also referencing a named regulatory framework.


reasoning: The paragraph is centrally about how the company evaluates and monitors cybersecurity risk posed by third parties, including pre-engagement diligence, contract requirements, and ongoing reviews. That makes Third-Party Risk the best fit rather than general risk management process.


reasoning: The paragraph primarily describes how cybersecurity information flows to the Audit Committee and full Board, making board oversight the central topic. Although it also mentions security measures like network security and data encryption, those are secondary to the governance reporting structure.


reasoning: The paragraph primarily describes what the company’s cybersecurity program is designed to do and the frameworks it uses, which makes it about the risk management process. Although it mentions responsible officers, those role references are secondary to the description of the program’s structure and operating approach.


reasoning: The paragraph primarily describes an actual cybersecurity event: threat actors targeted the company’s online banking platform using look-alike phishing sites, along with the outcome and response. Although it notes no breaches or losses, the dominant focus is what happened and its effects, which makes this an incident disclosure.


reasoning: The paragraph primarily describes how the board-level Audit Committee oversees cybersecurity-related risks and receives information from management, which is board oversight. It does not provide qualifying firm-specific or verifiable details beyond generic committee oversight language.


reasoning: The paragraph primarily describes board-level oversight by explaining how the Audit Committee receives information about cybersecurity threats, risks, and mitigation. Although it also includes a materiality conclusion about known cybersecurity threats, the majority of the paragraph is focused on governance and information flow to the board committee.


reasoning: The paragraph primarily provides a materiality-oriented business impact assessment, stating that certain cybersecurity threats are reasonably likely to materially affect the company's business strategy, results of operations, or financial condition. The rest of the paragraph is cautionary and cross-referential rather than describing governance, management structure, or specific cybersecurity processes.


reasoning: The paragraph primarily explains how the board, through its audit committee, oversees cybersecurity by receiving management reports and being informed of material incidents. It does not provide firm-specific cybersecurity structures, named programs, or verifiable details beyond generic oversight mechanics.


reasoning: The paragraph primarily describes a component of the company's cybersecurity program—using outside service providers to support containment and remediation activities. Although third parties are mentioned, they are described as assisting the company's internal incident-handling process rather than as the subject of vendor risk oversight.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity threats and incidents have not materially affected and are not reasonably likely to materially affect the company’s business strategy, results of operations, or financial condition. The remaining language is forward-looking risk boilerplate rather than describing governance, management, or operational cybersecurity processes.


reasoning: The paragraph primarily describes an actual cybersecurity incident, including when it was detected, what occurred, and that the Company incurred expenses in responding to it. The specific detection date makes the disclosure externally verifiable.


reasoning: The paragraph primarily explains how the company evaluates and monitors cybersecurity risk posed by vendors and other third parties with access to company information assets. Although it mentions cybersecurity assessments generally, the central topic is third-party due diligence and ongoing vendor oversight rather than the company’s internal security program.


reasoning: The paragraph primarily describes the escalation and reporting path for cybersecurity issues from management to the Audit Committee and Board, which is board oversight structure. Although it mentions the CFO's coordination role, the main focus is how important issues are communicated upward for governance purposes.


reasoning: The paragraph primarily provides a conclusion about whether cybersecurity threats or prior incidents have materially affected the company’s business, results, or financial condition, which is a strategy/materiality assessment. It does not describe governance, management roles, or cybersecurity processes.


reasoning: The paragraph is primarily about how the company manages cybersecurity risk arising from vendors and other third parties, making Third-Party Risk the best fit. Its specificity rises above boilerplate because it names Franklin Templeton as the entity imposing vendor requirements, but it does not include quantified or independently verifiable details.


reasoning: The paragraph primarily describes an actual event, including the nature of the incident, the company's response, and the resulting loss, which makes it an incident disclosure. Although it mentions governance and investigation steps, those details are subordinate to the disclosure of what happened and its consequences.


reasoning: This paragraph is only a cross-reference to another section of the filing for discussion of potential cyber impacts and does not itself describe governance, management, processes, third-party risk, an actual incident, or a materiality assessment.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from vendors and other external service providers, including assessments, reviews, audits, and contractual requirements. Although it uses cybersecurity-specific and vendor-risk terminology, it does not include firm-unique or externally verifiable facts such as named firms, dates, products, certifications, or quantified details.


reasoning: The paragraph primarily addresses cybersecurity risk arising from third-party technology service providers and the company's outreach to those providers after known breaches, making third-party risk the central topic. It does not include firm-specific roles, committees, named programs, dates, vendors, or other qualifying specific facts.


reasoning: The paragraph primarily describes what the cybersecurity program does—monitoring endpoints, training personnel, updating systems, and maintaining backup/recovery capabilities—even though those activities are performed by outside providers. It is not mainly about managing vendor cyber risk, but about the company’s operational cybersecurity measures.


reasoning: This paragraph primarily describes how the board-level oversight body receives cybersecurity information from management, which is a board oversight and information-flow disclosure. The mention of the CISO adds a firm-specific governance detail, but the focus remains on committee oversight rather than management organization.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from vendors, suppliers, and other business partners, making third-party oversight the central topic. It describes due diligence, contractual cybersecurity requirements, and mitigation steps for third-party incidents rather than the company's broader internal cyber program.


reasoning: The paragraph primarily describes how the Board and its Audit Committee oversee cybersecurity risk, including reporting flows from management up to the committee and then to the Board. While it includes cybersecurity oversight topics such as vulnerabilities, control maturity assessments, and incident prevention/detection/mitigation, it does not contain qualifying firm-specific or externally verifiable facts under the stated rules.


reasoning: The paragraph is primarily about how the company manages cybersecurity risks arising from vendors and other third-party service providers, including contractual requirements and onboarding review. Its focus is not the internal program generally, but third-party cyber oversight specifically.


reasoning: The paragraph primarily describes how the board oversees cybersecurity through reports from management and incident escalation, which is a board oversight structure question. The named CTO and CISO are firm-specific organizational details, but there are no externally verifiable dates, quantities, or named third-party facts.


reasoning: The paragraph primarily describes how cybersecurity information flows to a board-level committee, which is a board oversight function. It does not provide any qualifying specific facts beyond generic references to management reporting to the audit committee.


reasoning: The paragraph is centrally about how the company manages cybersecurity risks from third-party service providers, including diligence, monitoring, contractual requirements, and audits. It uses cybersecurity- and vendor-risk-specific practices, but does not include firm-unique or externally verifiable facts.


reasoning: The paragraph primarily presents generic risk language about potential cyber threats and possible impacts, with only a vague statement that the company devotes resources to cybersecurity. It does not substantively describe board oversight, management roles, concrete risk management processes, vendor oversight, an actual incident, or a material business-impact assessment.


reasoning: The paragraph primarily states a forward-looking materiality assessment that cybersecurity threats are reasonably likely to materially affect the company’s operations, strategy, results, or financial condition, which fits Strategy Integration. It does not describe governance, management roles, or concrete cybersecurity processes.


reasoning: The paragraph is a speculative cautionary statement about possible breaches and disruptions rather than a substantive description of board oversight, management structure, cybersecurity processes, third-party risk, incident details, or business impact assessment. It does not describe any concrete cybersecurity program or measure beyond a vague reference to 'adequate internal security measures.'


reasoning: The paragraph primarily provides a materiality assessment of cybersecurity threats and incidents, including whether they have materially affected or are reasonably likely to materially affect the company's business, results, or financial condition. Although it mentions prior incidents and risk factors, its central purpose is the Item 106/1C business-impact conclusion rather than describing governance, management, or operational cybersecurity processes.


reasoning: The paragraph primarily describes how management is organized to oversee cybersecurity, centered on the CDIO-led security council and the composition of management response teams. Although it references escalation to the board’s Audit Committee and mentions an actual incident, those points are secondary to the management-structure focus.


reasoning: The paragraph primarily explains how the board oversees cybersecurity risk, including delegation to a board committee and reporting flows from management to that committee and the full board. Although it mentions a management role, the main purpose is the board-level oversight structure.


