content_category: None/Other

category_confidence: high

specificity_confidence: high

reasoning: This paragraph is purely a cross-reference directing readers to Item 1A for discussions of cybersecurity risks and contains no substantive cybersecurity disclosure regarding governance, management, processes, or incidents. As a cross-reference with no domain terminology, firm-specific details, or verifiable claims, it qualifies as None/Other with Generic Boilerplate specificity.

provider: moonshotai

stage: benchmark


reasoning: This paragraph is a pure cross-reference incorporation by reference to Item 7 (MD&A), containing no substantive description of cybersecurity governance, management, processes, or risks. As a None/Other paragraph with no domain terms, firm-specific details, or verifiable facts, it receives Generic Boilerplate specificity.


reasoning: This paragraph is a pure cross-reference to Item 1A Risk Factors and contains no substantive disclosure about cybersecurity governance, management, processes, or incidents. As a cross-reference with no specific facts, domain terminology, or verifiable claims, it is classified as None/Other with Generic Boilerplate specificity.


reasoning: The paragraph consists entirely of forward-looking disclaimers about cybersecurity program limitations and a cross-reference to Item 1A Risk Factors, containing no substantive disclosure about governance structures, management organization, risk processes, or actual incidents. It lacks specific domain terminology (only generic references to 'cybersecurity program' and 'measures'), firm-unique details, and verifiable facts, qualifying as generic boilerplate.


content_category: Strategy Integration

reasoning: The paragraph states a negative materiality assessment ('not aware of any cybersecurity incidents that have materially affected...'), which per Rule 5 is a Strategy Integration conclusion about business/financial impact. For specificity, the language is generic SEC boilerplate containing no verifiable facts (negative assertions are not externally verifiable), no firm-specific details (no named roles, team sizes, or unique programs), and no domain-adapted terminology demonstrating cybersecurity expertise beyond standard ERM vocabulary.


content_category: Board Governance

fact: Senior Director of Governance & Information Security (Senior Director, GIS)

reasoning: The paragraph describes the Board's delegation of cybersecurity oversight to the Audit Committee and the information flow from management to the Board, answering how the board oversees cybersecurity (BG). The specificity is elevated to Firm-Specific by the specific title 'Senior Director of Governance & Information Security,' which is a director-level role with a security qualifier that distinguishes this company's organizational structure from others.


reasoning: This paragraph states a conclusion about whether cybersecurity incidents have materially impacted or are reasonably likely to materially impact business outcomes, which falls squarely under Strategy Integration per Rule 5 (SI materiality rule). The specificity remains Generic Boilerplate because the statement is a non-verifiable negative assertion about the absence of material incidents (explicitly excluded from Level 4 per the instructions), contains no domain-specific cybersecurity terminology (fails the ERM test), and includes no firm-specific details such as named roles or organizational structure.


reasoning: The paragraph describes oversight activities—reviewing information security examination reports from regulatory agencies and monitoring emerging risk issues—which are characteristic of board or board committee governance responsibilities in a banking context. It contains no specific facts, named frameworks, dates, or quantifiable details, consisting only of generic oversight duties that could apply to any regulated financial institution.


fact: cybersecurity dashboard featuring key metrics

fact: threat detection rates

fact: response times

fact: External penetration tests

fact: process audits

reasoning: The paragraph describes the Audit Committee's oversight role, information flow to the board (dashboards, briefings, third-party reports), and briefing cadence, fitting Board Governance. Specificity is Domain-Adapted due to cybersecurity-specific metrics (threat detection rates, response times) and practices (external penetration tests) that demonstrate domain expertise beyond generic risk management, though the 'Director of Information Technology' lacks a security qualifier and no firm-specific details or verifiable facts are present.


reasoning: The paragraph describes the Trust as a passive grantor trust with no active operations, customers, or data, serving as an explanation for the absence of substantive cybersecurity risks or programs to disclose. Under Rule 6, no-operations companies with no cybersecurity program are classified as None/Other, which by definition receives Generic Boilerplate specificity.


fact: Vice-President of Information Technology (VPIT)

fact: Director - Information Security (DIS)

reasoning: The paragraph answers how the Board oversees cybersecurity by describing Audit Committee reporting and the flow of information from management to Board members via presentations, which is classic Board Governance content. The specificity is Firm-Specific because it identifies distinct leadership roles—VP of Information Technology and Director of Information Security—that are unique to this company's organizational structure.


reasoning: The paragraph states a materiality conclusion regarding the absence of cybersecurity incidents affecting business outcomes (backward-looking 'have materially affected' and forward-looking 'reasonably likely to materially affect'), which falls under Strategy Integration per Rule 5. It contains no specific facts, verifiable claims, or domain-adapted terminology—only a generic negative assertion and a cross-reference to Risk Factors—resulting in Generic Boilerplate specificity.


reasoning: The paragraph answers how the Board oversees cybersecurity by describing the Board's role in overseeing the ERM program, receiving risk assessment results from Management, maintaining an escalation process for incidents, and engaging third-party experts for testing. This governance-chain description defaults to Board Governance under Rule 1. The language consists entirely of generic governance and oversight terminology ('Enterprise Risk Management program,' 'escalation process,' 'kept apprised') that any ERM professional could use, with no domain-specific cybersecurity practices, firm-unique organizational details, or quantifiable facts present.


content_category: Third-Party Risk

reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers through its TPRM program, including due diligence, contractual reviews, and ongoing monitoring. Specificity remains at Level 1 because the description uses high-level process language ('cybersecurity due diligence,' 'ongoing monitoring') that any ERM professional could apply to third-party risk without demonstrating cybersecurity domain expertise (e.g., specific assessment criteria like SOC 2 reviews or encryption requirements) and contains no firm-specific organizational details or verifiable facts.


reasoning: The paragraph provides general business context (handling personal information) and describes the threat landscape (being targets of cyber threats from external and internal actors) but does not answer any of the six substantive questions about governance, management structure, risk management processes, third-party oversight, specific incidents, or strategic/financial impact. It contains no cybersecurity domain terminology beyond generic references to 'cyber threats,' no firm-specific organizational details, and no quantifiable or verifiable facts.


reasoning: The paragraph describes general business operations and IT infrastructure (complex systems, third-party applications, data types stored) as background context but does not answer any of the six substantive cybersecurity questions regarding governance, management organization, risk processes, vendor oversight, incidents, or materiality. As None/Other content, it receives Generic Boilerplate specificity.


content_category: Risk Management Process

fact: security incident and event manager interface

fact: behavioral analytics

fact: logs of firewalls

fact: authentication attempts

fact: anti-malware

fact: attempted intrusions

fact: external and internal penetration testing

fact: system security assessments

reasoning: The paragraph describes the company's cybersecurity activities, tools, and testing procedures (SIEM interface, behavioral analytics, penetration testing), making it Risk Management Process. It demonstrates domain expertise through specific technical terminology (firewall logs, authentication monitoring, internal vs. external penetration testing) that would not appear in generic ERM language, qualifying as Domain-Adapted.


reasoning: The paragraph states a backward-looking conclusion that cybersecurity breaches have not materially affected the company's business strategy, results of operations, or financial condition, which per Rule 5 qualifies as Strategy Integration. The text contains no firm-specific details, domain-adapted cybersecurity terminology (using only generic phrases like 'disaster recovery systems' and 'information systems' that fail the ERM test), or quantifiable/verifiable facts.


reasoning: The paragraph describes business operations (handling data and funds) and the general threat environment but does not answer any of the six substantive questions—it does not address board oversight, management organization, specific risk management activities, third-party oversight, actual incidents, or materiality assessments. It contains no firm-specific details, quantified metrics, or domain-specific terminology beyond generic references to 'malicious tactics, code and viruses,' resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes the company's incident detection and analysis procedures, including automated monitoring and investigation processes, which answers what the cybersecurity program does (Risk Management Process). The description uses generic process language ('automated event-detection notifications,' 'security operations team,' 'incident response team') that does not demonstrate specific cybersecurity domain expertise beyond standard risk management terminology, contains no firm-specific organizational details, and offers no quantifiable or verifiable facts, resulting in Generic Boilerplate specificity.


fact: CIO (Chief Information Officer) role with cybersecurity portfolio

fact: CIO reports to General Counsel, Chief Accounting Officer, Chief Financial Officer, Chief Executive Officer, and Audit Committee

reasoning: The paragraph describes the Board's oversight structure, delegation to the Audit Committee, and the information flow from management (specifically the CIO) to the Board, answering how the board oversees cybersecurity. Specificity is Firm-Specific due to the identification of the CIO as the cybersecurity leadership role and the detailed reporting lines to specific C-suite executives and the Audit Committee.


fact: forensic investigations

fact: incident response management

reasoning: The paragraph describes the company's incident response procedures and activities (containment, remediation, recovery, and engaging third parties for forensic investigations), which answers what the cybersecurity program does. The reference to 'forensic investigations' and 'incident response management' demonstrates cybersecurity domain expertise (ERM professionals would not naturally specify forensics), but contains no firm-specific organizational details or quantifiable/verifiable facts.


reasoning: The paragraph contains the negative assertion 'we have not experienced any material cyber threats or incidents to date,' which Rule 5 explicitly classifies as Strategy Integration (backward-looking materiality assessment). While the paragraph includes forward-looking speculation and generic program references, the materiality assessment is the primary substantive cybersecurity disclosure. For specificity, the paragraph contains only generic business risk language ('cyberattackers,' 'unauthorized access,' 'continuous improvement') without domain-specific cybersecurity practices, firm-specific organizational details, or verifiable quantitative claims, resulting in Generic Boilerplate classification.


