content_category: None/Other

category_confidence: high

specificity_confidence: high

reasoning: This is a pure cross-reference directing readers to Item 1A Risk Factors, with no substantive cybersecurity disclosure. N/O paragraphs always get Generic Boilerplate.

provider: anthropic

generationId: agent-sdk

stage: benchmark


reasoning: This is a cross-reference incorporating another section by reference, with no substantive cybersecurity disclosure content. N/O paragraphs always receive Generic Boilerplate.

thinking: Cross-reference to another section, no substantive cybersecurity content.


content_category: Risk Management Process

category_confidence: medium

reasoning: The paragraph describes how management is informed about cybersecurity through briefings, threat intelligence, and security tools — applying the person-removal test, the content describes program monitoring activities rather than specific roles/qualifications, so RMP wins over MR. No domain-specific terms pass the ERM test; 'threat intelligence,' 'security tools,' and 'IT environment' are used generically without demonstrating specialized knowledge.


reasoning: This paragraph is a generic disclaimer that no program can fully protect against all risks, combined with a cross-reference to Item 1A Risk Factors. It does not provide any substantive cybersecurity disclosure — no measures, no assessments, no governance details. No domain terms or firm-specific facts are present.

thinking: Materiality/forward-looking assessment? No - this is generic disclaimer + cross-reference. N/O.


content_category: Third-Party Risk

reasoning: The paragraph's central topic is managing cybersecurity risks from third-party service providers, including a vendor risk management program, making TP the clear category. The language is entirely generic—'vendor third-party risk management program,' 'identify and manage material risks'—with no domain-specific terminology passing the ERM test, no firm-specific details, and no verifiable claims.

thinking:
Classify this paragraph.

Content: About enhancing monitoring of third-party service providers' cybersecurity, including a vendor third-party risk management program. Central topic is third-party cyber risk management → TP.

Specificity: "vendor third-party risk management program" - this is a generic description. No domain terms that pass ERM test. No firm-specific facts. No verifiable claims. This is Level 1.


reasoning: The paragraph's central topic is oversight of vendors' and partners' cybersecurity practices — vetting, monitoring, and compliance with security standards — making Third-Party Risk the clear category. All language (vetting, monitoring, reviews, compliance with standards) is generic process description any ERM professional could write; no domain terms, firm-specific facts, or verifiable claims are present.

thinking:
Classify this paragraph.

Content: About third-party risk management program - vetting vendors, monitoring compliance with security standards. Central topic is managing third-party cyber risks → Third-Party Risk.

Specificity: Let me scan for facts.
- "third-party risk management program" - generic
- "vetting of third parties before engagement" - generic process
- "Regular monitoring and reviews" - generic
- No domain terms that pass ERM test, no firm-specific facts, no verifiable claims.

This is all generic language any ERM professional could write.

So this rates as Level 1 - it's entirely boilerplate content without any specificity or concrete details.


content_category: Strategy Integration

fact: As of October 31, 2024 — specific date anchoring the materiality assessment

specificity_confidence: medium

reasoning: This is a backward-looking materiality assessment stating that no cybersecurity incidents have materially impacted the company, which is the SI materiality rule. The specific date 'October 31, 2024' is firm-specific (it's the company's fiscal year-end anchoring the assertion), but the negative self-assertion about absence of incidents is not externally verifiable, so it stays at Level 3.

thinking: Materiality assessment paragraph.


reasoning: This is a cross-reference directing readers to Item 1A Risk Factors for additional cybersecurity information, with no substantive cybersecurity disclosure of its own. No specific facts elevate specificity above Level 1.


content_category: Board Governance

fact: Vice-President of Information Technology (VPIT)

fact: Director - Information Security (DIS)

reasoning: The paragraph describes how the Audit Committee reports to the Board and how Board members receive cybersecurity presentations — this is about board-level oversight structure, making it Board Governance. The VP of Information Technology (VP-level IT role) and Director - Information Security (Director with security qualifier) are firm-specific roles that elevate specificity to Level 3.

thinking:
Classify this paragraph.

Content: Board oversight - Audit Committee reports to Board, Board receives presentations on cybersecurity from VPIT and DIS or external experts. This is about how the board oversees cybersecurity → Board Governance.

Specific facts:
- "Vice-President of Information Technology" → named_role (VP-level IT role, firm-specific)
- "Director - Information Security" → named_role (Director with security qualifier, firm-specific)
- "Audit Committee" → generic, not firm-specific

Specificity: Firm-Specific (Level 3) due to the VP and Director roles.


reasoning: The paragraph states a materiality conclusion ('not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition'), which is the SEC Item 106(b)(2) assessment → SI. The remainder is a cross-reference to Item 1A. The negative materiality assertion is a self-reported claim about absence, not externally verifiable, and no domain terms or firm-specific facts are present, so specificity remains Level 1.

thinking:
This paragraph states a conclusion about whether cybersecurity has materially affected business outcomes (negative assertion) and cross-references Item 1A.

Category: Strategy Integration - it's making a materiality assessment ("not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition").

Specificity: The negative assertion "not aware of any cybersecurity incidents that have materially affected..." is a self-reported negative assertion, not externally verifiable. The cross-reference to Item 1A is just pointing elsewhere. No domain terms, no firm-specific facts, no verifiable claims.

This is rated at Level 1 - the lowest disclosure quality tier.


fact: Third-Party Risk Management (TPRM) program — named internal program with distinguishing identifier

reasoning: The paragraph is centrally about managing cybersecurity risks from third-party service providers — due diligence, contractual terms, ongoing monitoring — making Third-Party Risk the clear category. The named 'Third-Party Risk Management (TPRM) program' with its acronym is a firm-specific identifier, elevating to Level 3, though the remaining content (due diligence, contractual review, ongoing monitoring) is generic ERM language.

thinking:
Classifying this paragraph about Unum Group's third-party risk management.

Category: This is centrally about how third-party cyber risks are managed → Third-Party Risk.

