reasoning: The paragraph describes the cybersecurity program's components (mechanisms, controls, technologies) and activities (assessing, identifying, managing risks) rather than governance structure or management organization details. It uses generic business terminology ('mechanisms', 'controls', 'outside advisors') without specific cybersecurity domain expertise, firm-unique details, or verifiable facts.


content_category: Management Role

fact: Information Security Steering Committee ("ISSC") - named management committee

fact: executives from Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments - specific cross-functional team composition

fact: services agreement with LMC - firm-specific organizational arrangement for establishing governance

category_confidence: high

specificity_confidence: high

reasoning: This paragraph describes management's organizational structure for cybersecurity oversight, specifically the Information Security Steering Committee (ISSC), its membership composition across specific departments, and its management oversight responsibilities, which falls under Management Role per Rule 1 (management-level committees described in terms of structure/membership). Specificity is Firm-Specific (Level 3) due to the named committee (ISSC), the explicit listing of participating departments (Legal, Accounting, Internal Audit and Risk Management, Cybersecurity, and Facilities), and the reference to the services agreement with LMC as the mechanism for establishing this governance structure.

provider: moonshotai

stage: benchmark


content_category: Risk Management Process

reasoning: The paragraph describes the company's processes for assessing and managing cybersecurity risks and protecting information assets, which directly answers what the cybersecurity program does (Risk Management Process). However, the language is entirely generic—phrases like 'processes for assessing, identifying and managing' and 'protect our information assets' pass the ERM test (applicable to financial or operational risks) and demonstrate no cybersecurity domain expertise. There are no firm-specific details (no roles, committees, or organizational specifics) and no quantifiable or verifiable facts (no numbers, dates, certifications, or named third parties).


content_category: Third-Party Risk

reasoning: The paragraph primarily answers how third-party cyber risks are managed by describing contractual requirements imposed on service providers (certification of security capabilities, breach reporting obligations). Per Rule 3, requirements imposed on vendors map to Third-Party Risk. For specificity, the paragraph contains only generic terms like 'risk assessment processes' and 'security measures' which explicitly fail the ERM test per the guidelines (listed as Level 1), with no domain-adapted terminology, firm-specific details, or verifiable facts present.


content_category: Strategy Integration

reasoning: The paragraph states a conclusion about whether cybersecurity incidents have materially affected or are reasonably likely to materially affect the company's business strategy, results of operations, or financial condition, which is the definition of a Strategy Integration assessment per Rule 5 (specifically the backward-looking and forward-looking materiality assertions). The text contains no domain-specific cybersecurity terminology, firm-specific organizational details, or externally verifiable facts—only generic negative assertions and cross-references that any company could use.


content_category: Incident Disclosure

fact: On February 23, 2023, we experienced a network outage that affected its internal servers and IT telephony

fact: on February 28, 2023, we further disclosed that certain data had been extracted from the DISH Network IT systems

reasoning: The paragraph primarily answers what happened in a specific cybersecurity incident, providing the exact dates (February 23 and 28, 2023), nature of the outage, and remediation steps, which qualifies as Incident Disclosure. The specificity is Level 4 because it contains externally verifiable, specific dates tied to real events that were publicly reported.


reasoning: The paragraph primarily answers whether cybersecurity risks are reasonably likely to materially affect the business, including the required SEC Item 106(b)(2) forward-looking assessment ('reasonably likely to materially affect'), which falls under Strategy Integration per Rule 5. The text contains no domain-adapted cybersecurity terminology (failing the ERM test), no firm-specific organizational details (roles, committees, programs), and no verifiable facts—only generic materiality assertions and cross-references to risk factors.


content_category: Board Governance

fact: Security & Technology Committee

reasoning: The paragraph describes the Board's oversight of cybersecurity incidents and explicitly names the 'Security & Technology Committee' as the specific board-level body receiving incident updates, which is a firm-specific governance structure (Level 3) distinguishing TTEC's oversight model from generic board governance.


fact: reviewing relevant cybersecurity certifications

fact: third-party audit results

fact: assessing technical and organizational controls

reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from suppliers, including reviewing certifications and audit results and assessing technical/organizational controls, which fits Third-Party Risk. The specificity is Domain-Adapted because it cites specific assessment activities (certification reviews, control assessments) that demonstrate cybersecurity domain expertise beyond generic vendor risk management language.


fact: vendor-provided software fixes, commonly called patches

fact: security configurations

fact: changes to security configurations are documented, approved, and tested

fact: exploitable files and services

fact: vulnerability scanning

fact: intrusion detection tools

fact: known vulnerabilities

reasoning: The paragraph describes specific cybersecurity program activities including patch management, configuration control, vulnerability scanning, and intrusion detection, which are core Risk Management Process functions. Specificity is Domain-Adapted because terms like 'patches,' 'exploitable files,' 'vulnerability scanning,' and 'intrusion detection tools' demonstrate cybersecurity domain expertise that would not appear in generic enterprise risk management language; no firm-specific organizational details or quantifiable metrics are present.


fact: Management Enterprise Risk Committee

fact: Vendor Management Committee

fact: managed security service monitoring

fact: penetration testing

fact: vulnerability assessment

reasoning: The paragraph primarily answers how third-party cyber risks are managed, focusing on vendor due diligence, contractual security requirements, and the Vendor Management Committee's oversight role, making it Third-Party Risk. Specificity is Firm-Specific (Level 3) due to the naming of distinct internal committees (Management Enterprise Risk Committee, Vendor Management Committee) that distinguish this company's governance structure, alongside domain terminology (managed security service monitoring, penetration testing, vulnerability assessment).


reasoning: The paragraph states a backward-looking conclusion that cybersecurity threats have not materially affected the company's business strategy, results of operations, or financial condition, which falls under Strategy Integration per Rule 5 (materiality assessments). It contains no specific facts, domain terminology, firm-specific details, or verifiable claims—only a generic negative materiality assertion regarding the reporting period—resulting in Generic Boilerplate specificity.


fact: Chief Information Security Officer (CISO) - VP-level cybersecurity leadership role

fact: Chief Risk Officer (CRO) - VP-level role overseeing risk function

fact: over 18 years of experience in information technology leadership - verifiable lower bound

fact: eight years of experience in leading information security oversight - verifiable specific duration

reasoning: The paragraph primarily describes management's organizational structure, reporting lines (CISO to CRO), and leadership qualifications, fitting Management Role. Specificity reaches Level 4 due to verifiable claims regarding the CISO's years of experience (18 years total, 8 years in security oversight), which are concrete, checkable facts.


fact: Combined over 35 years of IT management experience (Level 4)

fact: Chief Information Officer (Level 3)

fact: Information Security Officer (Level 3)

fact: Information security team (Level 3)

fact: Coordination with compliance and human resources departments (Level 3)

fact: Enterprise-wide cybersecurity strategy (Level 2)

fact: Information security awareness training (Level 2)

fact: Assessing cybersecurity robustness during third-party vendor onboarding (Level 2)

fact: Protective provisions in third-party vendor agreements (Level 2)

fact: Risk-based monitoring (Level 2)

reasoning: The paragraph primarily answers how management is organized to handle cybersecurity, identifying the Chief Information Officer and Information Security Officer, their reporting structure, qualifications, and coordination with other departments. The specificity is driven by the quantified, verifiable claim of 'over 35 years of IT management experience' for these officers, which sets an externally checkable threshold, alongside firm-specific role titles and departmental coordination details.


reasoning: The paragraph primarily states a materiality conclusion—that cybersecurity threats have not materially affected and are not reasonably likely to materially affect the company's business strategy, results of operations, or financial condition—which is a Strategy Integration assessment per Rule 5. The text contains no specific domain terminology (using only generic phrases like 'safeguard information systems' and 'mitigate potential risks' that any ERM professional would use), no firm-specific details (no named roles, committees, or organizational structures), and no quantifiable or verifiable facts (only negative assertions about absence of material impact and soft qualifiers).


reasoning: The paragraph provides a forward-looking materiality assessment ('reasonably likely to materially affect') and a backward-looking negative assertion about material incidents, which per Rule 5 classifies as Strategy Integration. For specificity, the paragraph contains only subjective beliefs and negative self-assertions about the absence of incidents, which the guidelines explicitly state are not externally verifiable; it lacks domain-specific terminology, named roles, or quantifiable data, resulting in Generic Boilerplate.


fact: February 23, 2023

fact: February 28, 2023

fact: DISH Network

fact: internal servers and IT telephony

fact: certain data had been extracted

reasoning: The paragraph primarily describes a specific historical cybersecurity incident, providing exact dates (February 23, 2023 for the outage and February 28, 2023 for the data extraction disclosure), identifying the affected entity (DISH Network), and detailing specific scope elements (internal servers, IT telephony, extracted data). These specific dates tied to real events constitute externally verifiable facts, making the specificity Level 4 despite the presence of generic forward-looking language elsewhere in the paragraph.


reasoning: The paragraph describes the Audit Committee's oversight role in receiving reports from management on cybersecurity strategy, which is classic board governance structure (Rule 1: Board-level committees → BG). The specificity is Level 1 because the language consists entirely of generic ERM terminology ('assists the board,' 'overseeing steps,' 'annually,' 'from time to time') that could apply to any risk type and contains no domain-specific practices, firm-unique details, or verifiable facts.