reasoning: The paragraph is primarily about who in management is responsible for cybersecurity and what qualifications those leaders have, which makes it a management-organization disclosure rather than a process description. It focuses on the CDO and interim CISO roles, reporting lines, and experience rather than detailing cybersecurity program activities.


reasoning: The paragraph primarily describes how the Board and its Audit Committee oversee cybersecurity risk and receive information about threats or incidents, which is board-level oversight. It does not provide qualifying firm-specific or externally verifiable cybersecurity facts beyond generic governance structure.


reasoning: The paragraph primarily explains how management is organized to handle cybersecurity, focusing on which executives lead the programs, their reporting relationships, and their responsibilities. Although it mentions assessments and reviews, those process details are secondary to the management structure.


reasoning: The paragraph primarily describes management's cybersecurity leadership structure, the CIO's background, and reporting lines rather than board oversight or cybersecurity processes. Its focus is on who is responsible and how management is organized to handle cybersecurity.


reasoning: The paragraph is primarily about how the company manages cybersecurity risks arising from suppliers and subcontractors, especially through contractual terms and incident reporting expectations. Its focus is third-party oversight rather than the company's broader internal cybersecurity program.


reasoning: The paragraph primarily states management’s conclusion that cybersecurity threats or incidents did not materially affect, and are not reasonably likely to materially affect, the company’s business strategy, results of operations, or financial condition, which is a Strategy Integration assessment. The remaining language is standard cautionary and cross-reference disclosure rather than process or governance detail.


reasoning: The paragraph is centrally about how the company manages cybersecurity risk from vendors, suppliers, and service providers, including pre-contract assessments and security-related contract terms. It uses cybersecurity-specific concepts, but does not provide clear firm-unique or externally verifiable facts.


reasoning: The paragraph primarily describes what the cybersecurity program does and the controls it includes, such as security architecture, endpoint detection, incident response, and privileged access management. Although it mentions the CISO, that role is presented in service of describing the program’s operation rather than management organization as the main focus.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk arising from third-party providers, including pre-engagement assessments, contractual oversight, and ongoing monitoring. Although it mentions the IT Security team, the disclosure is mostly a standard description of vendor cyber oversight practices rather than company-unique or verifiable detail.


reasoning: This paragraph is a cross-reference directing readers to the Risk Factors section rather than providing substantive cybersecurity governance, management, process, incident, or strategy disclosure. Under the rules, cross-references about potential material effects belong in None/Other.


reasoning: The paragraph is primarily about how the company identifies and oversees cybersecurity threats arising from vendors, service providers, and other external parties, making third-party risk the central topic. It describes this at a high level without naming specific vendors, controls, frameworks, committees, or verifiable details.


reasoning: This paragraph primarily describes an actual cybersecurity incident, including how it occurred, what data was accessed, and the company's response steps. The specific incident date and concrete event details make it a clear Incident Disclosure.


reasoning: This paragraph is an executive biography describing Mr. Shear’s business roles and career history, not cybersecurity governance, management, risk processes, third-party risk, incident disclosure, or strategy impact. Because it contains no substantive cybersecurity disclosure, it is classified as None/Other.


reasoning: The paragraph primarily describes cybersecurity program activities: external security maturity assessment, review of penetration tests and architecture, gap remediation, incident response policy development, and tabletop exercises. Although a third party is involved, Kroll is serving as an assessor of the company's internal security program rather than the paragraph focusing on vendor risk management.


reasoning: Although the paragraph opens with board/audit committee oversight, most of the text describes how cybersecurity risk is integrated into the company's broader risk management framework and references alignment to NIST. That makes the paragraph primarily about the company's cybersecurity risk management process rather than board oversight.


reasoning: The paragraph primarily describes how the board oversees cybersecurity by delegating oversight responsibility to a board committee. It does not provide qualifying specific facts beyond generic governance structure.


reasoning: This paragraph is primarily a cross-reference to Risk Factors and uses hypothetical material-adverse-effect language rather than describing an actual cybersecurity program, governance practice, or incident. Under the rules, cross-references and speculative impact statements without substantive cybersecurity measures are classified as None/Other.


reasoning: The paragraph primarily provides a materiality assessment, stating that as of the filing date the company has not identified cybersecurity risks or incidents that have materially affected its business strategy, results of operations, or financial condition. The remaining text is largely generic risk framing and cross-reference language rather than disclosure about governance, management, or specific risk-management practices.


reasoning: The paragraph primarily describes what the company's resilience and continuity program does—planning, impact analysis, risk assessment, continuity strategies, and exercises—so it is best categorized as Risk Management Process. Although it mentions a team, the focus is on program activities rather than management structure or board oversight.


reasoning: The paragraph primarily describes how management is organized to handle cybersecurity by assigning responsibilities to the Director, IT. Although it references cybersecurity-related tasks, the focus is the role and duties of a management position rather than the company’s broader cybersecurity program or board oversight.


reasoning: The paragraph is centrally about how the company manages cybersecurity risks from vendors and service providers, including assessments and contractual requirements imposed on them. That makes third-party risk the primary topic rather than general risk management.


reasoning: The paragraph is primarily about how the company manages cybersecurity risks posed by vendors and other service providers, making third-party risk the central topic. It describes only generic vendor diligence and risk assessment considerations without any named firms, specific controls, committees, frameworks, or verifiable details.


reasoning: The paragraph primarily provides a materiality assessment, stating that the company is not aware of cybersecurity threats that have materially affected or are reasonably likely to materially affect its business, results, or financial condition. Although it mentions experiencing cyber incidents generally, the dominant purpose is the SEC-required business impact conclusion rather than describing an actual incident or risk management process.


reasoning: The paragraph primarily describes the board's oversight role with respect to cybersecurity-related services, which makes Board Governance the best fit. Although it also mentions outsourced IT/cybersecurity support from affiliates, the main point is that the board oversees those services.


reasoning: The paragraph primarily describes how the board, through the Audit Committee, is informed and prepared to oversee cybersecurity-related matters via education and expertise. It does not meaningfully describe management structure, operational cybersecurity processes, or any incident.


reasoning: The paragraph is primarily about how management is organized to handle cybersecurity, focusing on the CISO’s role, reporting structure, qualifications, and leadership of a management-level committee. Although it also describes security activities, those details are presented through the management structure rather than as a standalone program description.


reasoning: The paragraph is primarily about how the company manages cybersecurity risks arising from third-party service providers, making Third-Party Risk the best fit. It describes vendor due diligence and oversight at a high level without firm-unique details, named parties, frameworks, or verifiable facts.


reasoning: The paragraph primarily describes which management roles lead cybersecurity risk management and emphasizes their collective experience and responsibility structure. Its focus is on management organization and qualifications rather than the underlying cybersecurity processes themselves.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk arising from third-party service providers, especially by requiring security certifications and breach reporting obligations. Although it mentions consultants helping with risk assessments and safeguards, the central focus is vendor-related cybersecurity oversight rather than the company’s internal program.


reasoning: The paragraph is primarily about how the company manages cybersecurity risk arising from third-party hosted software providers, including monitoring, audit expectations, and vendor assurance requirements. Although it includes a specific SOC 1/SOC 2 requirement, it does not provide firm-unique names, roles, or verifiable quantified details beyond standard third-party cyber oversight practices.


reasoning: This paragraph is a cross-reference directing readers to Item 1A Risk Factors for additional discussion, rather than describing cybersecurity governance, management, processes, third-party risk, an actual incident, or a materiality assessment. It contains no substantive cybersecurity disclosure of its own.


reasoning: The paragraph primarily describes what the cybersecurity program does: risk assessments, system monitoring, layered defenses, safeguards, incident response and recovery planning, patching, and countermeasure evaluation. Although it ends by noting Audit Committee oversight, the main focus is the operation of the cybersecurity risk management program rather than board oversight.


reasoning: The paragraph primarily describes how the Audit Committee and Board receive information about and oversee cybersecurity risks, including briefings, dialogue, strategic guidance, and annual review. Although management is mentioned through the Chief Operating Officer, the main focus is the board-level oversight structure rather than management organization or cybersecurity program activities.