Specific facts:
- "Third-Party Risk Management (TPRM) program" — named internal program with acronym → firm-specific
- "cybersecurity due diligence" — domain term? Actually this is pretty generic ERM language.
- "review of contractual terms with third parties" — generic
- "ongoing monitoring" — generic

The TPRM program with its acronym is a named internal program → Level 3.


content_category: Incident Disclosure

fact: March 2021 cybersecurity incident causing systems outage

fact: $2.4 million incremental one-time costs for year ended December 31, 2021

type: quantified

fact: Engaged leading forensic information technology firms and legal counsel

fact: Disruptions to brewery operations, production and shipments

fact: Shift in production and shipments from Q1 2021 to balance of fiscal year 2021

reasoning: The paragraph describes a real cybersecurity incident (March 2021 systems outage) with timeline, scope, remediation, and business impact, making it primarily Incident Disclosure. It contains financial impact language that could suggest SI, but the incident narrative frame dominates (Rule 4). The $2.4 million cost figure and specific date (March 2021) are externally verifiable facts, placing this at Level 4.

thinking: Incident disclosure with financial impact details.


reasoning: The paragraph answers 'what does the cybersecurity program do?' by listing risk assessments, security controls, training, incident response planning, and vendor management — all program activities → RMP. Despite the detailed bullet structure, every item uses generic ERM-passable language ('risk assessments,' 'security controls,' 'incident response plan,' 'awareness training,' 'vetting process') with no domain-specific terms, firm-specific facts, or verifiable claims.

thinking:
Classify this paragraph.

Category: This describes what the cybersecurity program does - risk assessments, security controls, incident response plan, training, third-party risk management. This is RMP.

Specificity: Let me scan for facts.
- "Risk assessments" - L1 generic
- "security controls" - L1
- "cybersecurity awareness training" - L1
- "cybersecurity incident response plan" - L1
- "third-party service providers" - L1
- "vetting process and ongoing monitoring" - L1

Everything here is generic process description. No domain-specific terms that pass the ERM test. No firm-specific facts. No verifiable claims.

This is Level 1 - Generic Boilerplate.


reasoning: This is an introductory paragraph describing the company's general risk profile as a data company and target of threats; it does not answer any of the six substantive cybersecurity disclosure questions (no program activities, governance, management roles, incidents, or strategy described). Language is entirely generic business context with no domain-specific terminology passing the ERM test.

thinking:
Classify this paragraph.

This describes the company as a target of cyber threats due to storing personal information. It's contextual/introductory - doesn't answer any of the six substantive questions directly. It's about the nature of the business and threat landscape, not about what the program does, how the board oversees, etc.

Category: None/Other - this is introductory context about the company's risk profile, not substantive cybersecurity disclosure.

Specificity: No domain terms that pass the ERM test. "cyber and other security threats", "storage and transmission of personal information" - generic.

So this rates as Level 1 disclosure.


reasoning: The paragraph contains a backward-looking materiality assessment ('we have not experienced any material cyber threats or incidents to date'), which per Rule 5 is SI. The remaining text is generic speculation ('could have a material adverse effect') and a cross-reference to Item 1A. No domain terms pass the ERM test, no firm-specific facts, and the negative materiality assertion is not externally verifiable, so specificity remains Level 1.

thinking:
Let me analyze this paragraph.

"Have not experienced any material cyber threats or incidents to date" — this is a negative assertion about materiality → SI per Rule 5.

But also has "could have a material adverse effect" which is generic speculation → NOT SI.

And a cross-reference to Item 1A.

The primary content: it states a materiality conclusion ("have not experienced any material cyber threats or incidents to date") which is SI per Rule 5. The rest is speculation and cross-reference.

Specificity: "have not experienced any material cyber threats or incidents" — this is a negative self-assertion, NOT externally verifiable per the rules.

Looking at the domain-specific language, I'm not finding anything that would pass the ERM test. The references to cybersecurity improvements, internal controls, and third-party providers are all standard boilerplate without firm-specific facts. This falls into Level 1 — generic disclosure language.


fact: Risk Management Committee of the Board

fact: CISO provides annual report to joint Risk Management Committee and Audit Committee meeting

fact: Managing Committee members participate in crisis exercise

fact: Quarterly reports from management on cybersecurity issues to Risk Management Committee and Subcommittee

fact: Annual executive-level crisis exercise with cybersecurity component involving Board members, third-party companies, and regulators

reasoning: The paragraph describes how the Board oversees cybersecurity through its committee structure, briefing cadences, and education sessions — squarely Board Governance. Firm-specific details include the named Cybersecurity and Technology Subcommittee, CISO role, and Managing Committee, all distinguishing this company's governance structure, but no externally verifiable quantified claims push it to Level 4.

thinking:
Classify this paragraph about US Bancorp's board oversight of cybersecurity.

Category: Board Governance - clearly about how the board oversees cybersecurity through committees.

Specific facts:
- Risk Management Committee (named committee but generic for banks)
- Cybersecurity and Technology Subcommittee (named, firm-specific committee)
- quarterly reports on cybersecurity issues
- joint meeting annually between Risk Management Committee and Audit Committee
- CISO mentioned
- annual executive-level crisis exercise with cybersecurity component
- Managing Committee (named committee)

- The firm-specific elements here are the Cybersecurity and Technology Subcommittee, the CISO role, the quarterly reporting cadence, and the structured annual joint meeting between committees. This pushes it to Level 3 - Firm-Specific.


reasoning: This paragraph provides general business context about ADP's data handling and the threat landscape but does not describe any cybersecurity program, governance structure, incident, or materiality assessment — it is background framing. No domain-specific cybersecurity terminology passes the ERM test; terms like 'malicious tactics, code and viruses' and 'attacks on information technology systems' are generic threat descriptions any business professional would use.

thinking:
Classifying this paragraph from ADP's 10-K Item 1C.

What question does it answer? It describes the data ADP handles and the threat landscape. It's not about board oversight, management roles, specific program activities, third-party risk, an actual incident, or a materiality assessment. It's contextual/background about why cybersecurity matters to ADP. No specific cybersecurity measures are described.

This is general context-setting. No actual cybersecurity program description. "Could affect" language is speculative. No materiality assessment conclusion. This is N/O or possibly RMP context... but there's no actual process described.

The paragraph sets business context for cyber risk without describing any actual measures or firm-specific security practices—just generic threat language and their data-handling role. That makes it N/O, Level 1.


content_category: Management Role

fact: Enterprise & Technology Security (E&TS) organization

fact: Chief Information Security Officer (CISO)

fact: CSIRT (Computer Security Incident Response Team)

fact: Product Security Incident Response Team (PSIRT)

fact: Business Information Security Officers (BISO)

fact: Office of the CISO

reasoning: The paragraph describes how IBM's cybersecurity management is organized—E&TS, CISO, PSIRT, BISOs—detailing roles, responsibilities, and reporting relationships. Applying the person-removal test, removing these roles and teams leaves little substantive content, confirming MR over RMP. Multiple named teams and roles unique to IBM (E&TS, PSIRT, BISO, Office of the CISO) elevate specificity to Firm-Specific.

thinking:
Let me analyze this paragraph.