fact: Engaged Marco Technologies as the organization's Managed IT provider

fact: Utilizes Red Canary to provide 24/7 monitoring on all end points

fact: High Point Networks provides physical and cloud-based network data backup solutions

fact: Return to Operations objectives of less than 24 hours

fact: Monthly cybersecurity training requirement for all Advisor personnel

reasoning: The paragraph primarily describes specific cybersecurity activities (endpoint monitoring, backups, software updates, training) performed by third-party providers, constituting Risk Management Process. Specificity is Level 4 due to named third-party vendors (Marco Technologies, Red Canary, High Point Networks) and the quantified Return to Operations objective of less than 24 hours.


category_confidence: medium

reasoning: The paragraph describes the company's reliance on third-party vendors for IT and cybersecurity services as a component of its operational infrastructure; per Rule 3, third parties mentioned as one component of an internal program map to Risk Management Process rather than Third-Party Risk (which requires focus on vendor risk management). The text contains no specific cybersecurity domain terminology (e.g., specific tools, frameworks, or practices), no firm-specific details (e.g., titles, named programs), and no quantifiable or verifiable facts, resulting in Generic Boilerplate specificity.


fact: CISO (Chief Information Security Officer) role mentioned as the source of reports to the audit committee

reasoning: The paragraph describes the audit committee's oversight activities—specifically what reports it receives and its access to cybersecurity information—which is Board Governance. The mention of the CISO constitutes a firm-specific cybersecurity leadership role (VP-level or above), elevating specificity from Generic Boilerplate to Firm-Specific.


fact: in 2019 we were the subject of a successful phishing attempt

reasoning: The paragraph primarily constitutes a materiality assessment containing the SEC-required forward-looking language that no cybersecurity risks are 'reasonably likely to materially affect' business strategy, results of operations, or financial condition, which per Rule 5 is explicitly Strategy Integration. While it mentions a 2019 phishing incident, this serves as contextual support for the materiality conclusion rather than constituting primary incident disclosure. Specificity is Firm-Specific because the disclosure of a specific historical incident occurring in 2019 distinguishes this company's cybersecurity experience from others, even though the year alone does not constitute an externally verifiable claim under Level 4 standards.


fact: January 2021

fact: source code

fact: credentials

reasoning: The paragraph primarily answers what happened in a specific cybersecurity incident, detailing the January 2021 discovery of improper access to systems hosted by a third-party cloud provider and the compromise of source code and credentials, including an extortion attempt. The specific date 'January 2021' and the identification of 'source code' as compromised data are externally verifiable facts that establish Level 4 specificity.


fact: February 2023 cyberattack (specific date of actual incident experienced by the company)

reasoning: The paragraph primarily answers whether cybersecurity incidents have materially affected the business, providing a backward-looking assessment that the February 2023 cyberattack did not have material adverse impacts on financial position or operations. The specific reference to 'February 2023' provides an externally verifiable date tied to an actual historical incident, satisfying Level 4 specificity despite the surrounding boilerplate risk language.


content_category: None/Other

reasoning: This paragraph provides only high-level threat context and generic statements about resource expenditure without describing actual governance structures, management roles, risk processes, or strategic business impacts. It functions as introductory risk disclosure rather than answering any of the six substantive questions. As a None/Other paragraph, it receives Generic Boilerplate specificity.


reasoning: The paragraph describes the Audit Committee's oversight of cybersecurity risks and receipt of management reports, which is classic board governance structure under Rule 1. The text contains no domain-specific cybersecurity terminology (failing the ERM test), no firm-specific roles or committees beyond the generic Audit Committee, and no quantifiable or verifiable facts, resulting in Generic Boilerplate specificity.


fact: Software Approval Board

fact: cross-functional members from Quality, Internal Audit, Information Security, Business Systems, and R&D

reasoning: The paragraph primarily answers how third-party cyber risks are managed through vendor diligence, contractual requirements, and software evaluation processes. Specificity is Firm-Specific due to the named internal committee ('Software Approval Board') and the detailed departmental composition of its membership, which distinguishes this company's approach from generic third-party risk descriptions.


reasoning: The paragraph provides the required SEC materiality assessment stating that no cybersecurity incidents materially affected the business in 2023 (backward-looking) and that none are reasonably likely to do so (forward-looking), which falls under Strategy Integration per Rule 5. It contains no specific facts, domain terminology, or verifiable claims—only generic negative assertions about the absence of material impacts and a standard cross-reference to Risk Factors.


reasoning: The paragraph centrally addresses how third-party cyber risks are managed, focusing on outreach to technology service providers to ascertain downstream implications of breaches. However, it contains no specific facts—no domain-specific security frameworks or tools (fails ERM test), no firm-specific organizational details or roles, and no quantifiable or verifiable claims.


fact: Information Security Officer role with responsibility for cybersecurity component

fact: reports directly to Chief Risk Officer

reasoning: Paragraph primarily describes management's organizational structure for cybersecurity, focusing on the Information Security Officer's responsibilities and reporting lines to the Chief Risk Officer and committees. Specificity is Firm-Specific due to named leadership roles (Information Security Officer, Chief Risk Officer) and the specific committee name (Information Technology Steering Committee), which distinguish this company's governance structure.


reasoning: This paragraph is a cross-reference directing readers to Item 1A Risk Factors for discussion of cyber intrusion impacts, containing no substantive cybersecurity disclosure about governance, management, processes, or strategy. It lacks specific facts, domain terminology, or verifiable claims, consisting solely of a navigational pointer.


reasoning: The paragraph primarily answers how the board oversees cybersecurity by describing the Audit Committee's receipt of periodic reports from the cybersecurity function and its access to threat-related materials, which constitutes Board Governance. While the paragraph includes a materiality assessment required by SEC Item 106(b)(2) (Strategy Integration), the governance description comprises the majority of the text. For specificity, the paragraph contains only generic references ('Audit Committee' is a standard governance body, 'cybersecurity function' lacks specific titles, and 'periodic' or 'various' reports lack concrete details) and a negative materiality assertion that is not externally verifiable, resulting in no facts above Level 1.


fact: In January 2024, board of directors participated in a cybersecurity training session

reasoning: The paragraph answers how the board oversees cybersecurity by describing the audit committee's delegated oversight role, regular management briefings, and board training, fitting Board Governance. The specificity is driven by the externally verifiable date 'January 2024' for the board's cybersecurity training session.


reasoning: The paragraph primarily answers whether cybersecurity risks have materially affected the business, explicitly stating that 'no such incident has had any such impact to date' and cross-referencing Item 1A for the full materiality assessment required by SEC Item 106(b)(2). The text contains no specific cybersecurity domain terminology (using only generic ERM phrases like 'protocols, controls, and systems' and 'monitor and update' that apply to any risk type), no firm-specific organizational details, and no quantifiable or verifiable facts.


fact: Security incident management processes involve compliance, legal and data privacy departments

fact: DWS is the designated entity responsible for notifying RREEF of incidents affecting stockholder data

fact: Deutsche Bank Group's security incident management framework covers subsidiaries including RREEF

reasoning: Paragraph describes incident response protocols and notification procedures, fitting Risk Management Process (incident response planning). Specificity is Firm-Specific because it explicitly names the specific departments involved (compliance, legal and data privacy) rather than using generic terms like 'management' or 'cross-functional teams,' and identifies DWS as the specific entity handling notification duties.


fact: Chief Business Officer provides cybersecurity updates to Board of Directors and Audit Committee

reasoning: The paragraph describes the Audit Committee's and Board's oversight of cybersecurity risk, including the frequency and source of updates (Chief Business Officer and outside consultant), which directly answers how the board oversees cybersecurity (Board Governance). The specificity is Firm-Specific because it identifies the Chief Business Officer—a C-level executive—as the specific internal role responsible for briefing the Board on cybersecurity matters, which distinguishes this company's governance structure from others.


reasoning: The paragraph describes business resilience planning activities including business impact analyses and tabletop exercises, which constitute risk management processes for operational continuity. However, the terminology used—including references to ISO 22301, BCI, DRII, business continuity strategies, and tabletop exercises without a cybersecurity qualifier—falls within standard enterprise risk management and business continuity lexicon that any ERM professional would use, per the 'commonly confused' list for Level 1. No firm-specific details (e.g., specific leadership titles, team sizes) or externally verifiable facts (e.g., certification dates, specific metrics) are present.


fact: Third Party Cyber Risk Management Plan (named internal program)

fact: SOC2 T2 (domain term)

fact: penetration testing (domain term)

fact: ISO 27001 certification (domain term)

specificity_confidence: medium

reasoning: The paragraph centrally addresses vendor cybersecurity oversight through due diligence processes, contractual security requirements, and ongoing monitoring, fitting the Third-Party Risk category. Specificity is Firm-Specific due to the named internal program 'Third Party Cyber Risk Management Plan', with additional domain expertise demonstrated through specific requirements for SOC2 Type 2 reports, penetration testing, and ISO 27001 certification.


fact: penetration testing firms

fact: forensic investigators

fact: security documentation reviews

fact: review of security questionnaires

fact: security audits

fact: Information Systems and Data

reasoning: The paragraph centrally addresses vendor oversight and management of third-party cybersecurity risks, including specific assessment processes and contractual obligations imposed on providers, fitting the Third-Party Risk category. It demonstrates cybersecurity domain expertise through specific practices like penetration testing, forensic investigations, and security questionnaires that exceed generic ERM language, but contains no firm-specific organizational details or quantifiable facts that would elevate it to higher specificity levels.


reasoning: The paragraph consists of forward-looking disclaimer language speculating about potential future breaches and operational disruptions without describing actual cybersecurity governance, management structures, processes, or incidents. Per Rule 6, pure speculation without substantive measures is classified as None/Other, which always receives Generic Boilerplate specificity.