reasoning: The paragraph primarily describes how the board and its audit committee oversee cybersecurity, including how updates flow from the CISO to the audit committee and full board. Although management roles are mentioned, they are presented mainly to explain the board’s oversight structure and reporting process.


reasoning: The paragraph primarily describes the oversight chain for cybersecurity risk, stating that the process is supported by senior leadership, the Audit Committee, and the Board of Directors. It does not provide substantive detail about management organization or the cybersecurity program itself.


reasoning: The paragraph primarily describes how the Board oversees cybersecurity through reports from management and the Audit Committee's oversight role, which makes board oversight the central topic. Although it includes management details about the CIO, those details are subordinate to the governance structure.


reasoning: The paragraph primarily explains how the company's cybersecurity risk management program is structured within its broader enterprise risk management processes, which is a process description rather than board oversight or business impact assessment. Although it mentions the Chief Risk Officer and ERM integration, it does so in generic terms without cybersecurity-specific operational detail.


reasoning: This paragraph primarily describes how management is organized to handle cybersecurity, including which management bodies and roles are responsible and the experience of relevant personnel. Although it references the cybersecurity risk management program, the focus is on management responsibility and qualifications rather than the program’s operational processes.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from vendors and other service providers, making third-party risk the central topic. It describes vendor-focused controls such as risk assessments, questionnaires, security program reviews, and contractual requirements, but does not include firm-unique or externally verifiable details.


reasoning: This paragraph is a cross-reference to the risk factors section and contains only hypothetical, forward-looking risk language about what could happen if security is compromised. It does not describe actual cybersecurity governance, management, processes, third-party oversight, incidents, or a materiality conclusion.


reasoning: The paragraph primarily explains how cybersecurity information flows to the Audit Committee and how that committee is informed about cyber risks and incidents, which is board oversight. It does not provide qualifying firm-specific or verifiable facts beyond generic governance structure and cadence.


reasoning: The paragraph primarily describes how the company’s cybersecurity risk management program operates by using external providers to help identify, assess, and manage cyber risks. Although third parties are mentioned, they are service providers supporting the company’s internal program rather than vendors being overseen, so this is Risk Management Process rather than Third-Party Risk.


reasoning: The paragraph primarily provides a materiality assessment that cybersecurity threats have not materially affected the company, its business strategy, results of operations, or financial condition, which is Strategy Integration under the materiality rule. The references to threats, breaches, and third-party vendors are general and subordinate to that assessment.


reasoning: The paragraph primarily describes part of the company's cybersecurity risk management approach: using outside advisors to help identify, assess, and manage cybersecurity risks. Although third parties are mentioned, they are service providers assisting the company's own program rather than vendors being overseen, so this fits Risk Management Process rather than Third-Party Risk.


reasoning: The paragraph primarily describes a real third-party cybersecurity incident, its operational effects on claims processing, and the ongoing investigation and remediation timeline. Although it includes materiality conclusions, the dominant focus is what happened and how the incident affected operations, which makes Incident Disclosure the best fit.


reasoning: The paragraph is primarily about how the company manages cybersecurity risks arising from third-party service providers, including onboarding and ongoing vendor assessments. It is not mainly describing the broader cyber program or governance structure, so Third-Party Risk is the best fit.


reasoning: This paragraph is only a cross-reference to the Risk Factors section and does not describe cybersecurity governance, management, processes, third-party risk, incidents, or strategy impacts. Under the rules, pure cross-references are classified as None/Other.


reasoning: This paragraph primarily describes management’s cybersecurity organization, reporting line, and qualifications, especially the CISO’s responsibilities and credentials. It is not mainly about board oversight or the company’s cybersecurity processes.


reasoning: The paragraph primarily describes an actual cybersecurity event, including when it was detected, what type of attack it was, and its operational impact, which makes it an incident disclosure. Although it also mentions business and financial effects, the incident narrative is the dominant focus.


reasoning: The paragraph primarily describes how management is organized to handle cybersecurity, focusing on the IT Security Director's reporting line, leadership role, and the cybersecurity team's experience and qualifications. Although it briefly mentions threat intelligence and external consultants, the main emphasis is on management structure and responsibilities rather than the operational cybersecurity program itself.


reasoning: The paragraph primarily explains how the board oversees cybersecurity through delegation to the Audit Committee and reporting up to the full Board. It does not provide firm-specific or verifiable details beyond standard governance boilerplate.


reasoning: This paragraph primarily describes how cybersecurity information flows to a board-level committee and how that committee is kept informed, which is board oversight. Although management roles are mentioned, they are presented mainly as part of the reporting chain to the committee.


reasoning: The paragraph primarily explains how management is organized for cybersecurity by identifying the CIO as the responsible executive, describing the information security team under the CIO, and outlining escalation to executive management. Although it mentions some operational processes, the dominant focus is on leadership responsibility, qualifications, and management structure.


reasoning: This paragraph primarily provides legal and regulatory background about banking-agency oversight and SEC disclosure requirements rather than describing the company’s own cybersecurity governance, management, or risk processes. Because it is not substantive company-specific cybersecurity disclosure, it falls under None/Other.


reasoning: The paragraph primarily explains how the company evaluates the materiality of cybersecurity incidents by considering financial, operational, reputational, and data-related impacts, which is most directly about business impact assessment. It does not describe board oversight, management structure, or operational security measures.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity threats and previously identified incidents have not materially affected the company's business strategy, results of operations, or financial condition. The rest of the paragraph is forward-looking caution and a cross-reference, which does not change the primary focus.


reasoning: The paragraph primarily gives the company's materiality assessment that cybersecurity threats and prior incidents have not materially affected and are not reasonably likely to materially affect its business strategy, results of operations, or financial condition, which fits Strategy Integration under the materiality rule. The rest is a cross-reference to risk factors rather than a description of governance, management, or process.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity risks have not materially affected the company’s business strategy, results of operations, or financial condition to date. Although it mentions threats and breaches, the main purpose is the business-impact conclusion rather than describing a specific incident or cybersecurity process.


reasoning: The paragraph primarily explains how the company evaluates cybersecurity risk posed by vendors and other service providers, including the review criteria used to assess those third parties. Although it also mentions broader security measures and outside assessors, the central focus is third-party cybersecurity oversight.


reasoning: The paragraph primarily describes actual cybersecurity incidents, including when they occurred, what systems or information were affected, and the company's response. Although it also notes immaterial costs and no material effect during the reporting period, the dominant focus is the disclosure of real events.


reasoning: The paragraph primarily describes the company's cybersecurity risk environment and its general approach to assessing, identifying, and managing information security risks, with examples of threat types and operational impacts. Although it includes governance references, those are secondary to the broader description of the cybersecurity risk management context.


reasoning: This paragraph is a cross-reference to a risk factor and contains only general, hypothetical cyber risk language rather than describing governance, management, processes, third-party oversight, strategy impact, or an actual incident. Under the rules, pure speculation and cross-references belong in None/Other.


reasoning: The paragraph primarily describes management responsibility for cybersecurity and the qualifications of the individual handling that responsibility, which fits Management Role. It does not meaningfully describe the cybersecurity program's processes or tools, and the stated experience/certifications are too vague to count as qualifying specific facts under the rubric.


reasoning: The paragraph primarily describes a component of the company's cybersecurity program—using external service providers to help evaluate and improve information security policies and procedures—so it is about how the program operates. Third parties are mentioned only as support for the internal program, not as the focus of vendor or supply-chain risk management.


reasoning: The paragraph primarily describes how the Board of Directors and its Audit Committee oversee cybersecurity through updates and briefings, which is board-level oversight. It does not provide qualifying specific facts beyond generic governance language and standard oversight topics.


reasoning: The paragraph primarily describes how the board, through the Audit Committee, oversees cybersecurity risk and receives information from management, which is board-level oversight. It uses cybersecurity-specific concepts such as data security posture, third-party assessments, and incident response, but does not include qualifying firm-specific or externally verifiable facts.