fact: CISO (Chief Information Security Officer) - VP-level cybersecurity leadership role

fact: Cybersecurity Executive Steering Body - named management committee for cybersecurity oversight

reasoning: The paragraph primarily describes the governance chain and information flow regarding how cybersecurity risks are elevated from management to the Board of Directors and Audit Committee, which is Board Governance. It achieves Firm-Specific specificity by identifying the CISO leadership role and the specifically named 'Cybersecurity Executive Steering Body' management committee, both of which distinguish this company's oversight structure from generic governance descriptions.


reasoning: The paragraph primarily answers whether cybersecurity has affected the business by stating a backward-looking materiality conclusion that past incidents 'have not materially affected the Company or our financial position, results of operations and/or cash flows,' which is the defining characteristic of Strategy Integration under Rule 5. It contains no specific facts—no quantified metrics, named standards, specific practices, organizational details, or verifiable claims appear anywhere in the text; the references to 'preventative actions,' 'internal controls,' and 'resiliency' constitute generic risk management language that fails the ERM test for domain expertise.


fact: ransomware

fact: malware

fact: phishing attacks

fact: social engineering

fact: operational technology

fact: detective surveillance controls

fact: virus and intrusion software

reasoning: The paragraph describes the company's cybersecurity program activities, including risk assessment, threat identification, technical controls, employee training, and incident response procedures, which directly answers what the program does (RMP). Specificity is Domain-Adapted because the text uses cybersecurity domain terminology including specific threat types (ransomware, malware, phishing, social engineering), architectural concepts (layered technical protective capabilities, detective surveillance controls), and operational technology (OT), demonstrating expertise beyond generic risk management language.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from vendors and partners through vetting and monitoring, placing it in Third-Party Risk. However, it employs generic risk management terminology ('vetting,' 'monitoring,' 'security standards') without specific cybersecurity domain expertise (e.g., SOC 2 reviews, encryption requirements), firm-specific structural details, or quantifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers whether cybersecurity has affected business outcomes by stating that no incidents have had a material adverse effect, which under Rule 5 qualifies as Strategy Integration. Specificity is Level 1 because the paragraph contains no domain-adapted terminology (failing the ERM test), no firm-specific organizational details, and no quantifiable or verifiable facts—only generic assertions about insurance coverage and speculative forward-looking statements.


content_category: Management Role

fact: Enterprise & Technology Security (E&TS) organization

fact: dedicated Chief Information Security Officer (CISO)

fact: CISO manages the CSIRT

fact: CISO manages the Product Security Incident Response Team (PSIRT)

fact: Business Information Security Officers (BISO)

fact: BISOs coordinate with the Office of the CISO

reasoning: The paragraph primarily describes IBM's management organizational structure for cybersecurity, detailing specific roles (CISO, BISOs), teams (CSIRT, PSIRT), and reporting relationships (Office of the CISO), which is characteristic of Management Role. Specificity is Firm-Specific (Level 3) due to the disclosure of unique organizational names and role titles (E&TS, PSIRT, BISOs) that distinguish IBM's structure; no quantifiable or externally verifiable facts (e.g., certifications, headcount, dates) are present to reach Level 4.


content_category: Incident Disclosure

fact: June 13, 2023 (date of disclosed IT security incident)

fact: nine days (duration to resume normal global business operations)

fact: $80 million to $85 million (estimated lost revenue from incident)

fact: $35 million to $40 million (estimated impact on operating earnings from incident)

reasoning: The paragraph primarily answers what happened in a specific cybersecurity incident, providing the exact date (June 13, 2023), response actions, timeline for recovery (nine days), and quantified financial impacts ($80-85M revenue loss, $35-40M earnings impact), making it Incident Disclosure at Level 4 due to multiple externally verifiable hard facts.


fact: Head of Cyber Security (specific leadership role/title)

reasoning: The paragraph primarily describes the Board's delegation of cybersecurity oversight to the Audit Committee and the information flow (quarterly reports, findings) from management to the Board, which is characteristic of Board Governance. The specificity is Firm-Specific because it identifies the specific title 'Head of Cyber Security,' which distinguishes this company's organizational structure from others, rather than using generic terms like 'management' or 'IT department.'


fact: CSO (Chief Security Officer) role

reasoning: The paragraph primarily describes operational cybersecurity activities (employee training, phishing tests, incident identification/containment/remediation tools) which are risk management processes. Under the person-removal test, substantive program descriptions remain after removing references to the team and CSO. Specificity is Firm-Specific due to the mention of the CSO, a VP-level cybersecurity leadership role that distinguishes this company's organizational structure.


reasoning: This paragraph is purely a cross-reference directing readers to Item 1A Risk Factors and contains no substantive cybersecurity disclosure regarding governance, management, processes, or incidents. As a None/Other paragraph per Rule 6 and the explicit cross-reference example in Rule 5, it receives Generic Boilerplate specificity.


fact: In April 2022 (specific date of cybersecurity incident)

fact: exfiltration of certain confidential company and patient information (specific nature of data breach)

reasoning: The paragraph primarily answers what happened in a specific cybersecurity incident (April 2022 disruption and data exfiltration), including timeline, scope, and remediation costs, making it Incident Disclosure per Rule 4. Specificity is Level 4 because the paragraph contains the externally verifiable date 'April 2022' tied to a real, publicly reported incident.


reasoning: The paragraph primarily answers how third-party cyber risks are managed, describing vendor vetting, approval, and inventory processes (Third-Party Risk). While it includes a concluding materiality assessment sentence, the majority of content focuses on vendor oversight. The text contains no specific cybersecurity domain terminology (fails the ERM test), no firm-specific organizational details (e.g., named committees, leadership titles), and no quantifiable or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers, describing the commencement of a vendor third-party risk management program (TP). It contains no specific domain terminology (fails ERM test), firm-specific details (no roles, committees, or named programs), or verifiable facts (no numbers, dates, or certifications), consisting only of generic forward-looking statements about enhancing monitoring and managing risks.


reasoning: The paragraph provides a backward-looking materiality assessment stating that no cybersecurity challenges have materially impaired business strategy, operations, or financial standing, which falls under Strategy Integration per Rule 5 (negative assertion of material impact). The text contains no verifiable facts (negative assertions about absence are not externally verifiable), no firm-specific details (no roles, committees, or organizational specifics), and no domain-adapted terminology that would fail the ERM test, resulting in Generic Boilerplate specificity.


fact: threat intelligence

fact: prevention, detection, mitigation, and remediation (of cybersecurity risks)

fact: security tools deployed in the IT environment

reasoning: The paragraph describes the operational activities of the cybersecurity program (monitoring, prevention, detection, mitigation, remediation) and the tools/sources used (threat intelligence, security tools), placing it in Risk Management Process rather than Management Role, which would require specific leadership titles, qualifications, or organizational structure. Specificity is Domain-Adapted due to cybersecurity-specific terminology including 'threat intelligence' and the standard incident response lifecycle phases ('prevention, detection, mitigation, and remediation'), which demonstrate domain expertise beyond generic risk management language.


fact: endpoint protection

fact: two-factor authentication (2FA)

fact: remote access protocols

fact: enhanced encryption

fact: real-time threat monitoring

fact: formal policy related to employees that access corporate systems from personal devices

fact: migration of business-critical systems including ERP system to Tier-1 cloud service providers

fact: simplification of infrastructure to minimize servers

fact: regular monitoring of outside threats

reasoning: The paragraph describes specific cybersecurity activities and technical controls (endpoint protection, 2FA, encryption, threat monitoring, BYOD policies, cloud migration) that constitute the company's risk management program, making it RMP. While the opening sentence is generic ERM language, the subsequent details demonstrate cybersecurity domain expertise through specific technical practices and architectural concepts (e.g., 2FA, endpoint protection, ERP migration) that would not appear in non-cybersecurity risk disclosures, satisfying Level 2 specificity. No quantifiable metrics, named individuals, or firm-unique organizational details are present to support higher specificity levels.


reasoning: The paragraph states a negative conclusion regarding the absence of material cybersecurity incidents during the reporting period (year ended December 31, 2024), which under Rule 5 constitutes Strategy Integration. It contains no domain-specific cybersecurity practices, firm-unique organizational details, or externally verifiable facts—only a self-reported negative assertion and forward-looking disclaimer—resulting in Generic Boilerplate specificity.


fact: Cybersecurity Committee (named board committee overseeing cybersecurity)

reasoning: The paragraph primarily answers how the board oversees cybersecurity by disclosing a specific 'Cybersecurity Committee' that actively reviews the company's programs, which is firm-specific governance structure (Rule 1). While it contains a backward-looking materiality assessment (Strategy Integration), the board oversight description is the dominant content. The named committee provides a firm-specific fact (Level 3); there are no quantified, verifiable claims (Level 4) such as dates, headcounts, or certifications, and the language otherwise consists of generic ERM framework descriptions.


fact: CISO (cybersecurity leadership role at VP level or above)

fact: Chief Risk Officer (assigned responsibility for assessing and managing cybersecurity risks)

fact: Chief Information and Technology Officer (cybersecurity leadership role at VP level or above)

reasoning: The paragraph identifies the specific executive and management roles (CISO, Chief Risk Officer, and Chief Information and Technology Officer) responsible for cybersecurity oversight, constituting firm-specific organizational structure. Under the person-removal test, removing these titles collapses the paragraph, confirming it describes management's organizational role rather than risk management processes.


fact: CISO (Chief Information Security Officer)

fact: CIO (Chief Information Officer)

fact: Transportation Security Administration (TSA) compliance

reasoning: The paragraph answers how the Board oversees cybersecurity by describing the governance chain (Board → Audit Committee → CISO/CIO), briefing frequencies, and escalation protocols, which is core Board Governance content. Specificity is Firm-Specific due to the identification of CISO and CIO leadership roles and the specific regulatory context of TSA compliance, which distinguishes this energy company's program from generic disclosures.