reasoning: The paragraph centers on vendor cybersecurity oversight, contractual security requirements, and mitigating third-party incident risks, clearly answering how third-party cyber risks are managed. It contains only generic descriptions of due diligence and contractual provisions without specific cybersecurity domain terminology (e.g., SOC 2, penetration testing), firm-unique details, or quantifiable facts, resulting in Generic Boilerplate specificity.


fact: June 30, 2024 (specific date of incident detection)

reasoning: The paragraph describes an actual cybersecurity incident that occurred on June 30, 2024, including unauthorized third-party access and subsequent remediation expenses, which directly answers 'what happened' (Incident Disclosure). The specific date constitutes a hard, externally verifiable fact that anchors the incident to a definite point in time, satisfying Level 4 specificity.


reasoning: The paragraph centrally addresses third-party cyber risk management through vendor assessments, contractual monitoring, and compliance tracking. However, it contains only generic descriptions of activities ('due diligence security assessments', 'periodic assessments', 'ongoing monitoring') that could apply to any enterprise risk management context without demonstrating cybersecurity domain expertise, and lacks firm-specific details (e.g., specific VP-level roles, team composition, named standards) or verifiable facts (e.g., specific dates, numbers, named vendors).


reasoning: The paragraph describes the existence of a cybersecurity program intended to monitor and improve the company's security posture, which falls under Risk Management Process. However, it contains no specific facts—only generic statements about data handling and program existence that apply to any company, with no domain-specific terminology, firm-unique details, or verifiable claims.


fact: CSO (Chief Security Officer) - cybersecurity leadership role at VP level or above

fact: TTEC executive leadership team - firm-specific organizational entity

reasoning: The paragraph describes the cybersecurity program's activities (protecting information systems, responding to incidents) and the deployment of teams to address threats, which are core risk management processes. While the CSO is mentioned, the content focuses on what the program does rather than organizational structure or qualifications. The specificity is Firm-Specific due to the identification of the CSO role and TTEC executive leadership team as distinct organizational entities involved in the program.


fact: data encryption

fact: unauthorized incorporation in large language models

fact: artificial intelligence systems

reasoning: The paragraph primarily describes specific cybersecurity activities and protective measures (network security, encryption, AI-related data protection), placing it in Risk Management Process, though it includes a secondary governance element regarding Board reporting. Specificity is Domain-Adapted due to the mention of specific technical controls and the distinctive reference to emerging AI-related threats (unauthorized incorporation in LLMs), which demonstrates cybersecurity domain expertise beyond generic risk management language.


reasoning: Paragraph describes Audit Committee oversight of cybersecurity risks and annual review of the enterprise risk management matrix presented by the Risk Committee. This answers 'How does the board oversee cybersecurity?' and fits Board Governance per Rule 1 (board-level committees describing oversight structure). Specificity remains Level 1 because the paragraph contains only generic governance terms (Audit Committee, Risk Committee, risk assessment, risk management, policies and procedures) explicitly listed as failing the ERM test in guidelines. The frequency 'at least once each calendar year' constitutes standard 'annual' cadence without specific dates, quantified headcounts, or domain-adapted terminology (e.g., NIST, penetration testing, SIEM) required for higher levels.


fact: vulnerability assessments

fact: threat environment

reasoning: The paragraph describes the Board and Audit Committee's oversight of cybersecurity, including reporting structures, briefing content, and information flow regarding incidents, which is core Board Governance content. Specificity is elevated to Domain-Adapted by the inclusion of cybersecurity-specific practices such as 'vulnerability assessments' and the 'threat environment,' which demonstrate specialized domain knowledge beyond generic enterprise risk management terminology.


fact: Chief Technology Officer (CTO)

fact: Chief Information Security Officer (CISO)

reasoning: The paragraph describes board oversight of cybersecurity, including the board receiving reports from management regarding program effectiveness and incident thresholds, which is classic Board Governance content. Specificity is Firm-Specific because it identifies the company's specific senior leadership titles (CTO and CISO) responsible for cybersecurity, distinguishing this company's organizational structure from others that might use different titles or lack these specific roles.


reasoning: The paragraph primarily describes engaging third-party consultants to assist with risk assessment, policy implementation, and monitoring activities, which constitutes a description of the cybersecurity risk management process (RMP). The language consists of generic risk management terminology ('risk assessment processes,' 'design and implement,' 'monitor and test') that could apply to any risk domain with minor substitution, lacking specific cybersecurity practices, firm-unique organizational details, or externally verifiable claims.


reasoning: The paragraph primarily addresses how third-party cyber risks are managed, focusing on vendor due diligence, ongoing monitoring of third parties, and the vendor management program. While it mentions annual internal assessments, the central topic is vendor oversight (TP), not internal risk management processes (RMP) or management roles (MR). For specificity, the paragraph uses generic ERM terminology ('risk-based approach,' 'ongoing monitoring,' 'industry-standard guidelines') that any enterprise risk management professional would use without demonstrating cybersecurity domain expertise. It contains no firm-specific details (no named roles, committees, or distinguishing program identifiers) and no quantified or verifiable facts (no specific dates, numbers, named standards, or certifications).


reasoning: This paragraph is a pure cross-reference directing readers to Item 1A for materiality assessments regarding cybersecurity threats, containing no substantive disclosure about board governance, management roles, risk processes, third parties, incidents, or strategy integration itself. As a cross-reference with no domain-specific terminology, verifiable claims, or firm-specific details, it qualifies as Generic Boilerplate.


fact: over 20 years of information security experience

fact: over four years as a director in the information security management practice of a big four accounting firm

fact: B.S. in Network Security

fact: CISO reports to Chief Financial Officer

fact: Information Security Steering Committee (ISSC)

reasoning: The paragraph primarily answers how management is organized, detailing the CISO's reporting line to the CFO, specific qualifications (20+ years experience, Big Four background, Network Security degree), and the management-level ISSC structure. Specificity reaches Level 4 due to verifiable claims about the CISO's years of experience, educational credentials, and prior employment that could be independently confirmed.


fact: CISO (cybersecurity leadership role at VP level or above)

fact: CIO (cybersecurity leadership role at VP level or above)

fact: Security & Resiliency global practice leader (specific organizational role title)

reasoning: The paragraph primarily answers how the board oversees cybersecurity, describing the Audit Committee's semi-annual review of risk management and the flow of information from management to the Board, which is core Board Governance content. Specificity is elevated to Firm-Specific by the identification of distinct senior leadership roles—including the CISO, CIO, and Security & Resiliency global practice leader—whose specific titles and reporting relationships distinguish Kyndryl's governance structure from generic frameworks.


reasoning: The paragraph provides the forward-looking materiality assessment required by SEC Item 106(b)(2), stating that cybersecurity threats 'are reasonably likely to materially affect our business strategy, result of operations or financial condition,' which categorizes it as Strategy Integration. It contains no domain-specific cybersecurity terminology (failing the ERM test), no firm-specific organizational details, and no quantifiable or verifiable facts—only generic resource commitments, negative assertions about incidents, and cross-references—resulting in Generic Boilerplate specificity.


fact: security questionnaires

fact: information security addenda

fact: audits and compliance reviews

fact: network infrastructure overviews

fact: cloud-based technology

fact: personally identifiable information

reasoning: The paragraph answers how third-party cyber risks are managed by describing the company's vendor management program, contractual security requirements, and risk assessment processes, placing it in Third-Party Risk. Specificity is Domain-Adapted because the paragraph uses cybersecurity-specific terminology (security questionnaires, information security addenda, network infrastructure reviews) that demonstrates domain expertise beyond generic enterprise risk management language, though it lacks firm-specific details like named roles or verifiable metrics.


reasoning: The paragraph contains the SEC Item 106(b)(2) forward-looking materiality assessment language ('reasonably likely to materially affect'), which per Rule 5 explicitly qualifies as Strategy Integration. The text consists entirely of generic regulatory boilerplate without specific facts, domain terminology that passes the ERM test, firm-specific details, or verifiable data.


fact: CISO (Chief Information Security Officer)

fact: NIST CSF (National Institute of Standards & Technology Cybersecurity Framework)

fact: endpoint detection

fact: privileged access management

fact: security incident response and event management

fact: documented security architecture program

fact: Global Information Security Policy

reasoning: The paragraph primarily describes specific cybersecurity program activities, technical controls (endpoint detection, privileged access management), and framework alignment (NIST CSF), which constitutes Risk Management Process per the person-removal test. Specificity reaches Firm-Specific due to the explicit mention of the CISO leadership role, supported by domain-adapted terminology throughout.


fact: Franklin Templeton named as the entity maintaining relationships with third party service providers for cybersecurity containment and remediation

reasoning: The paragraph describes engaging third-party providers to perform cybersecurity activities (containment and remediation), which falls under Risk Management Process per Rule 3 (third parties hired to serve the company). Specificity is Firm-Specific because it identifies Franklin Templeton as the specific external party responsible for these vendor relationships, distinguishing this company's organizational structure from peers who may manage such relationships internally or through different external advisors.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks presented by third-party vendors and external users, fitting the Third-Party Risk category. However, it employs generic governance terminology ('comprehensive, risk-based approach,' 'identifying and overseeing') that could apply to any enterprise risk domain without demonstrating cybersecurity-specific domain expertise, and contains no firm-specific details (e.g., named roles, committees) or verifiable facts (e.g., specific standards, named vendors).