reasoning: The paragraph primarily states management's conclusion that cybersecurity threats and prior incidents have not materially affected, and are not reasonably likely to materially affect, the company's business strategy, results of operations, or financial condition, which is a Strategy Integration assessment. The remaining content is largely cross-reference and generic forward-looking impact language rather than governance, management structure, or process detail.


reasoning: The paragraph primarily provides a materiality assessment that past cybersecurity threats and incidents have not materially affected, and are not reasonably likely to materially affect, the company’s business strategy, results of operations, or financial condition. Although it mentions prior threats and third-party vendor breaches, the main purpose is the SEC-required business impact conclusion rather than describing the incidents or the risk management process.


reasoning: The paragraph primarily explains how Marriott manages cybersecurity obligations for franchisees, licensees, and other counterparties, including required compliance with information security standards and incident reporting. That makes third-party oversight the central topic rather than Marriott’s internal risk management process.


reasoning: The paragraph primarily describes what the company's cybersecurity program does to identify, assess, and mitigate cyber risk, including vulnerability scanning, penetration testing, threat intelligence monitoring, and risk assessment activities. Although it mentions vendor risk assessment, third-party risk is presented as one component of the broader cybersecurity program rather than the central topic.


reasoning: The paragraph primarily describes the board’s oversight structure by explaining that cybersecurity oversight is delegated to a specific board committee and how that committee receives updates. Although it also mentions management responsibility and reporting lines, those details are subordinate to the governance-chain description.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity threats or incidents have not materially affected the company during the reported periods, which is a Strategy Integration disclosure under the materiality rule. It does not describe governance, management structure, or specific cybersecurity processes.


reasoning: The paragraph primarily describes how cybersecurity information is reported to the Audit Committee and Board of Directors, which is board oversight rather than management execution or program operations. It is generic governance language without qualifying firm-specific or externally verifiable details.


reasoning: The paragraph is primarily about how the company manages cybersecurity risks arising from vendors and other third parties, making third-party risk the central topic. It describes cyber-specific practices such as security assessments and ongoing monitoring, but includes no firm-unique or externally verifiable details.


reasoning: The paragraph primarily explains how cybersecurity information flows to board-level committees and how those committees are briefed, which is board oversight. While management roles are mentioned, they are described mainly in service of the board governance structure.


reasoning: The paragraph primarily describes how the Board and its Audit Committee oversee cybersecurity risk through briefings and updates from management, which is board-level oversight. It does not provide qualifying firm-specific or externally verifiable cybersecurity facts beyond common governance boilerplate.


reasoning: The paragraph primarily describes the company’s cybersecurity controls and operational safeguards—network, endpoint, access, data, and training measures—which is a description of the cybersecurity program’s activities. It is not focused on who oversees cyber risk, but on what protective processes and tools are used.


reasoning: The paragraph primarily describes how management is organized to handle cybersecurity, focusing on reporting lines, leadership roles, and team qualifications. While it mentions program activities like threat intelligence and incident efforts, the dominant emphasis is on who leads and manages those functions.


reasoning: The paragraph primarily explains how the board oversees cybersecurity risk, including the full board's responsibility and management's reporting flow to the board. It contains no qualifying firm-specific or verifiable cybersecurity facts beyond generic governance structure and reporting language.


reasoning: The paragraph primarily describes how the board and its delegated committee oversee cybersecurity risk and receive information from management, which is a board oversight structure question. Although it mentions management presenters, the focus is the Board/Audit Committee oversight and reporting flow rather than management organization itself.


reasoning: This paragraph is only a cross-reference to another section of the filing and does not describe cybersecurity governance, management, processes, third-party risk, incidents, or strategy impacts. Under the rules, pure cross-references are classified as None/Other.


reasoning: This paragraph is generic forward-looking disclosure language about what the company would report if a material cybersecurity incident were identified, rather than describing board oversight, management roles, a cybersecurity process, third-party risk, strategy impact assessment, or an actual incident. Because it contains no substantive cybersecurity measures or company-specific facts, it fits None/Other.


reasoning: The paragraph primarily describes how a board-level committee oversees cybersecurity through reports and presentations from management, which is board oversight rather than management organization or operational process detail. It contains no qualifying firm-specific or verifiable facts under the stated rules.


reasoning: The paragraph primarily describes what the company’s cybersecurity program does: assessing cyber risks, monitoring systems, scanning networks, conducting vulnerability testing, and using security tools for incident handling. Its focus is on operational security activities rather than board oversight, management roles, or third-party vendor risk.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks involving outside parties, especially by requiring vendors to follow security controls. Although it also mentions third-party firms performing security activities, the central theme is third-party/vendor cyber risk management.


reasoning: The paragraph primarily describes the company’s incident response process—how cybersecurity incidents are identified, assessed, escalated, and coordinated—rather than focusing on board oversight or management qualifications. Although it references the CEO and Board, those appear as escalation points within the response workflow, making the process itself the central topic.


reasoning: The paragraph primarily provides a materiality assessment that cybersecurity threats and prior incidents have not materially affected, and are not reasonably likely to materially affect, the company's business strategy, results of operations, or financial condition. The rest of the paragraph is a cross-reference to risk factors rather than discussion of governance, management, or operational processes.


reasoning: The paragraph primarily explains how the board receives oversight information on cybersecurity, including reporting from management to the Board of Directors. Although it mentions the CTO, the main purpose is describing board-level oversight and information flow rather than management organization.


reasoning: The paragraph primarily describes the general objective of the company's cybersecurity efforts—maintaining continuity and protecting technology, customer data, and employee data in the event of a cyber incident. It does not discuss board oversight, management structure, a specific incident, or any concrete process details.


reasoning: The paragraph primarily describes an actual cybersecurity incident, including when it occurred, what was affected, and remediation steps taken afterward. Although it also mentions protective measures and future risk, the real-event disclosure is the dominant purpose.


reasoning: This paragraph is a high-level introductory summary about the existence of cybersecurity risk management and governance processes, but it does not describe any actual oversight structure, management role, or process. Because it is merely framing language without substantive disclosure, it fits None/Other.


reasoning: The paragraph describes an actual cybersecurity incident that occurred during the reporting period and summarizes its containment, investigation, and lack of material impact, which is the core of incident disclosure. It is not primarily about governance or program design.


reasoning: The paragraph primarily describes a real cybersecurity incident involving Change Healthcare, its operational effects on the company's billing and claims processes, and responsive actions taken. Although it also includes materiality conclusions, the core of the paragraph is what happened and how the incident affected operations.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity threats and prior incidents have not materially affected and are not reasonably likely to materially affect the company's business strategy, financial condition, or results of operations. The remainder is a cross-reference to risk factors rather than substantive governance, management, or process detail.


reasoning: The paragraph primarily describes how the board, through the Audit Committee, oversees cybersecurity risk and receives information about the cybersecurity program. It focuses on oversight structure and reporting to the Board rather than management organization or the operational details of the cybersecurity program.


reasoning: The paragraph primarily describes how the board oversees cybersecurity risk, including delegation to a board committee and information flow from management to that committee and the full board. While it includes management titles, the main purpose is the board oversight structure rather than management organization or program activities.


reasoning: The paragraph primarily describes how cybersecurity oversight flows through the board, including the board’s ultimate oversight role, committee support, and management reporting up to the board. Although it mentions the CTO’s responsibilities, the main question answered is how the board oversees cybersecurity rather than how management is organized.


reasoning: The paragraph primarily gives a materiality-oriented assessment that prior cybersecurity incidents have not had a material impact, while warning that future incidents could affect the business, operations, and reputation. It does not describe governance, management structure, or concrete cybersecurity processes in substantive detail.


reasoning: The paragraph primarily describes what the cybersecurity program does: it references a framework, access control principles, and employee training practices. Although management actions are mentioned implicitly, the focus is on operational cybersecurity measures rather than organizational roles or board oversight.


reasoning: The paragraph primarily states a materiality conclusion: that the company has not experienced material cybersecurity incidents and that related expenses have been immaterial. That makes it a Strategy Integration paragraph under the SEC materiality-assessment rule, rather than an incident description or process discussion.


