reasoning: The paragraph describes the Audit Committee's oversight responsibilities, reporting lines to the Board, and review cadence regarding cybersecurity risks, which directly addresses board governance structure per Rule 1 (Board-level committee → BG). However, it contains only generic enterprise risk management terminology ('oversight,' 'risk assessment,' 'risk management,' 'annually') that could apply to any risk type without modification; there are no domain-adapted cybersecurity practices, firm-specific organizational details, or quantifiable verifiable facts.


content_category: Board Governance

fact: CTO has over 10 years of experience overseeing cybersecurity functions within technology-driven organizations

fact: COO has over 5 years of experience overseeing cybersecurity and IT functions

category_confidence: high

specificity_confidence: high

reasoning: The paragraph describes the Board's oversight function, delegation of cybersecurity risk oversight to the Audit Committee, and the information flow between management (CTO/COO) and the Board/Committee, including quarterly updates and incident reporting. This governance-chain structure (Board → Committee → Officer) is characteristic of Board Governance. Specificity is Level 4 because it includes externally verifiable, quantified claims about the CTO's and COO's years of experience (over 10 and over 5 years, respectively), which serve as checkable lower-bound thresholds against employment histories.

provider: moonshotai

stage: benchmark


fact: Chief Information Security Officer (CISO)

fact: Chief Information Officer (CIO)

reasoning: The paragraph primarily answers how the Board oversees cybersecurity by describing the governance chain (Board → Audit Committee → CISO/CIO) and briefing frequencies, defaulting to Board Governance under Rule 1. Specificity is driven by the identification of firm-specific executive leadership roles (CISO and CIO) at the VP level or above, which distinguish this company's organizational structure from others.


content_category: Strategy Integration

fact: EVP ERM (Executive Vice President of Enterprise Risk Management) - firm-specific leadership role responsible for quarterly cybersecurity risk reporting

reasoning: The paragraph primarily addresses materiality assessments required by SEC disclosure rules, explicitly stating that no cybersecurity events materially impacted the business in 2024 (backward-looking assessment) and that such matters could pose material future risks (forward-looking assessment), which per Rule 5 defines Strategy Integration. While governance structures are described, the materiality conclusions represent the substantive disclosure. Specificity is Firm-Specific due to the identification of 'EVP ERM' as the specific executive leadership role responsible for cybersecurity reporting.


content_category: Risk Management Process

category_confidence: medium

reasoning: The paragraph describes the company's cybersecurity risk management and governance processes at a high level, emphasizing a proactive approach and leadership involvement. However, it contains no specific cybersecurity domain terminology that passes the ERM test (terms like 'risk management' and 'governance processes' are generic and applicable to any risk domain), no firm-specific details such as named roles or organizational structures, and no quantifiable or verifiable facts.


fact: Externally managed company structure with day-to-day operations managed by Manager and executive officers

fact: Manager is an affiliate of ORIX USA

fact: Manager participates in and is subject to ORIX USA's cybersecurity program

fact: Company relies on ORIX USA and its cybersecurity risk management program to identify, assess and manage material risks

fact: Management agreement with Manager governs the provision of executive officers

reasoning: The paragraph primarily describes the company's cybersecurity risk management approach—specifically, that it relies on ORIX USA's program to identify, assess and manage material risks—which aligns with Risk Management Process (RMP). It achieves Firm-Specific (Level 3) specificity by naming the specific external entity (ORIX USA), describing the affiliate relationship, and detailing the unique externally-managed organizational structure and reliance chain.


fact: Collaboration with Arizona Cyber Threat Response Alliance (ACTRA)

fact: Collaboration with The Internet and Television Association (NCTA)

reasoning: The paragraph describes specific threat intelligence sharing activities and external collaboration processes (RMP), not board oversight, management roles, or vendor risk management. It names two specific external organizations (ACTRA and NCTA) that the company partners with, which are verifiable third-party entities satisfying the Level 4 criterion for named third-party firms.


reasoning: The paragraph describes cybersecurity program activities including continuous environmental monitoring, security tool deployment, and incident response coordination, which categorizes it as Risk Management Process. However, it employs generic terminology ('security tools', 'monitor', 'respond') that fails the ERM test—an enterprise risk management professional could naturally use this language for non-cybersecurity monitoring—and contains no firm-specific details (e.g., named roles, committees) or verifiable facts (e.g., specific tools, headcounts, dates), resulting in Generic Boilerplate specificity.


fact: ransomware

fact: malware

fact: computer viruses

reasoning: The paragraph primarily answers whether cybersecurity has materially affected the business by stating that as of the filing date, no risks or incidents have materially affected business strategy, results of operations, or financial condition—a clear Strategy Integration materiality assessment per Rule 5. It demonstrates domain expertise (Level 2) by specifying concrete threat types including ransomware, malware, and computer viruses rather than using generic risk language.


fact: IT Security Director (Level 3)

fact: Chief Information Officer (Level 3)

fact: threat intelligence (Level 2)

fact: prevention, detection, mitigation, and remediation (Level 2)

reasoning: The paragraph primarily describes the company's cyber risk management program activities (assessing cyber risk, prevention/detection/mitigation/remediation processes, threat intelligence utilization) and applies the person-removal test from Rule 2, leaving substantive program description. Specificity is Firm-Specific due to identification of the IT Security Director and Chief Information Officer leadership roles, while also demonstrating domain expertise through specific cybersecurity terminology.


reasoning: The paragraph describes engaging external service providers to evaluate and enhance information security policies, which constitutes a risk management process activity (third-party assessors per Rule 3). The language is generic and passes the ERM test—terms like 'external service providers,' 'policies and procedures,' and 'regulatory requirements' could apply to any risk management context without demonstrating cybersecurity domain expertise. No firm-specific details, quantified metrics, or verifiable facts are present.


reasoning: The paragraph contains a backward-looking materiality assessment required for Strategy Integration ('not aware of any cybersecurity incidents that have materially affected us to date'), but is otherwise composed of generic forward-looking speculation and cross-references without describing specific cybersecurity measures, governance structures, or incidents. No firm-specific details or verifiable facts are present, resulting in Generic Boilerplate specificity.


content_category: Third-Party Risk

fact: SOC2 report evaluations

fact: evaluation of Trust Services Criteria (security, availability of data, processing integrity, confidentiality, privacy controls)

fact: centralized registry of third-party vendors and suppliers

fact: due diligence surveys and interviews for vendor assessment

reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third parties (service providers, operators, vendors) through specific oversight mechanisms, making it Third-Party Risk. Specificity is Domain-Adapted due to cybersecurity-specific framework terminology (SOC 2, Trust Services Criteria) that demonstrates domain expertise beyond generic enterprise risk management language.


fact: Chief Technology Officer responsible for developing and implementing information security program

fact: hosted expert during 2023 annual board directors' retreat

reasoning: The paragraph primarily answers how the board oversees cybersecurity, describing the audit committee's assisting role, quarterly reporting cadence to the board, and board education efforts (2023 retreat expert), which defaults to Board Governance under Rule 1. Specificity is Firm-Specific because it identifies the Chief Technology Officer as the cybersecurity program lead (VP-level role per instructions) and cites a specific 2023 board retreat event, distinguishing this company's governance practices from generic disclosures.


reasoning: The paragraph centrally addresses vendor oversight by describing the engagement process for third-party IT service providers and the review of their cybersecurity measures, making Third-Party Risk the appropriate category. The language ('customarily includes,' 'among other things,' 'cybersecurity measures') consists entirely of generic business terminology that any enterprise risk management professional could use; it lacks specific security practices, tools, standards, or architectural concepts required for Domain-Adapted status, and contains no firm-specific roles, committee names, or verifiable quantitative claims.


fact: Clarium Managed Services, LLC conducted a Cybersecurity Assessment for the Bank in 2022

fact: Assessment resulted in a score of 4.8 on a scale of 0 to 5

reasoning: The paragraph primarily answers Strategy Integration by providing the SEC-required Item 106(b)(2) materiality assessment, including backward-looking statements ('have not materially affected') and forward-looking statements ('are reasonably likely to materially affect') regarding cybersecurity risks and incidents on business strategy, results of operations, and financial condition. While it references a risk assessment (RMP), the materiality framework dominates the text volume and disclosure purpose. Specificity is Level 4 due to the externally verifiable quantified assessment result (4.8/5 score), named third-party assessor (Clarium Managed Services, LLC), and specific engagement year (2022).


content_category: Incident Disclosure

reasoning: The paragraph describes an actual cybersecurity incident that occurred during the reporting period, including the nature of the incident (employee interactions with suspicious websites), containment actions, forensic investigation, and impact assessment. This clearly answers 'What happened in a cybersecurity incident?' making it Incident Disclosure. For specificity, the paragraph contains only generic temporal references ('during the reporting period'), subjective assessments ('promptly contained'), and standard business terminology ('forensic investigation,' 'material impact') without specific dates, quantified metrics, named entities, or technical cybersecurity domain terminology that would demonstrate expertise. The description uses boilerplate language that could apply to any company's incident disclosure.


fact: engagement with intelligence and law enforcement communities

fact: evaluation by internal and external experts

reasoning: The paragraph primarily describes activities of the cybersecurity program: regular evaluations by experts and external engagement with vendors and law enforcement. While it mentions the Board and Audit Committee, this is incidental to describing the program's governance chain rather than detailing board oversight mechanisms (frequency, scope, expertise). The reference to 'intelligence and law enforcement communities' demonstrates cybersecurity domain expertise (ERM professionals would not naturally use this language for non-cyber risks), satisfying Level 2. No firm-specific distinguishing facts (e.g., 'FactSet Audit Committee' is generic with company name attached) or verifiable quantities are present.