Category: This describes IBM's security organization structure - E&TS, CISO, CSIRT, PSIRT, BISOs. It's about how management is organized to handle cybersecurity. The person-removal test: remove titles/roles and the paragraph collapses to near-nothing. → MR

Specific facts:
- "Enterprise & Technology Security" ("E&TS") - named team
- CISO - named role (firm-specific)

- CSIRT - domain term
- "Product Security Incident Response Team" ("PSIRT") - named team
- "Business Information Security Officers" ("BISO") - named role
- "Office of the CISO" - named team

Specificity: Multiple firm-specific facts (named teams, named roles). Level 3.


fact: security operations team monitoring automated event-detection notifications

reasoning: The paragraph describes detection and analysis activities within the cybersecurity program—how incidents are identified, investigated, and assessed—making it RMP. 'Security operations team' references a SOC-like function that passes the ERM test, but the rest of the language (investigate, assess severity, determine nature) is generic process description, placing this at a borderline Level 2.

thinking:
Classify this paragraph.

Content: Describes incident detection and analysis processes - automated event-detection, security operations team monitoring, notifications from employees/third parties, incident response team investigation steps.

Category: This is about what the cybersecurity program does - detection, analysis, investigation processes. RMP.

Specificity: Let me scan for facts.
- "automated event-detection notifications" - generic
- "security operations team" - this is a domain term (SOC equivalent)
- "incident response team" - commonly confused, stays L1
- The processes described are fairly generic - detect, investigate, assess severity

"security operations team" - this passes the ERM test as it's a security-specific concept.

Actually, "dedicated cybersecurity team" is listed as NOT passing ERM test, and "security operations team" is essentially the same thing. But SOC is a recognized domain term, so "security operations team" is domain-adapted language. I'll count it as Level 2. The "automated event-detection notifications" part is too generic. No firm-specific facts here - no named roles, committees, or verifiable details. Overall, this lands at Level 2.


reasoning: The paragraph describes the scope of what the cybersecurity program aims to protect (IT assets, stakeholder data, IP, products), which frames the risk management program, though it is introductory and borderline N/O. No domain-specific terminology, firm-specific facts, or verifiable claims are present—every phrase could apply to any company's generic commitment statement.

thinking:
Classify this paragraph.

This is a generic commitment statement about protecting IT assets and data. No specific cybersecurity practices, no domain terms, no firm-specific facts.

Category: This doesn't answer any of the six questions substantively. It's a general commitment statement. Could be RMP but it describes no actual process. It's borderline N/O vs RMP. Let me think... it states what they're committed to protecting but describes no actual measures. I'll go RMP since it's describing the scope/purpose of their cybersecurity program, but actually it's so generic... It's really just a commitment statement. But it does describe what the program aims to protect - operations, stakeholder data, IP, products.

I'm treating this as an introductory framing statement that outlines the program's scope, so I'll classify it as RMP. For specificity, the language is entirely generic—terms like "cyber assets," "stakeholder data," and "intellectual property" are standard business vocabulary with no domain-specific terminology that would meet the ERM threshold. That puts it at Level 1.


fact: Chief Information Security Officer (CISO) role

fact: Chief Information Officer (CIO) role

fact: Chief Risk Officer (CRO) role

fact: CRO presents in person at board meetings twice each year

reasoning: The paragraph primarily answers how the board oversees cybersecurity—audit committee oversight, quarterly briefings from officers, and board-level reporting—making it Board Governance. Specificity reaches Level 4 due to the verifiable claim that two audit committee members hold cybersecurity oversight certifications and the CRO presents twice per year, both specific numbers that could be independently checked.

thinking:
Let me analyze this paragraph.

Category: This is about board oversight of cybersecurity - audit committee oversight, board reporting, briefing frequency. The primary question answered is "How does the board oversee cybersecurity?" → Board Governance.

Even though CIO, CISO, CRO are mentioned, they're mentioned in the context of reporting TO the board, which is about information flow to the board.

Specific facts:
- Audit committee oversees cybersecurity → generic (every company has audit committee)
- "Two members of the audit committee have obtained certifications in cybersecurity oversight" → quantified (specific number "two"), verifiable

- The CISO and CIO report quarterly to the audit committee, while the CRO presents to the full board on the same cadence, with in-person presentations happening twice yearly - these are firm-specific roles with documented reporting structures and frequencies that could be verified.
- The board has at least two members with documented cybersecurity oversight certifications, which is a concrete, verifiable detail.


fact: CISO identified as primarily responsible for assessing and managing cybersecurity risks

fact: Chief Information and Technology Officer identified as primarily responsible

reasoning: The paragraph identifies which management roles are responsible for cybersecurity risk, passing the person-removal test for MR (remove the titles and no program description remains). CISO and Chief Information and Technology Officer are VP+-level roles qualifying as firm-specific facts, elevating to Level 3.

thinking:
Classify this paragraph.

The paragraph identifies management roles responsible for cybersecurity risk management. It names specific titles (CISO, Chief Risk Officer, Chief Information and Technology Officer) and their responsibilities (assessing/managing risks, monitoring risk appetite metrics).

Category: This is about how management is organized to handle cybersecurity - who is responsible. The person-removal test: remove the titles and responsibilities, and nothing substantive about the program remains. → MR

Specific facts:
- CISO (firm-specific named role at VP+ level)
- Chief Risk Officer (generic executive role every company has... but wait, CRO is somewhat generic.

Now I'm checking the classification rules - generic governance roles like Board, Audit Committee, CEO, CFO, and General Counsel don't count as firm-specific, and CRO falls into that same category of standard executive positions. The Chief Information and Technology Officer is firm-specific since it's a VP+ level role with IT responsibilities. For the risk appetite metrics language, that's standard ERM terminology an enterprise risk professional would use. So I'm marking CISO and Chief Information and Technology Officer as firm-specific named roles, but leaving CRO out since it's a common executive role that exists across companies.


fact: forensic investigations

reasoning: The paragraph primarily answers what the cybersecurity program does regarding incident response — containment, remediation, recovery, third-party assistance, and annual plan review — making it RMP. Board/Audit Committee notification is subordinate to the process description. 'Forensic investigations' passes the ERM test as a domain-specific practice, elevating to Level 2, but no firm-specific or verifiable facts push it higher.

thinking:
Classify this paragraph.