fact: phishing attempts

fact: ransomware

fact: malware

fact: data leakage

reasoning: The paragraph primarily answers whether cybersecurity has materially affected the business via the negative assertion that the company is 'not aware of any material cybersecurity incidents,' which Rule 5 explicitly classifies as Strategy Integration. Specificity is Domain-Adapted because the paragraph references specific cybersecurity threat vectors (phishing, ransomware, malware, data leakage) that demonstrate domain expertise and would not naturally appear in generic enterprise risk management language, but contains no firm-specific details about Bristol Myers Squibb's actual cybersecurity posture or any externally verifiable quantitative claims.


fact: Vice President, Information Systems and Technology (VP-level IT leadership role)

reasoning: The paragraph describes the Board and Audit Committee's oversight of cybersecurity through management reporting channels, making it Board Governance. Specificity is Firm-Specific due to the identification of the particular VP-level leadership role (Vice President, Information Systems and Technology) responsible for delivering cybersecurity reports to the Board.


reasoning: The paragraph primarily answers whether cybersecurity has materially affected the business, providing the Item 106(b)(2) negative materiality assertion ('not aware of any cybersecurity threats that have materially affected...'). This is a Strategy Integration assessment per Rule 5. For specificity, the paragraph contains only generic language ('information security plan,' 'information technology infrastructure,' 'cyber-attacks') without domain-specific practices, firm-unique details, or verifiable facts, resulting in Generic Boilerplate.


reasoning: The paragraph answers what the cybersecurity program does at the highest level (protecting IT assets, stakeholder data, and intellectual property), but provides no specific processes, tools, or governance mechanisms. It contains no firm-specific details, domain-adapted terminology describing how protection is achieved, or verifiable facts, consisting entirely of generic commitment language applicable to any company.


fact: real-time security scoring of supplier technology services

fact: threat intelligence

fact: financial intelligence

fact: geopolitical risk intelligence

fact: negotiate appropriate provisions with respect to cybersecurity in our contracts

reasoning: The paragraph centrally addresses vendor/supplier cybersecurity oversight through supply chain risk management practices, fitting the Third-Party Risk category. It demonstrates cybersecurity domain expertise (Level 2) by referencing specific technical practices—real-time security scoring, continuous threat intelligence monitoring, and distinct intelligence categories (threat, financial, geopolitical)—that require specialized cybersecurity knowledge beyond generic enterprise risk management terminology.


fact: network and perimeter defense

fact: cloud security

fact: endpoint protection

fact: identity management

fact: network segmentation

fact: cybersecurity threat intelligence

reasoning: The paragraph describes the company's cybersecurity program activities and technical safeguards (network defense, endpoint protection, threat intelligence), which directly answers what the program does, placing it in Risk Management Process. The text demonstrates domain expertise through specific cybersecurity architectural concepts (network segmentation, identity management, endpoint protection) and practices that would not appear in general enterprise risk management discourse, warranting a Domain-Adapted specificity level, though it lacks firm-unique organizational details or verifiable metrics.


reasoning: The paragraph's central topic is oversight of third-party service providers, describing risk and compliance assessments for vendors accessing information assets, which falls under Third-Party Risk. However, the language is generic—stating that assessments are conducted without specifying methodologies, standards (e.g., SOC 2), or technical requirements—failing the ERM test for domain expertise and containing no firm-specific or verifiable details.


fact: Enterprise Cybersecurity Management Review Group (named management-level committee)

fact: Chief Information Security Officer (VP-level cybersecurity leadership role)

fact: Escalation process from MRG to Audit Committee and Board for material incidents

reasoning: The paragraph primarily describes the organizational structure, membership, and governance responsibilities of the Enterprise Cybersecurity Management Review Group, a management-level steering committee, including its interface with the CISO and escalation protocols to the Board. Specificity is driven by the named committee and the CISO title, though the paragraph lacks quantifiable metrics or dates that would support Level 4.


reasoning: The paragraph exclusively addresses how the company manages cybersecurity risks from its third-party service providers, including due diligence procedures, security risk assessments, and contractual security requirements, which falls squarely under Third-Party Risk. The language consists entirely of generic process descriptions ('preliminary assessment,' 'enhanced due diligence,' 'security requirements and controls') that any enterprise risk management professional could write without cybersecurity domain expertise; it lacks specific technical controls, named standards (e.g., SOC 2), firm-unique details, or quantified data, resulting in Generic Boilerplate specificity.


category_confidence: medium

reasoning: The paragraph primarily addresses the business and financial implications of cybersecurity risks, including a negative materiality assertion ('we have not...experienced a cybersecurity threat or incident that resulted in a material adverse impact') and hypothetical costs of future incidents (inventory write-downs, litigation, reputational harm). While it briefly mentions detection efforts, the dominant frame is strategic impact and materiality assessment. The paragraph lacks specific facts, verifiable claims, or domain-specific terminology beyond generic references to 'cyberattacks' and 'unauthorized attempts,' consisting instead of boilerplate risk disclosures and forward-looking speculation.


fact: data security controls

fact: user data

specificity_confidence: medium

reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers through assessments and contractual requirements, making it Third-Party Risk. It demonstrates domain expertise (Level 2) by specifying the assessment of 'data security controls' and detailed data handling practices ('collection, use, sharing and retention of user data') that distinguish cybersecurity vendor management from generic supplier risk management.


fact: 24/7 security operations center

fact: insider threat protection program leveraging cross-function information sharing

fact: security awareness program training employees at least annually

reasoning: The paragraph describes specific cybersecurity activities and operational capabilities (24/7 SOC, insider threat program, awareness training) rather than governance structure or management roles, placing it in Risk Management Process. Specificity is Firm-Specific due to concrete organizational claims including 24/7 operations, specific program descriptions (insider threat protection with cross-functional information sharing), and defined training cadences (at least annually).


fact: March 2021 (date of incident)

fact: $2.4 million (incremental one-time costs incurred)

fact: year ended December 31, 2021 (reporting period for costs)

fact: leading forensic information technology firms (specific type of third-party engaged)

reasoning: This paragraph describes a specific historical cybersecurity incident, including the timing (March 2021), investigation process, operational disruptions, and remediation costs, fitting Incident Disclosure. The specificity is Quantified-Verifiable due to the inclusion of a precise dollar amount ($2.4 million) and specific date (March 2021) tied to the event, both of which are externally verifiable facts.


fact: Chief Information Officer (CIO)

fact: Chief Information Security Officer (CISO)

fact: CIO is a member of the Company's Executive Committee

reasoning: Paragraph describes management's organizational structure for cybersecurity, identifying the specific C-level officers (CIO and CISO) responsible for risk management and their placement on the Executive Committee. Specificity is Firm-Specific because it names VP-level leadership roles (CIO, CISO) and specifies reporting lines/organizational structure (CIO's membership on the Executive Committee) that distinguish this company's governance from others.


reasoning: This paragraph provides a backward-looking materiality assessment stating that cyberattacks have not caused material impacts to the business, which falls under Strategy Integration per Rule 5. The language is entirely generic, containing no domain-specific practices, firm-specific organizational details, or verifiable quantitative claims; the negative assertion of 'no material impacts' is a self-reported conclusion that cannot be externally verified.


fact: defense in depth strategy

fact: data loss prevention technology

fact: advanced transport layer security encryption

fact: phishing, malware and social engineering testing

reasoning: The paragraph describes the operational activities and technical controls of the cybersecurity program (encryption, DLP, TLS, training content), fitting Risk Management Process. Specificity is driven by domain-specific technical terminology including 'defense in depth' architecture, specific security technologies (DLP, TLS), and enumerated threat vectors (phishing, malware, social engineering) that require cybersecurity expertise to articulate.


reasoning: This paragraph states a backward-looking conclusion that cybersecurity threats and incidents have not materially affected the company's business strategy, results of operations, or financial condition, which is a materiality assessment falling under Strategy Integration per Rule 5. The paragraph contains no specific facts, domain terminology demonstrating cybersecurity expertise, or verifiable claims, consisting solely of generic boilerplate language that could apply to any company.


fact: Chief Information Security Officer (CISO) role with SOC reporting to them

fact: Cybersecurity Incident Response Plan with categorized thresholds

fact: Crisis Response Team consisting of CEO, CFO, CHRO, CIO, and General Counsel

fact: Public Disclosure Committee involvement in incident disclosure decisions

fact: risk-based escalation process for threat notification

reasoning: The paragraph primarily describes the company's incident response workflow and escalation procedures (thresholds, crisis team activation, disclosure review), which falls under Risk Management Process. While it names specific management roles, the content focuses on the operational process rather than organizational structure alone. Specificity is Firm-Specific due to the identification of the CISO role, the specific executive composition of the Crisis Response Team (CEO, CFO, CHRO, CIO, General Counsel), and the Public Disclosure Committee.


reasoning: The paragraph is a cross-reference directing readers to Item 7's Risk Management section and contains no substantive cybersecurity disclosure about governance, management, processes, or incidents. It lacks specific facts, using only generic enterprise risk management terminology that explicitly fails the ERM test for domain expertise.


reasoning: The paragraph contains a backward-looking materiality assessment stating that cybersecurity risks 'have not materially affected our business or our results of operations,' which under Rule 5 qualifies as Strategy Integration. The paragraph contains no specific cybersecurity facts, domain terminology demonstrating expertise, firm-specific details, or verifiable claims, consisting entirely of generic risk disclosures and cross-references.