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers through vendor diligence and risk assessments. However, it employs generic ERM language ('conducting vendor diligence,' 'assessed for risk based on...') that would apply equally to financial or operational vendor risk management without demonstrating cybersecurity domain expertise, and contains no firm-specific details or verifiable facts.


reasoning: The paragraph describes the activities of the cybersecurity program (monitoring IT systems and managing incident prevention, detection, mitigation, and remediation), which falls under Risk Management Process. It contains no domain-specific terminology (using generic risk management phases applicable to any risk type), firm-specific organizational details (titles like 'information technology employee' and 'Chief Executive Officer' are generic), or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes the Board's delegation of cybersecurity oversight to the Audit Committee, which is a classic governance-chain description falling under Board Governance. The language consists of generic risk oversight terminology ('risk oversight function,' 'delegated to the Audit Committee') that any ERM professional would naturally use, containing no domain-specific cybersecurity terms, firm-specific details, or externally verifiable facts.


reasoning: The paragraph primarily describes the Board and Audit Committee's oversight structure for cybersecurity, including reporting lines from management (CISO) to the Committee and Board briefing frequencies, which is classic Board Governance content. The specificity reaches Firm-Specific (Level 3) because it identifies a distinct cybersecurity leadership role—the Vice President and Chief Information Security Officer (CISO)—which distinguishes Arista's organizational structure from companies without VP-level security leadership, even though it lacks quantified metrics or domain-specific technical terminology.


reasoning: This paragraph is a cross-reference directing readers to Item 1A (Risk Factors) for information about whether cybersecurity risks have materially affected the company, rather than providing substantive cybersecurity disclosure itself. It contains no specific facts, domain terminology, or verifiable claims about the company's cybersecurity program or posture.


reasoning: This paragraph describes the governance chain and information flow whereby management reports cybersecurity matters to the audit committee, directly addressing how the board oversees cyber risks. It contains no specific facts—only generic references to 'members of management' and 'audit committee' without specific titles, names, quantified details, or domain-specific terminology that would demonstrate cybersecurity expertise—resulting in Generic Boilerplate specificity.


reasoning: Paragraph describes senior management's (CEO/CFO) responsibilities for cybersecurity risk assessment and their reporting line to the Audit Committee, as well as their qualifications (general management experience without specific certifications). This focuses on management's organizational role. The paragraph contains no domain-specific terminology, firm-specific details (CEO/CFO are generic titles per guidelines), or verifiable facts, resulting in Generic Boilerplate specificity.


fact: over 20 years of both leading and transforming technology, digital growth, and e-commerce in the retail and food industry

fact: graduated with a master's degree in business administration and management from Ecole Supérieure de Commerce de Chambéry, Rhône-Alpes, France

fact: graduated from Miami University with a bachelor's degree in management information systems and marketing

reasoning: The paragraph describes specific cybersecurity leadership roles (CDO, interim CISO), their reporting relationships to the CEO, and detailed professional qualifications, answering how management is organized to handle cybersecurity. Specificity is Level 4 because it contains externally verifiable hard facts: the CDO's 'over 20 years' experience sets a checkable lower bound, and both officers' educational credentials from named institutions (Ecole Supérieure de Commerce de Chambéry and Miami University) are independently confirmable via academic records.


reasoning: The paragraph centers on vendor oversight and requirements imposed on third-party IT vendors, fitting the Third-Party Risk category under Rule 3 (requirements ON vendors). The language is entirely generic vendor risk management ('questionnaires', 'confidentiality, security, and privacy requirements') that an ERM professional would naturally use for any risk type; substituting 'operational disruptions' for 'cybersecurity incidents' would not change the paragraph's structure, confirming it fails the ERM test for domain expertise. No firm-specific cybersecurity roles, named programs, or verifiable facts (numbers, dates, certifications) are present.


fact: NEE Management and NEER provide or arrange for the provision of substantially all of NEP's information technology functions, including cybersecurity

fact: NEP's board oversees the provision of these third-party services

reasoning: The paragraph primarily describes reliance on specific named affiliates (NEE Management and NEER) for IT and cybersecurity services, with the board overseeing this vendor relationship, fitting Third-Party Risk. Specificity is Firm-Specific because it identifies the specific entities providing services rather than using generic terms like 'third-party vendors' or 'service providers'.


reasoning: The paragraph centrally addresses how the company manages cybersecurity risks from third-party service providers and supply chain partners, including contractual requirements and audits imposed on vendors, which aligns with Third-Party Risk. It lacks specific cybersecurity domain terminology (e.g., specific standards, tools, or practices like SOC 2 or penetration testing), firm-unique details (e.g., named roles or committees), or quantifiable facts, relying instead on generic risk management language like 'diligence,' 'monitor,' and 'audits' that would apply to any type of vendor risk oversight.


reasoning: This paragraph is a cross-reference directing readers to Item 1A Risk Factors rather than providing substantive cybersecurity disclosure regarding governance, management, or processes. As a None/Other paragraph containing no specific facts about the company's cybersecurity posture, it is classified as Generic Boilerplate.


fact: Kroll (named third-party firm engaged for security maturity assessment and tabletop exercises)

fact: November 2022 (specific date of security maturity assessment)

fact: September 2023 (specific date of tabletop exercises)

reasoning: The paragraph describes specific cybersecurity program activities including maturity assessments, penetration testing, gap remediation, and incident response planning, which falls under Risk Management Process. Specificity is Quantified-Verifiable because it names the external assessor Kroll and provides specific dates (November 2022 and September 2023) for when these assessment activities occurred.


reasoning: The paragraph provides a biographical overview of an executive's career history (David Shear) and general business roles (President International, marketing, regional leadership) without any reference to cybersecurity responsibilities, oversight, or organizational structure related to information security. As the content contains no substantive cybersecurity disclosure, it falls outside the scope of Item 1C categories.


reasoning: The paragraph describes Audit Committee (board-level) education on information security topics and committee members' expertise in technology and risk management, which addresses board oversight structure (BG). It contains only generic references to education topics and expertise areas without specific cybersecurity practices, firm-unique details, or verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph answers how the board oversees cybersecurity by describing the governance chain (Board of Directors and Audit Committee supporting the process with senior leadership). It contains only generic references to standard governance bodies and high-level assertions about maintaining security that any public company could make, with no domain-specific terminology, firm-unique details, or verifiable facts.


reasoning: The paragraph centrally addresses how third-party cyber risks are managed, describing contractual security addenda and incident reporting requirements for subcontractors. It contains no domain-specific cybersecurity terminology that would fail the ERM test (e.g., specific standards like SOC 2 or technical controls like encryption), no firm-unique organizational details (e.g., named committees or specific roles), and no quantifiable or externally verifiable claims (e.g., specific dates, numbers, or named vendors), resulting in generic boilerplate specificity.


fact: CTO's Senior Vice President, Chief Financial Officer and Treasurer, Senior Vice President, General Counsel and Corporate Secretary, and Senior Vice President, Chief Accounting Officer have approximately 20 years or more of experience managing risks including risks arising from cybersecurity threats (verifiable lower-bound claim on professional tenure)

reasoning: The paragraph describes the qualifications and experience of specific senior management positions (CFO, General Counsel, CAO) in overseeing cybersecurity risks, which fits Management Role. It reaches Quantified-Verifiable specificity due to the quantified claim of 'approximately 20 years or more of experience,' which sets a verifiable lower-bound threshold (≥20 years) that could be confirmed against the professional histories of these specific officers.


fact: Chief Information Security Officer (CISO)

fact: Chief Information Officer (CIO)

fact: over 20 years of experience

reasoning: The paragraph describes the governance chain from the Board of Directors to the Audit Committee to the CISO/CIO, which defaults to Board Governance under Rule 1. Specificity is Level 4 due to the externally verifiable claim that both the CISO and CIO have 'over 20 years of experience,' which sets a checkable threshold, alongside firm-specific executive titles.


reasoning: The paragraph primarily answers whether cybersecurity has materially affected the business through the required SEC materiality assessment language ('not aware of any risks... that have materially affected or are reasonably likely to materially affect'), which is a Strategy Integration conclusion per Rule 5. It contains no firm-specific organizational details, quantified metrics, or technical domain expertise (terms like 'cyber attacks' and 'data security incidents' are standard risk categories any ERM professional would use), resulting in Generic Boilerplate specificity.


fact: CDIO (Chief Digital Information Officer) chairs security council

fact: Security council comprises senior leaders from Legal and Regulatory, Corporate Security, Network Engineering, Internal Audit, Finance & Accounting and Risk and IT Infrastructure

fact: April 2024 cyber-attack

reasoning: The paragraph primarily answers how management is organized for cybersecurity, describing the CDIO-led security council, its cross-functional departmental composition, and escalation procedures to the Board, which fits Management Role. Specificity reaches Level 4 due to the externally verifiable reference to the 'April 2024 cyber-attack' (specific date of a real event) and firm-specific organizational details including the CDIO title and enumerated departmental membership of the council.


fact: over 20 years of experience in information technology and cybersecurity

fact: Vice President of Information Technology

fact: ERMC

reasoning: The paragraph describes management's organizational structure for cybersecurity, including specific roles (VP of IT, ERMC membership) and reporting relationships, which fits Management Role. The specific quantified claim of 'over 20 years of experience' is externally verifiable, establishing Level 4 specificity.


fact: CIO has led IT efforts since 2016

fact: more than 20 years of experience as an IT leader

fact: Chief Information Officer (CIO) leads the Information Security team

fact: CIO reports to Corporate General Counsel

reasoning: The paragraph describes the organizational structure of cybersecurity leadership, the CIO's qualifications and career history, and management reporting lines (Management Role). Specificity is driven by externally verifiable details including the specific tenure start date (2016) and quantified experience threshold (20+ years), alongside firm-specific organizational facts (CIO title and reporting line to the General Counsel).