Content: Describes incident response process - containment, remediation, recovery, third-party assistance, notification procedures, annual review of incident response plan.

Category: This is about what the cybersecurity program does regarding incident response. The main question answered is "What does the cybersecurity program do?" → RMP. There's mention of notifying the Board/Audit Committee, but that's subordinate to the incident response process description.

Specific facts:
- "incident response plan" - commonly confused, stays L1
- "forensic investigations" - domain term, passes ERM test
- "incident response management" - borderline, but in context of third-party services

- "Franklin Board of Directors" and "Franklin Audit Committee" are generic governance references that don't add domain specificity
- "at least annually" is just standard review cadence
- "cyber security incident response plan" itself is generic terminology

The key domain terms here are "forensic investigations," which clearly passes the ERM test since a non-security professional wouldn't naturally use it. "Containment" and "remediation" in the cybersecurity context are somewhat specialized, though "incident response" on its own tends to be commonly misunderstood across disciplines.

So I'm settling on Level 2, with "forensic investigations" as the distinguishing domain term that elevates this beyond generic governance language.


fact: Enterprise Cybersecurity Management Review Group (Enterprise Cybersecurity MRG) — named management-level steering committee

reasoning: This paragraph describes a management-level committee (Enterprise Cybersecurity MRG) — its composition, meeting cadence, responsibilities, and escalation path — making it primarily about how management is organized (MR per Rule 1: management-level committee about structure/membership). Specificity reaches Level 3 via the named committee (Enterprise Cybersecurity MRG) and CISO role, both firm-specific facts.

thinking:
Let me analyze this paragraph.

Category: This describes a management-level committee (Enterprise Cybersecurity MRG) - its structure, membership, meeting cadence, and responsibilities. It also describes escalation to the Board/Audit Committee. The primary question answered is about how management is organized to handle cybersecurity. But per Rule 1, governance-chain paragraphs default to BG when describing oversight structure. However, this is primarily about a management-level committee's structure and membership → MR per Rule 1 (management-level committees → MR if about structure/membership).

The paragraph focuses on the Enterprise Cybersecurity MRG's composition and how it escalates issues, which fits the structure/membership criterion for MR categorization. The specific roles like Chief Information Security Officer and the escalation pathway to the Board/Audit Committee are firm-specific details that support this classification.


fact: ransomware, malware, phishing attacks, intrusion software — specific threat types

fact: operational technology as a distinct attack surface

fact: phishing, social engineering training

reasoning: The paragraph answers 'what does the cybersecurity program do?' by listing risk assessment, protective controls, training, policies, and incident response procedures — squarely RMP. Specificity reaches Level 2 via domain terms like ransomware, malware, phishing, social engineering, operational technology, and detective surveillance controls, which pass the ERM test, but no firm-specific facts (no named roles, committees, or specific numbers) prevent it from reaching Level 3.

thinking:
Let me classify this paragraph.

Content category: This describes what the cybersecurity program does - risk assessment, protective capabilities, training, policies, etc. This is RMP.

Specific facts:
- Domain terms: ransomware, malware, phishing, intrusion software, operational technology, layered technical protective capabilities, detective surveillance controls, phishing/social engineering training, table top exercises involving senior leaders
- Let me apply the ERM test more carefully:
  - "ransomware, malware, phishing attacks, data theft" - specific threat types → domain terms
  - "layered technical protective capabilities and detective surveillance controls" - domain language
  - "operational technology" - domain term
  - "phishing, social engineering" - domain terms
  - "table top exercises" - the instructions say tabletop exercises without cybersecurity qualifier stay L1, but here they mention "involving senior leaders" which isn't a cybersecurity qualifier. However, the context is clearly cybersecurity. Let me be careful - the instructions say "tabletop exercises (without cybersecurity qualifier)" stays L1.

The threat types like ransomware, malware, phishing, and social engineering are clearly domain terms that pass the ERM test, along with "operational technology" and the detective surveillance controls language.

There are no firm-specific facts here—no named roles at VP level or above, no named committees, no specific numbers, and nothing verifiable. This lands at Level 2 for domain-adapted specificity.


reasoning: The paragraph is a general introduction covering multiple topics, but the final sentence delivers a clear materiality assessment ('not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect') which is a backward-looking and forward-looking conclusion per Rule 5 → SI. The language throughout is entirely generic — 'proactive and defensive safeguards,' 'information assets,' 'security incidents' all fail the ERM test, the date is a reporting-period anchor not a cybersecurity fact, and the negative materiality assertion is not externally verifiable, yielding no facts above Level 1.

thinking:
Let me analyze this paragraph.

Content: This is an introductory/overview paragraph that touches on multiple topics - importance of cybersecurity, proactive/defensive safeguards, board and management oversight, programs/policies, incident response, and a materiality assessment at the end.

The last sentence is a clear materiality assessment: "As of December 31, 2024, the Bancorp is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect Fifth Third, including its business strategies, results of operations or financial condition." This is a backward-looking materiality conclusion → SI per Rule 5.

But most of the paragraph is general overview/intro.

The materiality statement is significant though - it's a direct SEC Item 106(b)(2) type assessment. Per Rule 5, stating a conclusion about whether cybersecurity has affected business outcomes → SI. Looking more carefully, the paragraph is mostly introductory boilerplate with the materiality assessment at the end, which is a substantive conclusion. I'll go with Strategy Integration based on Rule 5.

Specificity: Let me scan for facts. "Board of Directors" is generic, every company has this. "Information security and cybersecurity risk management programs" is generic. "As of December 31, 2024" is just reporting period context, not a cybersecurity fact. The materiality statement is a negative self-assertion, not externally verifiable. No specific facts here.

The domain terms like "proactive and defensive safeguards," "information assets," and "security incidents" are all standard language. This is essentially generic boilerplate throughout - Level 1.


reasoning: The paragraph's central statement is a backward-looking materiality assessment ('none have materially affected the Company or our financial position, results of operations and/or cash flows'), which is the hallmark of Strategy Integration under Rule 5. The remainder is generic speculation about ongoing risks, vague investment language, and a cross-reference to Item 1A. No domain terms pass the ERM test, no firm-specific facts, and the negative materiality assertion is not externally verifiable, leaving specificity at Level 1.

thinking:
Let me analyze this paragraph.

The paragraph starts with a materiality assessment ("none have materially affected the Company or our financial position, results of operations and/or cash flows") - this is a backward-looking SI statement per Rule 5.

Then it has forward-looking speculation ("risks continue to increase", "may not successfully protect") and generic investment language, plus a cross-reference to Item 1A.

