fact: confidentiality, security and availability (CIA triad framework)

fact: cybersecurity threats

fact: cybersecurity incidents

reasoning: The paragraph primarily answers how the Board oversees cybersecurity by describing Board involvement in risk management oversight and integration of cybersecurity into the ERM program. The specificity is Domain-Adapted because it employs the CIA triad (confidentiality, security, availability) and specific cybersecurity terminology ('threats,' 'incidents') that demonstrate domain expertise beyond generic risk management language, though it lacks firm-specific details or verifiable metrics.


content_category: Management Role

fact: CISO

fact: Security Steering Committee

fact: CSIRT

fact: PSIRT

category_confidence: high

specificity_confidence: high

reasoning: The paragraph answers how management is organized to handle cybersecurity by describing specific leadership roles (CISO), management-level committees (Security Steering Committee), and specialized teams (CSIRT and PSIRT) along with their reporting lines and information flows. These firm-specific organizational elements—CSIRT (Computer Security Incident Response Team) and PSIRT (Product Security Incident Response Team) as distinct teams, the Security Steering Committee, and the CISO role—distinguish Qualys's management structure from generic descriptions, establishing Firm-Specific specificity.

provider: moonshotai

stage: benchmark


content_category: Strategy Integration

reasoning: The paragraph states a negative conclusion about materiality ('no cybersecurity incidents that materially affected'), which is explicitly classified as Strategy Integration under Rule 5. Specificity is Generic Boilerplate because the paragraph contains only a reporting period date (fiscal year context, not a verifiable cybersecurity fact) and an unverifiable negative assertion about the absence of incidents, with no domain-specific terminology or firm-unique details.


content_category: Board Governance

reasoning: The paragraph describes the audit committee's oversight structure and its relationship to the board and CFO regarding cybersecurity governance, which is classic Board Governance content. It contains no firm-specific details (only generic titles like 'Audit Committee' and 'Chief Financial Officer'), no domain-specific technical terminology demonstrating cybersecurity expertise (fails the ERM test), and no quantifiable or verifiable facts, resulting in Generic Boilerplate specificity.


fact: CTO

fact: internal working group

reasoning: The paragraph focuses on management qualifications and organizational structure, naming specific senior leadership roles (CTO, CISO) and an internal working group rather than describing board oversight or specific risk management activities. The specificity is elevated by identifying these VP-level cybersecurity leadership positions and the internal working group, which are firm-specific organizational details that distinguish this company's cybersecurity posture from others.


content_category: Third-Party Risk

reasoning: The paragraph centrally addresses vendor oversight, describing due diligence for new third-party providers and continuous monitoring of existing managed service providers and CIO firms, which aligns with Third-Party Risk. The content consists entirely of generic process descriptions (due diligence checks, protocols, scheduled meetings) without domain-specific technical terminology, firm-specific organizational details, or quantifiable metrics that would elevate it above boilerplate.


reasoning: The paragraph describes the Board and Audit Committee's oversight structure for cybersecurity risks and the information flow from the CFO, which directly answers how the board governs cybersecurity (Board Governance). It contains only generic governance roles (Board, Audit Committee, CFO) and generic risk management language ('identify, prioritize, assess, manage, and mitigate') that fails the ERM test for domain expertise, with no firm-specific details or verifiable facts.


reasoning: The paragraph centrally addresses vendor oversight, describing the company's dependence on third-party service providers and its process for obtaining cybersecurity efficacy reports from vendors handling sensitive data, which aligns with Third-Party Risk. The language consists of generic risk management and IT operational terms without specific cybersecurity domain expertise, firm-unique identifiers, or quantifiable facts, warranting Generic Boilerplate specificity.


content_category: None/Other

reasoning: This paragraph consists entirely of forward-looking speculative risk disclosure describing hypothetical consequences of potential security breaches (litigation, reputational harm, operational downtime) without detailing any actual cybersecurity measures, governance structures, or specific incidents. Per Rule 5, the 'could have a material adverse effect' language is explicitly classified as speculation rather than Strategy Integration. As the paragraph contains no substantive cybersecurity disclosures—only generic risk boilerplate that could apply to any company—it falls under None/Other with Generic Boilerplate specificity.


content_category: Risk Management Process

fact: IASME Cyber Essentials framework

fact: approved by the UK government Cyber Security NCSC

fact: NIST framework

reasoning: The paragraph describes the company's cybersecurity assessment methodology and framework adoption (Risk Management Process). It demonstrates domain expertise (Level 2) by citing specific cybersecurity frameworks (IASME Cyber Essentials, ISO 27001, NIST) and referencing the UK National Cyber Security Centre, terminology that requires cybersecurity domain knowledge rather than generic risk management vocabulary.


reasoning: The paragraph merely states that the company collects and stores customer and sensitive business information in the normal course of business, without describing any cybersecurity governance structures, management roles, risk management processes, third-party oversight, incidents, or strategic assessments. As it contains no substantive cybersecurity measures or disclosures, it falls under None/Other with Generic Boilerplate specificity.


reasoning: The paragraph primarily describes the governance chain where the Audit Committee reports cybersecurity risks to the Board, which reviews them at least annually, answering how the board oversees cybersecurity (Board Governance). The text contains only generic risk management terminology ('processes to prevent, detect and mitigate') and standard governance cadences without domain-specific practices, firm-unique details, or verifiable facts.


fact: monitor and identify known cybersecurity threats and incidents at third-party service providers

fact: vulnerabilities to our own systems

fact: Cybersecurity Program Manager

specificity_confidence: medium

reasoning: The paragraph primarily addresses how the company manages cybersecurity risks stemming from third-party service providers, including threat monitoring at vendors and vendor evaluation criteria, which is the central definition of Third-Party Risk. Specificity is Domain-Adapted because the paragraph employs cybersecurity domain terminology—specifically 'vulnerabilities' (a technical security concept distinct from generic 'risks') and the distinction between 'threats and incidents' in the third-party context—that demonstrates cybersecurity expertise beyond generic enterprise risk management language, and references a specialized role ('Cybersecurity Program Manager') rather than generic IT personnel.


reasoning: The paragraph primarily answers how the board oversees cybersecurity by describing the governance chain: the board addresses cybersecurity as part of its general oversight, delegating to the Audit Committee and management's Technology Steering Committee. While it mentions a management committee, the purpose is describing oversight structure (Board → Committee), not management's organizational qualifications or responsibilities. The mention of 'Technology Steering Committee' constitutes a firm-specific organizational detail (named non-generic committee), elevating specificity from generic boilerplate to Firm-Specific.


reasoning: The paragraph provides a backward-looking materiality assessment stating that cybersecurity risks have not affected business strategy, results of operations, or financial condition, which falls squarely under Strategy Integration per Rule 5 (SI materiality rule). The text contains only generic risk language and negative assertions about incident absence, with no domain-specific cybersecurity terminology, firm-unique organizational details, or externally verifiable facts, resulting in Generic Boilerplate specificity.


fact: CISO (Chief Information Security Officer) role

fact: responsibility scope covering centrally at Roivant and the majority of our Vants

reasoning: The paragraph describes the CISO's organizational responsibilities, scope of authority, and professional qualifications, fitting Management Role. Specificity is Firm-Specific due to identification of the CISO position (VP-level cybersecurity leadership) and reference to 'Vants' (proprietary organizational units unique to Roivant), but lacks quantified metrics like years of experience or certifications needed for Level 4.


reasoning: The paragraph provides generic contextual discussion about the importance of cybersecurity and the existence of threats (ransomware, denial-of-service) but does not substantively address any of the six required disclosure categories: it describes no board or management oversight structure (BG/MR), no specific risk management processes or methodologies (RMP), no third-party risk management practices (TP), no actual incidents (ID), and uses speculative 'could' language rather than stating conclusions about material business impact (SI). As a None/Other paragraph, it receives Generic Boilerplate specificity.


content_category: Incident Disclosure

fact: 26 BTC

fact: approximately $560,000

fact: US Federal law enforcement

reasoning: The paragraph describes a specific 2023 business email compromise incident involving a threat actor impersonating Sphere 3D's CFO to steal cryptocurrency, including details on the nature of the attack, the response (engagement with US Federal law enforcement), and outcome (recovery not possible), which clearly answers 'what happened' rather than assessing materiality or describing governance. Specificity is Quantified-Verifiable because the paragraph contains hard numbers including the exact quantity of Bitcoin stolen (26 BTC), the specific dollar value at the time (~$560,000), the year of occurrence (2023), and the specific entity engaged for recovery (US Federal law enforcement).


reasoning: The paragraph provides a purely definitional statement explaining what constitutes a 'cybersecurity threat' for the purposes of the filing, without addressing board governance, management organization, risk management processes, third-party oversight, specific incidents, or strategic business impact. As definitional boilerplate containing no firm-specific details, verifiable claims, or substantive program descriptions, it properly belongs in None/Other with Generic Boilerplate specificity.


fact: IT Lead has 5 years of experience in roles that include oversight of cybersecurity risk management programs

reasoning: The paragraph primarily answers how management is organized for cybersecurity by identifying the IT Lead as the responsible party and detailing their qualifications (5 years experience) and external support structure. The specificity is driven by the externally verifiable, quantified claim regarding the IT Lead's years of experience.


reasoning: Per Rule 6, SPACs and no-operations companies with no cybersecurity program are classified as None/Other. The paragraph states Keen Vision is a blank check company with no operations and therefore no material cybersecurity threats, constituting a disclosure of absence rather than substantive cybersecurity content, warranting Generic Boilerplate specificity.