fact: CIO/CDO role informs Audit Committee on cybersecurity matters

reasoning: The paragraph primarily answers how the Board oversees cybersecurity, describing the governance chain (Board → Audit Committee → CIO/CDO) and the information flow to the board, which is characteristic of Board Governance. The specificity is Firm-Specific (Level 3) due to the identification of the 'CIO/CDO' as the specific executive role responsible for briefing the Audit Committee, which distinguishes this company's organizational structure; otherwise, the paragraph relies on generic oversight terminology.


reasoning: This paragraph is a pure cross-reference directing readers to Item 1A for risk information, containing no substantive cybersecurity disclosure about governance, management, processes, or incidents. As a generic pointer with no actual content, it falls under None/Other and automatically receives Generic Boilerplate specificity.


reasoning: The paragraph describes external regulatory requirements (federal banking agency oversight and SEC disclosure rules) rather than answering any of the six substantive questions about the company's specific cybersecurity governance, management structure, or risk management processes. As a None/Other paragraph, it is classified as Generic Boilerplate per the category-specific specificity rule.


fact: Chief Information Officer designated as the executive providing cybersecurity updates to the Board

fact: Quarterly cadence for cybersecurity scorecard assessments and program updates

reasoning: The paragraph primarily answers how the Board oversees cybersecurity by describing the information flow from the Chief Information Officer to the full Board, including the frequency (quarterly) and scope of updates, which aligns with Board Governance. The specificity is Firm-Specific because it identifies the specific C-suite officer (CIO) responsible for cybersecurity reporting and the precise quarterly cadence of assessments—details that distinguish TopBuild's governance structure from generic oversight descriptions and satisfy the VP-level leadership criterion for Level 3.


reasoning: The paragraph exclusively addresses how the company manages cybersecurity risks from third-party service providers, including due diligence and selection criteria, which falls squarely under Third-Party Risk. However, it employs generic enterprise risk management terminology ('risk-based approach', 'due diligence', 'critical systems') that any ERM professional could use without cybersecurity domain expertise, and contains no firm-specific details, quantified metrics, or externally verifiable claims.


fact: National Institute of Standards and Technology Cybersecurity Framework

fact: multi-layered defenses

fact: physical, administrative, and technical safeguards

fact: monitoring and patching of vulnerabilities

reasoning: The paragraph primarily describes the company's cybersecurity program activities, including risk assessment methodology, adoption of the NIST Cybersecurity Framework, and operational processes such as vulnerability monitoring and patching, which aligns with Risk Management Process. Specificity is Domain-Adapted due to the use of cybersecurity-specific terminology including the NIST Framework, multi-layered defenses, and technical safeguards that demonstrate domain expertise beyond generic risk management language.


fact: VP of Information Technology

reasoning: The paragraph describes the senior management team responsible for leading cybersecurity processes, including specific leadership titles and their collective qualifications, which aligns with Management Role. The identification of a 'VP of Information Technology' constitutes a firm-specific fact (Level 3) as a VP-level role with IT portfolio responsibility, distinguishing this company's organizational structure from generic governance descriptions.


fact: Chief Technology Officer (C-level executive responsible for cybersecurity)

fact: over 15 years of experience in software development and security architecture

fact: reports to General Counsel regarding cybersecurity matters

reasoning: The paragraph primarily describes the organizational role, responsibilities, and qualifications of the Chief Technology Officer, including reporting lines to the General Counsel, which fits Management Role. Specificity is driven by the quantified experience claim ('over 15 years') which sets a verifiable threshold, along with firm-specific executive role identification.


reasoning: The paragraph serves primarily as a cross-reference to Item 1A Risk Factors and contains only generic statements about facing cybersecurity risks and having 'from time to time' experienced unspecified threats and incidents. It does not describe actual governance structures, management roles, program activities, third-party oversight, specific incident details (nature, scope, timing, impact), or materiality assessments. As a cross-reference with no substantive cybersecurity disclosure, it falls under None/Other. Specificity is Generic Boilerplate because the paragraph contains no firm-specific details, quantified metrics, or domain-specific technical terminology—only boilerplate risk language applicable to any public company.


fact: ISO (Information Security Officer) reports directly to the board of directors

fact: compliance with Interagency Guidelines for Safeguarding Customer Information

reasoning: The paragraph describes the governance chain for cybersecurity oversight, specifically how the Information Security Officer (ISO) reports directly to the board at least annually on program status, compliance with specific interagency guidelines, and material findings, which falls squarely under Board Governance. Specificity is Firm-Specific (Level 3) due to the identification of a distinct cybersecurity leadership role (ISO) with a direct board reporting line, and Domain-Adapted (Level 2) due to the specific reference to the Interagency Guidelines for Safeguarding Customer Information; no quantifiable metrics or externally verifiable claims are present that would elevate it to Level 4.


fact: threat actors

fact: look-alike phishing sites

fact: security posture

reasoning: The paragraph primarily describes an actual cybersecurity event—threat actors creating malicious phishing sites targeting the company's online banking platform—including details about timing, scope, and resolution, which fits Incident Disclosure. Specificity is Domain-Adapted because the paragraph uses cybersecurity-specific terminology ('threat actors,' 'look-alike phishing sites,' 'security posture') that demonstrates domain expertise beyond generic risk management language, but contains no firm-specific facts (named roles, specific dates, or numbers) that would elevate it to Level 3 or 4.


reasoning: The paragraph primarily answers how the Board oversees cybersecurity by describing the delegation of oversight to the Audit Committee, the Committee's reporting to the full Board, and management's update responsibilities—classic governance-chain content. Specificity is Level 1 because the language consists entirely of generic corporate governance terms ('risk oversight function,' 'delegated to the Audit Committee,' 'oversees management's implementation') that any ERM professional would use, with no domain-specific cybersecurity practices, firm-unique organizational details, or verifiable facts.


fact: Chief Operating Officer is the designated management role responsible for informing the Audit Committee on cybersecurity risks

fact: minimum briefing frequency of once per year

reasoning: The paragraph describes the governance chain and oversight structure between the Chief Operating Officer and the Audit Committee, including briefing cadence and the Committee's review authority, which answers how the board oversees cybersecurity. Specificity is driven by the identification of the Chief Operating Officer as the specific management role with cybersecurity oversight responsibilities and the explicit minimum frequency threshold for briefings.


reasoning: The paragraph primarily provides a backward-looking materiality assessment stating that cybersecurity risks have not materially affected business strategy or financial condition, which falls under Strategy Integration per Rule 5. The mention of experiencing breaches lacks specific details (nature, timing, scope) and serves as context for the materiality assertion rather than constituting Incident Disclosure. The text contains no firm-specific details, verifiable quantitative claims, or domain-adapted cybersecurity terminology (terms like 'breaches' and 'threats' are generic and pass the ERM test), resulting in Generic Boilerplate specificity.


fact: review of the vendor's security program

reasoning: The paragraph centrally addresses vendor oversight and third-party cyber risk management through assessments, questionnaires, and contractual obligations, placing it in Third-Party Risk per Rule 3 (vendor oversight as central topic). It achieves Domain-Adapted specificity by demonstrating cybersecurity expertise via references to reviewing vendor 'security programs' and classifying assets by 'sensitivity of the Information Systems and Data'—concepts that fail the ERM test as they require cybersecurity domain knowledge beyond generic vendor risk management.


reasoning: The paragraph describes engaging third-party service providers (legal counsel and cybersecurity consultants) to assist with identifying, assessing, and managing cybersecurity risks. Under Rule 3, third parties hired to serve the company in this capacity fall under Risk Management Process rather than Third-Party Risk. The language is generic ERM terminology ('identify, assess, and manage') that would apply to any risk domain, with no domain-specific security practices, firm-unique organizational details, or quantifiable facts.


reasoning: The paragraph centrally addresses vendor oversight, describing risk assessments and questionnaires for service provider selection and annual reviews to verify contractual cybersecurity compliance, which is the core of Third-Party Risk. The terminology ('risk assessments', 'questionnaires', 'contractual obligations') consists of generic ERM concepts that fail the ERM test for domain expertise, contains no firm-specific organizational details or roles, and lacks quantifiable or externally verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes the governance chain for cybersecurity oversight (Board of Directors and Audit Committee receiving quarterly updates on the program and specific risk topics), which falls squarely under Board Governance per Rule 1. For specificity, the paragraph contains only generic governance language—standard board/committee names, routine cadences ('quarterly'), and broad topic categories ('cybersecurity assessments,' 'third party risk management,' 'evolving risks') that any ERM professional would use without cybersecurity domain expertise. No firm-specific details (e.g., named security officers, unique committee structures) or quantifiable/verifiable facts (e.g., specific dates, headcounts, certifications, named tools) are present.


fact: chief information officer (CIO) - VP-level cybersecurity leadership role

fact: CIO also serves as the Kronos CIO - dual role structure

fact: reports to our and Kronos' chief executive officers - specific reporting lines

fact: Corporate information systems owned and operated by Contran - firm-specific entity relationship

fact: provided to us through the ISA (Intercompany Services Agreement) - firm-specific arrangement

fact: CompX director of IT reports to CompX's vice president in charge of coordinating operational activities within CompX's two operating reporting units - specific organizational structure

reasoning: The paragraph primarily answers how management is organized to handle cybersecurity by detailing the specific leadership roles (CIO and Director of IT), their reporting lines to executives, and the dual-role structure of the CIO. While it mentions annual assessments, the focus is on organizational structure and responsibilities rather than program activities. Specificity is Firm-Specific due to the naming of VP-level cybersecurity leadership (CIO), the specific reporting relationships to multiple CEOs, and the firm-specific arrangements with Contran and the ISA.