fact: Emergency Incident Response Team

reasoning: The paragraph describes cybersecurity program activities—specifically, that senior management and a dedicated team periodically review and drill on a plan—placing it in Risk Management Process rather than Management Role (which would require description of organizational structure, reporting lines, or qualifications). Specificity reaches Firm-Specific due to the named internal entity 'Emergency Incident Response Team,' which distinguishes this company's organizational approach from generic disclosures.


reasoning: The paragraph describes the Audit Committee's oversight responsibilities and the governance chain through which the Board receives cybersecurity information (reviewing reports from the CISO), which is core Board Governance content. Specificity is Firm-Specific because the text identifies a 'Chief Information Security Officer' (CISO), a VP-level cybersecurity leadership role that distinguishes the company's organizational structure from generic disclosures.


reasoning: The paragraph contains a backward-looking negative assertion regarding material cybersecurity incidents ('In the last three fiscal years, we have not experienced any material cybersecurity incidents'), which per Rule 5 constitutes a Strategy Integration assessment. The paragraph lacks specific cybersecurity domain terminology, firm-specific structural details, or verifiable quantitative claims, consisting primarily of generic cross-references and a temporal negative assertion that is neither externally verifiable nor firm-specific.


fact: theft of personal information of U.S., Canadian and U.K. consumers

reasoning: The paragraph primarily answers what happened in a past cybersecurity incident by referencing the specific 2017 Equifax breach with verifiable details including the year (2017) and geographical scope (U.S., Canadian and U.K. consumers), making this Incident Disclosure. The presence of a specific date tied to a real, externally verifiable event establishes Level 4 specificity.


fact: hacktivists

fact: state-sponsored organizations

reasoning: The paragraph centers on a materiality assessment conclusion ('there have not been any that have had a material adverse effect on the company'), which per Rule 5 classifies it as Strategy Integration. Specificity is Domain-Adapted because the text uses cybersecurity-specific threat actor terminology ('hacktivists,' 'state-sponsored organizations') that demonstrates domain expertise beyond generic enterprise risk management language, satisfying the ERM test.


fact: CIO (Chief Information Officer) - VP-level cybersecurity leadership role

fact: CISO (Chief Information Security Officer) - VP-level cybersecurity leadership role

fact: DTI organization - firm-specific organizational unit (Digital Technology and Innovation)

fact: CDT function/team - firm-specific organizational unit (Cybersecurity, Data and Technology)

fact: Incident Response team composition includes CISO and senior CDT members - firm-specific team structure

fact: Reporting structure: CDT team overseen by CISO, communicates to Incident Response team

reasoning: The paragraph primarily answers how management is organized to handle cybersecurity, describing the specific roles of the CIO, CISO, CDT team, and Incident Response team, along with their reporting lines and responsibilities (Management Role). Specificity is Firm-Specific due to the naming of firm-specific organizational units (DTI organization, CDT function) and VP-level security leadership roles (CIO, CISO), which distinguish Amgen's structure from generic disclosures.


fact: Two members of the audit committee have obtained certifications in cybersecurity oversight

fact: Chief risk officer presents in person at board meetings twice each year

reasoning: The paragraph primarily answers how the board oversees cybersecurity, describing audit committee oversight, reporting lines from management to the board, and board member qualifications. Specificity is driven by quantifiable, externally verifiable facts: exactly two audit committee members hold cybersecurity certifications and the chief risk officer presents in person at board meetings with a specific frequency of twice per year.


fact: EVP, Chief Digital and Innovation Officer (CDIO)

fact: Vice President (VP) of Platforms, Infrastructure and Cybersecurity

fact: over 20 years of related experience

reasoning: The paragraph describes the organizational structure for cybersecurity oversight, naming specific executive-level positions (EVP CDIO and VP of Platforms, Infrastructure and Cybersecurity) who share risk management responsibilities, which fits Management Role. Specificity is Quantified-Verifiable due to the precise titles and the externally verifiable claim that both leaders possess 'over 20 years' of experience, establishing a checkable threshold.


fact: Chief Information Security Officer (CISO) - VP-level cybersecurity leadership role

fact: EXCO - named executive committee

fact: SLT (Senior Leadership Team) - named management committee

fact: tabletop exercises - domain-specific security practice

fact: incident response processes - domain-specific security practice

fact: threat landscape - domain-specific security concept

reasoning: The paragraph primarily answers how management is organized by identifying the CISO as the leader of security efforts and detailing their reporting lines and meeting cadences with the Board and internal management committees (EXCO, SLT). Specificity is Firm-Specific (Level 3) due to the identification of the CISO role and the named committees (EXCO, SLT), which distinguish this company's governance structure.


fact: Company's Cyber Security Group (firm-specific organizational unit responsible for vendor screening)

fact: Department of Homeland Security's list of Prohibited Nations (firm-specific vendor sourcing policy referencing specific external authority)

fact: operational technology (domain-specific cybersecurity term distinguishing OT from IT systems)

fact: business continuity programs (domain-specific requirement for vendor risk management)

reasoning: The paragraph primarily answers how third-party cyber risks are managed through vendor screening, risk ranking, and sourcing restrictions. Specificity is driven by firm-specific details including the named 'Cyber Security Group' organizational unit and the specific policy of barring sourcing from countries on the Department of Homeland Security's Prohibited Nations list, alongside domain-adapted terminology such as 'operational technology' that demonstrates cybersecurity expertise distinct from generic risk management.


fact: February 2023 (specific date of cyberattack)

reasoning: The paragraph describes a specific historical cyberattack (February 2023), its operational impact (system interruption, data disclosure), and subsequent legal/governmental consequences, fitting the Incident Disclosure category. The specificity is Quantified-Verifiable due to the specific month and year provided for the incident, which constitutes a hard, externally verifiable fact.


fact: SOC 1 audit

fact: IT security controls

reasoning: The paragraph centrally addresses vendor risk management by describing requirements imposed on third-party service providers (mandating SOC 1 audits and reviewing reports), making it Third-Party Risk per Rule 3. Specificity is Domain-Adapted because it references specific audit standards (SOC 1) and IT security controls that demonstrate cybersecurity domain expertise beyond generic ERM language, but lacks firm-specific identifiers (e.g., named roles, committee names) or verifiable facts (e.g., specific dates, numbers) needed for higher levels.


fact: Chief Information Security Officer

fact: at least quarterly

fact: at least annually

fact: tabletop exercises

fact: incident response processes

fact: threat landscape

reasoning: The paragraph identifies the CISO as the leader of cybersecurity efforts and describes management's organizational structure, including the CISO's reporting relationships and meetings with the Board and internal leadership teams (ELT, SLT). Specificity is driven by verifiable frequency thresholds ('at least quarterly', 'at least annually') and firm-specific leadership roles, alongside domain-specific terminology like 'tabletop exercises' and 'threat landscape'.


reasoning: The paragraph primarily describes the company's cybersecurity program elements, including 'proactive and defensive safeguards,' protective policies and procedures, and incident response protocols, which fall under Risk Management Process. While it concludes with a materiality assessment (Strategy Integration), the majority of the text addresses programmatic activities. The language consists of high-level generic phrases ('various programs, policies and procedures,' 'not all incidents can be prevented') that any enterprise risk management professional could apply to non-cyber risks, lacking specific technical controls, firm-unique details, or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers whether cybersecurity has affected or is likely to affect the company's business strategy and financial condition, containing both backward-looking ('have not been materially adversely affected') and forward-looking ('reasonably likely to materially affect') materiality assessments per SEC Item 106(b)(2), which falls under Strategy Integration. It contains no domain-specific terminology beyond generic risk management language (which passes the ERM test), no firm-specific organizational details, and no quantified or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph centrally addresses contractual security requirements imposed on suppliers and vendors (requirements ON vendors), fitting the Third-Party Risk category. The language remains generic ('appropriate security controls') without specifying particular technical measures, frameworks, or verification methods, and contains no firm-specific details or quantifiable facts, resulting in Generic Boilerplate specificity.


fact: data security addendum

fact: cybersecurity insurance (required of vendors)

fact: mandatory incident reporting protocols

reasoning: The paragraph answers how third-party cyber risks are managed by detailing contractual requirements imposed on vendors, fitting Third-Party Risk. It demonstrates cybersecurity domain expertise through specific terminology like 'administrative, physical, and technical safeguards' and 'data security addendum,' but lacks firm-specific program names, dates, or quantifiable metrics that would elevate it to higher specificity levels.


fact: Security and Technology Risk Leadership Committee (named management committee)

fact: CISO (cybersecurity leadership role)

fact: Privacy and Data Governance Committee (named management committee)

fact: Chief Privacy Officer (senior leadership role)

fact: Data Security and Privacy Governance Committee (named oversight committee)

fact: approximately 20 departments (scope of cross-functional representation)

reasoning: The paragraph describes management-level committee structures, leadership roles (CISO, Chief Privacy Officer), and reporting lines, which falls under Management Role per Rule 1 and Rule 2. Specificity is Firm-Specific (Level 3) due to named committees and senior leadership titles that distinguish Home Depot's organizational structure, though the approximate department count is soft and no quantified-verifiable facts (Level 4) are present.


fact: May 2022 - specific date of ransomware attack

fact: ransomware - specific threat type

fact: multi-factor authentication - specific security control

fact: forensic experts - domain-specific expertise

reasoning: The paragraph primarily answers what happened in a specific cybersecurity incident, providing the timing (May 2022), nature (ransomware), scope (network disruption), and response (forensic experts, law enforcement), making it Incident Disclosure. Specificity reaches Level 4 due to the verifiable date 'May 2022' tied to the actual attack event, supported by domain-specific terms including 'ransomware', 'multi-factor authentication', and 'forensic experts'.