reasoning: The paragraph primarily describes how the Board oversees cybersecurity risk, including delegation to the Audit Committee and reporting flows from management to the Board. Although it mentions the CISO, the main purpose is the board-level oversight structure rather than management organization or operational cybersecurity processes.


reasoning: This paragraph is a cross-reference directing readers to Item 1A Risk Factors rather than providing substantive cybersecurity governance, management, process, third-party risk, incident, or strategy disclosure itself. Because it contains no actual cybersecurity measures or assessment beyond the pointer, it is best classified as None/Other.


reasoning: The paragraph primarily explains that the company relies on ORIX USA's cybersecurity risk management program to identify, assess, and manage cybersecurity risks, which is mainly a description of how its cybersecurity risk management operates. Although it references the Manager and board supervision, the core substance is the outsourced cybersecurity program and dependence on it rather than board oversight or management qualifications.


reasoning: The paragraph primarily describes how cybersecurity oversight flows through the board structure: the Board’s oversight role, delegation to a board committee, and management reporting up to the Board. Although it includes management responsibilities and qualifications, those details are presented in service of explaining the board oversight framework.


reasoning: The paragraph primarily explains how information about the information security program flows upward to senior management, the Audit Committee, and the Board, which makes board oversight the main topic. Although it mentions external experts and engagement with outside communities, those references are general and do not describe a distinct cybersecurity process in enough detail to make risk management the primary focus.


reasoning: The paragraph primarily describes the board-level oversight structure for cybersecurity, especially the Risk Management Committee’s role and the reporting flow to the full Board. Although it also includes a materiality statement and risk-factor style language, the dominant focus is how cybersecurity oversight is handled at the board level.


reasoning: The paragraph primarily provides a materiality assessment, stating that the company is not aware of any cybersecurity incidents that have materially affected it to date and discussing potential future material impacts on business strategy, results of operations, or financial condition. The remaining language is largely cautionary and cross-referential, not a substantive process or governance description.


reasoning: The paragraph primarily describes a cybersecurity activity within the company’s program—incorporating threat intelligence sharing about emerging threats—so it fits Risk Management Process. Although third parties are mentioned, they are part of the company’s broader security practices rather than the central topic of vendor risk oversight.


reasoning: The paragraph is primarily about how the company assesses and manages cybersecurity risks posed by service providers, vendors, operators, and other third parties. Although it briefly mentions cyber insurance, the central focus is third-party oversight processes rather than broader strategy or internal risk management.


reasoning: This paragraph primarily describes an actual cybersecurity event, including the timing of unauthorized access, the status of the investigation, and the company's ongoing evaluation of impact. Although it also mentions possible material impact and cross-references risk factors, the dominant focus is what happened in the incident.


reasoning: The paragraph primarily describes management's responsibility for overseeing cybersecurity strategy and risk, which is about how management is organized and responsible for cyber matters. It does not provide substantive detail about the cybersecurity program itself or any board-level oversight structure.


reasoning: The paragraph primarily explains which management personnel are responsible for cybersecurity risk management and why they are qualified, emphasizing roles, experience, and credentials. Although third-party service providers are mentioned, they are supporting details rather than the central topic.


reasoning: The paragraph primarily provides a company-specific conclusion about its cybersecurity incident history rather than describing governance, management structure, or risk processes. Because it states the company's historical incident status, it fits best under Strategy Integration rather than Incident Disclosure, which requires an actual incident.


reasoning: The paragraph primarily states management's conclusion that cybersecurity threats and incidents have not materially affected, and are not reasonably likely to materially affect, the company's business, results, or financial condition, which is a materiality assessment. It does not meaningfully describe governance, management structure, or cybersecurity processes.


reasoning: The paragraph primarily describes how the company assesses and monitors cybersecurity readiness through control tests, vulnerability assessments, audits, and continuous monitoring, which are cybersecurity program activities. Although it mentions reporting to specific roles and a committee, those details are secondary to the process description.


reasoning: The paragraph primarily describes how the company identifies and assesses cybersecurity risk as part of its overall risk management program, which fits Risk Management Process. Its language is high-level and generic, without named frameworks, tools, roles, vendors, dates, or other qualifying specific facts.


reasoning: The paragraph primarily describes how the Board of Directors and Audit Committee oversee cybersecurity and how management reports cybersecurity matters upward through quarterly and periodic briefings. Although it mentions management roles, the main purpose is the board-level oversight structure and information flow.


reasoning: The paragraph primarily describes operational cybersecurity activities—continuous monitoring, alert review, use of security tools, and response to possible security incidents—rather than board oversight or management structure. Although it contains no firm-specific or externally verifiable facts, it uses cybersecurity-specific process language beyond generic risk boilerplate.


reasoning: The paragraph primarily describes the company's general cybersecurity program objectives and protective measures—i.e., what it does to protect systems and data—rather than board oversight, management structure, third-party risk, or any actual incident. However, it does so only at a high level using generic language without concrete cybersecurity practices or company-specific details.


reasoning: The paragraph primarily describes an actual cybersecurity incident, including the disruption to IT systems, investigation, remediation, containment, and notification steps taken. Although it begins and ends with materiality-oriented statements, most of the paragraph is focused on what happened and how the Company responded.


reasoning: The paragraph primarily provides a materiality-oriented assessment by stating that the company has not experienced a cybersecurity incident resulting in a material adverse impact, which fits Strategy Integration under the negative-assertion rule. The rest is largely speculative risk language and a cross-reference to risk factors.


reasoning: The paragraph primarily describes how cybersecurity information flows to the Board and how the Board is briefed, which makes board oversight the central topic. Although it also discusses management responsibilities and program activities, those details are presented as part of the governance chain supporting Board oversight.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from third-party service providers, including pre-engagement assessments and ongoing review. Although it ends with a material-impact statement, most of the paragraph is focused on vendor-related cyber risk oversight.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk from external parties, especially by imposing security and breach-reporting requirements on third-party service providers. Although it also mentions outside auditors and experts, the dominant focus is third-party oversight rather than the company’s internal program.


reasoning: The paragraph primarily describes what the cybersecurity program does to assess, identify, and manage cyber risk, including controls, training, simulations, and monitoring activities. Although it includes cybersecurity-specific concepts like defense in depth and zero trust, it does not provide firm-unique named roles, committees, dates, vendors, or quantified facts.


reasoning: The paragraph primarily provides a materiality-oriented assessment of cybersecurity’s impact on the business, including the statement that no material cybersecurity incident occurred in the relevant lookback period and describing how a material incident could affect results of operations. Although it mentions cybersecurity threats such as advanced persistent threats, it does not mainly describe governance, management organization, or the company’s operational cyber program.


reasoning: The paragraph primarily describes how the company considers cybersecurity when engaging third-party IT service providers, making vendor-related cyber oversight the central topic. It is generic because it provides no named vendors, standards, contractual requirements, assessment methods, or other concrete cybersecurity details.


reasoning: The paragraph primarily gives a business-impact/materiality-oriented assessment of cybersecurity risk, capped by the statement that the company is not aware of any cybersecurity threats and has not had any cybersecurity incidents. The rest is largely hypothetical adverse-effect language rather than describing governance, management roles, or specific security processes.


reasoning: The paragraph primarily states management's conclusion about whether cybersecurity incidents materially affected or are reasonably likely to materially affect the company's business strategy, results of operations, or financial condition, which is a Strategy Integration assessment. It does not describe a specific incident, governance structure, or cybersecurity process.


reasoning: The paragraph primarily describes the company's cybersecurity program activities—its framework for identifying and mitigating threats, including detection, response, and mitigation procedures. It contains no firm-specific roles, named frameworks, technologies, committees, dates, or other qualifying specific facts.


reasoning: This paragraph is a cross-reference to the risk factors section and does not describe any substantive cybersecurity governance, management, process, third-party oversight, incident, or business impact assessment beyond generic forward-looking language.


reasoning: The paragraph primarily describes management responsibility for cybersecurity—specifically that senior management leads the information security team and reports cybersecurity matters to the board. It does not meaningfully describe the cybersecurity program’s activities or processes beyond assigning responsibility.