fact: threat intelligence analysis

fact: regular system scans

reasoning: The paragraph describes program activities (employee training, using external providers for security functions, and vendor contractual requirements), which primarily answers what the cybersecurity program does rather than how third-party risks are centrally managed. Specificity is driven by domain terminology including 'threat intelligence analysis' and 'system scans' that demonstrate cybersecurity expertise beyond generic risk management language.


fact: In May 2025

fact: same day it was discovered

fact: independent external assessment

fact: administrative credentials retained by a former employee

reasoning: The paragraph answers 'What happened in a cybersecurity incident?' by describing a specific event in May 2025 involving unauthorized DNS/email configuration changes by a former employee, including timeline (detected and contained same day), scope (email-routing disruption, no data exfiltration), and remediation (independent external assessment). The specific date (May 2025), containment timeframe (same day), and engagement of an external assessor are externally verifiable facts that elevate the specificity to Level 4.


reasoning: The paragraph describes the Board's delegation of cybersecurity oversight to the Audit Committee and the Committee's evaluation role, which is classic Board Governance content. The language consists entirely of generic risk oversight terms ('considers... critical,' 'delegates oversight,' 'evaluates... program') without domain-specific cybersecurity practices, firm-unique organizational details, or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph contains a negative assertion regarding incident experience ('we have not experienced any cybersecurity incidents to date'), which per Rule 5 classifies as Strategy Integration. The text lacks specific domain terminology, firm-unique details, or verifiable claims, consisting only of generic risk disclosures and speculative impact language that could apply to any company.


reasoning: The paragraph describes management organization for cybersecurity, including specific roles (CEO, MIS consultant, MIS supervisor) and reporting lines (MIS supervisor updates CEO), fitting Management Role. Specificity remains at Level 1 because the titles are below VP/Director thresholds, no domain-specific cybersecurity terminology passes the ERM test (terms like 'prevention, detection, mitigation, remediation' are generic risk management verbs), and no quantifiable or verifiable facts are present.


reasoning: The paragraph describes management's organizational responsibilities for cybersecurity oversight, including coordination with external IT support and accountability for the risk management framework, which directly answers how management is organized to handle cybersecurity (MR). Specificity remains at Level 1 because the paragraph contains only generic oversight language ('actively involved,' 'maintains responsibility,' 'evaluates periodically') that could apply to any risk domain; it lacks specific cybersecurity practices (fails ERM test), firm-specific organizational details (no named roles, committees, or individuals), and verifiable quantitative claims.


reasoning: The paragraph describes general activities of the cybersecurity program (identifying, assessing, and managing risks) but uses generic ERM language ('various information security processes') without specifying actual practices, tools, frameworks, or organizational details. The mention of 'third party hosted services' refers to assets being protected rather than vendor risk management processes, and 'clinical trial data' merely identifies a data type rather than distinguishing the company's cybersecurity posture.


reasoning: The paragraph focuses exclusively on vendor oversight activities (obtaining security reports, monitoring compliance with standards), making Third-Party Risk the central topic. The language is generic boilerplate ('obtain reports,' 'ongoing monitoring,' 'cybersecurity standards') that describes standard vendor management activities without specific cybersecurity domain expertise, firm-unique details, or verifiable facts.


fact: CCDC (named committee specific to the company)

fact: Vendor Management Program (named internal program)

fact: Members of the CCDC review the Vendor Management Program annually (firm-specific operational practice)

reasoning: The paragraph centrally addresses how third-party cyber risks are managed through vendor onboarding due diligence, contractual security requirements, and ongoing monitoring, fitting Third-Party Risk. Specificity is Firm-Specific due to the mention of the 'CCDC' (a named committee unique to the company) and the formal 'Vendor Management Program,' which distinguish this company's organizational structure from generic practices.


reasoning: The paragraph primarily describes Board oversight activities (briefings, annual reviews, strategic guidance) and the information flow from management to the Board, which falls under Board Governance. Despite mentioning management titles (Director of Internal Audit, CFO, Director of IT), these are referenced in the context of informing the Board rather than describing management's organizational structure or qualifications. For specificity, the paragraph contains only generic risk management language ('cybersecurity landscape', 'emerging threats', 'regulatory requirements') without domain-specific technical details, firm-specific organizational facts, or verifiable quantitative claims—all titles mentioned are generic governance roles that do not meet the firm-specific threshold.


fact: vice president of information technology services (VP-level leadership role with IT portfolio)

reasoning: The paragraph primarily describes the Board and Audit Committee's oversight structure for cybersecurity, including how information flows from senior leadership to the board, which is Board Governance. Specificity is Firm-Specific because it identifies a specific VP-level leadership role ('vice president of information technology services') responsible for leading the cybersecurity program, which distinguishes this company's organizational structure.


fact: Chief Information Officer

reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party vendors through pre-engagement security assessments and ongoing monitoring, fitting the Third-Party Risk category. The mention of the Chief Information Officer as the role responsible for conducting regular assessments provides a firm-specific organizational detail (C-level position), elevating the specificity to Level 3 despite otherwise generic process language.


fact: Chief Information Officer (CIO)

fact: more than 20 years of experience in information and operational technology

reasoning: The paragraph identifies the Chief Information Officer as the executive holding primary responsibility for the cybersecurity program and specifies over 20 years of relevant experience, which constitutes a verifiable qualification. This describes management's organizational structure and leadership credentials rather than detailed program activities.


reasoning: The paragraph states a backward-looking materiality conclusion that cybersecurity has not materially affected business strategy, results of operations, or financial condition, which under Rule 5 qualifies as Strategy Integration. The text contains no domain-specific cybersecurity terminology, firm-unique organizational details, or externally verifiable facts, consisting only of generic assertions and cross-references to risk factors, resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes the company's cybersecurity program activities, including risk assessments, security controls, and incident response processes, which aligns with Risk Management Process. It lacks domain-specific terminology (e.g., specific frameworks, tools, or practices like penetration testing or SIEM), firm-specific details (e.g., named roles, team composition), or verifiable facts (e.g., dates, numbers, certifications), consisting instead of generic ERM integration language that fails the domain-adapted threshold.


reasoning: The paragraph provides general business context about IT system dependencies and data handling (describing that the company uses IT systems for operations and handles sensitive patient data) without addressing any substantive cybersecurity governance question. It contains no domain-specific cybersecurity terminology (only generic references to 'secure' processing), no firm-specific organizational details, and no quantifiable or verifiable facts.


reasoning: The paragraph primarily describes the governance chain and information flow to the Audit Committee and Board of Directors (quarterly briefings on the program, immediate notification of material breaches), answering how the board oversees cybersecurity. It lacks domain-adapted terminology (generic 'monitoring' without specific tools or practices), firm-specific facts (no named officers, VP-level titles, or unique organizational details), and verifiable claims (no specific dates, numbers, certifications, or named third parties), resulting in Generic Boilerplate specificity.


fact: Vice President of Information Technology (VP-level role with IT portfolio)

fact: highly centralized (organizational structure)

fact: phishing (domain-specific threat type)

fact: penetration tests (domain-specific security practice)

reasoning: The paragraph primarily describes cybersecurity activities (third-party phishing and penetration testing, implementing remediation processes) rather than focusing on management qualifications or board oversight, making it Risk Management Process. It reaches Firm-Specific specificity by naming a 'Vice President of Information Technology' (a VP-level IT leadership role) and describing the organizational structure as 'highly centralized,' while also demonstrating domain expertise through specific references to 'phishing' and 'penetration tests.'


fact: $30,825 wire transfer amount

fact: April 9, 2024, 10:25 p.m. local Hong Kong SAR time detection timestamp

fact: March 27, 2024 wire transfer date

fact: April 11, 2024 verification date

fact: April 12, 2024 remediation action date

fact: Chief Information Security Officer (CISO) role

reasoning: The paragraph provides a detailed narrative of a specific email spoofing incident including precise timeline (dates/times of detection, wire transfer, verification, and response), financial impact ($30,825), and remediation actions, which is classic Incident Disclosure. The specificity is Quantified-Verifiable due to multiple externally verifiable hard facts including exact dollar amounts, specific timestamps, and calendar dates tied to real events.


fact: cyber incident response plan

fact: prevention, detection, mitigation, and remediation of cyber threats

fact: cyber threat trends

reasoning: The paragraph describes the oversight activities of a Steering Committee (receiving updates from management, reviewing policies, monitoring program effectiveness), which is a governance structure, placing it in Board Governance. Specificity is Domain-Adapted due to precise cybersecurity terminology including 'cyber incident response plan,' the specific operational phases 'prevention, detection, mitigation, and remediation,' and 'cyber threat trends,' demonstrating specialized security domain knowledge beyond generic risk management language.


reasoning: This paragraph describes a blank check company (SPAC) with no operations that explicitly states it has no cybersecurity personnel or processes of its own, relying entirely on third parties. Per Rule 6, SPACs and no-operations companies with no cybersecurity program are classified as None/Other. As a None/Other paragraph, specificity is Generic Boilerplate per the explicit instruction that None/Other paragraphs always receive this classification.


fact: penetration testing

fact: vulnerability scanning

reasoning: The paragraph describes specific cybersecurity program activities (workforce training, penetration testing, vulnerability scanning, and remediation workflows), which directly answers what the risk management process does. Specificity is Domain-Adapted because it uses technical cybersecurity practices like 'penetration testing' and 'vulnerability scanning' that demonstrate domain expertise beyond generic risk management language, with no firm-specific organizational details or verifiable quantitative claims present.