reasoning: This paragraph is a cross-reference to Item 1A Risk Factors containing only generic risk disclosure language without substantive cybersecurity governance, management, or program details. It lacks specific domain terminology, firm-specific facts, or verifiable claims.


reasoning: The paragraph describes the responsibilities and organizational role of the Director, IT, focusing on management functions such as hiring personnel, approving budgets, and overseeing cybersecurity activities (MR). The content contains only generic descriptions without specific domain terminology that would fail the ERM test, firm-unique details (the title 'Director, IT' lacks a security qualifier and is explicitly excluded from Level 3 per instructions), or verifiable facts, resulting in Generic Boilerplate specificity.


fact: December 15, 2020 - specific date of ransomware incident detection

fact: ransomware - specific threat type

reasoning: The paragraph primarily describes a specific past ransomware incident, including the detection date of December 15, 2020 and its operational impacts on customers, making it Incident Disclosure. The inclusion of a specific date tied to a real event constitutes a verifiable fact, establishing Quantified-Verifiable specificity.


fact: SOC 1 report

fact: SOC 2 report

fact: System and Organization Controls (SOC)

fact: security adequacy audits

reasoning: The paragraph centrally addresses how the company manages third-party cyber risks through vendor oversight requirements (mandatory SOC 1/2 reports, security audits) and an external vendor risk management platform, fitting Third-Party Risk. Specificity is Domain-Adapted because it references specific IT audit standards (SOC 1, SOC 2) and specialized vendor risk management tools that demonstrate cybersecurity domain knowledge beyond generic risk management language, with no quantifiable metrics or firm-specific organizational details present.


fact: alignment with National Institute of Standards and Technology (NIST) governance requirements and cybersecurity framework

reasoning: The paragraph describes the Board's oversight responsibility through the Audit Committee and the governance chain for cybersecurity risk management (Board → Committee → Program), defaulting to Board Governance per Rule 1. Specificity is Domain-Adapted because the reference to NIST demonstrates cybersecurity domain expertise that would not appear in generic enterprise risk management disclosures.


fact: vulnerability scanning (internal and external)

fact: penetration testing by independent security professionals

fact: simulated cyberattacks

fact: threat intelligence feeds

fact: security controls

fact: risk assessment framework categorizing threats by likelihood and impact

fact: third-party vendor risk assessment including due diligence

fact: third-party attestation reviews

fact: security questionnaires for vendors

reasoning: The paragraph primarily answers what the cybersecurity program does, describing specific technical activities (vulnerability scanning, penetration testing, threat intelligence monitoring) and risk assessment methodologies that constitute the Risk Management Process. It employs domain-adapted terminology like 'penetration testing,' 'threat intelligence feeds,' and 'simulated cyberattacks' that demonstrate cybersecurity expertise beyond generic enterprise risk management language, but lacks firm-specific identifiers (named personnel, specific organizational structures) or verifiable quantitative claims (dates, headcounts, named certifications) that would support higher specificity levels.


fact: intrusion detection/prevention systems (IDS/IPS)

fact: data loss prevention (DLP) solutions

fact: Mobile Device Management

fact: principle of least privilege

fact: encryption at rest and in transit

fact: phishing attempts

reasoning: The paragraph describes specific technical controls and activities of the cybersecurity program (firewalls, IDS/IPS, DLP, endpoint security, access controls, encryption, training), which directly answers what the program does—Risk Management Process. Specificity is Domain-Adapted because the text uses technical cybersecurity terminology including IDS/IPS, DLP, least privilege, and encryption states (at rest/in transit) that demonstrate specialized domain knowledge beyond generic risk management language, without containing firm-specific organizational details or verifiable quantitative claims.


fact: data exfiltration

fact: forensic and remediation costs

fact: breadth and sensitivity of data exposure

reasoning: The paragraph describes the framework and criteria for assessing materiality of cybersecurity incidents, covering financial, operational, and reputational factors, which falls under Strategy Integration. Specificity is Domain-Adapted due to the use of cybersecurity-specific terminology such as 'data exfiltration' and 'forensic' costs that demonstrate domain expertise beyond generic enterprise risk management language.


reasoning: The paragraph primarily provides a materiality assessment regarding whether cybersecurity risks and previous incidents have affected or are likely to affect the company's business strategy, results of operations, and financial condition, which is the defining characteristic of Strategy Integration under Rule 5. The text contains no specific facts, verifiable claims, named individuals, or domain-specific terminology beyond generic risk disclosures and hypothetical scenarios, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers whether cybersecurity risks have materially affected the business, explicitly stating backward-looking ('have not materially affected') and forward-looking ('are not reasonably likely to materially affect') materiality conclusions per SEC Item 106(b)(2), which aligns with Strategy Integration. While it mentions past breaches occurred, it provides no descriptive details (timing, scope, nature) that would constitute Incident Disclosure. For specificity, the paragraph contains no firm-specific details (no named roles, teams, or vendors), no domain-adapted technical practices (only generic terms like 'threats' and 'breaches'), and no quantified or verifiable facts—the date 'December 31, 2023' is reporting-period context excluded from specificity assessment, and materiality conclusions are self-assessments not externally verifiable.


reasoning: The paragraph primarily answers whether cybersecurity risks have materially affected the business, containing the specific backward-looking materiality assessment required by SEC Item 106(b)(1) ('have not materially affected us... to date'), which falls under Strategy Integration per Rule 5. The paragraph lacks specific facts: it contains only generic references to 'malware' and 'computer virus attacks' without firm-specific details, quantified metrics, dates, or domain-adapted technical practices that would demonstrate cybersecurity expertise beyond standard ERM language.


fact: the ISO (Information Security Officer) performs vendor security assessments

fact: SOC (Service Organization Controls) reports

fact: penetration testing

fact: vulnerability testing

fact: encryption standards

reasoning: The paragraph primarily answers how third-party cyber risks are managed, focusing extensively on vendor assessment procedures including SOC report reviews and control evaluations. Specificity is Firm-Specific due to the explicit reference to 'the ISO' as the designated role responsible for these assessments (a firm-unique organizational detail), supported by domain-specific cybersecurity terminology.


fact: September 14, 2023 (date of incident)

fact: social engineering attack (specific attack vector)

fact: outsourced IT support vendor (compromised third party)

fact: loyalty program database (specific data acquired)

fact: IRP (Incident Response Plan activated)

fact: state gaming regulators (specific regulatory bodies notified)

reasoning: Paragraph provides a detailed account of an actual cybersecurity incident including the specific date (September 14, 2023), attack methodology (social engineering), and affected systems (loyalty program database), which are externally verifiable facts. The content focuses on the timeline, scope, and immediate response actions (IRP activation, forensic engagement), making it clearly Incident Disclosure rather than risk management process or strategy integration.


reasoning: The paragraph provides a materiality assessment regarding whether cybersecurity risks have materially affected or are reasonably likely to materially affect business outcomes, which is the defining characteristic of Strategy Integration per Rule 5. The content consists entirely of standard SEC compliance language and negative assertions about material impacts, containing no domain-specific terminology, firm-specific details, or verifiable facts, resulting in Generic Boilerplate specificity.


fact: managed cybersecurity service providers

reasoning: The paragraph describes engaging external service providers to assist with the company's own cybersecurity risk management activities (identify, assess, manage), which falls under Risk Management Process rather than Third-Party Risk (which concerns managing risks from vendors/suppliers). Specificity is Domain-Adapted because the text uses cybersecurity-specific terminology including 'penetration testing' and 'managed cybersecurity service providers' (MSSPs), which demonstrate domain knowledge beyond generic risk management language.


fact: Change Healthcare

fact: UnitedHealth Group

reasoning: The paragraph primarily describes an actual cybersecurity incident affecting third-party vendor Change Healthcare, including specific dates (March 7 and 18, 2024) and the nature of the disruption to the company's operations. While it includes materiality assessments, the incident description dominates. Specificity is Level 4 due to externally verifiable dates and named third-party entities.


reasoning: The paragraph describes high-level objectives of the cybersecurity program (business continuity, protecting proprietary technology, and safeguarding data), which addresses what the program aims to do. However, it contains only generic risk management language that would apply to any enterprise risk context (business continuity is standard ERM terminology), with no domain-specific cybersecurity practices, firm-unique organizational details, or verifiable facts.


reasoning: The paragraph states a backward-looking materiality assessment that cybersecurity threats and previous incidents have not materially affected business strategy, results of operations, or financial condition, which per Rule 5 is Strategy Integration. It contains no domain-adapted terminology (e.g., specific frameworks, tools, or practices), no firm-specific details (e.g., named officers, specific incident descriptions, organizational structure), and no quantified or externally verifiable facts, resulting in Generic Boilerplate specificity.


fact: One member of our audit committee earned the NACD's CERT Certificate in Cybersecurity Oversight in 2023

fact: Chief Information Security Officer (CISO) role provides quarterly updates to the audit committee

fact: metrics about cyber threat response preparedness

fact: program maturity milestones

fact: current and emerging threat landscape

reasoning: The paragraph primarily answers how the board oversees cybersecurity, describing the audit committee's review function, briefing frequencies (quarterly to the committee, three times annually to the full board), and escalation procedures, which is classic Board Governance content. It achieves Quantified-Verifiable specificity because it contains the externally verifiable claim that an audit committee member earned the NACD's CERT Certificate in Cybersecurity Oversight in a specific year (2023), supplemented by firm-specific details like the CISO role and domain-specific terminology including threat response preparedness metrics and program maturity milestones.