The primary question answered: "How does cybersecurity affect the business/finances?" - the materiality conclusion is the key statement.

Specificity: The materiality statement is a negative self-assertion ("none have materially affected") - per the rules, this is NOT externally verifiable.

The rest is just generic boilerplate about investing in cybersecurity and resiliency, with vague references to past incidents but nothing firm-specific or verifiable. This lands at Level 1 - pure generic language without any domain-specific facts or details that would pass scrutiny.


fact: CIO reports on cybersecurity strategy and risk control efforts

fact: CIO reports to General Counsel, Chief Accounting Officer, CFO, CEO, and Audit Committee

reasoning: The paragraph primarily answers how the board oversees cybersecurity, describing the oversight chain from Board to Audit Committee to management, making it Board Governance. The CIO role in a cybersecurity context is a firm-specific fact, and the specific reporting chain (CIO → General Counsel, CAO, CFO, CEO, Audit Committee) is a distinguishing organizational detail, elevating to Level 3.

thinking:
Classify this paragraph.

Category: This describes how the board oversees cybersecurity - board oversight structure, how information flows from management to the board via Audit Committee. Primary question: "How does the board oversee cybersecurity?" → Board Governance.

Specific facts:
- CIO (named role - but CIO alone... is this VP-level or above? CIO is a C-suite role, so yes, firm-specific)
- General Counsel - generic role every company has
- Chief Accounting Officer - generic
- CFO, CEO - generic

- Audit Committee and Board of Directors are generic governance structures, but the CIO is firm-specific since it's a C-suite cybersecurity leadership role that the rules explicitly list.

The reporting structure itself—with the CIO connected to General Counsel, CAO, CFO, CEO, and the Audit Committee—is an organizational detail specific to this company. Combined with the CIO's presence, this pushes the content to Level 3 (Firm-Specific). The mention of "third-party cybersecurity risk assessments" doesn't elevate it beyond that since risk assessments are commonly confused with Level 1 content and don't clearly meet Level 2 criteria.


fact: Aerospace Safety Committee (non-generic board committee with cybersecurity oversight)

fact: Chief Information Officer and Senior Vice President, Information Technology & Data Analytics (CIO)

fact: Chief Security Officer (CSO)

fact: Chief Engineer

fact: Chief Aerospace Safety Officer

fact: Chief Product Security Engineer

fact: CIO and CSO present to Audit Committee at bimonthly meetings

fact: Designated Audit Committee member with cyber risk expertise meets regularly with management

reasoning: The paragraph answers how the board oversees cybersecurity — delegation to two committees, briefing cadence, escalation protocols, and information flow to the full board — clearly Board Governance. Specificity reaches Level 3 via multiple firm-specific roles (CIO, CSO, Chief Product Security Engineer, Chief Aerospace Safety Officer) and a non-generic committee (Aerospace Safety Committee), but no externally verifiable claims push it to Level 4.

thinking:
Classify this paragraph.

Category: Board Governance - describes board oversight structure, committee delegation, briefing frequency, expertise, information flow to the board.

Specificity: Let me scan for facts.

- CIO and SVP, Information Technology & Data Analytics - named role (firm-specific)
- CSO (Chief Security Officer) - named role (firm-specific)
- Audit Committee and Aerospace Safety Committee - Audit Committee is generic, but Aerospace Safety Committee is a named non-generic committee (firm-specific)

- Bimonthly meetings - specific cadence
- Chief Engineer, Chief Aerospace Safety Officer, Chief Product Security Engineer - named roles (firm-specific)
- "Designated one of its members with expertise in cyber risk management" - generic phrasing without specificity
- Discussion topics like threat landscape, cyber risks, incidents, and cybersecurity investments - domain terminology but commonly used language rather than firm-specific details

The firm-specific facts cluster around named executive roles and the Aerospace Safety Committee, while the governance cadence and discussion topics are more generic to standard board oversight practices.


reasoning: These lettered items (f, g) are part of a committee charter listing oversight responsibilities—reviewing regulatory reports and monitoring emerging risks—which describes governance oversight structure, defaulting to BG per Rule 1. The language is entirely generic governance/compliance terminology (examination reports, regulatory findings, frameworks) that any ERM professional in a regulated industry would use, with no domain-specific cybersecurity terms, firm-specific facts, or verifiable claims.

thinking:
Classifying this paragraph from Commerce Bancshares' 10-K Item 1C filing.

This lists committee responsibilities (reviewing examination reports, monitoring emerging risks). The question is whether this is BG or RMP.

These are oversight activities of what appears to be a committee. The items are lettered (f, g) suggesting they're part of a larger list of committee responsibilities. "Review... examination reports," "Monitor and discuss emerging... risk issues" — these are oversight/governance activities.

Given Rule 1, governance-chain paragraphs default to BG when describing oversight structure. This appears to be listing what a committee does in terms of oversight.

The language here is standard banking regulatory terminology—"information security examination reports" and references to regulatory agencies are typical compliance/governance vocabulary rather than domain-specific cybersecurity language. This reinforces the BG classification since it's framed as committee oversight rather than operational security activities.


reasoning: This is a pure cross-reference to Item 1A Risk Factors with no substantive cybersecurity disclosure. N/O with Generic Boilerplate as it contains no cybersecurity measures, processes, or assessments.

thinking: Cross-reference to Item 1A risk factors, no substantive cybersecurity content.


fact: Identity and access management, cyber defense operations, security engineering teams

fact: Penetration testing, incident response, threat intelligence, managed security services

fact: Executive Vice President / Chief Information Security Officer (CISO)

fact: Chief Information Officer (CIO)

fact: Senior Executive Vice President / Chief Operating Officer (reporting line)

fact: CISO has over 25 years' experience in cybersecurity risk management

fact: CIO has over 27 years' experience in technology risk management

reasoning: The paragraph primarily answers how management is organized for cybersecurity — team composition by specialty, leadership roles (CISO, CIO), qualifications, and reporting lines to COO/CEO/Board — making it Management Role. While third-party activities are mentioned at the end, the bulk is organizational. Specificity reaches Level 4 due to lower-bound verifiable claims: CISO with 'over 25 years' and CIO with 'over 27 years' of experience.

thinking:
Let me analyze this paragraph.