reasoning: The paragraph primarily answers whether cybersecurity has materially affected the business, stating a negative conclusion that the company 'have not experienced a cybersecurity incident that resulted in a material adverse impact,' which per Rule 5 classifies as Strategy Integration. The language contains no specific facts—only generic governance terms ('information security policies and procedures,' 'reviewed on a regular basis') that any ERM professional could apply to non-cyber risks, and the negative incident assertion is not externally verifiable.


content_category: None/Other

reasoning: The paragraph contains a sentence fragment about future operations/financial condition followed by a cross-reference to Item 1A Risk Factors. Per Rule 5, cross-references pointing elsewhere ('see Item 1A') without stating a substantive materiality assessment are classified as None/Other. As a None/Other paragraph, it automatically receives Generic Boilerplate specificity per the validation rules.


fact: scanning our internal network and infrastructure at least monthly

fact: conducting third-party vulnerability testing at minimum on an annual basis

fact: identify, escalate, investigate, resolve and recover from security incidents

reasoning: The paragraph answers what the cybersecurity program does (risk assessment, monitoring, vulnerability management, incident response) without mentioning board oversight (BG), management roles (MR), vendor risk requirements (TP), actual incidents (ID), or business materiality (SI). It demonstrates domain expertise through specific security practices (network scanning, vulnerability testing) and the incident response lifecycle verbs ('identify, escalate, investigate, resolve, recover'), which exceed generic ERM vocabulary. However, it lacks firm-specific organizational identifiers (named roles, committees, programs) and contains no externally verifiable hard numbers (headcount, certifications, named tools, specific dates), keeping it at Level 2.


reasoning: The paragraph describes the incident response workflow and escalation procedures (identify, assess, respond, coordinate, notify), which are core cybersecurity program activities, making it Risk Management Process. Applying the person-removal test, removing references to the Incident Response Team, CEO, and Board leaves substantive process description. However, the language consists of generic risk management verbs (identify, assess, coordinate, notify) that any ERM professional could use without cybersecurity expertise; it lacks specific domain terminology (e.g., forensic analysis, threat hunting, SIEM), firm-specific identifiers (e.g., named teams like 'CIRT'), or verifiable facts (e.g., team size, certifications, dates), resulting in Generic Boilerplate specificity.


fact: Chief Information Officer (CIO) - VP-level leadership role with IT/cybersecurity portfolio

fact: Senior Vice President Internal Audit - VP-level role receiving cybersecurity risk updates

reasoning: The paragraph describes Board oversight of cybersecurity, including annual briefings by management and Audit Committee support, which is classic Board Governance content. Specificity is Firm-Specific because it identifies specific VP-and-above leadership roles (CIO and SVP Internal Audit) involved in the governance chain, distinguishing this company's structure from generic disclosures.


reasoning: The paragraph provides a backward-looking materiality assessment regarding the absence of cybersecurity incidents affecting business outcomes, which per Rule 5 explicitly maps to Strategy Integration ('Have not materially affected our business strategy, results of operations, or financial condition' → SI). For specificity, the text contains only standard SEC materiality boilerplate ('to date', 'materially affected') that any ERM professional would use without cybersecurity domain knowledge, and the negative assertion of no incidents is explicitly excluded from Level 4 per validation rules (self-reported absence is not externally verifiable).


reasoning: The paragraph describes the governance chain for cybersecurity oversight—specifically, management reporting to the Audit Committee and the Committee's evaluation of cybersecurity strategy—which directly answers how the board oversees cybersecurity (Board Governance). The specificity is Firm-Specific because it identifies the 'Senior Director, Global Information Security' role, a director-level title with a security qualifier that distinguishes this company's organizational structure from generic governance descriptions.


reasoning: The paragraph centrally addresses how Peloton manages cybersecurity risks from third-party suppliers and business partners through due diligence, contractual notification requirements, and acknowledgment of monitoring limitations, fitting the Third-Party Risk category. It lacks specific technical practices, organizational details, or quantifiable facts, consisting entirely of generic vendor risk management language that any enterprise could use, resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes the company's cybersecurity program in terms of having 'policies, procedures, and security measures' to 'mitigate risks' and 'ensure compliance,' which aligns with Risk Management Process (what the program does). However, the content is entirely generic—terms like 'safeguarding information systems,' 'mitigate risks,' and 'compliance with applicable laws' pass the ERM test (any enterprise risk professional would naturally use this language for financial or operational risks as well). There are no domain-specific security practices, firm-specific roles or structures, or quantifiable/verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes the company's cybersecurity program activities and procedures (threat detection, incident response, risk mitigation), which aligns with Risk Management Process. It contains only generic capabilities that any company could claim without domain-specific terminology, firm-specific details, or verifiable data points, resulting in Generic Boilerplate specificity.


content_category: Management Role

reasoning: The paragraph attributes ultimate responsibility for cybersecurity oversight to 'executive management,' answering how management is organized to handle cybersecurity (Management Role) rather than describing Board-level governance or specific risk management processes. However, it contains only generic ERM language ('considers cybersecurity risk as part of its risk oversight,' 'ultimate responsibility for overseeing strategy') that any enterprise risk professional could apply to financial or operational risks, with no domain-adapted terminology, firm-specific titles or structure, or verifiable facts.


reasoning: The paragraph states a backward-looking conclusion about the absence of material cybersecurity incidents and immaterial expenses, which falls under Strategy Integration per Rule 5 (negative assertions about materiality). It contains no verifiable facts (negative self-assertions are not externally verifiable), no firm-specific details (any company could make this statement), and no domain-adapted terminology demonstrating cybersecurity expertise, resulting in Generic Boilerplate specificity.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from vendors and third-party providers, fitting the Third-Party Risk category. For specificity, the language is entirely generic—describing standard 'due diligence' and 'periodically reviewing' vendors against 'necessary cybersecurity standards' without naming specific standards (e.g., SOC 2, ISO 27001), controls, or verification methods. This vocabulary would be natural for any ERM professional managing non-cyber vendor risks, and contains no firm-specific details or verifiable facts.


reasoning: The paragraph primarily answers whether cybersecurity has affected the business by stating the Company 'has not experienced a cybersecurity incident that has materially affected our operations, reputation, or financial performance,' which is a backward-looking materiality assessment falling under Strategy Integration per Rule 5. The text contains no specific facts—only generic statements about cyber threats, technologies, and partnerships without domain-specific terminology, firm-unique details, or verifiable data.


reasoning: The paragraph states a materiality assessment conclusion regarding whether cybersecurity risks have affected or are reasonably likely to affect business strategy, results of operations, and financial condition, which falls squarely under Strategy Integration per Rule 5 (SI materiality rule). Specificity is Generic Boilerplate because the text contains only generic risk disclosure language and negative assertions about the absence of material incidents. The date 'December 31, 2024' constitutes standard reporting period context rather than a verifiable cybersecurity fact per the guidelines, and there are no domain-specific terms demonstrating cybersecurity expertise, no firm-specific organizational details, and no externally verifiable quantitative claims.


reasoning: The paragraph provides a backward-looking materiality assessment stating that no cybersecurity incidents materially affected business strategy, operations, or financial condition during the reporting period, which falls under Strategy Integration per Rule 5 (negative materiality assertion). However, it contains only generic disclosure language with no domain-specific terminology (e.g., specific threat types, security tools, or frameworks), no firm-specific details (e.g., named officers, team composition, or organizational structure), and no verifiable facts (e.g., hard numbers, named third parties, or certifications)—only a reporting period anchor and negative self-assertion about the absence of incidents, which per the guidelines is not externally verifiable.


reasoning: This paragraph is purely a cross-reference directing readers to Item 1A for cybersecurity risk factor disclosures rather than describing governance, management, or processes. It contains no substantive cybersecurity facts, domain terminology, firm-specific details, or verifiable claims—only generic risk language quoted from the referenced section.


reasoning: The paragraph states conclusions about whether cybersecurity risks have materially affected (backward-looking) or are reasonably likely to materially affect (forward-looking per SEC Item 106(b)(2)) business outcomes, which falls squarely under Strategy Integration per Rule 5. It contains no domain-adapted terminology (only generic terms like 'cyber-attacks' and 'security problems' that any ERM professional would use), no firm-specific details distinguishing this REIT from others, and no verifiable quantitative claims—only unverifiable negative assertions about the absence of material impact—resulting in Generic Boilerplate specificity.


reasoning: This paragraph is a cross-reference directing readers to Item 1A for risk factor descriptions, containing only hypothetical speculation about potential consequences of a compromise. It answers none of the six substantive questions about governance, management, processes, or actual incidents, and contains no specific facts, domain terminology, or verifiable claims.


fact: November 2023 (date of cybersecurity incident)

reasoning: The paragraph primarily describes a specific past cybersecurity incident occurring in November 2023, detailing the detection, investigation with external experts and law enforcement, remediation efforts, and containment status, which aligns with Incident Disclosure. The specificity is Quantified-Verifiable due to the inclusion of the specific date 'November 2023' tied to the actual incident, constituting an externally verifiable fact.


reasoning: The paragraph describes the general threat landscape (malware, ransomware, phishing, APTs, nation-state actors) and states a generic commitment to protection, but does not address any of the six substantive categories: it contains no board oversight mechanisms (BG), no management roles or qualifications (MR), no description of cybersecurity program activities or methodologies (RMP), no vendor risk management practices (TP), no specific incident details (ID), and no business/financial impact assessments (SI). As contextual threat description without substantive cybersecurity governance or process disclosure, it falls under None/Other and receives Generic Boilerplate specificity per the rule that N/O paragraphs always receive Level 1.