category_confidence: low

reasoning: The paragraph discusses cybersecurity governance in general terms, positioning it as important for business alignment and regulatory compliance, but does not specify board oversight mechanisms, management structures, or specific program activities. It contains no domain-specific terminology (all language would be natural to a non-security ERM professional), no firm-specific facts (no roles, committees, or organizational details), and no quantifiable or verifiable claims.


reasoning: The paragraph centrally addresses vendor cybersecurity oversight through assessments and contractual notification requirements, fitting Third-Party Risk. The language consists of generic risk management descriptions ('conducts cyber assessments,' 'contractually required to manage their cybersecurity risks') that an ERM professional would use for any vendor risk type, with no domain-specific security practices, firm-unique organizational details, or quantifiable facts present.


reasoning: The paragraph provides generic threat landscape context describing ransomware, phishing, and nation-state threats facing the banking industry, but does not answer any of the six substantive questions regarding the company's specific cybersecurity governance, management organization, risk management processes, or incidents. As a None/Other paragraph, it is classified as Generic Boilerplate per the classification rules.


reasoning: The paragraph describes hypothetical risks and potential consequences of cybersecurity failures ('could disrupt our business,' 'cause losses') rather than answering any of the six substantive questions about governance, management organization, actual risk management processes, third-party oversight, specific incidents, or materiality assessments. It constitutes generic forward-looking risk speculation common to all 10-K filings without disclosing specific cybersecurity measures. No domain-specific terminology, firm-unique facts, or verifiable claims are present.


fact: On February 22, 2024 (specific date of incident disclosure)

fact: cybercrime threat actors (domain terminology)

reasoning: The paragraph primarily describes an actual cybersecurity incident, including the disclosure date, ongoing investigation, and attribution to threat actors, which falls under Incident Disclosure. Specificity is Level 4 because the paragraph contains the verifiable specific date (February 22, 2024) when the incident was disclosed.


fact: CIO and Director of Cybersecurity both have over 20 years of cybersecurity oversight experience

fact: CIO previously served as CIO for a New York Stock Exchange listed manufacturing company

fact: Director of Cybersecurity has experience developing and implementing cybersecurity programs for multiple manufacturing firms

fact: Director of Cybersecurity

fact: Chief Information Officer (CIO)

fact: CIO reports directly to Chief Executive Officer (CEO)

reasoning: The paragraph primarily describes management roles (CIO and Director of Cybersecurity), reporting lines, and professional qualifications, fitting Management Role. Specificity is Level 4 due to verifiable claims including the specific experience threshold (over 20 years) and the CIO's prior employment at a specific type of public company.


fact: Progress Software Corporation

fact: MOVEit Transfer

reasoning: The paragraph primarily describes an actual cybersecurity incident involving the MOVEit Transfer vulnerability, detailing its nature, scope, timing, impact, and remediation actions, which fits Incident Disclosure. It contains externally verifiable facts including the named third-party software vendor (Progress Software Corporation) and the specific product/platform involved (MOVEit Transfer), supporting Quantified-Verifiable specificity.


fact: Previously Disclosed Cyber Incident

fact: risks from cybersecurity threats have materially affected us, including our results of operations and financial condition

fact: risks are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition

reasoning: This paragraph states forward-looking and backward-looking materiality conclusions about cybersecurity's impact on business outcomes, satisfying Rule 5 for Strategy Integration. While it references a firm-specific incident ('Previously Disclosed Cyber Incident') and makes company-specific materiality claims, it lacks quantified verifiable facts (e.g., specific dollar impacts, dates, or headcounts), resulting in Firm-Specific rather than Quantified-Verifiable specificity.


fact: Chief Information Security Officer (CISO) role

fact: 30 years of information technology experience

fact: 17 years focused specifically on information security and risk management

reasoning: The paragraph describes the CISO's organizational responsibilities, reporting structure (implied by 'primary responsibility'), and specific professional qualifications (30 years IT experience, 17 years in security), making it Management Role. The specificity is Quantified-Verifiable due to the precise, externally checkable years of experience cited for the officer.


fact: CISO

fact: Managing Committee

reasoning: The paragraph primarily describes the Board's oversight structure for cybersecurity risk, including the Risk Management Committee, its Cybersecurity and Technology Subcommittee, and how information flows to the Board via quarterly reports and annual joint meetings. Specificity is Firm-Specific due to references to the company's CISO, the named Cybersecurity and Technology Subcommittee, and the Managing Committee (a specific executive committee at US Bancorp).


reasoning: The paragraph contains the SEC-required Item 106(b)(2) forward-looking materiality assessment stating that cyber threats are 'reasonably likely to materially affect' business outcomes, which classifies it as Strategy Integration per Rule 5. It lacks any specific cybersecurity practices, firm-unique governance details, or quantifiable facts, consisting entirely of generic regulatory boilerplate language found in standard 10-K filings.


fact: Chief Information Security Officer (CISO) - cybersecurity leadership role at VP level or above

fact: vulnerability assessments - domain-specific cybersecurity practice

reasoning: The paragraph describes the Board's Risk Committee oversight structure, including delegation to the Risk Committee, information flow from the CISO to the committee, and annual reporting to the Board, which is classic governance chain content (BG). Specificity is Firm-Specific because the paragraph identifies a CISO (VP-level cybersecurity leadership role), which distinguishes the company's organizational structure; the mention of 'vulnerability assessments' demonstrates domain expertise but does not elevate to Quantified-Verifiable due to the absence of specific dates, headcounts, or verifiable certifications.


reasoning: The paragraph primarily answers whether cybersecurity has affected Verizon's business or finances by stating that, to date, no cyber attacks have been material to operations or financial condition—a backward-looking materiality assessment that falls under Strategy Integration per Rule 5. It contains no specific facts: the threat descriptions are generic, the materiality claim is a non-verifiable negative assertion, and the cross-reference points elsewhere, resulting in Generic Boilerplate specificity.


fact: insider threats

fact: supply chain incidents

fact: cyber intrusion

reasoning: The paragraph primarily contains a backward-looking materiality assessment stating that prior cybersecurity threats have not materially affected business operations or financial condition, which categorizes it as Strategy Integration per Rule 5. Specificity is Domain-Adapted because the paragraph employs specific cybersecurity threat vector terminology—including 'insider threats,' 'supply chain incidents,' and 'cyber intrusion'—that demonstrates domain expertise beyond generic risk management language, satisfying the ERM test.


fact: Designated information security personnel from each segment are assigned to third-party risk assessments

fact: Internal business sponsors collaborate with information security personnel in the assessment process

fact: Risk assessment reports are shared with the Information Security Team

reasoning: The paragraph centrally addresses vendor oversight, describing pre-onboarding cybersecurity risk assessments for third-party service providers and impact analysis on systems/data, fitting the Third-Party Risk category. Specificity is Firm-Specific because it references the company's unique segment-based organizational structure ('each segment') and specific internal entities ('Information Security Team', 'internal business sponsors') that distinguish its third-party risk management workflow from generic descriptions.


reasoning: The paragraph describes generic risk management activities (implementing policies, procedures, and systems to identify and address risks) applicable to any risk domain, with no specific cybersecurity practices, firm-specific organizational details, or quantifiable facts. While it mentions 'confidentiality, integrity and availability,' this basic CIA triad reference does not demonstrate the specialized domain expertise (e.g., specific tools, frameworks, or practices) required for Level 2.


fact: Our CISO has over thirty years of experience as a cybersecurity professional

fact: experience as the CISO of two large retailers

fact: receive training at least annually on cybersecurity and information security

fact: reports to our CSBDO

fact: VF's CISO

fact: CSBDO

reasoning: The paragraph primarily describes the company's cybersecurity risk management activities, including systems for incident detection, third-party risk assessments, training programs, and incident response planning. Applying the person-removal test leaves substantial descriptions of these processes, confirming RMP classification over Management Role. Specificity is Quantified-Verifiable due to multiple externally verifiable claims, including the CISO's thirty-plus years of experience, previous employment as CISO at two large retailers, and the annual training requirement for associates.


reasoning: The paragraph states a backward-looking negative conclusion that no material cybersecurity breaches affected business outcomes, which per Rule 5 is Strategy Integration. It contains only generic temporal references ('In 2023') and unverifiable negative assertions, with no domain-specific terminology, firm-specific organizational details, or externally verifiable quantitative facts.


fact: defense-in-depth and layered strategy

fact: endpoint detection and response

fact: network anomaly detection

fact: multi-factor authentication

fact: threat intelligence services

fact: phishing simulation exercises

reasoning: The paragraph describes the company's cybersecurity program activities, technical controls, and risk mitigation measures (EDR, MFA, threat intelligence), placing it in Risk Management Process. The use of specific cybersecurity domain terminology including 'defense-in-depth,' 'endpoint detection and response,' and 'phishing simulation exercises' demonstrates specialized security knowledge beyond generic enterprise risk management language, supporting Domain-Adapted specificity.


reasoning: The paragraph centrally addresses vendor oversight for cybersecurity risk, including selection criteria and contractual requirements imposed on providers, which fits Third-Party Risk. It employs generic business language ('industry standards,' 'contractually imposed obligations') that would apply equally to financial or compliance risk management, failing the ERM test for domain-adapted specificity, and contains no firm-specific details or verifiable facts.


fact: CSO (Chief Security Officer) - cybersecurity leadership role at VP level or above

reasoning: The paragraph primarily describes what the cybersecurity program does (assessing/identifying/managing risks, responding to incidents, minimizing asset compromise) rather than governance structure or management organization, placing it in Risk Management Process. Specificity is Firm-Specific because it names the CSO (Chief Security Officer), which is a cybersecurity leadership role at the VP level or above.