fact: Cleco's CSIRPs (named internal cybersecurity incident response program)

fact: detection, analysis, containment, eradication, recovery (specific incident response lifecycle phases)

fact: post-incident review

reasoning: The paragraph describes the operational components of Cleco's cybersecurity incident response plans (CSIRPs), including specific technical phases like detection, containment, and eradication, which falls under Risk Management Process. The use of the specific program acronym 'CSIRPs' constitutes a firm-specific fact (Level 3), while the detailed incident response phases demonstrate domain expertise (Level 2).


fact: vulnerability management

reasoning: The paragraph describes the governance structure and information flow from Management to the Board's Audit Committee regarding cybersecurity oversight, including briefing frequency ('regularly') and scope. Specificity is elevated by the domain term 'vulnerability management,' which demonstrates cybersecurity-specific expertise that would not naturally appear in generic enterprise risk management discourse.


reasoning: This paragraph is a cross-reference directing readers to Item 1A Risk Factors and contains no substantive cybersecurity disclosure about the company's program, governance, or processes. Per the classification rules, cross-references default to 'None/Other' and always receive 'Generic Boilerplate' specificity.


reasoning: The company explicitly states it is a SPAC with no business operations and has not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Per Rule 6, SPACs with no operations and no cybersecurity program are classified as None/Other. As a None/Other paragraph, specificity is Generic Boilerplate by definition.


reasoning: The paragraph primarily addresses the material impact of cybersecurity risks on the business, explicitly stating that no incidents have materially affected operations to date while acknowledging potential future material impacts, which aligns with Strategy Integration. The content consists of generic risk disclosures and standard SEC materiality language without specific organizational details, quantified metrics, or domain-specific technical implementations, resulting in Generic Boilerplate specificity.


reasoning: The paragraph provides a forward-looking materiality assessment stating that no known cybersecurity risks are reasonably likely to materially affect the company's business strategy, results of operations, or financial condition, which falls under Strategy Integration per Rule 5. It contains no specific cybersecurity domain terminology (failing the ERM test), no firm-specific organizational details (no named officers, teams, or distinguishing programs), and no quantifiable or verifiable facts, resulting in Generic Boilerplate specificity.


fact: In June 2024 (specific date of incident)

fact: involving CDK (named third-party provider)

reasoning: The paragraph primarily answers what happened in a specific cybersecurity incident, providing the timing (June 2024), nature (involving third-party CDK), scope (disrupted operations), and impact (materiality assessment), making Incident Disclosure the dominant category over Risk Management Process. Specificity is Level 4 due to the externally verifiable date and the named third-party entity (CDK Global).


fact: request System and Organization Controls reports from third-party vendors

reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from vendors, including pre-engagement evaluations and requesting SOC reports, which fits Third-Party Risk. The mention of 'System and Organization Controls reports' (SOC reports) demonstrates cybersecurity domain expertise by specifying the exact audit framework used to assess vendor controls, elevating the specificity to Domain-Adapted.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third parties (vendors, CROs, service providers), which is the definition of Third-Party Risk. The language consists entirely of generic risk management terminology ('comprehensive, risk-based approach,' 'identifying and overseeing') that any ERM professional could write without cybersecurity expertise, and contains no firm-specific details, quantified metrics, or verifiable claims.


reasoning: The paragraph describes the company's general cybersecurity risk management activities (monitoring IT networks, preventing/detecting threats) and threat environment without specifying domain-specific practices, firm-unique organizational structures, or verifiable metrics. While it references specific threat types (malware, ransomware, phishing), these are standard business risk terms that any ERM professional would use, failing the domain expertise test for Level 2.


reasoning: The paragraph describes general operational dependence on technology and third-party systems but does not answer any of the six substantive questions—it does not address governance structures, management responsibilities, specific risk management processes, how third-party risks are managed, incident details, or strategic/financial impacts. Lacking specific cybersecurity facts, domain terminology, or verifiable claims, it is classified as None/Other with Generic Boilerplate specificity.


fact: Technology Committee of our Board (named non-generic Board committee responsible for information security oversight)

fact: Information Security Policy (specific named governing policy approved by the Board committee)

reasoning: The paragraph answers how the Board oversees cybersecurity by describing the Technology Committee's approval of policies and oversight of mitigation plans, which is classic Board Governance content under Rule 1. It achieves Firm-Specific status by naming the 'Technology Committee' as the specific Board-level oversight body rather than using generic 'the Board' language, and by identifying the specific 'Information Security Policy' as a key governing document.


fact: Executive Vice President of Technology

fact: reports directly to the Chief Executive Officer

fact: over 16 years of experience managing information technology and cybersecurity matters

reasoning: The paragraph primarily describes the management structure for cybersecurity oversight, identifying the specific executive role (EVP of Technology), reporting line to the CEO, and quantified professional experience (16+ years), which satisfies the Management Role category. The specificity reaches Level 4 due to the verifiable claim of 'over 16 years of experience,' which establishes a concrete, auditable threshold, alongside firm-specific organizational details like the exact title and reporting structure.


category_confidence: medium

reasoning: The paragraph describes the board and management meeting periodically to assess cybersecurity status and determine next steps, which constitutes governance oversight structure. The language is entirely generic—containing no specific cybersecurity domain terminology (fails ERM test), no firm-specific roles or committees beyond generic 'board of directors,' and no quantifiable or verifiable facts.


fact: Chief Operating Officer responsible for assessing and managing material cybersecurity risks

fact: Chief Compliance Officer responsible for assessing and managing material cybersecurity risks

fact: Management expertise spans information systems technology, cybersecurity, regulatory compliance, and corporate governance

fact: Communications regarding cybersecurity incidents involve legal, operations, information technology, and compliance personnel

reasoning: The paragraph primarily answers how management is organized to handle cybersecurity by identifying specific C-level officers (COO and Chief Compliance Officer) as responsible for risk assessment and management, describing their multidisciplinary expertise, and detailing the specific departments (legal, operations, IT, compliance) involved in incident communications. These organizational specifics distinguish this company's structure from generic descriptions, establishing Firm-Specific specificity.


fact: penetration testing

fact: forensic analysis

fact: NIST framework

reasoning: The paragraph primarily answers how third-party cyber risks are managed, describing FRI's risk-based approach to vendor oversight, diligence procedures, and integration of third-party risks into its NIST framework. Specificity is Firm-Specific due to the named internal program 'FRI's Global Corporate Continuity Program,' while also containing domain terms like 'penetration testing' and 'NIST framework.'


fact: managed detection and response services

fact: intrusion prevention and detection applications

reasoning: The paragraph describes operational cybersecurity activities including penetration testing, managed detection and response (MDR) services, and intrusion prevention/detection systems, which are core risk management process components; while third parties are mentioned, they are framed as service providers executing these technical activities rather than as the central governance topic. Specificity is Domain-Adapted because the paragraph employs precise cybersecurity domain terminology (penetration testing, MDR, IDS/IPS) that demonstrates technical expertise beyond what a generic enterprise risk management professional would naturally use, with no firm-specific identifiers (named roles, departments, or quantified claims) present.


fact: Chief Information Security Officer

reasoning: The paragraph primarily answers how the board oversees cybersecurity by describing the Audit Committee's specific oversight responsibilities and establishing the governance chain from Board Committee to CISO to program. Specificity is Firm-Specific due to the mention of the Chief Information Security Officer (a VP-level cybersecurity leadership role), while other terms like 'identify, assess and mitigate' are generic risk management language that fails the ERM domain expertise test.


fact: Forensic investigation completed on December 13, 2023

fact: Last confirmed date of unauthorized third-party activity occurred on November 20, 2023

fact: Malware deployed was not self-propagating

reasoning: The paragraph describes an actual cybersecurity incident with specific timeline details (investigation completed December 13, 2023; last activity November 20, 2023) that are externally verifiable facts, making this Incident Disclosure at Quantified-Verifiable specificity. The mention of non-self-propagating malware also demonstrates domain expertise.


fact: Last confirmed date of unauthorized third-party activity was November 20, 2023

fact: Data was exfiltrated by the unauthorized third-party

reasoning: The paragraph describes a specific cybersecurity incident with concrete timeline details (investigation completed December 13, 2023; last activity November 20, 2023) and technical scope (non-self-propagating malware, data exfiltration, no customer system impact), fitting Incident Disclosure. The specific dates and forensic findings constitute externally verifiable facts, resulting in Quantified-Verifiable specificity.


fact: Quarterly Internal Vulnerability Reports

fact: current Cyber Events briefings

fact: Cybersecurity Risk Assessment

reasoning: The paragraph describes the Board's Risk Management Committee oversight structure and responsibilities, making it Board Governance. It demonstrates domain expertise through specific cybersecurity terminology such as 'Internal Vulnerability Reports' and 'Cyber Events briefings' that would not naturally appear in general enterprise risk management discourse.


reasoning: The paragraph states a materiality conclusion required by SEC Item 106(b)(2)—that cybersecurity threats have not materially affected and are not reasonably likely to materially affect business strategy, results of operations, or financial condition—making it Strategy Integration per Rule 5. Specificity is Generic Boilerplate because the paragraph contains only standard SEC safe-harbor language with no firm-specific organizational details, domain-specific cybersecurity practices, or verifiable quantitative claims.


reasoning: The paragraph primarily answers whether cybersecurity affects the business by stating a materiality conclusion that threats have not materially affected and are not reasonably likely to materially affect the company's business strategy, operations, or financial condition, which is explicitly classified as Strategy Integration under Rule 5. The paragraph contains no specific facts elevating it above Level 1: 'confidentiality framework' and 'document management regulations' are generic business terms that fail the ERM test, there are no firm-specific organizational details or named roles, and the temporal reference 'as of the date of this report' provides only reporting context rather than a verifiable cybersecurity event or metric.