fact: Director of IT Security and Compliance (Director-level title with security qualifier)

reasoning: The paragraph primarily describes cybersecurity activities—assessments, vulnerability testing, audits, and continuous monitoring—making it Risk Management Process (passing the person-removal test). It reaches Firm-Specific specificity due to the disclosure of a 'Director of IT Security and Compliance,' a Director-level title with a security qualifier that distinguishes this company's organizational structure.


reasoning: The paragraph primarily addresses how the company manages cybersecurity risks associated with third-party service providers, including conducting security assessments and ensuring compliance with standards, which falls under Third-Party Risk. The content is generic, describing high-level oversight activities ('stringent processes', 'thorough security assessments') without specific domain terminology (e.g., specific frameworks like NIST or ISO 27001), firm-specific details (e.g., named roles or committees), or verifiable data (e.g., number of vendors assessed), resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes the Board's delegation of cybersecurity oversight to the Audit Committee and the Committee's supervision of management's implementation, which directly answers how the board governs cybersecurity risk (BG). The text contains only generic governance terminology ('risk oversight function,' 'Audit Committee') that any ERM professional could apply to non-cyber risks, with no domain-specific practices, firm-unique organizational details, or quantifiable facts (L1).


fact: Head of IT reports directly to Chief Financial Officer

fact: over twenty years of experience managing information technology and cybersecurity matters

fact: Master of Science degree in Telecommunications and Computer Networks

fact: Project Management Professional certified

fact: Certified Scrum Master

fact: IT Infrastructure Library certified

reasoning: The paragraph primarily answers how management is organized to handle cybersecurity by detailing the Head of IT's reporting line to the CFO, specific qualifications, and professional certifications. It contains multiple externally verifiable facts including specific certification titles (PMP, CSM, ITIL), a quantified experience threshold ('over twenty years'), and specific educational credentials, supporting Quantified-Verifiable specificity despite also containing a brief materiality assessment.


reasoning: This paragraph provides a purely definitional description of 'systems' for purposes of the filing rather than addressing any substantive cybersecurity governance, management, process, incident, or strategy question. It contains no firm-specific details, quantifiable metrics, or cybersecurity domain terminology (e.g., specific controls, frameworks, or tools) that would elevate it beyond generic definitional boilerplate.


reasoning: The paragraph states a conclusion about whether cybersecurity has materially affected business outcomes (operations/financial standing), which is a Strategy Integration assessment per Rule 5. It contains no specific facts, verifiable claims, or domain-adapted terminology beyond generic cybersecurity references, resulting in Generic Boilerplate specificity.


reasoning: This paragraph consists entirely of speculative risk language ('we are at risk,' 'if our security controls are breached,' 'we may lose customers') and serves as a cross-reference to Item 1A Risk Factors. It describes hypothetical scenarios rather than actual Board oversight, management organization, risk management processes, third-party oversight, or specific incidents. As a forward-looking disclaimer with no substantive cybersecurity disclosures about the company's specific program, it falls under None/Other and receives Generic Boilerplate specificity.


reasoning: This paragraph describes IT/OT infrastructure and operational technology usage (refinery processes, petroleum monitoring, business applications) but answers none of the six substantive cybersecurity questions. It establishes operational context and asset inventory without detailing cybersecurity governance, management roles, risk processes, third-party oversight, incidents, or strategic impact. As a None/Other paragraph, it automatically receives Generic Boilerplate specificity.


fact: over 15 years of experience in cybersecurity

fact: COO leads development and implementation of cybersecurity strategy

fact: COO reports to CEO

reasoning: Paragraph describes the COO's leadership role in cybersecurity, reporting structure to the CEO, and specific professional qualifications, which are organizational and personnel details characteristic of Management Role. The specificity reaches Level 4 due to the quantified, externally verifiable claim regarding the COO's years of cybersecurity experience (a checkable lower-bound threshold), supplemented by firm-specific organizational facts about the COO's responsibility for strategy and reporting lines.


reasoning: The paragraph primarily answers whether cybersecurity has affected the business, containing a backward-looking negative assertion that the company has not experienced any cybersecurity incidents (per Rule 5, this maps to Strategy Integration) alongside standard forward-looking materiality speculation about potential impacts. It contains no domain-adapted terminology (failing the ERM test with generic phrases like 'mitigating controls' and 'identify threats'), no firm-specific organizational details, and no quantifiable or externally verifiable facts—only soft temporal references ('To date') and negative assertions about absence that cannot be independently verified.


reasoning: The paragraph describes the integration of cybersecurity risk management into the broader enterprise risk management program using generic governance terminology ('common methodologies,' 'reporting channels,' 'governance processes') that any ERM professional would naturally use, failing the ERM test for domain expertise. It lacks specific cybersecurity practices, firm-specific organizational details (e.g., named roles, committees, or team structures), and quantifiable or externally verifiable facts.


fact: attest reports covering cyber-related controls

fact: complementary user entity controls

fact: contractual safeguards in the event a cyber incident occurs

reasoning: The paragraph centrally addresses how third-party cyber risks are managed, detailing specific oversight mechanisms (attest reports, complementary user entity controls, contractual safeguards) imposed on vendors who house sensitive data. The specificity is Domain-Adapted because it employs precise cybersecurity audit terminology—specifically 'complementary user entity controls' and 'attest reports'—that demonstrates domain expertise beyond generic enterprise risk management language, yet contains no firm-specific organizational details or verifiable quantitative claims.


reasoning: The paragraph describes Board-level oversight of cybersecurity risks conducted through the Audit Committee, which is a standard governance-chain structure (BG). The language consists entirely of generic enterprise risk management terminology ('overseeing management's assessments,' 'reviewing options to mitigate') that would apply equally to financial or operational risks, and contains no domain-adapted cybersecurity practices, firm-specific governance details, or verifiable facts.


reasoning: The paragraph primarily answers how third-party cyber risks are managed by detailing contractual requirements imposed on service providers (certification of security capabilities, maintenance of measures, breach reporting). While the first two sentences mention engaging auditors and experts—which could suggest Risk Management Process—these describe third-party relationships subject to the vendor management requirements in the third sentence, which constitutes the majority of the text by word count and the most substantive content. Specificity is Generic Boilerplate because the paragraph contains only generic ERM terminology (auditors, validation, policies, safeguards, certification requirements) without domain-specific cybersecurity practices, firm-specific details, or verifiable quantitative claims.


fact: routine scanning

fact: phishing attempts

fact: minor technical vulnerabilities

reasoning: The paragraph describes actual cybersecurity events observed during specific fiscal years—including scanning, phishing attempts, and technical vulnerabilities—and their mitigation and impact, fitting Incident Disclosure. Specificity is Domain-Adapted because the paragraph uses cybersecurity-specific terminology (scanning, phishing, vulnerabilities) that demonstrates domain expertise beyond generic risk management language, but contains no firm-specific organizational details or externally verifiable quantitative claims.


reasoning: The paragraph describes Board-level oversight mechanisms, including the independent board members' role, quarterly review cadence, and incident escalation procedures, answering how the board oversees cybersecurity. The language consists entirely of generic governance terms ('quarterly review,' 'key program metrics,' 'policy and process') applicable to any risk domain without domain-specific terminology, firm-distinguishing details, or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: Paragraph focuses on management structure: responsibilities of 'The Director' (program development, operation, maintenance), qualifications (extensive IT experience, cybersecurity skills), and reporting lines (Director and CFO review risks). This answers 'How is management organized?' (MR), not 'What does the program do?' (RMP). Specificity is Generic Boilerplate because it contains no domain-adapted terminology (only generic phrases like 'information security program' and 'controls'), no firm-specific role identifiers ('Director' without security qualifier and 'CFO' are generic titles), and no verifiable facts (soft descriptors like 'extensive experience' and 'regularly' lack hard numbers or dates).


fact: subservice organizations

fact: service availability risks

specificity_confidence: medium

reasoning: The paragraph centrally addresses vendor oversight—specifically the annual assessment of vendors/subservice organizations for cybersecurity risks and imposed information security requirements—making it Third-Party Risk under Rule 3 (requirements imposed ON vendors). Specificity is Domain-Adapted because the term 'subservice organizations' (SOC framework terminology) and the pairing of 'cybersecurity' with 'service availability risks' (CIA triad concept) demonstrate cybersecurity domain expertise that would not naturally appear in generic enterprise risk management language, satisfying the ERM test.


reasoning: The paragraph focuses exclusively on managing cybersecurity risks from third parties (vendors, service providers, external users), making it Third-Party Risk. It contains only generic language about maintaining a 'risk-based approach' to 'assessing and overseeing' risks without specifying actual practices (e.g., SOC 2 reviews, contractual requirements), metrics, or organizational details, resulting in Generic Boilerplate specificity.


fact: between approximately August 5-8, 2025

fact: 2025 Cybersecurity Incident

reasoning: The paragraph primarily answers what happened in a specific cybersecurity incident, providing the exact dates (August 5-8, 2025) when a threat actor gained unauthorized access, the completion status of the forensic investigation, and the scope of potentially acquired data. This specific timeframe constitutes a hard, externally verifiable fact that distinguishes this disclosure from hypothetical or generic risk language. While the paragraph mentions ongoing material impact evaluation, the incident description dominates, making Incident Disclosure the appropriate category.


fact: more than 20 years of experience in the Business Finance and Audit management industry

fact: President and CEO

fact: January 2020

fact: reports directly to our Board of Directors

reasoning: Paragraph primarily describes the organizational role of the President and CEO in leading the information security team, his quantified professional experience (20+ years), and his direct reporting line to the Board, fitting Management Role. Specificity reaches Level 4 due to the verifiable quantified experience claim and specific timeframe.