fact: Vice President of IT is responsible for Li-Cycle's information security program

reasoning: The paragraph primarily describes the company's cybersecurity risk management processes, controls, and the threat landscape it faces (including ransomware, phishing, and supply chain compromises), rather than detailing governance mechanisms or management organizational structure. Specificity is Firm-Specific due to the identification of the 'Vice President of IT' as the leader of the information security program, which is a firm-specific leadership role at the VP level.


fact: CIO has 19 years of experience in technology risk management

fact: CIO has 11 years of experience with the Company (or its affiliates)

fact: CIO holds SANS Global Information Security Leader certification

fact: CIO holds Certified Information Systems Auditor (CISA) certification

fact: Monthly scorecards used to update risk landscape

fact: Quarterly dashboards used to update risk landscape

reasoning: The paragraph primarily describes the organizational structure and qualifications of management responsible for cybersecurity, including the CIO's role, reporting lines, and specific credentials. Specificity is driven by multiple verifiable facts: the CIO's 19 years of experience (11 with the company) and two named professional certifications (SANS Global Information Security Leader and Certified Information Systems Auditor), which are externally verifiable credentials.


reasoning: This paragraph is purely a cross-reference to Item 1A containing no substantive cybersecurity disclosure, qualifying as None/Other. It lacks any specific facts, domain terminology, firm-specific details, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: This paragraph describes future disclosure obligations for material cybersecurity incidents ('will report,' 'will be disclosed') rather than describing actual governance structures, management roles, risk processes, third-party oversight, specific incidents, or materiality assessments. It answers no substantive cybersecurity question and contains no domain-adapted terminology, firm-specific facts, or verifiable claims—only generic forward-looking reporting policy language referencing standard SEC disclosure requirements.


reasoning: Paragraph describes the governance chain (security team representatives → Audit Committee/Board) and information flow regarding cybersecurity oversight, which defaults to Board Governance under Rule 1. The language consists of generic ERM terms ('quarterly updates', 'systems testing', 'activities of third parties') that survive the ERM test without demonstrating cybersecurity domain expertise, specific organizational structure, or verifiable facts, resulting in Generic Boilerplate specificity.


fact: principle of least-privilege

fact: phishing awareness exercises

fact: security-by-design principles

fact: privileged access

reasoning: The paragraph describes the company's cybersecurity activities including framework adoption (ISO 27001), access control practices (least-privilege), and employee training programs (phishing exercises, security-by-design), which directly answers what the risk management process does. Specificity is Domain-Adapted because terms like 'ISO 27001,' 'least-privilege,' and 'security-by-design' demonstrate cybersecurity domain expertise that would not appear in generic enterprise risk management descriptions, yet no firm-specific organizational details or verifiable claims are present.


reasoning: The paragraph centrally addresses vendor risk management by describing security assessments and ongoing monitoring of third-party providers to ensure compliance with cybersecurity standards, which falls squarely under Third-Party Risk per Rule 3. The language is generic boilerplate (Level 1) because it describes 'security assessments' and 'ongoing monitoring' without specifying what evidence is reviewed (e.g., SOC 2 attestations), what technical requirements are imposed (e.g., encryption), or naming any firm-specific details—language any ERM professional could use without cybersecurity domain expertise.


fact: In connection with the Acquisition

fact: recently reshaped our Board of Directors

fact: do not at this time anticipate collecting or storing any significant personal information, personal data or confidential information related to customers, consumers, employees, or vendors

reasoning: The paragraph primarily answers how cybersecurity affects the business by stating a materiality assessment—that the company does not anticipate handling significant personal or confidential data, reducing its risk exposure, and noting investments in risk reduction measures. It contains firm-specific facts including reference to 'the Acquisition,' Board reshaping, and specific categories of data the company does not collect (customers, consumers, employees, vendors), but lacks quantified metrics or externally verifiable claims.


fact: Marriott brand standards relating to information security

fact: franchisees and licensees as specific third-party counterparties with contractual obligations to report information security incidents

reasoning: The paragraph centrally addresses how Marriott manages cybersecurity risks from third parties (franchisees and licensees) through contractual requirements and brand standards, fitting Third-Party Risk. It rises to Firm-Specific due to references to 'Marriott brand standards' and the specific business structure distinguishing owned/leased properties from franchised operations, which distinguishes Marriott's third-party risk approach from generic vendor management.


reasoning: The paragraph constitutes a Strategy Integration disclosure as it states a conclusion about whether cybersecurity risks have materially affected or are reasonably likely to materially affect the company's business strategy, results of operations, or financial condition, satisfying the SEC Item 106(b)(2) materiality assessment requirement. However, it contains no specific_facts qualifying for higher specificity levels: it offers only generic materiality language without domain-adapted terminology (failing the ERM test), firm-specific details, or quantified verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: This paragraph is a cross-reference directing readers to Item 1A Risk Factors for descriptions of cybersecurity risks, and quotes speculative risk language ('could experience a material adverse impact') without stating any conclusion about actual material effects. Per Rule 5, cross-references to risk factors are classified as None/Other. The paragraph contains no specific facts about governance structures, management roles, program activities, or verifiable data, warranting Generic Boilerplate specificity.


fact: key business stakeholders

reasoning: The paragraph centrally addresses vendor cybersecurity oversight—specifically requiring third-party risk assessments and security contract terms—making it Third-Party Risk per Rule 3 (vendor oversight as central topic). Specificity is Firm-Specific because it identifies the precise organizational units responsible for conducting assessments (information security and enterprise risk management teams) and notes input from key business stakeholders, distinguishing this company's cross-functional approach from generic process descriptions.


fact: Chief Risk Officer oversees enterprise risk management program

reasoning: The paragraph primarily describes how the cybersecurity program integrates into the broader enterprise risk management framework and shares governance processes, which falls under Risk Management Process. It identifies the Chief Risk Officer—a specific C-suite leadership role with cybersecurity oversight responsibility—providing firm-specific organizational detail that elevates specificity to Level 3.


reasoning: The paragraph describes the Audit Committee's oversight structure—specifically, that it receives periodic reports from senior management concerning cybersecurity threats and mitigation processes. This answers 'How does the board oversee cybersecurity?' and falls under Board Governance per Rule 1 (governance-chain default). For specificity, the text contains only generic governance roles (Audit Committee, CFO, General Counsel, VP Finance) that exist at every company and standard risk oversight language ('periodic reports,' 'mitigation') that any ERM professional could write for any risk domain. It lacks domain-adapted terminology (specific security practices, tools, or frameworks), firm-specific cybersecurity leadership roles, or verifiable quantitative claims.


fact: CISO

fact: CIO

fact: Technology & Operations Committee

fact: information technology, legal, and internal audit functions

reasoning: The paragraph describes the governance chain for cybersecurity oversight, specifically how the Audit Committee and Technology & Operations Committee receive updates from management (CISO, CIO, and IT/legal/audit functions) on a quarterly basis. Specificity is driven by firm-specific details including named executive roles (CISO, CIO), the specific board committee (Technology & Operations Committee), and the explicit identification of presenting departments (information technology, legal, and internal audit).


fact: CISO has served in IT and information security roles for over 20 years

fact: CISO holds undergraduate degree in Information Systems from Xavier University

fact: CISO holds MBA from Michigan State

fact: CISO and regional security leaders hold combined total of over 25 IT and cybersecurity certifications

fact: Certifications include Certified Information Systems Security Professional (CISSP)

fact: Certifications include Certified Cloud Security Professional (CCSP)

fact: Certifications include Certified Information Security Manager (CISM)

reasoning: The paragraph exclusively addresses management organization—specifically the CISO's reporting line to the CIO, team structure, and professional qualifications—making it Management Role rather than Risk Management Process (which would describe program activities) or Board Governance (which would address board oversight). Specificity is Level 4 because the paragraph contains multiple independently verifiable hard facts: quantified experience thresholds ('over 20 years', 'over 25 certifications'), specific educational institutions (Xavier University, Michigan State), and named professional certifications (CISSP, CCSP, CISM) that can be validated against issuing body registries.


fact: Third-Party Risk Management Program

fact: Vendor Management Policy

reasoning: The paragraph primarily addresses vendor oversight through the Third-Party Risk Management Program and Vendor Management Policy, including onboarding and periodic reviews, which centers on Third-Party Risk. Specificity is Domain-Adapted because the paragraph cites the specific 'Interagency Guidance on Third-Party Relationships: Risk Management' and uses formal program names, demonstrating knowledge of banking regulatory frameworks for vendor risk management, though the content remains generic to the banking sector without firm-unique identifiers or quantifiable details.


fact: The Task Force (specific internal committee entity)

fact: at least annually (specific minimum briefing cadence)

reasoning: The paragraph describes governance structure and information flow between a specific internal 'Task Force' and the Board's Audit Committee regarding cybersecurity oversight. The capitalized reference to 'The Task Force' indicates a firm-specific committee or working group, and 'at least annually' specifies a concrete organizational commitment regarding briefing frequency, distinguishing this from generic governance language.


fact: CISO (Chief Information Security Officer) role

fact: At least quarterly reporting cadence to the committee

fact: prevention, detection, mitigation, and remediation (cybersecurity incident response phases)

reasoning: The paragraph describes the governance chain for cybersecurity oversight, specifically how the CISO and Internal Audit report to the board's Audit, Risk and Finance Committee. This is board-level oversight structure (BG), not management organization (MR). The specificity is Firm-Specific due to the explicit identification of the CISO role and the specific 'at least quarterly' reporting cadence, which are concrete organizational facts distinguishing this company, even though the paragraph also contains domain-adapted terminology like 'prevention, detection, mitigation, and remediation.'