reasoning: This paragraph contains generic introductory language describing the company's business and a nonspecific commitment to security, but does not describe any actual cybersecurity governance structures, risk management processes, or security measures. It lacks domain-specific terminology, firm-specific details, or verifiable facts that would elevate it above boilerplate status.


reasoning: The paragraph answers how the Board oversees cybersecurity by describing the Board's ultimate responsibility, use of committees for assistance, and the Audit Committee's primary oversight role for cybersecurity risks. It employs generic governance terminology ('risk assessment,' 'risk management') that would apply to any risk type and lacks specific security practices, firm-specific structures beyond the standard Audit Committee, or quantifiable details, resulting in Generic Boilerplate specificity.


fact: cyber risk advisory services

fact: third-party technology and expertise

reasoning: The paragraph describes the company's reliance on external consultants and partners as part of its cybersecurity risk management infrastructure, which is a process description (RMP) rather than a discussion of managing third-party risks or internal governance. Specificity is Domain-Adapted because the text references specific service types ('cyber risk advisory') and technical components ('third-party technology') that demonstrate basic cybersecurity domain knowledge beyond generic boilerplate, but lacks firm-unique organizational details or verifiable quantitative claims.


reasoning: The paragraph contains backward-looking ('not aware of any cyber incidents that have been material') and forward-looking ('do not believe that risks...are reasonably likely to materially affect') materiality assessments regarding cybersecurity, which falls under Strategy Integration per Rule 5. It contains no specific facts—only negative assertions about the absence of material incidents and generic cross-references that are neither externally verifiable nor firm-specific—resulting in Generic Boilerplate specificity.


fact: 24/7 SIEM/SOC monitoring

fact: automated off-boarding and access-revocation processes

fact: forensic investigation

fact: SIEM/SOC

fact: domain, DNS, and email operations

fact: targeted cybersecurity training

reasoning: The paragraph primarily describes remediation actions following a specific cybersecurity incident (forensic investigation, automated off-boarding, 24/7 monitoring implementation), with the incident response frame dominant despite the concluding materiality statement. Specificity is Firm-Specific due to the organizational claim of 24/7 SIEM/SOC monitoring and specific process implementations, supported by domain-adapted terminology including forensic investigation, SIEM/SOC, and DNS operations.


fact: Head of Information Technology for Latin America oversees Cybersecurity

fact: 25 years of experience in strategic IT leadership and global project management

reasoning: The paragraph answers how management is organized to handle cybersecurity by identifying a specific leadership role (Head of Information Technology for Latin America), their scope of responsibility (oversees Cybersecurity), and their qualifications (Management Role). The specificity is driven by the externally verifiable claim of '25 years of experience' (a hard number checkable against employment history), supported by the firm-specific organizational fact of a regional IT leadership role with cybersecurity portfolio.


fact: joined Workday in 2010

fact: served as our CISO since April 2018

fact: more than 15 years of experience in cybersecurity and information technology risk management

fact: degree in information systems management

reasoning: The paragraph centers on the CISO's organizational responsibilities, tenure, and professional qualifications, fitting Management Role. Specificity is Quantified-Verifiable due to externally checkable details including specific employment dates (2010, April 2018), a quantified experience threshold (>15 years), and a verifiable educational credential.


reasoning: The paragraph addresses the company's cybersecurity insurance coverage, which is a financial and strategic risk management element falling under Strategy Integration. It contains no specific facts—such as coverage amounts, insurance carriers, policy terms, or deductibles—that would elevate it above generic boilerplate language common across filings.


fact: we have no personnel or processes of our own for this purpose

reasoning: The paragraph primarily answers how the board oversees cybersecurity by describing the board's review of risk factors and oversight of cybersecurity risks. The specificity is Firm-Specific because the disclosure that the company has no cybersecurity personnel or processes of its own distinguishes this SPAC from typical operating companies.


reasoning: The paragraph describes the company's engagement of third-party consultants and service providers to perform cybersecurity activities including risk assessment, security control maintenance, and incident response coordination, which falls under Risk Management Process (per Rule 3, third parties hired to serve the company map to RMP, not TP). The language consists entirely of generic terms ('risk assessment', 'security controls', 'external service providers') that fail the ERM test for domain expertise and contain no firm-specific details or verifiable facts, resulting in Generic Boilerplate specificity.


fact: May 2014 (specific date of incident occurrence)

fact: email spoofing (specific attack vector)

fact: subsidiary impersonation (specific target of attack)

fact: no money sent to scammer's bank account (specific outcome)

reasoning: The paragraph describes a specific historical cybersecurity incident (an email spoofing attack in May 2014), which fits Incident Disclosure. It contains a verifiable specific date (May 2014) tied to the actual event, along with concrete details about the attack method, target, and financial outcome, making it Quantified-Verifiable.


reasoning: This paragraph contains introductory boilerplate language stating a general commitment to cybersecurity and acknowledging risks without describing specific governance structures, management roles, risk management processes, or materiality assessments. It lacks domain-specific cybersecurity terminology, firm-specific details, or verifiable facts, consisting only of generic statements applicable to any public company.


fact: Form 8-K filed on February 29, 2024

fact: MOVEit Cybersecurity Incident

fact: PBI (named third party engaged for investigation)

fact: approximately 2.5 million to 2.7 million affected policyholders/customers

fact: social security numbers exposed

fact: DSCP (Disclosure and Security Control Policy - named internal program)

reasoning: The paragraph primarily answers what happened in a specific cybersecurity incident by detailing the MOVEit incident disclosure date, investigation scope with named third-party PBI, and quantified impact (2.5-2.7 million records including SSNs), making it Incident Disclosure. Specificity is Quantified-Verifiable due to multiple externally verifiable facts including the specific filing date (February 29, 2024), named incident, named investigator, and hard numbers of affected individuals.


reasoning: This paragraph is a generic introductory statement affirming the importance of cybersecurity without answering any of the six substantive questions (it describes no governance structure, management roles, specific processes, third-party oversight, incidents, or strategic impact). It contains only boilerplate language ('robust cybersecurity measures,' 'confidentiality, integrity, and availability') that could apply to any company and demonstrates no domain expertise, firm-specific details, or verifiable facts.


fact: Chief Technology Officer (CTO)

fact: Chief Information Security Officer (CISO)

reasoning: The paragraph describes Board and Audit Committee oversight of cybersecurity, including the governance chain for receiving reports from management, which aligns with Board Governance. Specificity is Firm-Specific because the paragraph identifies distinct C-suite cybersecurity leadership roles (CTO and CISO) that distinguish the company's organizational structure.


reasoning: This paragraph consists of forward-looking speculation and disclaimers about potential impacts of hypothetical cybersecurity incidents ('could cause,' 'could materially impact'), which falls under None/Other per Rule 5 and Rule 6. It contains no substantive description of actual governance structures, management roles, risk management processes, or third-party oversight—only generic references to an 'information security program' designed to 'prevent, detect and respond' without any specific methodology or measures. As a None/Other paragraph with no verifiable facts, firm-specific details, or domain-adapted terminology describing actual practices, it receives Generic Boilerplate specificity.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party vendors, fitting the Third-Party Risk category. However, it lacks specific facts above Level 1: it describes a 'formal, documented process' without naming specific assessment methodologies (e.g., SOC 2 reviews, penetration testing), security standards, or firm-specific organizational details, and contains no quantifiable or verifiable claims.


fact: insider threat controls

fact: alert on suspicious or unusual insider activity

fact: prevent data loss

fact: external sharing of company information

reasoning: The paragraph describes specific cybersecurity program activities for managing insider threats and preventing data loss/exfiltration, which are domain-specific operational practices (RMP). It contains domain terminology ('insider threat controls,' 'data loss') that demonstrates cybersecurity expertise rather than generic risk management language, but lacks firm-specific organizational details or quantifiable metrics that would elevate it to higher specificity levels.


reasoning: The paragraph provides a materiality assessment stating that cybersecurity risks have not materially affected and are not reasonably likely to materially affect the company's business strategy, results of operations, or financial condition, which falls squarely under Strategy Integration per Rule 5. The text contains only generic speculation about future material adverse effects and negative self-assertions without any domain-specific terminology, firm-specific organizational details, or externally verifiable facts, resulting in Generic Boilerplate specificity.


fact: Executive Vice President – Operations

fact: technology services team

fact: CTO reports to Executive Vice President – Operations

fact: cybersecurity incidents reported to legal department

reasoning: The paragraph primarily answers how management is organized to handle cybersecurity, describing reporting lines (CTO to EVP-Operations), incident escalation paths (to legal), and management qualifications. Specificity is Firm-Specific due to identification of executive-level cybersecurity leadership roles (CTO, EVP-Operations) and the specific technology services team designation.


reasoning: The paragraph states a negative conclusion regarding material cybersecurity incidents ('have not had any known instances of material cybersecurity incidents'), which per Rule 5 constitutes Strategy Integration. Specificity is Generic Boilerplate because the text contains only standard forward-looking disclaimers and unverifiable negative assertions, with no domain-specific cybersecurity practices, firm-unique organizational details, or externally verifiable facts.


fact: design and assess program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF)

reasoning: The paragraph describes the company's cybersecurity risk assessment methodology and framework adoption (NIST CSF), which directly answers what the program does (Risk Management Process). Specificity is Domain-Adapted because citing the NIST CSF specifically demonstrates cybersecurity domain expertise that would not appear in generic ERM language.