reasoning: The paragraph primarily describes how the company manages cybersecurity risk arising from vendors, suppliers, and other third-party providers, making Third-Party Risk the best fit. It remains generic because it provides no named standards, firms, tools, roles, dates, or other company-specific details.


reasoning: The paragraph primarily states a conclusion about whether cybersecurity threats have materially affected the company, its business strategy, results of operations, or financial condition, which is a Strategy Integration assessment. Its mention of past threats and breaches is generic and subordinate to that materiality conclusion.


reasoning: The paragraph primarily provides a conclusion about business impact and materiality, stating that the company has not experienced a cybersecurity incident that materially affected its operations, reputation, or financial performance. The remaining statements are general forward-looking risk and investment language rather than a description of governance or specific cybersecurity processes.


reasoning: This paragraph is primarily a cross-reference to risk factors and contains hypothetical adverse-effect language rather than describing governance, management, processes, third-party risk management, an actual incident, or a concrete materiality assessment. Under the rules, cross-references and speculative harm language are classified as None/Other.


reasoning: This paragraph is a cross-reference to risk factors and contains only hypothetical, forward-looking consequences of cybersecurity threats rather than describing governance, management, processes, third-party oversight, incidents, or a materiality assessment conclusion.


reasoning: The paragraph primarily explains how the company addresses cybersecurity risk arising from suppliers, service providers, and other business partners, making third-party oversight the central topic. It describes general due diligence and contractual notice requirements, but does not provide concrete, firm-specific, or externally verifiable details.


reasoning: The paragraph primarily provides a materiality assessment, stating that prior cybersecurity threats or incidents have not materially affected the company, which fits Strategy Integration under the materiality rule. Although it also mentions requirements for third-party service providers, that is secondary to the paragraph's overall business-impact conclusion.


reasoning: This paragraph is primarily a forward-looking risk disclaimer describing hypothetical cybersecurity harms and directing readers to Risk Factors, rather than explaining governance, management, processes, third-party oversight, an actual incident, or a concluded materiality assessment. Because it contains no qualifying firm-specific or verifiable cybersecurity facts, it is generic boilerplate.


reasoning: This paragraph primarily describes the general cybersecurity threat environment and a broad commitment to protection, rather than explaining board oversight, management roles, specific risk management processes, third-party risk procedures, strategy impact, or a real incident. It is therefore non-substantive boilerplate rather than a disclosure answering one of the core Item 1C questions.


reasoning: This paragraph is a definitional statement explaining what 'systems' means rather than describing cybersecurity governance, management, processes, third-party risk, incidents, or strategy impact. It does not provide any substantive cybersecurity disclosure.


reasoning: The paragraph primarily describes how cybersecurity information flows to the Audit Committee and how that committee oversees cybersecurity strategy, which is board-level oversight. The Senior Director, Global Information Security is a firm-specific organizational detail, but the paragraph’s main purpose is governance rather than management organization.


reasoning: The paragraph primarily describes how the board oversees cybersecurity, including which directors provide oversight and how the board is engaged on significant incidents. The content is governance-focused rather than describing management structure or cybersecurity processes.


reasoning: The paragraph primarily provides a materiality assessment, stating that no cybersecurity incidents had a material impact on operations, liquidity, or financial condition, which fits Strategy Integration under the materiality rule. Although it mentions phishing attempts and technical vulnerabilities, those references are subordinate to the overall business-impact conclusion.


reasoning: The paragraph primarily provides a materiality assessment, stating that prior cybersecurity incidents have not materially affected and are not reasonably likely to materially affect the company, its operations, strategy, results, or financial condition. The remaining language is mostly generic risk and disclaimer text supporting that assessment.


reasoning: The paragraph primarily states management's conclusion that cybersecurity incidents have not materially affected, and are not reasonably likely to materially affect, the company's business, results, or financial condition, which is a materiality/business-impact assessment. It does not describe governance, management structure, or cybersecurity processes.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk from vendors and other third parties through questionnaires, contractual requirements, monitoring, and disengagement rights. Although it also mentions internal security software, the central focus is third-party cybersecurity oversight.


reasoning: The paragraph primarily provides a materiality assessment, stating that prior cybersecurity threats have not materially affected the company but that future threats could reasonably be likely to do so. Its main purpose is to describe cybersecurity's potential impact on operations, strategy, and financial condition, not governance, management, or process details.


reasoning: The paragraph is primarily about how the company manages cybersecurity risk arising from vendors, contractors, and subservice organizations, making third-party oversight the central topic. It describes vendor cyber risk assessments and security requirements rather than broader internal cybersecurity governance or incident response.


reasoning: The paragraph primarily explains how management is organized to handle cybersecurity by identifying the management role responsible for cyber risk and describing that person's experience and support structure. Although board oversight is mentioned, the emphasis is on management responsibility and qualifications rather than board oversight mechanics.


reasoning: The paragraph primarily conveys a materiality-style assessment about whether cybersecurity issues have materially affected the company’s operations or financial condition, which fits Strategy Integration. The remainder is a cross-reference to risk factors and does not add substantive cybersecurity process or governance detail.


reasoning: This paragraph primarily describes an actual cybersecurity incident—what happened, how it occurred, and the immediate consequences—so it is best classified as Incident Disclosure. Although it includes an impact assessment, the incident narrative is the dominant focus.


reasoning: The paragraph primarily describes how the company manages cybersecurity risks arising from third-party service providers, making third-party oversight the central topic. It does not provide qualifying firm-specific or verifiable details beyond generic monitoring language and cadence.


reasoning: The paragraph primarily describes how the company's cybersecurity risk management program operates within its broader enterprise risk management structure, which is a process description rather than a board or management-role discussion. It contains only high-level ERM integration language and no cybersecurity-specific verifiable or firm-distinguishing facts.


reasoning: The paragraph primarily describes the company’s incident response process—its Incident Response Plan, escalation framework, coordination, and review—rather than board oversight or management qualifications. Although it mentions notification to management committees and the board, those references are part of explaining how the response process operates.


reasoning: The paragraph primarily provides a materiality assessment, stating that known cybersecurity threats and prior incidents have not materially affected and are not reasonably likely to materially affect the company’s operations, strategy, results, or financial condition. That makes it a Strategy Integration disclosure rather than a process, governance, or incident-description paragraph.


reasoning: This paragraph is a cross-reference directing readers to risk factor disclosures in Item 1A rather than providing substantive cybersecurity governance, management, process, third-party, incident, or strategy details itself. Under the rules, cross-references about potential material effects belong in None/Other.


reasoning: The paragraph primarily addresses cybersecurity risk arising from externally provided website hosting services, making third-party service providers the central topic. It does not describe a broader cybersecurity program or governance structure.


reasoning: The paragraph primarily provides management's materiality assessment that cybersecurity incidents have not materially affected, and are not reasonably likely to materially affect, the company's business, results, or financial condition. Its main purpose is not to describe governance or operational controls, but the business-impact conclusion and related risk-factor cross-reference.


reasoning: The paragraph is primarily a generalized warning that the company lacks resources to address cybersecurity vulnerabilities and may be harmed by them. It does not describe actual governance, management structure, risk processes, third-party oversight, an incident, or a materiality assessment, so it falls outside the substantive categories.


reasoning: The paragraph primarily describes management responsibility and organization for cybersecurity, focusing on the Director's role, experience, and management-level review involving the CFO. It does not meaningfully describe the cybersecurity program's operations beyond generic references to reviewing risks and measures.


reasoning: The paragraph primarily describes the company's cybersecurity program activities—investments in processes and technology, continuous assessment, and protection/detection/response/recovery capabilities—rather than focusing mainly on board oversight or management roles. Although it ends with an oversight chain, most of the text is about how cybersecurity risk is managed operationally.


reasoning: The paragraph primarily explains how management is organized to handle cybersecurity, focusing on the executive risk committee’s role, its membership, and the qualifications of the cybersecurity team. Although it mentions oversight activities, the emphasis is on management structure and expertise rather than board governance or the underlying cybersecurity program.