Category: This describes the cybersecurity team composition, leadership roles, qualifications, and reporting lines. The person-removal test: remove names, titles, qualifications, experience, reporting lines, team composition — what remains? "Comerica engages information technology risk management employees... engages third parties from time to time to assess, manage and respond to cybersecurity risks through risk assessment, penetration testing, incident response, threat intelligence, education, and managed security services." Some program description remains but the bulk is about roles and organization. The primary question answered is "How is management organized to handle cybersecurity?" → Management Role.

Specificity: The passage includes concrete details like specific domain areas (identity and access management, cyber defense operations, security engineering, IT governance risk and compliance), named executive roles (EVP/CISO and CIO), quantified experience levels (over 25 and 27 years respectively), clear reporting relationships to the Senior EVP/COO, and specific service capabilities like penetration testing and incident response. The experience figures are lower bounds, making them verifiable claims.


fact: phishing attempts

fact: ransomware

fact: malware

reasoning: The paragraph's lead statement is a backward-looking materiality assessment ('not aware of any material cybersecurity incidents that have impacted the Company'), which is SI per Rule 5. The remainder is speculative risk language and a cross-reference to Item 1A. Specificity reaches Level 2 from named threat types (phishing, ransomware, malware) that pass the ERM test, but the 'as of December 31, 2023' date anchors a negative assertion which is not externally verifiable, keeping it below Level 4.

thinking:
Let me analyze this paragraph.

Content: States no material incidents as of Dec 31 2023, discusses cyber threats they face, mentions various attack types, and cross-references Risk Factors.

Category: The opening statement "we are not aware of any material cybersecurity incidents that have impacted the Company" is a materiality assessment → SI per Rule 5. The rest is speculative risk language and a cross-reference. The SI assessment is the key substantive claim.

Specificity: "As of December 31, 2023" is a reporting date anchor for a negative assertion. Per the rules, negative self-assertions are NOT externally verifiable.

Now I'm checking the specific threat types mentioned—ransomware, phishing, malware, and computer viruses are domain-specific terms that meet the ERM test, while cloud and Internet are too generic. The core negative assertion about material incidents maps to SI, and the threat types themselves represent Level 2 specificity, though there are no firm-specific facts beyond the date anchoring this negative claim.


fact: Incident disclosed on June 13, 2023

fact: Normal operations resumed over nine days following the incident

fact: Lost revenue of approximately $80 million to $85 million

fact: Lost operating earnings of $35 million to $40 million

reasoning: The paragraph primarily describes a real cybersecurity incident—its date, response actions, recovery timeline, and financial impact—making it Incident Disclosure (the incident frame dominates, even though the last sentence touches on materiality assessment). Specificity is Level 4 due to multiple verifiable facts: a specific incident date, a quantified recovery period, and dollar-range estimates of lost revenue and earnings.

thinking:
Let me analyze this paragraph carefully.

This describes a real cybersecurity incident with specific details about what happened, timeline, and financial impact.

Category: The paragraph describes a real incident (June 13, 2023), its response, timeline, and financial impact. It's primarily about what happened - Incident Disclosure. But it also includes significant financial impact numbers. Per Rule 4, mixed with incident frame dominant → ID. Actually, the financial numbers are substantial here. Let me re-read...

The paragraph covers: the incident date, response actions, resumption timeline (9 days), financial impact ($80-85M revenue, $35-40M earnings), and a materiality statement.

The incident frame dominates here—what happened on June 13th, the nine-day recovery window, and the resulting financial consequences. That last sentence about not identifying other material cyber events is more of a disclosure safeguard, but the core narrative is clearly incident-focused.

Now looking at the specificity: I have concrete dates, quantified losses in both revenue and earnings, and a specific recovery timeline. The "leading security experts" reference lacks detail, but most of the claims are verifiable through the numbers provided.

Multiple quantified facts with verifiable specifics puts this at Level 4.


fact: cybersecurity dashboard featuring threat detection rates and response times

fact: penetration tests

reasoning: The paragraph primarily answers how the board oversees cybersecurity, describing Audit Committee oversight structure, briefing cadence, and reporting lines — classic Board Governance. Specificity reaches Level 2 via domain terms (threat detection rates, response times, penetration tests) that pass the ERM test, but 'Director of Information Technology' lacks a security qualifier and 'Audit Committee' is generic, so no firm-specific facts push it to Level 3.

thinking:
Let me analyze this paragraph.

Category: This is about how the board (Audit Committee) oversees cybersecurity. The primary question answered is "How does the board oversee cybersecurity?" → Board Governance.

Specific facts:
- "Director of Information Technology" - This is a director-level title without a security qualifier, so NOT firm-specific per the rules
- "cybersecurity dashboard" with "threat detection rates and response times" - these are domain terms (specific metrics)
- "penetration tests" - domain term

- "Audit Committee" - generic, every company has one
- "annual cybersecurity briefing" - generic cadence
- "third-party firm" - unnamed, not specific

The domain-specific metrics like threat detection rates and response times, along with penetration tests and the cybersecurity dashboard, push this to Level 2 (Domain-Adapted) specificity.


fact: hacktivists (specific cyber threat actor type)

fact: state-sponsored organizations and nation states as threat actors

reasoning: The paragraph culminates in a backward-looking materiality assessment ('have not been any that have had a material adverse effect on the company'), which per Rule 5 is SI. The threat landscape language includes domain-specific threat actor types like 'hacktivists' and 'state-sponsored organizations' that pass the ERM test, but no firm-specific or verifiable facts are present, keeping specificity at Level 2.

thinking:
Let me analyze this paragraph.

The paragraph discusses cybersecurity threats IBM faces (referencing Item 1A Risk Factors), lists threat actors and sources, and concludes with a materiality assessment: "there have not been any that have had a material adverse effect on the company."

Category: The last sentence contains a backward-looking materiality assessment ("have not had a material adverse effect"). Per Rule 5, this is SI. The first part is threat landscape description, but the materiality conclusion is the key assessment.

Specificity: Let me scan for facts:
- "AI" mentioned as a risk source - generic
- Lists of threat actors (criminal hackers, hacktivists, state-sponsored organizations) - these are threat types, domain terms? The ERM test: would a non-security ERM professional use "hacktivists, state-sponsored organizations"? Possibly not naturally.

These threat actor categories like "hacktivists" and "state-sponsored organizations" are cybersecurity-specific terminology that demonstrate domain expertise, even though they've become more mainstream. The negative materiality assertion about no material adverse effects is unverifiable, and the cross-reference to Item 1A adds context but doesn't change the classification.


fact: Senior Director of Governance & Information Security ('Senior Director, GIS')

reasoning: The paragraph describes the board's delegation of cybersecurity oversight to the Audit Committee, briefing frequency, and information flow—classic Board Governance content. Specificity reaches Firm-Specific due to the 'Senior Director of Governance & Information Security' title, which is a Director-level role with a security qualifier distinguishing this company's governance structure; other elements (Audit Committee, CFO, quarterly/bi-annual cadences) are generic.

thinking:
Classify this paragraph.