reasoning: The paragraph describes external regulatory requirements (SEC disclosure rules effective December 18, 2023, and federal banking agency oversight) and cross-references another section for additional information, without providing substantive disclosure about the company's own cybersecurity governance, management, processes, or strategy. As a None/Other paragraph, it receives Generic Boilerplate specificity.


reasoning: This paragraph is a pure cross-reference, directing readers to another section of the filing where materiality assessments are discussed, without containing any substantive cybersecurity disclosure itself. As a cross-reference with no specific facts, it falls under None/Other with Generic Boilerplate specificity.


fact: quarterly vulnerability scanning

fact: PCI DSS compliance requirements

fact: annual network assessments

fact: annual penetration testing

fact: vulnerability scans as part of cyber insurance underwriting process

reasoning: The paragraph describes specific cybersecurity assessment activities (vulnerability scanning, penetration testing) and regulatory standards (PCI DSS) that demonstrate cybersecurity domain expertise, satisfying Level 2. It does not contain firm-specific identifiers (e.g., named officers, committee names, team compositions) or externally verifiable facts (e.g., specific dates, vendor names, certification numbers), so it does not reach Level 3 or 4. The content addresses what the cybersecurity program does regarding third-party assessments, which falls under Risk Management Process rather than Third-Party Risk (which covers vendor oversight, not use of third-party assessors).


reasoning: This paragraph is purely a cross-reference directing readers to Item 1A (Risk Factors) for information about whether cybersecurity risks have materially affected the company. It contains no substantive cybersecurity disclosure, governance description, or materiality assessment itself—only a pointer to where such information is located. As a cross-reference paragraph, it receives 'None/Other' classification and 'Generic Boilerplate' specificity per the classification rules.


reasoning: The paragraph states a materiality conclusion that cybersecurity threats have not materially affected business strategy, results of operations, or financial condition, which per Rule 5 falls under Strategy Integration. The paragraph contains no specific cybersecurity domain terminology, firm-specific details, or externally verifiable facts—only vague temporal references ('To date') and unverifiable negative assertions—resulting in Generic Boilerplate specificity.


fact: October 28, 2023 (date of incident identification)

fact: mid-December 2023 (restoration of facilities)

fact: $1.5 million (expenses incurred)

fact: first quarter of fiscal 2024 (impact period)

reasoning: The paragraph primarily answers what happened in a specific cybersecurity incident, providing a detailed timeline (October 28, 2023 identification through mid-December 2023 restoration), scope (impact on shipping orders), and remediation status. While it includes financial impact ($1.5 million) and a materiality assessment, the incident narrative is dominant. Specificity is Quantified-Verifiable due to hard dates and a precise dollar amount that can be independently verified.


reasoning: This paragraph is a cross-reference to Item 1A Risk Factors rather than a description of actual cybersecurity governance, management, or processes. It contains only generic forward-looking speculation ('could materially and adversely affect') without domain-specific terminology, firm-specific details, or verifiable facts.


reasoning: The paragraph states conclusions about whether cybersecurity risks have materially affected the company (backward-looking) and whether they are reasonably likely to materially affect it (forward-looking), which is the definition of Strategy Integration per Rule 5. Specificity is Generic Boilerplate because the text consists entirely of standard SEC template language for materiality assessments without any verifiable facts, firm-specific organizational details, or cybersecurity domain terminology (e.g., specific tools, frameworks, or practices).


reasoning: The paragraph describes the governance chain for cybersecurity oversight: Board of Directors → Risk Committee → oversight of IT/cyber risks. This answers 'how does the board oversee cybersecurity' (BG), not management's organizational structure. Specificity is Level 1 because the language is generic risk governance terminology ('primary responsibility for risk oversight', 'communicating material risks') that passes the ERM test—any non-security risk professional could write this about financial or operational risks by substituting the risk type. No domain-specific practices, firm-unique structures, or verifiable facts are present.


reasoning: This paragraph constitutes a backward-looking materiality assessment stating that the company is unaware of any historical cybersecurity incidents that materially impaired operations or financial reporting, which falls squarely under Strategy Integration per Rule 5 (negative assertion). The statement contains no specific dates, quantified metrics, named roles, domain-specific security practices, or externally verifiable claims—only a generic negative assertion—resulting in Generic Boilerplate specificity.


reasoning: The paragraph focuses on the company's Third Party Program for managing third party risk, making Third-Party Risk the appropriate category. However, the content uses generic enterprise risk management language ('identification, measurement, management, monitoring and reporting') that would apply to any risk type and could be written by any ERM professional without cybersecurity expertise, containing no domain-specific terminology, firm-specific program identifiers, or verifiable facts.


reasoning: The paragraph describes the governance chain for cybersecurity oversight: Board (via Audit Committee) → CEO → third-party consultants. This is classic oversight structure description, making it Board Governance. For specificity, the paragraph contains only generic governance language ('management's responsibility,' 'Audit Committee,' 'CEO,' 'third-party consultants') that any ERM professional would use for any risk type. No domain-adapted cybersecurity terms, no firm-specific details (named officers, specific committees beyond Audit Committee), and no verifiable facts (numbers, dates, named products) are present.


fact: To date, we have not had a cybersecurity incident

reasoning: The paragraph primarily answers whether cybersecurity has materially affected the business by stating that no incidents have occurred to date, which is a backward-looking materiality assessment per Rule 5. This negative assertion about incident history is a firm-specific fact (Level 3) that distinguishes the company's disclosed posture, even though it is not externally verifiable.


fact: CIO has more than twenty years of experience

fact: has been CIO since 2007

fact: Cyber Risk Committee

fact: virtual Chief Information Security Officer

fact: escalated non-standard IT change requests

reasoning: The paragraph primarily describes the management organizational structure for cybersecurity, including the composition of the Manager's Cyber Risk Committee, the CIO's responsibilities and qualifications, and reporting lines to executive officers, fitting Management Role. Specificity is Level 4 due to verifiable hard facts regarding the CIO's tenure (since 2007) and quantified experience (more than twenty years).


fact: prevention, detection, mitigation, and remediation of cybersecurity incidents

reasoning: The paragraph describes management's organizational structure for cybersecurity, identifying the Senior Director and Head of Information Technology as the leader of the program and noting their reporting relationship to a management committee, which aligns with Management Role. The specificity is Domain-Adapted because the paragraph uses technical cybersecurity terminology—specifically the four-phase incident response framework of 'prevention, detection, mitigation, and remediation'—which demonstrates domain expertise beyond generic risk management language, though it lacks firm-specific structural details (e.g., the title is below VP-level without a security qualifier) or quantifiable metrics.


fact: threat intelligence

fact: prevent, detect, mitigate, and remediate cybersecurity risks

fact: security tools deployed in the IT environment

reasoning: The paragraph answers how management is organized to handle cybersecurity by identifying specific executive leadership roles (CFO, Senior Vice President and General Counsel) and describing their supervisory function over the cybersecurity program. It is classified as Management Role because the primary focus is on management's organizational responsibilities and oversight activities rather than the board or specific program mechanics. Specificity is Domain-Adapted because the paragraph uses cybersecurity-specific terminology ('threat intelligence,' 'prevent, detect, mitigate, remediate') that demonstrates domain expertise beyond generic risk management language, but contains no firm-specific details (only generic titles like CFO) or verifiable facts.


fact: CISO (Chief Information Security Officer) - cybersecurity leadership role at VP level or above

reasoning: The paragraph centers on the Audit Committee's oversight responsibility, the governance chain for cybersecurity reporting (CISO to Committee to Board), and Board education practices—classic Board Governance content. Specificity reaches Firm-Specific due to the mention of 'our CISO,' which identifies a specific cybersecurity leadership role at the VP level or above, but lacks quantified metrics, specific dates, or externally verifiable claims (e.g., certifications, named assessors) required for Level 4.


fact: May 2020 (specific date of ransomware attack)

fact: ransomware attack (domain-specific threat type)

fact: self-hosted environment (architectural domain term)

fact: Security Incident (firm-specific capitalized designation for the 2020 event)

fact: subset of data removed (specific scope detail)

reasoning: The paragraph primarily answers 'What happened?' by describing the May 2020 ransomware attack, including the timing, nature (ransomware), and scope (data removed from self-hosted environment), making it Incident Disclosure. Specificity is Level 4 because the date 'May 2020' provides a verifiable temporal anchor for the specific incident, and the detailed description of the attack constitutes firm-specific facts that could be confirmed against external reporting.


reasoning: The paragraph describes the company engaging external parties to develop its cybersecurity processes and incident response capabilities, which constitutes a Risk Management Process disclosure. The language consists entirely of generic ERM terminology ('processes and procedures,' 'response plan') that could apply to any risk domain, with no domain-specific cybersecurity practices, firm-unique details, or quantifiable facts to elevate specificity above Level 1.


reasoning: The paragraph describes the Board of Directors' ultimate oversight of cybersecurity risk and the Audit Committee's assisting role in reviewing the program, which directly answers how the board governs cybersecurity. Specificity is Generic Boilerplate because the text contains only standard governance terminology (Board, Audit Committee, enterprise risk management, regular reviews) that any ERM professional could apply to any risk type, with no domain-specific cybersecurity practices, firm-unique structures, or verifiable facts.