fact: over 20 years of cybersecurity experience

fact: last 10 years in leadership positions

fact: CISSP certification

fact: CCSP certification

fact: GSTRT certification

fact: CISSP-ISSAP certification

fact: CGEIT certification

fact: CDPSE certification

fact: CEH certification

reasoning: The paragraph describes management's organizational structure for cybersecurity, including specific leadership roles (CFO, Senior Director of IT), reporting lines, and individual qualifications, fitting Management Role. Specificity is Level 4 due to verifiable claims including precise years of experience ('over 20 years,' 'last 10 years') and named professional certifications (CISSP, CCSP, GSTRT, CISSP-ISSAP, CGEIT, CDPSE, CEH) that are externally verifiable through certification bodies.


fact: Brian Fellon serves as Vice President, Chief Information Officer and Chief Information Security Officer (VP, CIO and CISO)

fact: Brian Fellon joined NW Natural in September 2024

fact: Brian Fellon reports to the Chief Financial Officer

fact: Brian Fellon has 28 years of experience in information technology

fact: Brian Fellon served as Director of Information Technology at Puget Sound Energy from 2016 to September 2024

reasoning: The paragraph primarily answers how management is organized to handle cybersecurity by identifying the specific executive leader (Brian Fellon), his dual VP-level titles with security portfolio, reporting structure to the CFO, and detailed career history including verifiable prior employment dates and specific years of experience (28). These quantified, externally checkable facts about a named individual drive the Level 4 classification, while the organizational description of the management team's responsibilities confirms the Management Role category.


fact: DPT (Digital Protection Team) oversees material incident investigation and response

fact: Incident Response Team (IRT) is a committee of IT members including the Chief Information Officer

fact: Escalation path from IRT to DPT for material incidents

fact: DPT ensures senior leadership and Audit Committee are informed of material incidents

reasoning: The paragraph primarily answers how management is organized to handle cybersecurity incidents by detailing the Incident Response Team composition (IT members including the CIO), the DPT's oversight role, and escalation reporting lines to senior leadership. Specificity is Firm-Specific due to the naming of the DPT, the defined IRT structure with CIO membership, and the firm-specific escalation procedures described.


fact: threat actors

reasoning: The paragraph primarily answers whether cybersecurity has materially affected the business through its backward-looking materiality assessment ('To date we have not identified any prior cybersecurity incidents that have materially affected...'), which per Rule 5 is Strategy Integration. Specificity is elevated to Domain-Adapted by the use of the cybersecurity domain term 'threat actors' (a specific threat type), distinguishing it from generic risk language.


reasoning: The paragraph primarily answers whether cybersecurity has materially affected the business, making backward-looking ('did not experience a material cybersecurity incident') and forward-looking ('not aware of any cybersecurity risks that are reasonably likely to materially affect') materiality assessments required by SEC Item 106(b)(2). It contains no specific facts—no domain-specific security practices (Level 2), no firm-specific organizational details or leadership roles (Level 3), and no verifiable claims or hard numbers (Level 4)—only generic assertions about the absence of material impact and cross-references to risk factor titles.


fact: Chief Information Officer (CIO) - VP-level cybersecurity leadership role

fact: Chief Information Security Officer (CISO) - VP-level cybersecurity leadership role

fact: Information Security team - team composition

fact: Cyber Incident Response Teams - specific team composition under CISO

fact: CIO oversees CISO - reporting line

fact: Teams under CISO - reporting line

fact: Partnership with Risk and Legal - organizational structure/reporting lines

reasoning: The paragraph answers how management is organized to handle cybersecurity by identifying specific VP-level leadership roles (CIO, CISO), describing team composition (Information Security team, Cyber Incident Response Teams), and detailing reporting lines and partnerships (CIO oversees CISO, teams report to CISO, partnership with Risk and Legal). This organizational focus places it in Management Role rather than Risk Management Process, which would emphasize activities and methodologies over roles and structure. Specificity is Firm-Specific (Level 3) due to the identification of specific leadership titles and team structures that distinguish Vistra's organizational chart, with no quantified or externally verifiable facts (Level 4) present.


reasoning: The paragraph primarily answers whether cybersecurity has materially affected the business, stating that prior threats have not materially affected the company (backward-looking materiality assessment per Rule 5). The third-party vendor requirements, while constituting Third-Party Risk content, are introduced as secondary ('In addition') and are subordinate to the materiality conclusion. Specificity is Generic Boilerplate because the paragraph contains no firm-specific details (e.g., named roles, team sizes), no verifiable facts (e.g., specific dates, certifications, numbers of incidents), and no domain-adapted terminology (e.g., specific frameworks, tools, or practices beyond generic 'security measures').


reasoning: The paragraph primarily answers whether cybersecurity risks have materially affected business outcomes, providing the backward-looking materiality assessment required by Item 106(b)(2). While it mentions prior breaches, it offers no specific incident details (nature, scope, timing, remediation) that would trigger Incident Disclosure. For specificity, the paragraph contains no firm-specific details (e.g., named roles, committees, or organizational structures), no domain-adapted terminology demonstrating cybersecurity expertise (e.g., specific practices, tools, or architectural concepts per the ERM test), and no quantifiable or independently verifiable facts (e.g., dates, headcounts, certifications, or hard numbers)—only generic temporal references ('from time to time,' 'to date') and vague assertions.


fact: developing and maintaining our overall cybersecurity risk methodology

fact: prevent, detect, mitigate, and remediate cybersecurity risks and incidents

fact: threat intelligence

fact: security tools deployed in the information technology environment

reasoning: The paragraph primarily answers what the cybersecurity program does (risk methodology, prevention/detection activities, use of threat intelligence and security tools) rather than focusing on board oversight structure or management organizational charts. Under the person-removal test, removing management roles and personnel references leaves substantive program descriptions (methodology, tools), confirming RMP over MR. Specificity is Domain-Adapted because terms like 'threat intelligence,' 'security tools deployed,' and the specific cybersecurity risk lifecycle ('prevent, detect, mitigate, remediate') demonstrate cybersecurity domain expertise that would not appear in generic enterprise risk management disclosures.


fact: CISO has over 20 years of cybersecurity and technology management experience

fact: CISO

fact: Security Governance Committee

fact: selected from the Adviser's business groups

reasoning: The paragraph answers how management is organized for cybersecurity by describing the CISO's qualifications and the Security Governance Committee's composition. Specificity is Quantified-Verifiable because the claim of 'over 20 years' of experience is a hard, externally verifiable quantity, supplemented by firm-specific details like the named committee and CISO role.


fact: February 26, 2024

fact: Progress software

fact: SEC investigation

reasoning: The paragraph describes an actual cybersecurity breach and its regulatory aftermath, including public disclosure, customer notifications, and a specific SEC investigation with a verifiable date (February 26, 2024) and named software (Progress) implicated in the incident. The specific date of the SEC request and identification of Progress software as the source of the failure provide externally verifiable facts.


reasoning: The paragraph describes the Board's delegation of cybersecurity oversight to the Audit Committee, which is classic Board Governance content. The language consists entirely of generic governance terms ('ERM program,' 'Audit Committee,' 'internal controls') without domain-specific cybersecurity practices, firm-specific details, or verifiable facts, resulting in Generic Boilerplate specificity.


fact: Form 8-K filed on July 14, 2023

fact: on or about May 31, 2023

fact: MOVEit managed file transfer software

fact: zero-day vulnerability

fact: First National 1870 division

fact: Guardian Mortgage division

reasoning: The paragraph describes a specific real-world cybersecurity incident (the MOVEit vulnerability), providing the exact timing (May 31, 2023), the specific software product involved (MOVEit), and the specific business divisions affected (First National 1870 and Guardian Mortgage), which are all externally verifiable facts.


fact: over 20 years of experience in information security, risk management, and compliance

reasoning: The paragraph primarily describes management's organizational structure for cybersecurity, focusing on the Director of Information Technology's responsibilities, reporting lines, and qualifications. The specificity level is driven by the quantified, externally verifiable claim that the DIT possesses over 20 years of experience, which sets a checkable threshold.


reasoning: The paragraph describes the company's cybersecurity program activities including risk assessments, training, tools, and incident response planning, which directly answers 'What does the cybersecurity program do?' (RMP). The language consists entirely of generic risk management and governance terms ('periodic risk assessments,' 'employee awareness training,' 'escalate incidents') that an ERM professional would use for any risk domain, with no specific technologies, frameworks, organizational details, or verifiable facts to elevate specificity.


fact: Senior Vice President, Engineering Operations (VP-level role with cybersecurity oversight)

fact: Executive risk committee (management-level committee)

fact: Cybersecurity team comprised of professionals with computer science, cybersecurity assurance or other cybersecurity degrees

fact: Senior Vice President, Engineering Operations has technical education in computer engineering

reasoning: The paragraph primarily answers how management is organized to handle cybersecurity, describing the executive risk committee's composition (CFO, CLO, and SVP Engineering Operations), reporting lines (committee receives reports from the cybersecurity team), and team qualifications. Specificity is Firm-Specific due to VP-level leadership titles (Senior Vice President, Engineering Operations), the named management committee, and detailed team composition including specific degree requirements (cybersecurity assurance, computer engineering).


fact: scan and analyze for vulnerable software

fact: misconfigurations

fact: cybersecurity questionnaire

fact: cybersecurity posture

reasoning: The paragraph centrally addresses vendor cybersecurity oversight, describing contractual security requirements, assessment questionnaires, and monitoring processes for third-party providers. Specificity is Domain-Adapted because the text uses technical cybersecurity concepts—including 'vulnerable software,' 'misconfigurations,' and 'cybersecurity posture'—that demonstrate specialized domain knowledge beyond generic enterprise risk management terminology.