reasoning: The paragraph describes the components and activities of the cybersecurity risk management program—risk assessments, security controls, incident response procedures, awareness training, and third-party oversight—answering what the program does (RMP) rather than board governance, management organizational structure, or specific incidents. Specificity remains Level 1 because the text contains only generic process language ('risk assessments,' 'security controls,' 'vetting process') that would apply to any enterprise risk management context; it lacks domain-specific cybersecurity terminology (e.g., penetration testing, EDR, SIEM), firm-specific details (e.g., named roles, team composition), or externally verifiable facts (e.g., specific dates, certifications, named vendors, headcount numbers).


fact: isolated computer workstations

fact: two-factor authentication

fact: independent authorizations

reasoning: The paragraph describes the Trust's cybersecurity program activities and technical controls (isolated workstations, multi-factor authentication), placing it in Risk Management Process. Specificity is Domain-Adapted because it references specific cybersecurity architectural concepts (isolated workstations, two-factor authentication) that demonstrate domain expertise beyond generic risk management language and would not naturally be used by a non-security ERM professional.


fact: defense-in-depth approach

fact: National Institute of Standards and Technology Cyber Security Framework

fact: vulnerability scanning

fact: penetration testing

fact: cyber risk scoring

fact: incident response exercises

fact: disaster recovery exercises

fact: encryption

fact: threat management

fact: continuous monitoring

fact: elevated privileges

reasoning: The paragraph primarily describes the company's cybersecurity risk management activities and program structure, detailing six functional areas including proactive processes (vulnerability scanning, penetration testing), reactive processes (incident response), and technical controls (encryption, MFA). It demonstrates domain expertise (Level 2) through specific cybersecurity terminology like 'defense-in-depth', 'NIST Cyber Security Framework', and 'cyber risk scoring' that would not be used by non-security ERM professionals.


reasoning: The paragraph describes oversight by Board-level committees (Audit Committee and Risk Committee) of cybersecurity governance and internal audit coverage, answering 'How does the board oversee cybersecurity?' The text contains no firm-specific details (only generic committee names), no quantifiable data, and no domain-specific cybersecurity terminology that would fail the ERM test—using standard governance language any risk professional could apply to any control environment.


fact: John Bresney holds a bachelor's degree in information systems and business

fact: John Bresney holds a Master's Certificate in Project Management

fact: John Bresney holds a Columbia University CIO Program Certificate

fact: Robert McKenna has over 27 years of technology and information security experience

fact: Robert McKenna holds a master's degree in business administration

fact: Robert McKenna holds a Certificate in Project Management

fact: Robert McKenna is a Certified Insurance Counselor

fact: Christopher Cunniff has over 32 years of insurance industry experience

fact: Christopher Cunniff holds a bachelor's degree in mathematics

fact: Christopher Cunniff is a fellow of the Casualty Actuarial Society

fact: Christopher Cunniff is a member of the American Academy of Actuaries

reasoning: The paragraph primarily answers how management is organized to handle cybersecurity by detailing specific leadership roles (EVP & CIO, SVP of Enterprise Strategy and Execution, SVP and CRO), reporting lines, and individual qualifications. Specificity is Quantified-Verifiable due to multiple externally verifiable claims including named academic degrees, professional certifications (e.g., Certified Insurance Counselor, Fellow of the Casualty Actuarial Society), and quantified experience thresholds with lower bounds ('over 27 years', 'over 32 years').


reasoning: This paragraph is a pure cross-reference directing readers to Item 1A Risk Factors for materiality disclosures, containing no substantive cybersecurity description of its own. As a cross-reference paragraph with no specific facts, domain terminology, firm-specific details, or verifiable claims, it properly receives the None/Other category and Generic Boilerplate specificity.


fact: Vice President of Cybersecurity

reasoning: The paragraph primarily answers how the Board oversees cybersecurity, describing Audit Committee responsibilities, briefing frequencies (quarterly/semi-annual/annual), and escalation procedures, which is classic Board Governance content. Specificity is Firm-Specific because it identifies a 'Vice President of Cybersecurity' as the management representative providing briefings—a VP-level cybersecurity leadership role that distinguishes this company's organizational structure from generic disclosures.


fact: Certified Information Systems Security Professional (CISSP) certification

fact: Global Industrial Cyber Security Professional (GICSP) certification

fact: Electricity Information Sharing and Analysis Center (E-ISAC)

fact: Cybersecurity and Infrastructure Security Agency (CISA)

reasoning: The paragraph primarily answers what the cybersecurity program does (using threat intelligence, network monitoring, and vulnerability scanning) rather than focusing on organizational structure or governance oversight. It contains externally verifiable claims regarding specific professional certifications held by team members (CISSP and GICSP) and names specific threat intelligence sources (E-ISAC, CISA).


reasoning: The paragraph describes the Audit Committee's oversight responsibility for cybersecurity risks, which is a classic board governance function describing oversight structure. The language is entirely generic boilerplate—referencing standard governance roles (Audit Committee, Board) and generic oversight activities ('policies, strategies, and initiatives') without any firm-specific details, domain-specific cybersecurity practices, or verifiable facts.


fact: Subject to regulation by the FRB (Federal Reserve Board)

fact: Subject to regulation by the FDIC

fact: Subject to regulation by the DFR (Vermont Department of Financial Regulation)

reasoning: The paragraph describes the company's establishment of a cybersecurity risk management program to address regulatory requirements, fitting Risk Management Process. Specificity is Firm-Specific because naming the DFR (Vermont Department of Financial Regulation) identifies the company's specific state regulatory jurisdiction, distinguishing it from banks regulated by other state agencies.


reasoning: The paragraph constitutes a backward-looking materiality assessment stating that cybersecurity threats have not materially affected the company's business strategy, results of operations, or financial condition, which falls under Strategy Integration per Rule 5. Specificity is Generic Boilerplate because the paragraph contains no firm-specific cybersecurity details (e.g., roles, committees), verifiable quantitative claims, or domain-adapted terminology demonstrating cybersecurity expertise; the date serves only as a reporting period anchor and the negative materiality assertion is not externally verifiable.


reasoning: This paragraph contains only introductory boilerplate language stating the importance of cybersecurity and the intent to provide an overview, without disclosing any actual governance structures, management roles, risk management processes, or specific risks. As a None/Other paragraph, it receives Generic Boilerplate specificity.


reasoning: This paragraph states a conclusion about whether cybersecurity risks have materially affected or are reasonably likely to affect business strategy, financial condition, and results of operations, which is the defining characteristic of Strategy Integration per Rule 5. Specificity is Generic Boilerplate because the paragraph contains only a negative materiality assertion (explicitly excluded from verifiable claims in the guidelines) and a cross-reference, with no domain-specific terminology, firm-specific organizational details, or externally quantifiable facts.


reasoning: The paragraph primarily consists of materiality assessments regarding whether cybersecurity threats have affected business strategy and financial condition (backward-looking statements that 'have not materially affected' results and forward-looking speculation about potential effects), which falls under Strategy Integration per Rule 5. It contains no specific facts: the language consists of generic risk management terms ('information security and controls,' 'security vulnerabilities') that pass the ERM test, with no firm-specific organizational details, domain-adapted cybersecurity practices, or quantifiable/verifiable claims.


reasoning: This paragraph is a cross-reference directing readers to Item 1A for risk factor disclosures regarding material effects of cybersecurity threats, containing no substantive cybersecurity governance, management, or process descriptions itself. No specific facts, domain terminology, or verifiable claims are present—only generic directional language.


reasoning: The paragraph primarily contains backward-looking materiality assessments ('have not been materially affected') and forward-looking business impact statements, which per Rule 5 classify as Strategy Integration. It mentions cybersecurity insurance but provides no quantified details, named roles, standards, or technical specifics that would elevate specificity above generic boilerplate.


fact: over 30 years of IT experience

fact: over 20 years specializing in cybersecurity

reasoning: The paragraph primarily answers how management is organized to handle cybersecurity by describing the Senior Manager's leadership role, reporting lines to the Managing Director of Enterprise IT, and executive reporting structure. The specificity is driven by verifiable biographical details regarding the Senior Manager's years of experience (over 30 years in IT, over 20 in cybersecurity), which constitute externally checkable claims.


fact: CISO (cybersecurity leadership role)

fact: Core Cybersecurity Management Team (CCMT) (named management committee)

fact: CIRP / Teradata's CIRP (named internal cyber incident response program)

reasoning: The paragraph primarily answers how management is organized to handle cybersecurity by detailing the composition (CISO, Chief Legal Officer, CFO) and responsibilities of the Core Cybersecurity Management Team (CCMT), making it Management Role. Specificity is Firm-Specific because it names the CCMT, identifies the CISO role, and references the company-specific CIRP (Cyber Incident Response Plan), but contains no quantifiable metrics or externally verifiable claims that would elevate it to Level 4.


fact: CISO (Chief Information Security Officer) - cybersecurity leadership role at VP level or above

reasoning: The paragraph describes Board oversight mechanisms (receiving briefings from the CISO and external experts for continuing education), which is classic Board Governance content. Specificity is driven by the mention of 'our CISO,' which qualifies as a firm-specific cybersecurity leadership role at VP level or above; without this role mention, the remaining content (annual briefings, external experts, continuing education) would constitute generic governance language.


fact: crisis simulation exercises involving our shipboard and shoreside employees

reasoning: The paragraph describes the company's incident response procedures, testing protocols, and team training, which are core risk management process activities. While terms like 'incident response plan' and 'crisis simulation exercises' are generic, the reference to 'shipboard and shoreside employees' provides a firm-specific detail that uniquely identifies Carnival's cruise line operating structure, distinguishing it from land-based corporations.