reasoning: The paragraph centers on managing cybersecurity risks associated with third-party service providers and the existence of a third-party risk management program, making Third-Party Risk the appropriate category. The content is generic boilerplate (Level 1) as it merely states the company has implemented a program without describing specific vendor oversight activities, security requirements imposed on vendors, firm-specific organizational details, or any quantifiable or verifiable facts.


reasoning: This paragraph contains a backward-looking materiality assessment stating that past cyber incidents did not materially affect business outcomes, which falls under Strategy Integration per Rule 5 (SI materiality rule). It contains no specific facts—only a negative assertion about materiality that is not externally verifiable, a vague reference to past incidents without description, and a cross-reference to Risk Factors—resulting in Generic Boilerplate specificity.


reasoning: This paragraph is a pure cross-reference directing readers to Item 1A for information on material effects of cybersecurity threats and contains no substantive cybersecurity disclosure itself. As a None/Other paragraph, it receives Generic Boilerplate specificity.


reasoning: The paragraph describes the company's employee cybersecurity training and awareness activities, which are core components of the cybersecurity risk management program (RMP). The language is entirely generic—containing no specific training methodologies, frameworks, technologies, organizational roles, or quantifiable details that would demonstrate domain expertise or firm-specific implementation—resulting in Level 1 specificity.


reasoning: The paragraph primarily answers whether prior cybersecurity incidents have materially affected the business, providing a backward-looking materiality assessment ('have not had a material adverse effect'), which falls under Strategy Integration per Rule 5. It contains no firm-specific details (roles, committees), no domain-adapted terminology that demonstrates cybersecurity expertise (it uses generic risk language any ERM professional could write), and no quantified or verifiable facts (negative assertions about incident impact are not externally verifiable).


fact: Prudential's CISO

fact: CIO

fact: Operational Risk Management

fact: Manager

fact: Subadviser

reasoning: The paragraph describes Board oversight of cybersecurity, including review of IT security controls and the frequency of updates from management, which aligns with Board Governance. Specificity is Firm-Specific due to the identification of VP-level cybersecurity leadership roles (CISO, CIO) and the Operational Risk Management department that provide updates to the Board, as well as the specific entities (Manager, Subadviser) whose controls are reviewed.


reasoning: The paragraph describes the company's activities for assessing cyber risk, including engaging external firms to conduct evaluations and implementing recommended network upgrades, which directly answers what the cybersecurity program does (Risk Management Process). However, it lacks domain-specific terminology beyond generic 'risk assessment' language, contains no firm-specific details such as named vendors, roles, or committees, and offers no quantifiable metrics or verifiable claims (e.g., specific dates, headcounts, or certifications), resulting in Generic Boilerplate specificity.


fact: Risk Management, Legal and/or Information Security Departments

fact: service organization controls reports

reasoning: The paragraph centrally addresses how the company manages vendor cybersecurity risk through contract review and due diligence programs (Third-Party Risk). Specificity is Firm-Specific because it identifies the specific organizational departments (Risk Management, Legal, and Information Security) responsible for oversight, and Domain-Adapted through reference to 'service organization controls reports' (SOC reports), which demonstrates cybersecurity-specific expertise.


fact: CISO has over 30 years of industry experience

fact: CISO joined Visa in November 2015

fact: President of Technology joined Visa in November 2013

fact: President of Technology has over 30 years of experience

reasoning: The paragraph focuses on the qualifications, tenure, and cybersecurity responsibilities of Visa's CISO and President of Technology, making it Management Role. Specificity is Quantified-Verifiable due to precise employment dates (November 2015, November 2013) and quantified experience claims (over 30 years) that are externally verifiable.


reasoning: The paragraph describes the Board's risk oversight function and delegation to the Audit Committee, including reporting relationships from management, which is classic governance structure. It contains no domain-specific cybersecurity terminology, firm-specific organizational details, or verifiable facts, consisting only of generic oversight language.


fact: August 2021 (date of cybersecurity incident)

fact: January 2023 (date of cybersecurity incident)

fact: Note 18 – Commitments and Contingencies (financial statement reference)

reasoning: The paragraph primarily addresses the financial and business impacts of past cybersecurity incidents (costs incurred, insurance coverage limits, potential material adverse effects), which aligns with Strategy Integration under Rule 4 and Rule 5 (materiality assessment). Specificity is Level 4 due to verifiable dates (August 2021, January 2023) referencing publicly disclosed incidents and the specific citation to Note 18 in the financial statements.


fact: Chief Information Security Officer (CISO) - VP-level cybersecurity leadership role

fact: Chief Information Officer (CIO) - VP-level IT leadership role

fact: internal Technology and Operations Committee - named cross-functional committee overseeing cyber risks

reasoning: The paragraph describes how cybersecurity management is organized, including specific executive titles (CISO, CIO) and reporting lines, fitting Management Role. The presence of specific VP-level cybersecurity leadership titles and a uniquely named internal committee (Technology and Operations Committee) provides firm-specific organizational facts, establishing Level 3 specificity.


fact: Chief Financial Officer is the primary person responsible for overseeing the cybersecurity risk management program

fact: CFO has had oversight of cybersecurity programs since the second half of 2021

fact: CFO cybersecurity oversight is not a full-time function

fact: CFO is not an experienced computer professional

reasoning: The paragraph primarily answers how management is organized to handle cybersecurity by identifying the CFO as the responsible executive, detailing his tenure since H2 2021, and describing his qualifications and capacity constraints (not full-time, not an experienced computer professional). This organizational and role-specific content clearly fits Management Role. The specificity is Firm-Specific (Level 3) due to the identification of the CFO as the cybersecurity lead, the specific timeframe of his oversight, and the distinctive details about his part-time capacity and lack of technical background, which collectively distinguish this company's approach from generic disclosures.


reasoning: The paragraph states a backward-looking materiality assessment that the company 'did not experience any cybersecurity incidents that have materially affected' business outcomes, which falls under Strategy Integration per Rule 5. The text contains no firm-specific cybersecurity facts, verifiable metrics, or domain-adapted terminology—only generic risk disclaimers and a temporal negative assertion—resulting in Generic Boilerplate specificity.


fact: ISIRP (named internal program/acronym for Information Security Incident Response Plan)

fact: System and Organization Control reports (domain terminology)

reasoning: The paragraph centrally addresses how third-party cyber risks are managed through due diligence, contractual data protection covenants, and ongoing vendor monitoring using SOC reports, fitting Third-Party Risk. Specificity is Firm-Specific due to the named internal program 'ISIRP' (a distinguishing acronym for the bank's incident response plan), while 'System and Organization Control reports' provides domain-adapted terminology.


reasoning: The paragraph centers on managing cybersecurity risks related to third-party service providers, placing it in the Third-Party Risk category. However, the content employs generic enterprise risk management language ('implemented a third party risk management program') that passes the ERM test, lacking specific security practices, organizational structures, or verifiable facts, resulting in Generic Boilerplate specificity.


fact: Our CISO (cybersecurity leadership role at VP level or above)

fact: Executive Steering Committee includes CEO, CFO, Executive Vice President Engineering, Senior Director IT, and General Counsel (firm-specific committee composition and membership)

fact: multidisciplinary teams across the Company (both standing, regular teams and special teams as needed) (firm-specific team structure)

reasoning: The paragraph primarily answers how management is organized to handle cybersecurity by detailing the CISO role, the specific membership of the Executive Steering Committee (including CEO, CFO, EVP Engineering, and General Counsel), and the structure of multidisciplinary teams. While it mentions program activities, the focus is on roles, responsibilities, and reporting lines. Specificity is Firm-Specific due to the identification of the CISO position and the detailed composition of the management-level steering committee.


fact: open-source intelligence risk assessments

fact: posture and intelligence reviews of vendors

fact: monitoring and rating services

fact: embedding cyber controls and practices in service level agreements

reasoning: The paragraph centrally addresses vendor oversight through specific cybersecurity mechanisms like open-source intelligence assessments and posture reviews, fitting Third-Party Risk. Specificity is Domain-Adapted because terms such as 'open-source intelligence' and 'posture reviews' demonstrate cybersecurity domain expertise that exceeds generic enterprise risk management vocabulary, with no firm-specific details or verifiable claims present.


reasoning: The paragraph provides the SEC-required materiality assessment that cybersecurity risks 'have not materially affected and are not reasonably likely to materially affect' business strategy, results of operations, or financial condition, and mentions insurance coverage in generic terms. It contains no specific coverage amounts, dates, incident details, or domain-specific technical terminology, resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes the company's cybersecurity program activities—specifically maintaining incident response plans and testing them—which falls under Risk Management Process. However, the language is entirely generic ('incident response and recovery plans,' 'periodic basis') and explicitly matches the Level 1 examples provided; per the guidelines, 'incident response plan' fails the ERM test and remains boilerplate without specific methodologies, tools, frequencies, or verifiable details.


reasoning: The paragraph contains only generic forward-looking speculation about potential IT system failures ('could disrupt our business') without describing any actual cybersecurity governance structures, risk management processes, or specific measures. Per Rule 5, speculative language about potential material adverse effects is not Strategy Integration, and per Rule 6, this falls below the threshold for substantive cybersecurity disclosure. As a None/Other paragraph, it receives Generic Boilerplate specificity.


fact: layered security model

fact: confidentiality, integrity, and availability

reasoning: The paragraph describes the cybersecurity program's operational architecture and protective objectives (layered security model, CIA triad), placing it in Risk Management Process. It demonstrates domain expertise through specific information security architecture terminology that would not appear in generic enterprise risk management discourse, but contains no firm-specific organizational details or quantifiable metrics that would elevate it to higher specificity levels.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers, suppliers, and manufacturers through contractual requirements, fitting the Third-Party Risk category. For specificity, the language consists of generic vendor management descriptions ('selection and oversight,' 'agree by contract') without naming specific security standards, verification methods (e.g., SOC 2), organizational roles, or quantifiable details that would demonstrate domain expertise or firm-specific facts.