reasoning: The paragraph primarily describes how the board oversees cybersecurity by delegating oversight responsibility to a board committee and having that committee monitor management's implementation. It does not provide qualifying firm-specific or verifiable details beyond generic governance structure.


reasoning: The paragraph primarily explains how the company's incident response program operates—how incidents are reviewed, escalated, investigated, and remediated under the IRP. Although it names internal teams and roles, those details support the description of the response process rather than focusing mainly on management organization.


reasoning: This paragraph primarily describes the company’s operational reliance on IT and OT systems and general business applications, rather than explaining cybersecurity governance, management, risk processes, third-party risk, incidents, or material business impact. It provides system context but no substantive cybersecurity disclosure.


reasoning: The paragraph primarily explains how management is organized for cybersecurity, including leadership roles, reporting structure, and team responsibilities. It does not focus on board oversight or describe the cybersecurity program in enough standalone detail to make Risk Management Process the primary category.


reasoning: The paragraph primarily describes what the company's cybersecurity program does: risk assessments, employee training, use of security tools, incident response procedures, and monitoring of cybersecurity infrastructure. It does not focus on board oversight, management organization, or a specific incident.


reasoning: The paragraph primarily describes how the board oversees cybersecurity risk, including delegation through the Audit Committee, which is board-level governance. It does not provide firm-specific or verifiable cybersecurity details beyond generic oversight language.


reasoning: The paragraph primarily describes management’s organizational role in cybersecurity: the COO leads the cybersecurity strategy, reports to the CEO, and is responsible for key cyber functions. Although it mentions activities like risk assessments and incident response, those are framed as responsibilities of the COO rather than a description of the broader cybersecurity program.


reasoning: The paragraph primarily describes how management is organized to handle cybersecurity, focusing on the chief technology officer’s responsibility, experience, and reporting role with support from the information security team. Although it also mentions reporting to the audit committee and board, those governance references are secondary to the management-organization discussion.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from vendors and service providers, including oversight of third parties that host sensitive data. Although it mentions general internal safeguards, the central focus is on third-party sources of cyber risk and the controls used to address them.


reasoning: The paragraph primarily describes how the board oversees cybersecurity risk through delegation to a board committee and management reporting to that committee. It does not provide qualifying firm-specific or verifiable facts beyond generic governance structure.


reasoning: The paragraph describes an actual cybersecurity incident and subsequent regulatory response, including customer notifications and an SEC investigation tied to the breach. Its primary purpose is to explain what happened after the breach, which fits Incident Disclosure.


reasoning: The paragraph primarily describes an actual cybersecurity event involving a zero-day vulnerability, including when the company learned of it and what system was affected. Because it centers on a real incident rather than general vendor oversight practices, Incident Disclosure is the best fit.


reasoning: The paragraph primarily describes what the company’s cybersecurity risk management program does by noting its integration into enterprise risk management and listing assessment activities. Although it mentions board oversight, the central focus is on the risk management processes rather than board governance.


reasoning: The paragraph primarily describes how the Board oversees cybersecurity through expertise, documentation, and reporting mechanisms, which is a board oversight question. It does not provide qualifying firm-specific or verifiable details such as named directors, committees, dates, or concrete cybersecurity frameworks.


reasoning: The paragraph primarily describes a real cybersecurity-related incident, including what occurred and steps taken afterward, which makes Incident Disclosure the best fit. Although it includes remediation measures, those are framed as responses to the 2019 event rather than a general program description.


reasoning: The paragraph primarily describes cybersecurity program activities: using external service providers and experts for protection, maturity assessments, audits, and independent reviews of controls. Although third parties are central to how the program operates, the focus is on internal cybersecurity processes rather than oversight of vendor risk.


reasoning: The paragraph primarily explains how the company addresses cybersecurity risks arising from vendors, service providers, and other external parties, making third-party risk the central topic. It does not provide concrete practices, named programs, roles, committees, or verifiable details beyond generic risk-management language.


reasoning: The paragraph primarily provides a materiality-focused assessment that the company is not aware of any material cybersecurity incidents affecting it, which fits Strategy Integration under the SEC materiality rule. The remainder is largely generic risk language and a risk-factor cross-reference rather than a description of governance or operational cybersecurity processes.


reasoning: The paragraph describes an actual cybersecurity event, including its nature (ransomware), effects, and remediation, so it primarily answers what happened in a real incident. It is firm-specific because it contains company-unique incident details, but lacks clearly externally verifiable anchors such as a specific date, named firm, or named system/product.


reasoning: The paragraph primarily addresses how the company interacts with third-party vendors on cybersecurity matters, making vendor-related risk oversight the central topic. It provides only generic statements about collaboration cadence and contains no qualifying firm-specific or verifiable facts.


reasoning: This paragraph primarily explains how management is organized to handle cybersecurity by identifying the responsible management team leader, his title, reporting line, and qualifications. It is not mainly about board oversight or cybersecurity processes, but about who in management is responsible and why he is qualified.


reasoning: This paragraph primarily describes who in management is responsible for cybersecurity and why that person is qualified, focusing on leadership roles, reporting, and experience rather than the mechanics of the cybersecurity program itself. The specific claim that the CTO has over 26 years of IT experience makes the paragraph quantified and externally verifiable.


reasoning: The paragraph primarily describes how the Audit Committee and full Board oversee cybersecurity, including management reporting and briefings to the Board. While it mentions management presenters, the main focus is the board-level oversight structure and information flow.


reasoning: The paragraph primarily describes an activity the company undertakes—monitoring cybersecurity and privacy regulatory developments to maintain compliance—which fits the company's cyber risk management process. It does not focus on board oversight, management structure, third-party risk, or a specific incident.


reasoning: The paragraph primarily provides a materiality-oriented assessment of how cybersecurity threats could affect the business and states that the company has not had a cybersecurity incident to date, which fits Strategy Integration under the materiality rule. The remaining discussion is largely generic risk and precautionary language rather than a detailed process, governance, or incident description.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from vendors, service providers, and other third parties, making third-party risk the central topic. It includes cybersecurity-specific practices such as evaluating third-party security posture through a security scoring system and ongoing monitoring, but does not provide firm-unique or externally verifiable facts.


reasoning: The paragraph primarily states management's conclusion about whether cybersecurity threats have materially affected or are reasonably likely to materially affect the company's business strategy, results of operations, or financial condition, which is a strategy/materiality assessment. The remaining language is generic risk caution and cross-reference text rather than process, governance, or incident detail.


reasoning: This paragraph only states a general commitment to protect IT assets and data and lists categories of information involved. It does not describe any actual governance structure, management role, cybersecurity process, third-party oversight, incident, or business-impact assessment.


reasoning: The paragraph primarily assesses the actual and potential business impact of cybersecurity threats, including stating that the company has not experienced significant impacts to date and that future attacks could materially affect financial results. That makes it a business-impact/materiality statement rather than a description of governance, management, or operational processes.


reasoning: The paragraph primarily describes the existence and purpose of the company's cybersecurity risk management processes—identifying, assessing, and managing risks to systems and data—so it fits Risk Management Process. It does not provide concrete cybersecurity practices, tools, frameworks, roles, or verifiable details, making it generic boilerplate.


reasoning: The paragraph primarily describes management responsibility and qualifications for cybersecurity, focusing on who is accountable for the program and why they are qualified. It does not primarily describe board oversight or the cybersecurity program’s operational processes.


reasoning: The paragraph primarily addresses potential business and financial implications of cybersecurity, especially through its statement that the company maintains cybersecurity insurance and that losses may not be fully insured. Although it also includes generic cautionary language and a risk-factor cross-reference, the business-impact framing is the most applicable category.


reasoning: This paragraph primarily describes management's cybersecurity organization and qualifications, specifically the CISO and the Security Governance Committee. Its focus is on who fills these roles and the CISO's experience rather than on board oversight or operational cybersecurity processes.


reasoning: The paragraph primarily describes how the board oversees cybersecurity through delegation to a board committee, which is a governance structure disclosure. It contains only generic roles and broad oversight language without firm-unique or verifiable cybersecurity details.