fact: Vice President of Information Security

fact: CIO

fact: vulnerability assessments

reasoning: The paragraph primarily answers how the Board and Audit Committee oversee cybersecurity risks, detailing the frequency of briefings (quarterly with Audit Committee, annually with Board), reporting thresholds for incidents, and the flow of information from management to the board. It qualifies as Firm-Specific due to the identification of specific executive leadership roles (CIO, Vice President of Information Security) and the Information Technology Senior Leadership Team.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers through pre-engagement assessments and committee review, fitting the Third-Party Risk category. The language consists of generic vendor risk management descriptions ('pre-engagement and periodic risk assessments', 'strategic risk management committees') that pass the ERM test—substituting 'financial' for 'cybersecurity' yields standard vendor due diligence language—resulting in Generic Boilerplate specificity.


reasoning: The paragraph states conclusions about whether cybersecurity has materially affected the company (backward-looking) and whether it is reasonably likely to materially affect the company (forward-looking), which constitutes a materiality assessment classified as Strategy Integration per Rule 5. It contains only generic SEC disclosure language and negative assertions about the absence of incidents that cannot be independently verified, with no domain-specific cybersecurity terminology or firm-specific details, warranting a Generic Boilerplate specificity level.


reasoning: The paragraph contains a backward-looking materiality assessment stating that 'no material incidents [have been] incurred to-date,' which qualifies as Strategy Integration under Rule 5 (negative assertions about material incidents). However, it lacks specific cybersecurity domain terminology (failing the ERM test), firm-unique organizational details, or quantifiable verifiable claims, resulting in Generic Boilerplate specificity.


fact: denial of service attacks

fact: malicious software attacks

reasoning: The paragraph primarily answers how third-party cyber risks are managed, focusing on reliance on third parties for card transactions and service provision, historical breaches affecting those parties, and the conduct of security assessments on higher-risk vendors. While it opens with a materiality statement (Strategy Integration) and references past incidents (Incident Disclosure), the substantial content addresses third-party risk exposure and oversight. Specificity is Domain-Adapted because the paragraph employs specific cybersecurity domain terminology including 'denial of service attacks' and 'malicious software attacks' that demonstrate technical expertise beyond generic risk management language.


fact: CIO (VP-level cybersecurity leadership role)

reasoning: The paragraph primarily answers how the board oversees cybersecurity, describing the Board's annual review and the Audit Committee's quarterly updates on cyber risks. While it references the CIO's responsibilities, the emphasis is on the governance oversight structure rather than management's organizational details. Specificity is Firm-Specific because the paragraph identifies a VP-level cybersecurity leadership role (CIO), which distinguishes the company's governance structure from generic descriptions.


fact: Chief Information Officer (CIO) has more than 30 years of experience

fact: CIO has chief information officer roles in financial services, banking, healthcare, and hospitality sectors

fact: CIO has led governance, risk, and compliance technology programs

fact: CIO has led information security programs

fact: Cybersecurity team holds Master's in Cybersecurity

fact: Cybersecurity team holds Certified Information Systems Security Professional (CISSP)

fact: Cybersecurity team holds Certified Information Security Manager (CISM)

fact: Cybersecurity team holds Microsoft Certified Cybersecurity Architect Expert

fact: Cybersecurity team holds Graduate Certificates in Enterprise Cybersecurity and Data Science

fact: Cybersecurity team holds Security+ certification

fact: Cybersecurity team holds Certified Information Systems Auditor (CISA)

reasoning: This paragraph primarily answers how management is organized to handle cybersecurity by detailing the CIO's leadership role, 30+ years of experience across specific sectors, and the dedicated team's externally verifiable professional certifications (CISSP, CISM, CISA, etc.). The specific certifications and quantified experience claims are independently verifiable facts that elevate the paragraph to Level 4.


fact: Vice President of Information Technology, Security and Business Intelligence serves as the principal manager responsible for overseeing the cybersecurity risk management program

fact: Over 18 years of experience in information technology and information security roles

fact: Previous employment at Biogen, AstraZeneca, Iron Mountain, Charles River Labs, Sunovion Pharmaceuticals, Agero, and DentaQuest

fact: Master's degree in business administration from Boston University

fact: Master's degree in electrical and computer engineering from Utah State University

fact: Bachelor's degree in electronics engineering from Mumbai University

fact: Information Technology team has over 10 years of experience managing risks arising from cybersecurity threats

fact: Coordinates with Chief Executive Officer, Chief Financial Officer, and General Counsel

reasoning: The paragraph describes the management structure, reporting relationships, and qualifications of the executive responsible for cybersecurity, fitting Management Role. Specificity is Quantified-Verifiable due to externally verifiable biographical details including precise years of experience (18+ and 10+), named academic degrees from specific universities, and identifiable previous employers.


fact: Director of IT Infrastructure and Security has over 30 years of experience

fact: Director has experience in Defense Industrial Base environment

fact: Director holds GIAC Security Essentials certification

fact: Director holds GIAC Certified Enterprise Defender certification

fact: Director holds GIAC Certified Incident Handler Certification

fact: Director holds GIAC Certified Windows Security Administrator certification

fact: Director holds GIAC Critical Controls Certification

fact: Vice President of Information Technology has over 19 years of experience

fact: Vice President holds Certified Information Systems Security Professional (CISSP) certification

fact: Vice President holds Masters of Business Administration

fact: Director reports to Vice President of Information Technology

reasoning: This paragraph primarily answers how management is organized for cybersecurity by detailing the titles, reporting structure, qualifications, and specific certifications of the IT Security leadership team (Director of IT Infrastructure and Security and VP of IT). Specificity reaches Level 4 due to multiple externally verifiable claims including specific GIAC and CISSP certifications held by leadership and quantified years of experience (over 30 and over 19 years).


reasoning: This paragraph consists entirely of forward-looking speculation about hypothetical consequences of system failures ('could disrupt,' 'could damage,' 'material adverse effect') rather than answering any substantive question about actual governance structures, management roles, or risk management processes. Per Rule 5, 'could have a material adverse effect' is speculative language that does not constitute a Strategy Integration assessment, and per Rule 6, pure speculation without measures falls under None/Other. As a None/Other paragraph containing no specific cybersecurity facts, tools, or verifiable claims, it receives Generic Boilerplate specificity.


fact: Chief Security Officer (CSO) - senior-most security professional role

fact: reports to the CFO

fact: served in that role for Zebra since 2018

fact: over 14 years of global executive cybersecurity experience

reasoning: The paragraph primarily answers how management is organized for cybersecurity by detailing the CSO's responsibilities, reporting line to the CFO, and specific qualifications. Specificity is Quantified-Verifiable due to externally checkable claims regarding the officer's tenure (since 2018) and years of experience (over 14 years).


fact: Third Party Risk Management (TPRM) program (named internal program with acronym)

fact: integrated into our procurement process (firm-specific organizational structure)

fact: monitor certain of our principal suppliers (specific scope of vendor oversight)

reasoning: The paragraph centrally addresses how Unisys manages cybersecurity risks from vendors and service providers, including due diligence requirements and continuous monitoring using an outside-in methodology, fitting the Third-Party Risk category. Specificity is Firm-Specific due to the named TPRM program and its integration into the procurement process, distinguishing Unisys's approach from generic vendor risk descriptions.


fact: National Institute on Standards and Technology Cybersecurity Framework

fact: multi-factor authentication

fact: intrusion prevention and detection systems

fact: partitioning

fact: encryption

fact: third party security operation center

fact: firewalls

fact: malware defenses

fact: email filtering

fact: access controls

reasoning: The paragraph describes the company's cybersecurity program activities, technical controls, and defense mechanisms (RMP). It demonstrates domain expertise through specific cybersecurity practices and technologies—including NIST CSF alignment, MFA, IDS/IPS, network partitioning, and SOC utilization—that exceed generic enterprise risk management vocabulary (Level 2).


fact: System and Organization Controls (SOC) 2

fact: ISO 27001 (Information and Security Certification)

fact: information security posture assessment

fact: third-party hosted applications

reasoning: The paragraph primarily answers how third-party cyber risks are managed through vendor onboarding, due diligence, and contractual security requirements imposed on suppliers. Specificity reaches Level 2 due to domain-specific terminology including named standards (SOC 2, ISO 27001) and technical concepts (information security posture, hosted applications) that demonstrate cybersecurity expertise beyond generic risk management language.


reasoning: The paragraph addresses how the company manages cybersecurity risks from third parties (specifically acquisition targets) through contractual requirements and pre-acquisition testing, which falls squarely under Third-Party Risk. It lacks specificity because terms like 'security due diligence,' 'independent testing,' and 'contractual protections' would be naturally used by a non-security enterprise risk management professional conducting financial or operational due diligence (failing the ERM test), and contains no firm-specific details, domain-adapted terminology (e.g., specific testing methodologies or standards), or quantifiable facts.


fact: identity and access management

fact: cyber defense operations

fact: security engineering

fact: penetration testing

fact: threat intelligence

fact: managed security services

fact: Executive Vice President/ Chief Information Security Officer

fact: Chief Information Officer

fact: Senior Executive Vice President / Chief Operating Officer

fact: reports directly to Comerica's Chief Executive Officer and the Board of Directors

fact: over 25 years' experience in cybersecurity risk management

fact: over 27 years' experience in technology risk management

reasoning: The paragraph primarily answers how management is organized by detailing specific leadership roles (EVP/CISO, CIO), their reporting lines to the COO and Board, and their qualifications. Specificity is Quantified-Verifiable due to the externally checkable claims that the CISO has over 25 years and the CIO has over 27 years of experience, alongside firm-specific titles and domain-specific cybersecurity functions.