fact: ransomware virus

fact: encrypted several machines

fact: threat was quickly identified and isolated

fact: restore them from backup

reasoning: The paragraph describes an actual ransomware attack that occurred, including technical details of the incident (encryption of machines), containment actions (isolation), and recovery methods (backup restoration), which clearly answers 'what happened' rather than providing a general materiality assessment. Specificity is Domain-Adapted due to the use of technical cybersecurity terms including 'ransomware,' 'encrypted,' and 'isolated' that demonstrate domain expertise beyond generic risk management language, though no verifiable quantities or firm-specific organizational details are present.


reasoning: The paragraph centers on vendor oversight and compliance monitoring, making Third-Party Risk the appropriate category. However, the content employs generic enterprise risk management terminology ('monitor compliance', 'mitigating measures', 'weekly calls') that would appear in any vendor management context without cybersecurity domain expertise; no specific frameworks, tools, firm-unique structures, or quantifiable claims are present.


reasoning: The paragraph primarily describes the Audit Committee's oversight responsibilities, briefing cadence (quarterly), and information flow to the Board regarding cybersecurity, which directly answers how the board oversees cybersecurity threats (Board Governance). It contains no firm-specific details (only generic committee titles, no named individuals, no specific organizational structures unique to Vanda) and relies on standard enterprise risk management terminology ('risk management,' 'incident response plan,' 'business continuity planning') that fails the ERM test for domain-adapted specificity, resulting in Generic Boilerplate classification.


fact: chief technology officer responsible for information security team (firm-specific leadership structure)

fact: over a decade of industry experience (verifiable quantitative lower-bound threshold)

fact: information security professionals holding similar positions at large technology companies (firm-specific team composition and career history)

reasoning: The paragraph primarily answers how management is organized to handle cybersecurity, describing the CTO's leadership responsibilities, the security team's qualifications and career history, and reporting lines to senior management and the board, which aligns with Management Role rather than Board Governance (which would focus on board-level oversight mechanisms) or Risk Management Process (which would detail technical activities). Specificity reaches Level 4 due to the verifiable quantitative claim that the CTO has 'over a decade of industry experience'—a specific lower-bound threshold that can be independently checked against employment records—alongside firm-specific organizational details about the team's composition and structure.


reasoning: Paragraph describes Board oversight structure, expertise, discussion frequency, and reporting mechanisms regarding cybersecurity risks, directly answering how the board governs cybersecurity (BG). The language consists entirely of generic governance terminology ('established reporting mechanisms', 'strategic decisions', 'documentation... is maintained') that could apply to any risk domain without modification; it contains no domain-specific security practices, firm-unique organizational details, or quantifiable/verifiable facts.


reasoning: The paragraph describes external state regulatory trends and generic compliance monitoring activities rather than answering any of the six substantive questions about the company's specific cybersecurity governance, management structure, risk processes, or strategy. While it references domain terms like 'data encryption' and 'breach notification,' these describe regulatory requirements rather than company practices, and the monitoring language ('actively monitor legislative and regulatory developments') is generic ERM terminology applicable to any compliance function. No firm-specific details, quantified metrics, or verifiable claims are present.


reasoning: The paragraph provides only generic commitment language regarding cybersecurity ('committed to protecting') without describing any actual oversight structure, management organization, risk processes, third-party oversight, incidents, or business strategy impact. It answers none of the six substantive questions and contains no specific facts, domain terminology, or verifiable claims—merely stating that protection applies to standard stakeholder categories (employees, customers, suppliers) and assets.


fact: GISO (Global Information Security Officer) role

fact: Chief Information Security Officer role

reasoning: The paragraph primarily describes the company's cybersecurity assessment activities (maturity assessments, audits, control environment reviews) performed by engaged third-party experts, which constitutes Risk Management Process content that survives the person-removal test. Specificity is Firm-Specific due to the identification of senior cybersecurity leadership titles (GISO and Chief Information Security Officer) at the VP level or above, distinguishing the company's organizational structure from generic disclosures.


reasoning: The paragraph describes the company's cybersecurity processes and their purpose (identifying, assessing, and managing risks), which falls under Risk Management Process. The language consists entirely of generic risk management terminology ('identify, assess and manage,' 'material risks') and standard IT asset listings that would appear in any enterprise risk management context without requiring cybersecurity domain expertise, and contains no firm-specific details or verifiable facts.


fact: more than 20 years' experience

fact: Certified Information Systems Security Professional (CISSP) certification

fact: University of California, Santa Barbara degree

reasoning: The paragraph centers on the qualifications, credentials, and responsibilities of a specific management position (Director of Information Technology), including verifiable claims such as CISSP certification, over 20 years of experience, and specific educational background. This describes management organization rather than board oversight or program activities.


fact: Change Healthcare (named third-party entity involved in cybersecurity incident)

fact: UnitedHealth Group (named parent company of affected third party)

fact: EXOGEN device (specific product line affected by the incident)

reasoning: The paragraph primarily describes the Change Healthcare cybersecurity incident, including the nature of the breach (threat actor accessing IT systems), specific operational impacts on Bioventus (disrupted EXOGEN device claims processing, delayed cash remittances), and remediation steps (alternative intermediary), making it Incident Disclosure. Specificity is Quantified-Verifiable due to the naming of specific external entities (Change Healthcare, UnitedHealth Group) and firm-specific product details (EXOGEN) that are independently verifiable.


reasoning: The paragraph primarily describes the company's cybersecurity risk management processes (maturity assessments, IT risk assessments, and third-party security assessments) and their integration with enterprise risk management, fitting the Risk Management Process category. While it mentions Audit Committee oversight, this is contextual rather than the primary focus. The specificity is Generic Boilerplate because the paragraph contains only high-level process descriptions without domain-specific cybersecurity terminology, firm-unique details, or quantifiable metrics.


reasoning: The paragraph is a cross-reference to Item 1A risk factors, explicitly stating where the materiality assessment is located rather than providing the assessment itself. Under Rule 5, cross-references pointing elsewhere ("see Item 1A") are classified as None/Other. The paragraph contains no specific facts—no quantified data, firm-specific roles or programs, or domain-adapted cybersecurity terminology that would fail the ERM test (terms like "cybersecurity threats," "incidents," and "business strategy" are generic risk management language).


fact: contractual requirements for third parties to maintain cybersecurity programs

fact: contractual requirements for third parties to report actual or suspected security incidents

fact: cyber review process integrated into vendor onboarding

fact: risk-based monitoring of vendors by criticality and risk profile

reasoning: The paragraph centrally addresses how third-party cyber risks are managed through vendor contractual requirements, incident reporting obligations, and onboarding reviews. Specificity is Domain-Adapted because it describes cybersecurity-specific vendor management practices (e.g., requiring incident reporting and cyber review processes) that demonstrate domain expertise beyond generic enterprise risk management, though it lacks firm-specific structural details or verifiable metrics.


reasoning: The paragraph states a conclusion about whether cybersecurity risks have materially affected or are reasonably likely to materially affect business outcomes (operations, business strategy, results of operations, financial condition), which is the definition of Strategy Integration under Rule 5. Specificity is Generic Boilerplate because the text contains only the SEC's regulatory definition of cybersecurity threats (quoting the CIA triad as external regulatory text rather than demonstrating internal domain expertise), generic cross-references to Risk Factors, and a negative materiality assertion that is not externally verifiable, with no firm-specific details, security practices, or quantified facts.


reasoning: The paragraph discusses general IT investments for operational purposes (customer experience, compliance, efficiency) but contains no substantive cybersecurity disclosure—no risk management processes, governance structures, or security-specific measures are described. As a non-cybersecurity paragraph appearing in Item 1C, it is classified None/Other with Generic Boilerplate specificity.


reasoning: The paragraph states a negative conclusion about material business impact ('not aware of any cybersecurity incidents... that have materially impacted us'), which per Rule 5 classifies as Strategy Integration. Specificity is Generic Boilerplate because the text contains only generic risk language and cross-references without domain-specific security practices, firm-specific organizational details, or externally verifiable facts (and negative assertions about incident absence are explicitly non-verifiable per Level 4 guidelines).


fact: ransomware

fact: malware

fact: computer viruses

fact: phishing attempts

reasoning: The paragraph primarily answers whether cybersecurity has materially affected the business by stating no material incidents were experienced in the last three years, which per Rule 5 qualifies as a Strategy Integration negative assertion. Specificity is Domain-Adapted because the paragraph enumerates specific cyber threat types (ransomware, malware, computer viruses, phishing) that demonstrate cybersecurity domain expertise beyond generic risk management language.


fact: security event monitoring and detection

fact: extended detection and response

fact: vulnerability scanning

fact: phishing simulations

fact: penetration tests

reasoning: The paragraph enumerates specific technical activities and capabilities of the cybersecurity program (monitoring, EDR, vulnerability scanning, phishing simulations, penetration testing), which directly answers what the program does (Risk Management Process). The terminology demonstrates cybersecurity domain expertise—terms like 'extended detection and response' and 'phishing simulations' are specific security practices that would not naturally appear in generic ERM language—making this Domain-Adapted (Level 2).


reasoning: The paragraph provides the SEC-required materiality assessment that cybersecurity risks 'have not materially affected, and we do not believe are reasonably likely to materially affect' business strategy, results of operations, or financial condition, which falls squarely under Strategy Integration per Rule 5. The language is entirely generic boilerplate containing no firm-specific details, domain-specific cybersecurity terminology (e.g., specific frameworks, tools, or practices), or verifiable facts—only standard materiality assertions and cross-references to risk factors.