reasoning: The paragraph primarily describes the oversight structure for cybersecurity, led by a board-level committee and related governance bodies, which makes it Board Governance. Its named program and named committees are company-specific details, but there are no hard quantified or independently verifiable facts.


reasoning: The paragraph discusses general information technology investments, strategic plan implementation, customer experience, compliance, and growth, but it does not describe cybersecurity governance, management, processes, third-party risk, incidents, or a cybersecurity-specific business impact assessment. Because it lacks substantive cybersecurity content, it fits None/Other.


reasoning: The paragraph primarily describes the company's cybersecurity program objective and its integration into a broader risk management framework, which is about what the program does rather than board or management structure. Its reference to protecting the confidentiality, integrity, and availability of systems and information reflects cybersecurity-specific terminology, but it provides no firm-unique or externally verifiable facts.


reasoning: The paragraph primarily describes a real cybersecurity incident—its timing, nature, response, and potential consequences—so it is best categorized as Incident Disclosure. Although it includes materiality conclusions, the incident narrative dominates the paragraph.


reasoning: This sentence is a general statement about the cyber threat landscape and does not describe the board's oversight, management's role, a cybersecurity process, third-party risk management, a specific incident, or business impact assessment. It is therefore non-substantive background language rather than a substantive cybersecurity disclosure.


reasoning: The paragraph is primarily about how the company manages cybersecurity risk from suppliers, including contractual requirements, audits, assessments, and remediation expectations. Although it includes specific cybersecurity practices and references to standards, it does not provide firm-unique roles, committees, dates, numbers, or other company-distinguishing verifiable details.


reasoning: The paragraph primarily describes what the company's cybersecurity program does: incident response planning, coordination during incidents, data protection controls, and continuity/recovery measures. Although vendors and external parties are mentioned, they are described as components of the broader response process rather than the central topic of third-party risk management.


reasoning: The paragraph primarily explains how the board oversees cybersecurity, including delegation to board committees and management reporting to the board, which is classic board governance content. Although it mentions management responsibilities, those details are subordinate to the oversight structure.


reasoning: The paragraph primarily gives a materiality assessment that cybersecurity incidents or threats have not materially impacted the company’s business, financial condition, or results of operations, which fits Strategy Integration. The rest is general cautionary language and a cross-reference to risk factors rather than substantive process, governance, or incident details.


reasoning: The paragraph primarily describes the board-level oversight structure for cybersecurity, including committee oversight and reporting flows from management to the board. Although it mentions management responsibilities and the CSO, those details mainly support the governance chain rather than describing the cybersecurity program itself.


reasoning: The paragraph primarily describes the company's incident response plan—its team, lifecycle, documentation templates, timelines, and communications—which is a cybersecurity process description. Although it also includes a negative materiality statement and discusses a physical break-in, those points are secondary to the discussion of how the incident response program operates.


reasoning: The paragraph primarily addresses how cybersecurity relates to financial risk by stating that the company maintains cybersecurity insurance to manage financial statement risk from cyber-attacks. It does not describe governance, management structure, or operational security processes.


reasoning: The paragraph primarily describes the components of the company’s cybersecurity program—monitoring, detection, scanning, training, simulations, incident response, and testing—so it is about what the program does. Although it uses cybersecurity-specific terminology, it does not include firm-unique or externally verifiable facts such as named personnel, products, firms, dates, or quantities.


reasoning: The paragraph primarily provides a materiality assessment, stating that no cybersecurity threats or incidents identified in 2023 materially affected or are reasonably likely to materially affect the company’s business strategy, results of operations, or financial condition. That makes it Strategy Integration under the materiality rule, rather than incident disclosure or risk management process.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from vendors and third-party systems, making third-party risk the central topic. It describes vendor cyber risk assessments and breach-notification expectations rather than broader internal cybersecurity operations.


reasoning: The paragraph primarily describes how the company evaluates cybersecurity-related risks posed by vendors before entering into business relationships, making third-party risk the central topic. It includes cybersecurity-specific concepts such as vendor assessments tied to data security, availability, and confidentiality, but no firm-unique or externally verifiable facts.


reasoning: The paragraph primarily describes a real cybersecurity incident, including when it occurred, what was affected, and remediation steps taken afterward. Although it also mentions post-incident security changes and forward-looking risk, the incident itself is the central focus.


reasoning: The paragraph primarily describes how cybersecurity incident information and materiality determinations flow to the board, including when the board is briefed and how oversight is triggered. Although it mentions disclosure obligations, the main focus is the governance structure connecting the Critical Threat Committee and the Board.


reasoning: The paragraph primarily describes what the company's cybersecurity program does: assessing cyber threats through enterprise risk management, identifying and prioritizing risks, mitigating them, escalating issues, and training employees. Although third parties are mentioned, they are ancillary support to the overall risk management process rather than the central focus.


reasoning: The paragraph primarily describes how the board oversees cybersecurity, specifically through a board committee and management information flow supporting that oversight. It does not meaningfully describe management qualifications or the cybersecurity program's activities.


reasoning: The paragraph primarily describes components of the company's cybersecurity program and how it operates, including threat intelligence, patch management, and security monitoring. It is about operational security activities rather than governance, management structure, or third-party oversight as the central topic.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity threats have not materially affected the company's business strategy, results of operations, or financial condition. The cross-reference to Item 1A is secondary and does not change the paragraph's main purpose.


reasoning: The paragraph primarily provides a materiality assessment, stating that known cybersecurity threats and prior incidents have not materially affected and are not reasonably likely to materially affect the company’s business, operations, results, or financial condition. The remaining language is cautionary and cross-referential rather than describing governance, management, or operational cybersecurity processes in substance.


reasoning: The paragraph primarily describes how cybersecurity information flows upward for oversight, including escalation from the CISO to the Audit Committee and Board, which is a board-governance function. Its most specific qualifying detail is the presence of a CISO role, making it firm-specific rather than merely domain-adapted.


reasoning: The paragraph primarily provides a materiality assessment, stating that the company has not experienced material cybersecurity incidents and that related expenses were immaterial, which fits Strategy Integration under the materiality rule. The remaining text is a cross-reference to risk factors rather than a description of governance, management, or cybersecurity processes.


reasoning: The paragraph primarily describes how the board-level Audit Committee oversees cybersecurity through reports from management and incident updates, which is board oversight structure. It contains no qualifying firm-specific or externally verifiable facts beyond generic governance language.


reasoning: The paragraph primarily describes what the company's cybersecurity program does: policies and processes for assessing, identifying, managing, and responding to cybersecurity risks and incidents. Although it mentions third-party service providers and assessors, those references are components of the broader cybersecurity risk management program rather than the central topic of vendor oversight.


reasoning: The paragraph primarily describes the components and activities of the company's cybersecurity program, including risk assessments, security controls, training, incident response, and third-party risk management. Although it lacks firm-unique or verifiable details, it uses cybersecurity-specific concepts such as data leakage, unauthorized access, and controls for AI/GenAI-related risks.


reasoning: The paragraph primarily describes the company’s cybersecurity protective measures—access controls, encryption, monitoring, information protection, and maintenance—which are elements of the cybersecurity program’s operations. It does not focus on board oversight, management roles, vendors, or a specific incident.


reasoning: This paragraph is a cautionary disclaimer about the possible ineffectiveness of the company's cybersecurity program and primarily points readers to a risk factor cross-reference, rather than describing governance, management, processes, third-party risk, strategy impact, or an actual incident.


reasoning: This paragraph is primarily a disclaimer that the company cannot prevent all cybersecurity risks and a cross-reference to the Risk Factors section for potential impacts. It does not substantively describe governance, management, processes, third-party risk, an actual incident, or a materiality assessment.


reasoning: The paragraph primarily describes the board’s oversight of cybersecurity, including management’s reporting and escalation of material cyber risks to the Board of Directors. Although it includes management role details, those details mainly support the governance chain and information flow to the board.


reasoning: The paragraph primarily describes how management reports cybersecurity matters to the Board and what oversight topics are covered in those briefings, which is board oversight structure. Although it includes cybersecurity subject matter, it does not provide qualifying firm-specific or externally verifiable facts.