reasoning: The paragraph constitutes the SEC-required materiality assessment stating that cybersecurity threats have not materially affected and are not reasonably likely to materially affect the company (backward and forward-looking), which falls under Strategy Integration per Rule 5. Specificity is Generic Boilerplate because the paragraph contains only standard compliance language with no domain-specific terminology, firm-specific organizational details, or externally verifiable facts; the negative assertion regarding absence of material incidents is explicitly excluded from Level 4 per the annotation guidelines.


reasoning: The paragraph centrally addresses managing risks from third-party vendors and developing a vendor risk management program, fitting the Third-Party Risk category. It contains no specific facts, domain terminology demonstrating cybersecurity expertise (failing the ERM test), firm-specific details, or verifiable claims, resulting in Generic Boilerplate specificity.


fact: conducts at least one incident response test exercise on an annual basis

reasoning: The paragraph details the company's incident response workflows, escalation protocols, and testing cadence, which are core Risk Management Process activities. The specificity is Level 4 because it contains a verifiable quantitative commitment to conduct 'at least one' test exercise annually.


fact: cybersecurity consultants

fact: threat assessments

fact: security enhancements

reasoning: The paragraph describes engaging external experts to evaluate and test the company's risk management systems through audits and threat assessments, which falls under Risk Management Process (third parties hired as assessors rather than managing vendor risk). Specificity is Domain-Adapted due to cybersecurity-specific terminology including 'threat assessments' and 'cybersecurity consultants' that demonstrate specialized domain knowledge beyond generic enterprise risk management language.


fact: Chief Information Security Officer (CISO) - cybersecurity leadership role at VP level or above

reasoning: The paragraph describes the organizational structure of the security team and the specific leadership responsibilities of the CISO, fitting the Management Role category. The identification of a 'Chief Information Security Officer' constitutes a firm-specific leadership fact, establishing Level 3 specificity.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks associated with third-party service providers and suppliers, fitting the Third-Party Risk category. It lacks specific cybersecurity domain terminology (failing the ERM test), firm-specific program names or organizational details, and any quantifiable or verifiable claims, resulting in Generic Boilerplate specificity.


fact: Audit Committee engages in discussions with the COO and Company management at least once a year

fact: vulnerability assessments

reasoning: The paragraph primarily describes the Board and Audit Committee's oversight structure for cybersecurity, including the delegation of risk purview and the information flow from management to the committee, which fits Board Governance. The specificity is Quantified-Verifiable due to the inclusion of the measurable engagement frequency 'at least once a year,' which establishes a verifiable threshold for oversight meetings.


reasoning: This paragraph consists of generic forward-looking speculation about potential cyber risks ('may be subject to certain risks') and broad statements about business dependency on security without describing any actual governance structures, management organization, specific processes, or materiality assessments. As boilerplate risk disclosure without substantive cybersecurity measures, it falls under None/Other and receives Generic Boilerplate specificity.


reasoning: This paragraph consists of forward-looking speculation about potential increased costs and hypothetical material adverse effects from possible future security breaches, without describing actual cybersecurity governance, management organization, risk management processes, or specific security measures. It contains no domain-specific terminology, firm-specific facts, or verifiable claims—only generic risk disclosure language applicable to any company.


reasoning: The paragraph centrally addresses vendor risk management by describing pre-engagement assessments and contractual security requirements for third-party service providers, fitting the Third-Party Risk category. However, the language consists entirely of generic ERM concepts ('process,' 'assess,' 'requirements,' 'standards') that could apply to any risk type without modification, failing the ERM test for domain expertise and containing no firm-specific details or verifiable facts.


reasoning: The paragraph provides a backward-looking materiality assessment stating that no cybersecurity threats or incidents materially affected the business during 2022-2024, which falls under Strategy Integration per Rule 5 (negative assertion about material impact). It contains no specific facts about the company's cybersecurity program, organizational structure, or verifiable metrics—only a negative assertion about the absence of incidents that is not externally verifiable, resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes the Fund's processes for assessing and managing cybersecurity risks and references a cybersecurity program implemented by the Adviser, which aligns with Risk Management Process (RMP). Applying the person-removal test, removing the entity 'Adviser' leaves substantive description of risk management activities, confirming RMP over Management Role. The language consists of generic ERM phrases ('processes to assess, identify, and manage material risks') that pass the swap test with financial risks, and lacks specific domain terminology, firm-unique details, or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers whether cybersecurity has materially affected the business via a backward-looking negative materiality assertion ('have not experienced any cybersecurity incidents that have been determined to affect us materially'), which falls under Strategy Integration per Rule 5. Specificity is Generic Boilerplate because the paragraph contains only unverifiable negative assertions, generic references to 'Business Continuity and Incident Response programs' (terms explicitly failing the ERM test per the Level 1 guidance), and a cross-reference, with no domain-specific terminology, firm-unique organizational details, or quantified verifiable facts.


reasoning: The paragraph describes engaging external consultants to assess and test cybersecurity controls, which is a program activity (RMP) rather than vendor oversight (TP) under Rule 3. However, the language is entirely generic—lacking specific domain practices (e.g., penetration testing, SOC 2), firm-unique structures, or verifiable details—resulting in Level 1 specificity.


fact: Chief Information Security Officer (CISO) - VP+ cybersecurity leadership role

fact: served in the role since 2015 - verifiable tenure duration

fact: application security - domain expertise

fact: intrusion detection - domain expertise

fact: penetration testing - domain expertise

fact: complex threat modeling - domain expertise

fact: unconventional cyber-attack vectors - domain expertise

fact: devoted full time - firm-specific team dedication

fact: RCOC - named committee (Risk Committee or equivalent)

reasoning: The paragraph primarily answers how management is organized for cybersecurity, detailing the CISO's role, specific qualifications (application security, penetration testing), tenure since 2015, and team structure. Specificity reaches Level 4 due to the verifiable tenure claim ('since 2015') and firm-specific organizational details (CISO title, RCOC, full-time team), supported by domain-specific expertise terminology.


fact: outsourced all of our internal bookkeeping and accounting functions to a third-party accounting firm

fact: records stored on the company's systems are primarily non-financial in nature

fact: information technology systems are minimal due to company's small size and nature of operations

reasoning: The paragraph primarily answers how third-party cyber risks are managed, focusing on outsourcing of accounting functions and reliance on vendor cybersecurity protections. Specificity is Firm-Specific (Level 3) due to unique organizational details about the company's minimal IT infrastructure, the non-financial nature of their stored records, and their complete outsourcing of bookkeeping functions.


reasoning: The paragraph primarily answers how the board oversees cybersecurity risk, describing the full board's responsibility, the determination that regularly scheduled reports are unnecessary, and the protocol for prompt reporting of material changes. It contains no specific cybersecurity domain terminology (failing the ERM test), no firm-specific details such as named officers or committees, and no quantifiable or verifiable facts, consisting entirely of generic governance language applicable to any risk oversight context.


fact: October 28, 2023 (date of incident identification/announcement)

fact: first quarter of fiscal 2024 (timing of operational impact)

fact: mid-December 2023 (recovery date)

fact: $1.5 million (expenses incurred related to the incident)

reasoning: The paragraph primarily answers 'What happened in a cybersecurity incident?' by describing a real event from October 28, 2023, including its scope (internal operations/IT systems), operational impact (shipping disruption), remediation timeline (operational by mid-December 2023), and financial cost ($1.5 million). While it contains a backward-looking materiality assessment, the incident description dominates. Specificity is Level 4 due to multiple verifiable hard facts including exact dates (October 28, 2023; mid-December 2023), fiscal quarter (Q1 2024), and quantified financial impact ($1.5 million).


reasoning: The paragraph centrally addresses how the company manages cybersecurity threats associated with third-party service providers, fitting the Third-Party Risk category. It employs generic risk management language ('assesses and manages,' 'communicated to management') that would be used for any type of vendor risk without specific cybersecurity domain terms, firm-unique details, or quantifiable facts, warranting a Generic Boilerplate classification.


fact: CISO has more than 20 years of experience

fact: dedicated CISO manages the program

fact: CISO appointed by the RACC

fact: RACC oversees implementation, monitoring and testing of information security program

fact: CISO and CRO meet separately with the chair of the RACC

fact: teams across application and product security, cyber defense, risk management, information governance

fact: enterprise-wide cybersecurity strategy, policy, standards, architecture and processes

fact: incident response procedures

reasoning: The paragraph primarily answers how the board oversees cybersecurity by describing the governance chain: the RACC (Board committee) appoints the CISO, receives quarterly reports, and oversees program implementation, while the CISO manages the program and provides updates. This structure aligns with Board Governance under Rule 1. Specificity is driven by the verifiable claim of the CISO's 20+ years of experience (a checkable threshold), supported by firm-specific governance details (RACC committee, dedicated CISO role) and domain-adapted terminology (application security, cyber defense, incident response).


fact: security awareness training

reasoning: The paragraph describes specific risk management activities—employee security training and integrating cybersecurity into the ERM framework through risk indicator tracking—which falls under Risk Management Process. While the ERM integration language is generic, the mention of 'security awareness training' constitutes a specific cybersecurity practice that demonstrates domain expertise, elevating the paragraph to Domain-Adapted (Level 2).