fact: security threat intelligence system

fact: internal vulnerability management tools

fact: patch management standard

fact: Security Operations Center

fact: event correlation

reasoning: The paragraph describes operational cybersecurity activities (threat intelligence, vulnerability management, patching, SOC operations) that constitute the company's risk management processes. The terminology—including 'patch management standard,' 'Security Operations Center,' and 'event correlation'—demonstrates cybersecurity domain expertise that would not appear in generic enterprise risk management discourse.


reasoning: The paragraph primarily addresses how cybersecurity affects business finances through the maintenance of cybersecurity insurance to manage financial statement risk, with emphasis on coverage limitations and disclaimers about future protection (Strategy Integration). It contains only generic assertions about the existence of a program and insurance, with no domain-specific security practices, firm-unique organizational details, or quantified/verifiable facts that would elevate it above boilerplate.


fact: utilizing a third-party security scoring system

fact: evaluate the security posture

fact: continuous compliance with its cybersecurity standards

reasoning: The paragraph centrally addresses vendor risk management, describing oversight processes for third-party security risks including security scoring and posture evaluation, which places it in Third-Party Risk per Rule 3. It employs cybersecurity domain terminology ('security scoring system,' 'security posture') that fails the ERM test—generic risk professionals would not naturally use these specific technical constructs—elevating it to Domain-Adapted. It lacks firm-specific identifiers (named roles, committees, or programs) and contains no quantified or externally verifiable claims (specific dates, numbers, or named vendors), so it does not reach Level 3 or 4.


fact: identity management

fact: access control safeguards

fact: encryption of data in transit

fact: encryption at rest

reasoning: The paragraph catalogues specific technical controls and safeguards implemented by the cybersecurity program (identity management, encryption protocols, network monitoring), which directly answers what the program does, placing it in Risk Management Process. Specificity is Domain-Adapted because terms such as 'encryption at rest,' 'encryption in transit,' and 'identity management' represent specialized cybersecurity domain knowledge that would not naturally appear in generic enterprise risk management discourse.


fact: CISO (Chief Information Security Officer) role

reasoning: The paragraph describes the escalation pathway and information flow from management (CISO) through the Audit Committee to the Board, which addresses how the Board oversees cybersecurity risks (Board Governance). The identification of a CISO role provides a firm-specific organizational detail (Level 3).


reasoning: The paragraph provides a backward-looking materiality assessment stating the Company has not experienced material cybersecurity incidents and that related expenses were immaterial, which Rule 5 explicitly classifies as Strategy Integration (negative assertion regarding incidents). The text contains only generic reporting period references ('three year period ending December 31, 2023') and unverifiable negative assertions, with no domain-specific security terminology, firm-specific organizational details, or quantified facts that could be independently verified, resulting in Generic Boilerplate specificity.


reasoning: This paragraph is a forward-looking disclaimer and cross-reference to Risk Factors, containing no substantive description of actual cybersecurity governance structures, management roles, risk management processes, or incidents. It lacks specific domain terminology, firm-unique details, or verifiable facts, consisting solely of generic cautionary language about program effectiveness.


reasoning: The paragraph is centrally about managing cybersecurity risks from third-party vendors, describing vendor assessments and contractual notification requirements, which falls under Third-Party Risk. For specificity, the paragraph uses generic ERM terminology ('risk assessments,' 'processes to identify risks') that explicitly fails the domain-adapted test per the guidelines (risk assessment is listed as Level 1), and contains no firm-specific details (no named roles, committees, or organizational structures) or quantifiable/verifiable facts (no numbers, dates, or named third parties).


fact: Namecheap

fact: Godaddy

fact: Cloudflare

fact: only cybersecurity risk is from the use of websites associated with the Company

reasoning: The paragraph describes the company's cybersecurity risk management approach for websites by stating they engage specific third-party hosting providers (Namecheap, Godaddy, Cloudflare). Under Rule 3, third parties hired to serve the company (hosting providers) are categorized as Risk Management Process rather than Third-Party Risk, which requires vendor oversight or supply chain risk management as the central topic. Specificity reaches Level 4 because the named vendors are externally verifiable facts (checkable via DNS/hosting records), and the claim that websites represent the 'only' cybersecurity risk provides a firm-specific scope description (Level 3).


fact: Chief Information Officer (CIO) presents to the Audit Committee on cybersecurity topics

reasoning: The paragraph primarily describes Board and Audit Committee oversight activities—how they receive briefings, what information flows to them, and their reporting structure—making it Board Governance. Specificity is Firm-Specific because it identifies the Chief Information Officer (a C-level/VP-or-above IT leadership role) as presenting to the Audit Committee, which distinguishes this company's governance structure from others; no quantifiable or externally verifiable facts (Level 4) are present.


reasoning: The paragraph primarily answers whether cybersecurity risks have materially affected or are reasonably likely to materially affect the company, which is a materiality assessment per Rule 5 (SI). It contains no domain-specific cybersecurity terminology, firm-specific details, or verifiable facts—only generic SEC boilerplate language about materiality and forward-looking disclaimers.


reasoning: The paragraph describes the governance chain for cybersecurity oversight (Board → Audit Committee → management interaction), which directly answers how the board oversees cybersecurity risk. For specificity, the paragraph contains only generic governance language and titles ('Audit Committee,' 'Director of Information Technology' without a security qualifier) that do not demonstrate cybersecurity domain expertise (Level 2), provide firm-distinguishing details (Level 3), or contain verifiable facts (Level 4).


fact: CTO oversees cybersecurity program with CFO

fact: over 26 years of information technology experience

fact: previous roles include Director of Technology, Information Technology Manager, Technical Manager, and Systems Analyst

fact: manages cybersecurity team of certified professionals

reasoning: The paragraph focuses on management organizational structure, reporting lines (CFO/CTO receiving reports from IT team), and the CTO's qualifications and career history. The specific claim of 'over 26 years' of experience is a quantified, externally verifiable fact (Level 4), and the assignment of cybersecurity oversight to the CTO is a firm-specific organizational detail (Level 3).


fact: $1.0 million in Cybersecurity Incident related costs net of expected insurance receivable in 2023

fact: System remediation efforts concluded December 30, 2023

fact: Received insurance proceeds in Q4 2024 exceeding recorded receivable by $0.6 million

fact: Insurance proceeds represented costs associated with lost revenue and incremental expenses

reasoning: The paragraph describes a specific, named cybersecurity incident with technical details (system suspension, restoration), temporal specifics (remediation concluded December 30, 2023; Q4 2024 insurance proceeds), and hard financial figures ($1.0 million costs, $0.6 million excess recovery), fitting Incident Disclosure. The specific dollar amounts and dates are externally verifiable facts, placing this at Level 4 despite the absence of domain-adapted security terminology.


reasoning: This paragraph is a generic contextual statement about the threat environment that does not answer any of the six substantive questions regarding board governance, management organization, risk processes, third-party risk, incidents, or business strategy impact. It contains no specific facts, domain terminology, firm-specific details, or verifiable claims, consisting entirely of boilerplate introductory language applicable to any entity.


reasoning: The paragraph provides a backward-looking materiality assessment stating that cybersecurity risks have not materially affected business strategy, results of operations, or financial condition over the last three fiscal years, which is the defining characteristic of Strategy Integration per Rule 5. Specificity is Generic Boilerplate because the paragraph contains no firm-specific details, domain-specific cybersecurity terminology (e.g., specific threat types, tools, or frameworks), or verifiable facts—only a negative assertion about materiality and a cross-reference that are not independently verifiable.


reasoning: The paragraph centrally addresses how the company manages cybersecurity relationships with third-party vendors (collaborative coordination and meeting cadences), which falls under Third-Party Risk. However, the language is entirely generic business terminology ('Information Technology department,' 'mutually beneficial approach,' 'rolling basis,' 'risk is presented') that passes the ERM test—any enterprise risk management professional could write this without cybersecurity expertise. It contains no firm-specific details (generic department names, no leadership titles), no domain-adapted cybersecurity practices, and no quantifiable or verifiable facts.


fact: identification, detection, prevention and remediation of known or potential IT security vulnerabilities

fact: third-party hackers

fact: cybersecurity risks

reasoning: The paragraph addresses the financial and resource constraints preventing the Company from implementing cybersecurity measures, and the potential for business damage, which frames cybersecurity as a business strategy and resource allocation issue (SI). While it references specific cybersecurity domain activities (identification, detection, prevention, remediation) and threat vectors (third-party hackers), the disclosure lacks firm-specific details such as named roles, team compositions, or quantified resources that would distinguish this company's specific posture, remaining at the domain terminology level (Level 2).


fact: In March 2020 (specific date of the ransomware attack)

fact: ransomware attack (domain-specific threat type)

fact: confidential information was stolen (firm-specific impact of the incident)

fact: trade secrets (specific type of firm data potentially exposed)

fact: personal information of our employees (specific type of firm data potentially exposed)

reasoning: The paragraph primarily answers what happened in a specific cybersecurity incident, describing the March 2020 ransomware attack, system access, data exfiltration, and remediation efforts, which is Incident Disclosure. Specificity is Quantified-Verifiable because it includes the hard temporal fact 'March 2020' tied to the actual incident occurrence, which is externally verifiable against public breach disclosures or news reports.


fact: data leakage

fact: artificial intelligence (AI)

fact: generative AI (GenAI)

reasoning: The paragraph catalogs the operational components of the cybersecurity program (risk assessments, security controls, incident response procedures, and third-party risk management), which directly addresses what the program does. Specificity is Domain-Adapted because the text includes cybersecurity-specific threat terminology ('data leakage') and identifies specific emerging technologies ('artificial intelligence (AI) and generative AI (GenAI)') as focal points for security controls, demonstrating domain expertise beyond generic risk management descriptions.