fact: October 2023 (specific date of cybersecurity incident — verifiable)

fact: 23andMe.com accounts (firm-specific platform/system affected)

fact: Security Operations (domain-specific cybersecurity function)

fact: two-step verification (domain-specific security control/MFA)

fact: detection tools (domain-specific security capability)

reasoning: The paragraph primarily answers what happened in a cybersecurity incident, providing the specific date (October 2023), scope (unauthorized access to 23andMe.com accounts), and detailed response actions. This incident-focused content dominates over the forward-looking materiality speculation, making Incident Disclosure the correct category. Specificity is Level 4 because the date 'October 2023' tied to a specific cybersecurity incident constitutes a hard, externally verifiable fact (this breach was publicly reported), supported by firm-specific details like the '23andMe.com' platform reference.


fact: advanced persistent threats

fact: sophisticated and targeted measures

fact: uncoordinated individual attempts

fact: sensitive, proprietary and other data categories, in addition to personal data

reasoning: The paragraph explicitly states a negative materiality assessment ('we have not experienced a material cybersecurity incident in the two-year period ended December 31, 2024'), which per Rule 5 is classified as Strategy Integration. Specificity is Domain-Adapted due to cybersecurity domain terminology including 'advanced persistent threats' and specific data categorization (sensitive, proprietary, personal data) that demonstrates security expertise beyond generic risk management language.


reasoning: The paragraph centers on a management position (Director of Operations & Information Technology), describing the role's responsibilities (evaluating cybersecurity risk profiles, leading strategy development) and qualifications (experience, certifications), which defines who is responsible and how the function is organized per Management Role. Specificity remains Generic Boilerplate because the vocabulary ('risk profile,' 'strategies to mitigate risks,' 'certifications') passes the ERM test—an ERM professional could use identical language for financial or operational risks without cybersecurity expertise. The title lacks a security qualifier required for firm-specificity, and 'approximately 20 years' is a soft approximation rather than a verifiable claim.


fact: defense in depth (architectural approach)

fact: zero trust based controls (security architecture)

fact: phishing email simulations (specific security awareness training method)

fact: cyber risk management and quantification system (specific risk management methodology)

reasoning: The paragraph describes the operational activities of the cybersecurity program (risk assessment processes, training, technical controls), which is the definition of Risk Management Process. It rises to Domain-Adapted because it employs cybersecurity-specific architectural concepts (defense in depth, zero trust) and operational practices (phishing simulations, cyber risk quantification) that demonstrate domain expertise beyond generic enterprise risk management language.


reasoning: This paragraph is a pure cross-reference directing readers to Item 1A for risk factor discussions, containing no substantive cybersecurity disclosure about governance, management, processes, or incidents. As a cross-reference, it falls under None/Other and receives Generic Boilerplate specificity.


fact: The Company's CIO has 25 years of experience in the information technology industry

fact: The Company's Chief Information Officer (CIO)

fact: The CIO reports to the Chief Executive Officer

fact: supported by a dedicated cybersecurity team within our information systems department

reasoning: The paragraph primarily describes management's organizational structure for cybersecurity, including the CIO's qualifications (25 years experience), reporting lines (to CEO), and team composition (dedicated cybersecurity team, multidisciplinary incident response team), which are hallmarks of Management Role content. While it mentions Board oversight, the governance chain serves to frame the management structure rather than being the primary focus, and the management-specific details constitute the majority of the text. The paragraph achieves Quantified-Verifiable specificity because it contains the hard biographical fact that the CIO has '25 years of experience,' which is an externally checkable claim against professional records, alongside multiple firm-specific organizational facts (CIO title, reporting structure, team composition) that support Level 3.


fact: Chief Information Officer (CIO) presents to the Audit Committee

fact: vCISO (virtual CISO) presents to the Audit Committee

reasoning: The paragraph primarily answers how the Board oversees cybersecurity by describing the delegation to the Audit Committee and the reporting structure from management to the Board, which is classic Board Governance content. Specificity is Firm-Specific because it identifies specific cybersecurity leadership roles (Chief Information Officer and vCISO) that distinguish the company's organizational structure, per the Level 3 criteria for VP-or-above IT/cybersecurity titles.


reasoning: The paragraph constitutes a backward-looking materiality assessment stating that no cybersecurity threats or incidents have materially affected the Company during the reporting periods, which categorizes as Strategy Integration per Rule 5 (specifically matching the 'Have not materially affected...' pattern). It contains no specific facts—only generic assertions about exposure to threats and an unverifiable negative claim about material impact—resulting in Generic Boilerplate specificity.


fact: September 2022 (specific dates of incidents)

fact: Rockstar Games (named subsidiary)

fact: 2K Games (named subsidiary)

fact: next Grand Theft Auto (specific product/IP accessed)

fact: advanced persistent threats (domain terminology)

fact: network intrusion (domain terminology)

reasoning: The paragraph primarily answers what happened in specific cybersecurity incidents, describing the September 2022 network intrusions affecting Rockstar Games and 2K Games with details about accessed assets and remediation actions, which is Incident Disclosure. Specificity is Level 4 due to the inclusion of specific dates (September 2022) and named subsidiaries that constitute externally verifiable facts about the events.


reasoning: The paragraph primarily answers whether cybersecurity risks have materially affected the company by stating that 'prior incidents have not had a material impact on us' (backward-looking assessment) and that future incidents 'could have a material impact' (forward-looking assessment per SEC Item 106(b)(2)), which falls under Strategy Integration per Rule 5. Specificity is Generic Boilerplate because the paragraph contains no verifiable facts, firm-specific details, or domain-adapted terminology beyond generic risk management language ('processes are designed to help prevent, detect, respond') that would apply to any enterprise risk.


fact: Chief Information Security Officer

fact: Chief Technology and Digital Officer

reasoning: The paragraph describes the governance chain for cybersecurity oversight, focusing on the Audit and Finance Committee's quarterly reviews and annual Board discussions with management, which is classic Board Governance content. Specificity is Firm-Specific because it identifies the specific C-level roles (Chief Information Security Officer and Chief Technology and Digital Officer) responsible for briefing the Board, which distinguishes this company's governance structure from generic disclosures.


fact: CTO is the designated executive role responsible for reporting cybersecurity matters to the Board of Directors

reasoning: The paragraph describes the governance chain and oversight structure, specifically how the CTO reports to the Board of Directors on cybersecurity risks and incidents (BG). It identifies the specific C-level role (CTO) charged with this responsibility, which qualifies as a firm-specific fact (Level 3). While it mentions a 'quarterly' cadence, this is a generic reporting frequency without specific dates or quantifiable metrics, and the paragraph lacks externally verifiable claims (Level 4) or domain-specific technical terminology (Level 2).


reasoning: The paragraph constitutes a materiality assessment stating that cybersecurity threats have not materially affected and are not reasonably likely to materially affect the company's business strategy, financial condition, or results of operations, which falls under Strategy Integration per Rule 5. The text contains no specific cybersecurity practices, firm-specific organizational details, or verifiable quantitative facts, consisting solely of generic materiality language and cross-references to Risk Factors.


reasoning: The paragraph describes the Board's oversight responsibilities for cybersecurity risks, management's reporting lines to the Board and Audit Committee, and the governance chain between these bodies, which directly answers how the board oversees cybersecurity (Board Governance). It contains only generic governance terminology ('oversight,' 'risk management,' 'reports at least annually') that would apply to any operational risk and lacks domain-specific cybersecurity practices, firm-unique organizational details, or quantifiable facts.


reasoning: The paragraph describes how cybersecurity risks are identified and addressed through various processes and reviews, which falls under Risk Management Process. It employs generic enterprise risk management terminology ('integrated into our overall risk management systems,' 'governance, risk and compliance reviews,' 'independent third-party assessments') that an ERM professional could apply to financial or operational risks without cybersecurity domain knowledge, and lacks any firm-specific details, named roles, or quantifiable claims.


reasoning: The paragraph constitutes a negative assertion regarding the absence of cybersecurity incidents, which Rule 5 explicitly maps to Strategy Integration ('Have not experienced any material cybersecurity incidents' → SI). Specificity is Generic Boilerplate because the paragraph contains only standard reporting-period dating (explicitly excluded as 'reporting period context, not a cybersecurity fact' under Level 4), unverifiable negative claims about incident absence (explicitly excluded as 'negative self-assertion, NOT externally verifiable'), and generic business-impact language that passes the ERM test (any enterprise risk professional could write this about financial or operational risk by swapping the topic word).


fact: Certified Information Systems Security Professional (CISSP)

fact: Risk and Governance Committee

fact: reports directly to our Chief Financial Officer

fact: Head of Information Technology

reasoning: This paragraph primarily answers how the board oversees cybersecurity by describing the delegation chain from Board to Risk and Governance Committee to the Head of IT, including briefing frequency (quarterly) and information flow. While it includes management details (CISSP certification, reporting line), these support the governance structure description. Specificity reaches Level 4 due to the verifiable CISSP certification claim, supported by Level 3 firm-specific facts including the named Risk and Governance Committee and the specific reporting relationship to the CFO.


fact: penetration testing

fact: threat monitoring

reasoning: The paragraph centers on vendor oversight—requiring third-party cybersecurity firms to adhere to security controls and managing risks associated with third-party data access—making Third-Party Risk the primary category. It demonstrates cybersecurity domain expertise through specific technical practices like 'penetration testing' and 'threat monitoring' that exceed generic enterprise risk management vocabulary, satisfying Domain-Adapted specificity despite lacking firm-specific details or verifiable quantities.