reasoning: The paragraph describes the company's program activities of reviewing and updating systems and using third-party consultants to assess attacks, fitting Risk Management Process. The language consists entirely of generic risk management terminology ('review and update systems, processes and procedures') that could apply to any business risk, with no domain-specific practices, firm-unique details, or verifiable facts, resulting in Generic Boilerplate specificity.


fact: Fortra, LLC (named third-party vendor)

fact: GoAnywhere managed file transfer as a service system (MFTaaS) (named product)

fact: fiscal 2023 (specific timeframe of incident)

fact: zero-day vulnerability (specific exploit type)

fact: Health Insurance Portability and Accountability Act (specific regulatory framework)

fact: State Attorneys General (regulatory notification recipients)

reasoning: The paragraph answers 'What happened?' by describing a specific past data security incident at vendor Fortra affecting customer PHI/PII, including timeline (fiscal 2023), scope (zero-day exploit, no direct system access but data exfiltration), and response (outside experts, regulatory notifications). Specificity is Level 4 due to externally verifiable facts: named vendor (Fortra, LLC), named product (GoAnywhere MFTaaS), specific incident timing, and specific regulatory frameworks cited.


reasoning: The paragraph enumerates components of the cybersecurity program (risk assessments, offsite backup, use of external assessors, training), which describes what the program does rather than governance structure or management roles. The language consists entirely of generic process descriptions ('risk assessments,' 'offsite backup storage,' 'cybersecurity awareness training') that lack specific domain terminology distinguishing cybersecurity from general enterprise risk management, contain no firm-specific details (named roles, committees, or organizational structures), and offer no quantifiable or externally verifiable facts.


fact: access controls

fact: firewalls

fact: intrusion detection and prevention systems

fact: vulnerability and patch management processes

fact: phishing tests

reasoning: The paragraph describes the company's cybersecurity program activities, technical controls, and operational processes (firewalls, IDS/IPS, patch management, phishing tests) rather than governance oversight or organizational structure, placing it in Risk Management Process. It demonstrates domain expertise through specific security technologies and practices that would not appear in generic enterprise risk management language, but lacks firm-specific organizational details or quantifiable metrics, resulting in Domain-Adapted specificity.


reasoning: The paragraph centers on contractual requirements imposed on third-party service providers regarding security measures and breach reporting, which falls under Third-Party Risk per Rule 3. The language consists of generic obligations ('appropriate security measures', 'reasonable security measures', 'promptly report') that do not demonstrate cybersecurity domain expertise (failing the ERM test) and contains no firm-specific details, named standards, or verifiable facts.


fact: Externally managed company structure

fact: Reliance on Manager's (Bimini's) information systems for operations

fact: Reliance on Manager's processes for cybersecurity risk management

fact: All executive officers are executive officers, directors and employees of Bimini

reasoning: The paragraph describes the management structure for cybersecurity, explaining that as an externally managed company, Orchid Island Capital relies entirely on its Manager (Bimini) for information systems and cybersecurity risk management processes, with all executive officers being Bimini employees. These specific organizational facts about the external management arrangement and entity relationship distinguish this company from others, making it Firm-Specific (Level 3) despite using generic risk management process language that fails the ERM test for Level 2.


fact: National Institute of Standards and Technology Cybersecurity Framework (NIST CSF)

reasoning: The paragraph describes the company's risk management methodology, specifically that they design and assess their program based on the NIST CSF framework. The naming of this specific cybersecurity framework demonstrates domain expertise (Level 2), but the paragraph contains no firm-specific details (e.g., specific roles, team size) or externally verifiable claims (e.g., certification status, dates, numbers).


reasoning: This paragraph constitutes a materiality assessment required by SEC Item 106(b), stating both that cybersecurity threats have not materially affected the company (backward-looking) and that certain risks are reasonably likely to materially affect it if realized (forward-looking), which falls squarely under Strategy Integration per Rule 5. The paragraph contains no domain-specific cybersecurity terminology, firm-specific details (no named roles, committees, or programs), or verifiable facts (no specific numbers, dates, certifications, or named third parties), resulting in Generic Boilerplate specificity.


fact: Chief Information Security Officer

fact: Chief Technology Officer

fact: Chief Operations Officer

fact: over 25 years' experience in the field

reasoning: The paragraph describes the organizational structure for cybersecurity management, including the CISO's responsibilities, reporting lines to the CTO and COO, and the CISO's qualifications, which falls under Management Role. Specificity is driven by the externally verifiable claim of 'over 25 years' experience' and the identification of specific executive roles (CISO, CTO, COO) responsible for cybersecurity oversight.


reasoning: The paragraph describes the company's cybersecurity risk management program activities, specifically risk assessments to identify material risks, answering 'What does the cybersecurity program do?' The language contains only generic references to 'risk assessments' and 'critical systems' without specific methodologies, tools, or domain-specific expertise (failing the ERM test), resulting in Generic Boilerplate classification.


fact: Named internal program: cybersecurity incident response plan ("CIRP")

fact: Domain term: threat intelligence

fact: Domain term: tactics, techniques, and procedures (TTPs)

fact: Domain term: phishing exercises

fact: Domain term: monitoring and detection of cybersecurity environment

reasoning: The paragraph describes specific risk management activities including threat intelligence feeds, employee phishing exercises, continuous monitoring, vendor security assessments, and incident response planning. It qualifies as Firm-Specific due to the named internal program 'CIRP' (Cyber Incident Response Plan), which distinguishes this company's documentation from generic incident response planning. The paragraph also demonstrates domain expertise through specific cybersecurity terminology such as 'tactics, techniques, and procedures' and 'threat intelligence.'


fact: October 3, 2024 (specific date of disclosed cybersecurity incident)

reasoning: The paragraph primarily answers whether cybersecurity has materially affected the business, stating the backward-looking conclusion that no incident has resulted in material impact to financial condition or operations (Strategy Integration per Rule 5). While it references the October 2024 incident, it provides no descriptive details about nature, scope, or response, instead cross-referencing other sections. Specificity is Quantified-Verifiable due to the specific, externally verifiable date 'October 3, 2024' tied to the real incident.


fact: CISO (Chief Information Security Officer) - cybersecurity leadership role at VP level or above

reasoning: This paragraph primarily answers how the board oversees cybersecurity, describing the Board's direct oversight of risk management policies, review of operational risks, and annual reporting from the CISO. The mention of 'our CISO' constitutes a firm-specific fact (Level 3) as it identifies a specific VP-level cybersecurity leadership role distinct from generic governance language.


fact: Chief Information Security Officer (CISO)

fact: Information Technology Committee

fact: at least quarterly

fact: penetration test results

reasoning: The paragraph primarily answers how the Board oversees cybersecurity, describing the Information Technology Committee's review of controls and the CISO's reporting cadence to the Board. Specificity is driven by the verifiable frequency threshold 'at least quarterly,' alongside firm-specific references to the CISO role and Information Technology Committee, and domain-specific mention of penetration testing.


reasoning: The paragraph primarily answers whether cybersecurity affects the business/finances by providing the SEC-required materiality assessment (backward and forward-looking) and disclosing the absence of cybersecurity insurance, both core Strategy Integration topics. Specificity is Generic Boilerplate because the paragraph contains no firm-specific organizational facts (no roles, committees, or team structures), no verifiable quantitative details (the insurance disclosure is a negative assertion, not a coverage amount or named provider), and no domain-adapted terminology that would fail the ERM test (terms like 'cybersecurity incidents' and 'commercial insurance policy' are standard business risk management language).


fact: On July 10, 2024, detected unauthorized occurrences on IT systems

fact: Threat actor was ejected from IT systems on July 10, 2024

reasoning: The paragraph describes an actual cybersecurity incident with specific dates (July 10, 2024) for both detection and remediation, fitting Incident Disclosure. The specific dates tied to the event constitute externally verifiable facts, establishing Level 4 specificity.


reasoning: The paragraph addresses how the company manages financial exposure to cyber incidents through insurance coverage, which is a Strategy Integration topic (financial impact/business protection). It lacks any firm-specific details (no coverage amounts, carriers, or policy limits) and uses generic risk management language that any ERM professional would employ, resulting in Generic Boilerplate specificity.


fact: incident detection

fact: containment

fact: remediation

fact: security incident response plan

reasoning: The paragraph describes the company's incident response capabilities and procedures, which falls under Risk Management Process. While 'incident response plan' alone is generic, the specific enumeration of technical phases—detection, containment, and remediation—demonstrates cybersecurity domain expertise (distinct from generic ERM language) and satisfies the ERM test, warranting Domain-Adapted classification.


reasoning: The paragraph describes the Board's oversight of cybersecurity, including annual board reviews and quarterly audit committee reviews, which is classic Board Governance content. Specificity is Generic Boilerplate because it contains only standard governance language (Board, Audit Committee, annual/quarterly cadences) that applies universally to public companies, with no firm-specific details, domain-specific cybersecurity terminology, or verifiable facts.


reasoning: This paragraph provides generic background on the cyber threat landscape facing companies generally, not specific disclosure about Autonomix Medical's cybersecurity governance, management, processes, or incidents. It contains no firm-specific details, domain expertise (merely listing common attack vectors like 'malware' and 'viruses' that any ERM professional would use), or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph makes a backward-looking negative assertion that 'we did not experience any cybersecurity incidents' as of a specific date, which per Rule 5 falls under Strategy Integration (assessing whether cybersecurity has materially affected the business). The text consists entirely of generic risk impact language and boilerplate process references; it lacks domain-specific terminology, firm-specific organizational details, or externally verifiable facts.