reasoning: The paragraph centers on vendor oversight for service providers with critical or sensitive data access, including due diligence procedures and contractual validation, which directly answers how third-party cyber risks are managed. The terminology ('multiple levels of due diligence,' 'controls,' 'contractual rights and obligations') consists of generic process descriptions that an enterprise risk management professional could apply to financial, legal, or operational risk contexts without cybersecurity domain expertise; it contains no specific security technologies, frameworks, firm-specific roles, or quantifiable claims.


reasoning: The paragraph answers how third-party cyber risks are managed by describing vendor security assessments conducted prior to onboarding, which falls squarely under Third-Party Risk per Rule 3 (requirements imposed ON vendors). Specificity remains Level 1 because the description uses generic risk management language ('calibrated to the identified risk level') and high-level security concepts (the CIA triad of confidentiality, integrity, availability implied by 'data security, availability, and confidentiality') without identifying specific assessment criteria (e.g., SOC 2, penetration testing), firm-unique organizational details, or quantifiable/verifiable facts.


fact: Security Incident Response Plan ('SIRP')

fact: encryption protocols

fact: multi-factor authentication

fact: data loss prevention controls

reasoning: The paragraph primarily answers what the cybersecurity program does: it describes the incident response framework (SIRP), technical safeguards (encryption, MFA, DLP), and business continuity testing. The specificity is driven by the firm-specific naming of the 'Security Incident Response Plan (SIRP)' alongside domain-adapted technical controls that demonstrate cybersecurity expertise beyond generic risk management.


reasoning: The paragraph describes the Board's delegation of cybersecurity oversight to the Audit Committee and the frequency of updates provided to that committee, directly answering how the board governs cybersecurity risk. It contains no firm-specific details (only generic references to the Audit Committee and senior management) and no domain-specific cybersecurity terminology that would demonstrate technical expertise, resulting in generic boilerplate specificity.


reasoning: The paragraph describes the integration of the cybersecurity program into the broader risk framework and its objectives (protecting confidentiality, integrity, and availability), which answers what the program does (RMP). It uses specific cybersecurity domain terminology (the CIA triad) that would not appear in generic enterprise risk management disclosures, satisfying Level 2, but contains no firm-specific organizational details or verifiable quantitative data.


fact: Chief Security Officer (CSO)

fact: Cyber Risk Advisory Committee

reasoning: The paragraph describes the governance chain from the Board to the Security Committee to the CSO and Cyber Risk Advisory Committee, primarily answering how the board oversees cybersecurity (BG). Specificity is Firm-Specific due to the named executive role (Chief Security Officer) and the specific committee (Cyber Risk Advisory Committee) that distinguish this company's organizational structure.


reasoning: The paragraph describes generic risk management activities (identifying, prioritizing, and mitigating risks) and employee training using standard ERM language that applies to any risk domain, lacking specific cybersecurity domain expertise, firm-unique organizational details, or verifiable facts. The mention of third parties refers to external consultants engaged to assist with assessments (RMP per Rule 3), not vendor risk oversight.


reasoning: The paragraph provides a materiality assessment stating that no cybersecurity incidents have had or are reasonably likely to have a material impact on business outcomes, which qualifies as Strategy Integration under Rule 5 (negative assertion about material impact). It contains no domain-specific terminology, firm-specific details, or verifiable facts—only generic SEC boilerplate language and a cross-reference—resulting in Generic Boilerplate specificity.


fact: Vice President, IT Security and Compliance

fact: Chief Information Officer

fact: IT Security Director

fact: threat intelligence

fact: prevention, detection, mitigation, and remediation

reasoning: Paragraph primarily answers how management is organized, detailing reporting lines (VP reports to CIO), specific leadership titles (IT Security Director), and team qualifications (decades of experience, certifications). Specificity is Firm-Specific due to disclosure of VP-level and Director-level security roles and C-level IT reporting structure, supplemented by domain terminology including threat intelligence and incident response phases.


reasoning: The paragraph describes the Audit Committee's receipt of reports from management regarding cybersecurity risks and incidents, which constitutes board-level oversight structure and information flow (BG). It contains only generic governance language ('regular reports,' 'where it deems appropriate') without domain-adapted terminology (fails the ERM test), firm-specific details (no named roles or unique committees), or verifiable facts (no numbers, dates, or specific thresholds), resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers whether cybersecurity has affected the business by stating 'To date, we have not experienced any significant impacts from cybersecurity threats,' which is a backward-looking materiality assessment qualifying as Strategy Integration under Rule 5. Specificity is Level 1 because the paragraph contains no firm-specific details, domain-adapted terminology (terms like 'business recovery protocol' and 'safeguards' are generic business continuity language any ERM professional would use), or verifiable facts—only generic risk disclosures, forward-looking speculation, and cross-references.


fact: over 20 years of security experience

fact: Certified Information Systems Security Professional

fact: Certified Information Security Manager

reasoning: The paragraph primarily answers how management is organized to handle cybersecurity, detailing the CSO's reporting structure (to EVP/COO), team composition, and specific qualifications rather than board oversight mechanisms or program activities. Specificity is driven by externally verifiable claims: the CSO's quantified experience ('over 20 years') and named professional certifications (CISSP, CISM) held by team members.


reasoning: The paragraph contains only a forward-looking disclaimer about cybersecurity limitations and a cross-reference to Risk Factors, with no substantive disclosure about governance, management, processes, or incidents. No specific facts, domain terminology, firm-specific details, or verifiable claims are present—only generic boilerplate language applicable to any registrant.


reasoning: The paragraph provides a backward-looking assessment that no cybersecurity incidents have materially affected business strategy, results of operations, or financial condition, and a forward-looking assessment that such incidents are reasonably likely to materially affect these areas, which falls squarely under Strategy Integration per Rule 5. It contains no specific facts—only generic negative assertions about materiality and a cross-reference—resulting in Generic Boilerplate specificity.


fact: $2.7 million of loss

fact: early in Fiscal 2024

fact: Note 18 to the accompanying consolidated financial statements

fact: fraudulently-induced outbound wire transfers

fact: forensic investigation

reasoning: The paragraph describes an actual cybersecurity incident (business email compromise scheme), including the nature of the attack, discovery timeline, response activities, and financial impact, which aligns with Incident Disclosure. Specificity is Quantified-Verifiable due to the hard-dollar loss figure ($2.7 million) and specific temporal reference ('early in Fiscal 2024') that could be verified against the cited financial statement note.


reasoning: The paragraph describes the company's cybersecurity program activities and controls (incident response plans, vulnerability management policy, disaster recovery, encryption) which defines the Risk Management Process category. For specificity, the paragraph uses generic terminology (including 'incident response plans' and 'disaster recovery plans' which are explicitly listed as commonly confused terms that fail the ERM test) without demonstrating cybersecurity domain expertise, and contains no firm-specific details or verifiable facts, resulting in Generic Boilerplate.


fact: identification and testing of vulnerabilities

fact: phishing simulations

fact: cybersecurity awareness training

fact: internal security reviews of information systems and related controls

fact: external reviews of the cybersecurity program

fact: assessments of relevant data protection practices

fact: targeted attack simulations

reasoning: The paragraph describes specific activities of the cybersecurity program (vulnerability testing, phishing simulations, attack simulations) rather than governance structure or management roles, placing it in Risk Management Process. It employs domain-specific terminology (e.g., 'targeted attack simulations,' 'data protection practices') that demonstrates cybersecurity expertise beyond generic risk management, satisfying Level 2, but contains no firm-specific organizational details (e.g., named officers, team sizes) or quantifiable/verifiable claims (e.g., specific dates, named vendors, certification numbers) needed for higher levels.


reasoning: The paragraph describes the board's oversight function and the allocation of cybersecurity risk management responsibilities among the Audit Committee, technology committee, and management, constituting governance-chain content that defaults to Board Governance under Rule 1. The language consists entirely of generic enterprise risk management terminology ('identifying, assessing, and managing,' 'mitigation measures,' 'policies and procedures') that any business professional could apply to financial, operational, or other risk domains; it demonstrates no cybersecurity domain expertise, contains no firm-specific governance details (e.g., proper committee names, specific roles, or reporting cadences), and offers no quantified or externally verifiable facts.


reasoning: The paragraph contains generic forward-looking disclaimer language ('as with all companies,' 'committed to continuing to strengthen') and vague assertions about 'controls' without describing specific cybersecurity measures, governance structures, management roles, or organizational processes. It does not substantively address Board Governance, Management Role, Risk Management Process, Third-Party Risk, Incident Disclosure, or Strategy Integration. The text lacks domain-specific terminology that would fail the ERM test (e.g., 'controls' and 'protection' are generic risk management terms), contains no firm-specific facts (no named roles, committees, or unique organizational features), and presents no quantified or externally verifiable claims.


fact: NIST

fact: ISO

fact: HIPAA

fact: Payment Card Industry standards

fact: application vulnerability assessments

fact: public internet presence monitoring

fact: security capabilities and maturity assessments

fact: controls evidence reviews

reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from suppliers through contractual requirements and various security assessments, fitting the Third-Party Risk category. Specificity is Domain-Adapted due to references to specific cybersecurity standards (NIST, ISO, HIPAA, PCI) and technical assessment practices (application vulnerability assessments, controls evidence reviews) that demonstrate cybersecurity domain expertise beyond generic risk management language.