fact: forensic reviews of cybersecurity-related incidents

reasoning: The paragraph describes the company's cybersecurity program activities regarding the engagement of external parties for security assessments and incident response support, placing it in Risk Management Process under Rule 3 (third parties hired to serve the company). Specificity is Domain-Adapted due to the inclusion of 'forensic reviews,' a technical security practice demonstrating domain expertise beyond generic ERM language, though the remainder of the paragraph uses aspirational phrasing ('may engage,' 'industry best practices').


reasoning: The paragraph contains purely speculative, forward-looking risk language ('could prevent,' 'could severely harm') describing hypothetical impacts of potential cyber attacks rather than any actual cybersecurity governance, processes, or assessments. It lacks specific facts, domain terminology passing the ERM test, or verifiable claims.


reasoning: The paragraph focuses on managing cybersecurity risks from third-party service providers, including performing assessments and requesting security information from vendors, which clearly addresses the Third-Party Risk category. The language consists of generic oversight terms ('risk assessments', 'security policies') that would be used by any ERM professional for non-cyber risks as well, with no domain-specific cybersecurity practices, firm-specific details, or verifiable facts present.


fact: dedicated department within its Enterprise Risk Management division

fact: Bank's Information Technology Department

fact: bank operations technology, payroll and benefits administrators, and professional service providers

reasoning: The paragraph centrally addresses how third-party cyber risks are managed, describing a dedicated department within the ERM division that evaluates cybersecurity risks associated with specific vendor categories (bank operations technology, payroll administrators), fitting the Third-Party Risk category. Specificity is Firm-Specific due to the disclosure of the company's specific organizational structure (dedicated third-party risk department within ERM, collaboration with the Bank's IT Department) and enumerated vendor types.


fact: Chief Innovation Officer (provides reports to Audit Committee on IT security, risk assessments, and cybersecurity mitigation steps)

reasoning: The paragraph describes the Board and Audit Committee's oversight structure for cybersecurity, including the frequency of reviews and the information flow from management. The identification of the 'Chief Innovation Officer' as the specific executive role responsible for reporting cybersecurity matters to the Audit Committee constitutes a firm-specific governance detail that distinguishes this company's oversight structure.


reasoning: The paragraph states a materiality conclusion that cybersecurity threats have not materially affected the company to date and assesses potential future material impact on business strategy and financial condition, which is a Strategy Integration assessment per Rule 5. The text contains only generic assertions about materiality and hypothetical impacts without domain-specific terminology, firm-specific organizational details, or externally verifiable facts (negative self-assertions about incident absence are not verifiable), resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily describes the company's process for assessing and managing cybersecurity risks within its ERM framework, including annual evaluation of security domains (information security, incident response, business continuity, etc.), which fits Risk Management Process. It contains no firm-specific details (only generic mention of the Audit Committee), no quantifiable metrics, and no domain-specific cybersecurity terminology that would demonstrate technical expertise (e.g., specific tools, frameworks, or practices), resulting in Generic Boilerplate specificity.


fact: Chief Capability Officer (CCO)

fact: Chief Information Officer (CIO)

fact: Chief Information Security Officer (CISO)

reasoning: The paragraph primarily describes Audit Committee oversight activities—receiving quarterly reports and engaging with management on cyber topics—answering how the board oversees cybersecurity (Board Governance). Specificity is Firm-Specific due to the identification of specific C-suite leadership roles (CCO, CIO, CISO) engaged in cybersecurity governance, which distinguishes this company's oversight structure.


fact: Aerospace Safety Committee (non-generic Board committee overseeing aerospace cybersecurity risks)

fact: Chief Information Officer and Senior Vice President, Information Technology & Data Analytics (CIO)

fact: Chief Security Officer (CSO)

fact: Chief Aerospace Safety Officer

fact: Chief Product Security Engineer

fact: designated member of Audit Committee with expertise in cyber risk management

reasoning: The paragraph answers how the Board oversees cybersecurity, describing delegation to the Audit Committee and the firm-specific Aerospace Safety Committee, reporting lines to the full Board, and briefing cadences. Specificity is Firm-Specific due to non-generic committee names (Aerospace Safety Committee) and specific senior leadership titles (CIO, CSO, Chief Aerospace Safety Officer, Chief Product Security Engineer) that distinguish Boeing's governance structure from generic disclosures.


fact: Chief Technology Officer chairs the Information Security and Data Management Committee

fact: Head of Technology & Operations chairs the Operational Risk Committees

fact: Chief Risk Officer chairs the Enterprise Risk Management Committee

fact: representatives of the Company's second LOD (Line of Defense)

fact: CEO is a member of the Information Security and Data Management Committee

reasoning: The paragraph primarily answers how management is organized by detailing the structure, chairs, and membership of management-level risk committees (Information Security and Data Management Committee, Operational Risk Committees, Enterprise Risk Management Committee). Specificity is driven by firm-specific governance details including the named committees and VP-level leadership roles (Chief Technology Officer, Head of Technology & Operations, Chief Risk Officer) that distinguish Santander's organizational structure.


reasoning: This paragraph is purely a cross-reference directing readers to Item 1A Risk Factors and contains no substantive cybersecurity disclosure about the company's actual program, governance, or incidents. Per annotation rules, cross-references qualify as None/Other and automatically receive Generic Boilerplate specificity.


reasoning: The paragraph states a conclusion about whether cybersecurity risks have materially affected or are reasonably likely to materially affect the company's business strategy, results of operations, or financial condition, which is the defining characteristic of Strategy Integration under Rule 5. For specificity, the paragraph contains no verifiable facts (the negative assertion regarding material incidents is explicitly excluded as non-verifiable per the guidelines), no firm-specific details about governance or organization, and no domain-specific cybersecurity terminology that would fail the ERM test, resulting in Generic Boilerplate classification.


reasoning: The paragraph centrally addresses how Tredegar manages cybersecurity risks from third-party service providers by requiring tailored security protocols and periodically assessing their security frameworks, fitting the Third-Party Risk category. The language consists of generic risk management terms ('periodically,' 'security frameworks,' 'adequate security measures') that lack specific standards (e.g., SOC 2, ISO 27001), technical controls, named vendors, or quantifiable details, resulting in Generic Boilerplate specificity.


fact: Cross-functional effort involving end-user, Legal, Privacy and Information Security teams (specific departmental composition)

reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers, including vendor assessments and ongoing monitoring. Specificity is Firm-Specific because it identifies the specific departmental composition of the cross-functional team (end-user, Legal, Privacy, and Information Security teams) involved in third-party risk assessments.


fact: CIO and/or CISO report to the Corporate Risk Committee

fact: Corporate Risk Committee oversees information technology systems including information security

fact: ERM team reports annually to Board of Directors

fact: at least bi-annually reporting frequency to Corporate Risk Committee

reasoning: Paragraph primarily describes Board and Committee oversight of cybersecurity, including delegation to the Corporate Risk Committee and Audit Committee, and information flows from management to the Board. Contains firm-specific details including named executive roles (CIO, CISO), the Corporate Risk Committee structure, and specific reporting frequencies (bi-annually, annually).


fact: Chief Information Officer (firm-specific cybersecurity leadership role)

reasoning: The paragraph describes management's organizational responsibility for cybersecurity, the CIO's oversight role, and supervision of internal/external personnel, fitting Management Role. The CIO title qualifies as a firm-specific leadership role (Level 3), though 'many years of experience' is too vague for Level 4.


fact: CDO and CISO lead cybersecurity processes

fact: collectively over 25 years of prior work experience

fact: ISACA Certified Information Security Manager certification

fact: ISC2 Certified Information Systems Security Professional certification

reasoning: This paragraph answers how management is organized to handle cybersecurity by identifying the specific leadership roles (CDO and CISO), their reporting structure, qualifications, and collective experience. Specificity reaches Level 4 due to the quantified experience claim ('over 25 years') and the naming of specific, externally verifiable professional certifications (ISACA CISM and ISC2 CISSP).


reasoning: The paragraph describes the Risk Committee's oversight role in providing assurances to management and the Board regarding the company's cybersecurity risk identification and mitigation controls, which falls squarely under Board Governance. The language consists entirely of generic governance and enterprise risk management terminology ('identified and evaluated key risks,' 'implemented mitigating controls') that would apply to any risk domain and contains no specific cybersecurity domain expertise, firm-unique details, or verifiable facts.


fact: Chief Security and Trust Officer role

fact: reports to Executive Vice President, Operations

fact: over 25 years of experience in IT and information security

reasoning: The paragraph centers on describing the organizational structure and qualifications of Cisco's Chief Security and Trust Officer, including specific reporting lines and tenure, which is core Management Role content. Specificity reaches Level 4 due to the verifiable quantitative claim of 'over 25 years' of experience, supported by firm-specific details regarding the executive title and reporting relationship.


fact: 2023 (specific year of third-party vendor incident)

fact: MOVEit Transfer (named file sharing software)

fact: zero-day vulnerability (specific vulnerability type)

reasoning: The paragraph primarily describes actual cybersecurity incidents that occurred, including fraud attempts, unauthorized access to customer data, and a specific 2023 third-party vendor incident involving a zero-day vulnerability in MOVEit Transfer software, making it Incident Disclosure. Specificity is Level 4 due to verifiable facts including the specific year of the incident, the named software product, and the specific vulnerability type.


fact: Vendor Management Committee

fact: Vendor Management team

reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party vendors, including due diligence processes and ongoing reviews, which falls squarely under Third-Party Risk. Specificity is Firm-Specific (Level 3) because the text identifies distinct internal organizational entities—the 'Vendor Management Committee' and 'Vendor Management team'—that are unique to this corporation's governance structure, distinguishing it from generic vendor risk descriptions.