Category: Board Governance - describes board/committee oversight structure, delegation, briefing frequency.

Specific facts:
- "Audit Committee" - generic, every company has one → NOT firm-specific
- "Chief Financial Officer" - generic → NOT firm-specific
- "Senior Director of Governance & Information Security" - Director-level with security qualifier → firm-specific
- "quarterly information security updates" - generic cadence
- "bi-annual basis" - generic cadence
- "Senior Director, GIS" - abbreviation for their specific role

The "Senior Director of Governance & Information Security" is a Director-level title WITH a security qualifier, so it qualifies as firm-specific per the rules.

The domain language here doesn't meet the ERM threshold, but the named role pushes this to firm-specific classification overall.


fact: CISO role reporting on cybersecurity risks

fact: Cybersecurity Executive Steering Body

reasoning: The paragraph describes the information flow from CISO → Cybersecurity Executive Steering Body → Audit Committee, which is a governance-chain paragraph whose purpose is describing oversight structure and how cybersecurity information reaches the board, making it Board Governance. The named 'Cybersecurity Executive Steering Body' is a firm-specific non-generic committee, and CISO is a firm-specific VP+ role, elevating specificity to Firm-Specific.

thinking:
Classify this paragraph.

Category: This describes how information flows from CISO → Steering Body → Audit Committee. It's about oversight structure and how information reaches the board. This is Board Governance.

Specific facts:
- CISO (named_role, firm-specific)
- Cybersecurity Executive Steering Body (named_committee, firm-specific)
- Audit Committee (generic, not firm-specific)

Specificity: Firm-Specific due to CISO and the named committee "Cybersecurity Executive Steering Body."


fact: April 2022 cybersecurity incident

fact: Security Operations Center (SOC) enhancements

fact: exfiltration of confidential company and patient information

fact: ransomware attacks mentioned as ongoing threat

fact: incident disrupted a subset of hospital operations

fact: detection tools and capabilities enhanced post-incident

reasoning: The paragraph describes a real cybersecurity incident (April 2022) including its nature (operational disruption, data exfiltration), impact (significant costs, lost revenues), and remediation steps, making Incident Disclosure the primary category. The specific date 'April 2022' is an externally verifiable fact tied to a real event, elevating specificity to Quantified-Verifiable.

thinking: Incident disclosure with remediation details and some forward-looking risk language.


reasoning: The paragraph contains a backward-looking materiality assessment ('has not been materially affected by a cybersecurity breach') which triggers SI per Rule 5, combined with cross-references to Item 1A Risk Factors and forward-looking speculative language. No domain terms, firm-specific facts, or verifiable claims are present — the negative materiality assertion is a self-reported claim about absence, and the rest is cross-referencing and generic risk language.

thinking:
This paragraph contains a backward-looking materiality assessment ("has not been materially affected by a cybersecurity breach") plus cross-references to Risk Factors. The materiality assessment is SI per Rule 5. The cross-references are N/O but the SI assessment is substantive content.

Specificity: The negative materiality assertion is not externally verifiable. No domain terms, no firm-specific facts beyond the standard materiality statement. This is generic boilerplate.

Wait - "has not been materially affected by a cybersecurity breach" is a backward-looking SI assessment. But for specificity, there are no domain terms, no firm-specific roles, no verifiable facts.

So this lands at Level 1 - it's a backward-looking SI statement with no specificity.


reasoning: The paragraph's central assertion is a backward-looking materiality assessment ('no cybersecurity incidents have had a material adverse effect on our business, financial condition or results of operations'), which is SI per Rule 5. The remaining content—speculative risk language and generic insurance mention—does not elevate specificity: the negative materiality assertion is not externally verifiable, 'cyber risk insurance' is generic, and no domain terms, firm-specific facts, or verifiable claims are present.

thinking:
Let me analyze this paragraph.

Content: Discusses experience with security incidents (no material ones), materiality assessment, insurance, and speculative risk language.

Category: The key sentence is "no cybersecurity incidents have had a material adverse effect on our business, financial condition or results of operations" — this is a backward-looking materiality assessment → SI per Rule 5. The rest is speculation ("could have a material adverse effect") and insurance mention.

Specificity: "cyber risk insurance" — this is a generic mention. "No cybersecurity incidents have had a material adverse effect" — per the rules, this is a negative self-assertion, NOT externally verifiable.

No named roles, no domain-specific terminology that would satisfy the ERM test, no firm-specific facts, and no externally verifiable claims. This is Level 1.


fact: Vendor Management department (named internal department)

reasoning: The majority of the paragraph (4 of 6 sentences) describes the Vendor Management department's processes for vetting and approving third-party vendors, making TP the dominant category by text volume, though it also contains a backward-looking materiality assessment (SI) and a cross-reference (N/O). Specificity reaches Firm-Specific due to the named 'Vendor Management department,' but the vetting processes described are otherwise generic and lack domain terminology.

thinking:
Let me analyze this paragraph carefully.

It covers multiple topics:
1. Vendor Management department and third-party vetting processes
2. A materiality assessment statement
3. A cross-reference to Item 1A

Let me determine the primary category. The paragraph starts with vendor management (TP), then has a materiality statement (SI), then a cross-reference (N/O).

The materiality statement "Risks from Cybersecurity threats or previous incidents have not materially affected business strategy, results of operations, or financial condition" is a backward-looking SI assessment per Rule 5.

The vendor management content is about 4 sentences, the SI statement is 1 sentence, the cross-reference is 1 sentence.

By text volume, TP dominates. The vendor management content describes how the company's Vendor Management department imposes requirements on third-party vendors—policies, vetting, approval, and inventory processes—which is clearly TP under Rule 3. The SI statement is just one sentence and secondary to the main focus.

The language is generic ("vetted, approved and inventoried") without domain-specific terminology, but "Vendor Management department" is a named internal organizational unit, making this firm-specific. I'd classify this as Level 3 - Firm-Specific, with TP as the primary category.


reasoning: The paragraph answers how the board oversees cybersecurity: full Board oversight of ERM incorporating cyber risks, management briefings on risk assessments, escalation process, and periodic third-party testing—all classic Board Governance content. No domain-specific terms pass the ERM test (risk assessment, escalation process, third-party experts are all generic governance language), no firm-specific facts (Board and Management are generic), and no verifiable claims.

thinking:
Classify this paragraph.