fact: Chief Information Security Officer (CISO)

fact: Chief Technology Officer (CTO)

fact: CISO reports to Chief Risk Officer (CRO)

fact: Executive team coordination for cybersecurity includes CTO

reasoning: The paragraph primarily answers how management is organized to handle cybersecurity, describing the CISO role, reporting structure (CISO under CRO), and coordination with the executive team including the CTO. Specificity is driven by firm-specific organizational facts: named cybersecurity leadership roles (CISO, CTO), the specific reporting line to the CRO, and the composition of the executive coordination structure.


reasoning: The paragraph primarily describes the company's activities to detect, investigate, and prevent unauthorized attempts and attacks through process and tool updates, which answers what the cybersecurity program does (Risk Management Process). However, the language consists entirely of generic descriptions ('internal processes and tools,' 'service delivery,' 'detect and investigate') that any ERM professional could use without cybersecurity domain expertise, contains no firm-specific organizational details (roles, committees, programs), and offers no quantifiable or externally verifiable claims, resulting in Generic Boilerplate specificity.


fact: cyber incident response plan

fact: cybersecurity assessors

reasoning: The paragraph describes the company's cybersecurity program activities, including risk assessment methodologies, oversight of third-party service provider risks, and use of external assessors, which aligns with Risk Management Process. Specificity is Domain-Adapted due to the use of the CIA triad ('confidentiality, integrity, and availability') and specific reference to 'cyber incident response plan' and 'cybersecurity assessors,' demonstrating cybersecurity domain expertise beyond generic enterprise risk management terminology.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers, including contractual requirements, mandated pre-engagement reviews, annual re-evaluations, and data deletion protocols—falling squarely under Third-Party Risk per Rule 3. For specificity, the text contains only generic process descriptions ('enterprise risk program,' 'contractual obligations,' 'at least annually') that any ERM professional would use for non-cyber vendor risk management; no cybersecurity domain terms (Level 2), firm-distinguishing facts (Level 3), or externally verifiable claims (Level 4) are present.


fact: Critical Threat Committee

reasoning: The paragraph describes the governance chain and oversight structure for cybersecurity incidents, specifically how the Critical Threat Committee evaluates materiality and escalates information to the Board of Directors, Chairman, and Audit Committee. The specificity is Firm-Specific due to the named internal committee 'Critical Threat Committee,' which is a non-generic committee identifier distinct from standard board committees like the Audit Committee.


fact: patching and vulnerability management

fact: cybersecurity tabletop exercise

fact: information technology security infrastructure

fact: cybersecurity threat assessment

reasoning: The paragraph describes the cadence (annual and semiannual) and content of cybersecurity reports presented to the full Board of Directors, which directly addresses board oversight structure and governance. It achieves Domain-Adapted specificity by referencing technical cybersecurity practices—such as patching, vulnerability management, and tabletop exercises—that require specialized domain knowledge and would not appear in generic enterprise risk management descriptions.


fact: CISO (cybersecurity leadership role)

fact: steering committee on information security (management-level committee)

fact: over 20 years of experience (quantified)

fact: CIO Executive Education Certificate from Stanford University (verifiable credential)

reasoning: The paragraph focuses on management's organizational structure for cybersecurity (CISO and steering committee) and the specific qualifications of the CISO, making it Management Role. Specificity is Level 4 due to the verifiable claim of 'over 20 years of experience' and the specific Stanford University credential, alongside firm-specific roles.


fact: VP of IT

reasoning: The paragraph primarily describes the Board's oversight structure, including delegation to the Audit Committee and the reporting chain from management (VP of IT) to the Board, which answers how the board oversees cybersecurity. Specificity is Firm-Specific due to the mention of the 'VP of IT' role, which is a VP-level leadership position distinguishing this company's governance structure from others.


fact: In October 2023 (specific date of incident)

fact: 23andMe.com accounts (specific scope/platform affected)

fact: reset customer passwords (specific remediation action)

fact: required two-factor verification (specific technical control implemented)

reasoning: The paragraph primarily answers what happened in a specific cybersecurity incident, providing the date (October 2023), scope (23andMe.com accounts), and remediation details, which is classic Incident Disclosure. The specificity reaches Level 4 due to the verifiable date tied to a real event and the specific domain affected, alongside concrete remediation actions like mandatory two-factor verification.


reasoning: Paragraph describes the governance oversight chain (Board of Directors → Audit Committee → Chief Financial Officer) for cybersecurity risk management. While it mentions the CFO has primary responsibility for the cybersecurity program, this constitutes governance structure description rather than management organizational detail, and CFO is explicitly defined as a generic governance role per the annotation guidelines. The text contains no domain-specific cybersecurity terminology, firm-unique facts, or externally verifiable claims.


fact: Information Security Program ("ISP")

fact: Information Technology Board Committee ("ITBC")

fact: IT Steering Committee ("ITSC")

reasoning: The paragraph describes the oversight structure for the company's Information Security Program, specifically naming the Information Technology Board Committee (ITBC), which is a board-level entity, placing this in Board Governance. Specificity is Firm-Specific because the paragraph identifies proprietary committee names (ITBC, ITSC) and a named internal program (ISP) that are unique to this organization.


fact: Pension Benefit Information, LLC (PBI) - named third-party vendor

fact: Progress Software Corporation - named software vendor

fact: MOVEit Transfer software - named vulnerable product

fact: approximately 850,000 customers affected - specific quantity of impacted records

fact: quarter ended June 30, 2023 - specific timeframe of prior disclosure

fact: personally identifiable information - specific data type compromised

reasoning: The paragraph describes an actual cybersecurity incident involving the MOVEit vulnerability at a specific vendor (PBI), including the nature of the breach, timeline (previously disclosed in the June 30, 2023 10-Q), and scope (850,000 customers' PII), which fits Incident Disclosure. Specificity is Quantified-Verifiable due to named external entities (PBI, Progress Software Corporation), specific product names (MOVEit Transfer), and the quantified impact figure (approximately 850,000 customers).


fact: Ann Bordelon, Chair of the Audit Committee, has cybersecurity risk management experience

fact: Paulette Dodson has cybersecurity risk management experience

fact: Noah Glass has cybersecurity risk management experience

reasoning: The paragraph describes Board and Audit Committee oversight of cybersecurity, including the Committee's review of risk profiles and IT changes. Per Rule 1, governance-chain descriptions of Board-level committees default to Board Governance. The specificity is driven by the naming of three specific Directors (Bordelon, Dodson, Glass) and their cybersecurity qualifications, which distinguishes this company's governance structure. No domain-adapted terminology (e.g., specific security practices, frameworks, or tools) or quantifiable verifiable facts (e.g., years of experience, certifications, headcounts) are present.


fact: implemented multi-factor authentication (MFA) across all our systems and email accounts

reasoning: The paragraph primarily answers what happened in a past cybersecurity incident by describing the 2019 wire fraud scheme, including the compromise vector and timeline, making it Incident Disclosure. Specificity is Quantified-Verifiable due to the specific date of the incident (2019) and the externally verifiable claim that MFA has been implemented across all systems and email accounts.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers and supply chain partners, including requirements for security measures and audits, which falls under Third-Party Risk. The language consists of generic process descriptions ('identify, monitor and address,' 'specified ways,' 'as appropriate') that lack domain-specific technical detail, firm-unique identifiers, or quantifiable facts, placing it at Generic Boilerplate specificity.


fact: Chief Information Security Officer (CISO)

fact: Enterprise Risk Committee (ERC)

fact: Operational Risk Committee (ORC)

fact: ERC led by CEO and includes representatives from relevant functions

fact: CISO reports to ORC and ERC at least annually

fact: Cybersecurity team coordinates with Compliance, Human Resources, Internal Audit and Legal

reasoning: The paragraph describes management-level governance structures (ERC and ORC) and the CISO's operational responsibilities, reporting lines, and coordination with specific departments, answering how management is organized to handle cybersecurity. Specificity is Firm-Specific due to the identification of the CISO role, specific committee names (ERC/ORC), and the explicit list of coordinating departments (Compliance, HR, Internal Audit, Legal).


fact: Chief Information Officer

fact: Chief Information Security Officer

reasoning: The paragraph primarily describes Board oversight through the Audit Committee, which receives reports from management and evaluates cybersecurity risks for the Board. Specificity is Firm-Specific due to the identification of senior cybersecurity leadership roles (CIO and CISO) that distinguish the company's governance structure.


fact: threat landscape assessment

fact: cybersecurity posture

fact: incident response plans

reasoning: This paragraph primarily answers how the board (via the audit committee) oversees cybersecurity risk by describing the quarterly briefing mechanism and formal updates provided by management. While the bullet points detail substantive risk management activities (threat monitoring, incident response), they are framed as the content of governance reports to the board rather than standalone program operations. Specificity is Domain-Adapted because terms like 'threat landscape assessment' and 'cybersecurity posture' demonstrate cybersecurity domain expertise that would not naturally appear in generic enterprise risk management discourse.


fact: Vice President of Information Technology (firm-specific leadership role at VP level responsible for reviewing the cybersecurity risk management program with the Board)

reasoning: The paragraph describes the Board's oversight structure, assigning responsibility to the Audit Committee, establishing quarterly meetings with management, and annual reviews of the cybersecurity program—classic governance-chain content that defaults to Board Governance under Rule 1. Specificity is Firm-Specific because the paragraph identifies a 'Vice President of Information Technology' as the specific management role interfacing with the Board, which qualifies as a firm-specific leadership title at the VP level.


reasoning: The paragraph is primarily a cross-reference directive pointing to Item 1A Risk Factors, with no substantive cybersecurity disclosure. The single operational claim—that 'senior leadership' evaluates risks and mitigations—is generic governance language applicable to any enterprise risk management context, lacking description of board oversight structures, management roles, risk processes, or specific cybersecurity measures.