Category: Board oversight of cybersecurity risks, how Board is informed, escalation process. This is Board Governance.

Specific facts:
- "Enterprise Risk Management program" - generic ERM term, L1
- "cybersecurity risk assessment" - generic
- "escalation process" for high-severity incidents - process description but generic
- "independent third-party technology experts to test... information technology systems, including cybersecurity" - this is about pen testing/security testing, but described generically

No named roles above generic "Board", no firm-specific facts, no verifiable claims. The language is generic - "risk assessment," "escalation process," "third-party technology experts." No domain-specific terms that pass the ERM test.

This lands at Level 1 - Generic Boilerplate. The entire passage relies on standard risk management terminology without any company-specific details or concrete examples.


fact: endpoint protection

fact: enhanced encryption

fact: two-factor authentication (2FA)

fact: real-time threat monitoring

fact: remote access protocols

reasoning: The paragraph describes the company's cybersecurity program activities—monitoring, software updates, BYOD policy, cloud migration, endpoint protection—squarely answering 'what does the program do?' → RMP. Domain terms like endpoint protection, encryption, 2FA, and real-time threat monitoring pass the ERM test, elevating to Level 2, but no named roles, named vendors, or verifiable claims push it higher.

thinking:
Classify this paragraph.

Category: This describes what the cybersecurity program does - risk assessment, monitoring, software updates, policies, infrastructure changes, endpoint protection. This is RMP.

Specificity: Let me scan for facts.
- "regular monitoring of outside threats" - generic
- "continuous updating of software" - generic
- "formal policy related to employees that access corporate systems from personal devices" - BYOD policy, somewhat domain-specific
- "migration of business-critical systems, including the Company's ERP system, to Tier-1 cloud service providers" - firm-specific detail about ERP migration
- "endpoint protection" - domain term

- "enhanced encryption" - domain term
- "two-factor authentication (2FA)" - domain term
- "real-time threat monitoring" - domain term

The ERP migration stands out as a concrete company action, though the cloud providers aren't named. Most other technical terms like encryption, 2FA, and threat monitoring are standard domain vocabulary rather than firm-specific details.

The ERP system migration itself is operational and company-specific, but without named entities or identifiers, it doesn't cross into firm-specific territory—it's just describing what they did in domain-adapted language.


fact: Chief Information Security Officer (CISO)

fact: EXCO (executive committee)

fact: Senior Leadership Team (SLT)

fact: tabletop exercises

reasoning: The paragraph primarily describes how information flows from the CISO to the Board, EXCO, and SLT through quarterly meetings and annual tabletop exercises — an oversight structure description fitting Board Governance. Firm-specific facts include the named CISO role, EXCO, and SLT as distinct organizational bodies, elevating specificity to Level 3.

thinking:
Let me analyze this paragraph.

Category: The paragraph describes the CISO's role, meeting cadence with board/committees, and activities. It mentions Board oversight but the primary subject is the CISO and their responsibilities. The governance chain here describes how the CISO interfaces with oversight bodies. Per Rule 1, governance-chain paragraphs default to BG when describing oversight structure, but become MR when management's organizational role is primary. The CISO is the subject, describing their meeting cadence and what they do in those meetings. But the purpose is describing the oversight structure - how information flows to the board.

Actually, let me re-read.

The paragraph starts with "led by our CISO" (MR), then describes meetings with Board, EXCO, SLT (BG - information flow to board), then tabletop exercises with Board/EXCO/SLT. The purpose is describing the oversight/reporting structure. I'd say BG - the meetings and tabletop exercises describe how the board stays informed. But applying the person-removal test: if I strip out the CISO, names, and titles, what's left? Quarterly meetings with Board/EXCO/SLT, annual tabletop exercises, evaluating incident response processes, staying informed of threat landscape. That's still substantive content describing oversight activities, which suggests this leans toward BG.

Looking at specificity: CISO is firm-specific (named role), EXCO and SLT are named committees, "at least quarterly" is generic cadence, and "tabletop exercises" is a domain term that becomes cybersecurity-specific in this incident response context. The CISO reference is Level 3 firm-specific, but the tabletop exercises themselves—even though the rules note they're L1 without a cybersecurity qualifier—are implicitly cybersecurity-focused here given the incident response framing.


fact: Emergency Incident Response Team

reasoning: This fragment describes senior management and a named team periodically reviewing and drilling on a plan, which is a program activity (RMP). The 'Emergency Incident Response Team' is a firm-specific named team elevating specificity to Level 3.

thinking:
Classifying this paragraph from Entergy Louisiana's 10-K Item 1C filing.

The paragraph mentions "Part I Item 1A, 1B, and 1C including key questions to be addressed, critical decision points, and sources of key information to support decision-making. Senior management and the Emergency Incident Response Team periodically review and drill on the plan."

This seems like a fragment - likely a continuation of a sentence about a plan. It mentions senior management and an Emergency Incident Response Team reviewing and drilling on a plan. This is about risk management processes (drilling on a plan) with some management involvement.

The "Emergency Incident Response Team" is a named internal team specific to this firm, which qualifies as a Level 3 specificity classification for a named non-generic committee.


reasoning: The paragraph primarily answers how the board oversees cybersecurity: Board has overarching responsibility, Audit Committee monitors cybersecurity risk, and management reports to the board through the Audit Committee. This is a governance-chain paragraph with oversight structure as the purpose → BG. The VP, Information Systems and Technology is a VP-level title with IT portfolio, qualifying as firm-specific, elevating to Level 3.

thinking:
Classify this paragraph.

Category: This describes board oversight of cybersecurity risks, with the Audit Committee monitoring risk management including cybersecurity. It describes how information flows from management to the board. The primary question answered is "How does the board oversee cybersecurity?" → Board Governance.

Specific facts:
- "Vice President, Information Systems and Technology" — VP-level role with IT portfolio → firm-specific (named_role)
- "Audit Committee" — generic, every company has one → NOT firm-specific
- "cybersecurity maturity" — not really a domain term that passes ERM test

- The VP title pushes this to Level 3 specificity since it's a named executive role tied to the firm's structure.


fact: Chief Information Security Officer (CISO) leads information security efforts

fact: Executive Leadership Team (ELT) referenced as distinct group

fact: Senior Leadership Team (SLT) referenced as distinct group

reasoning: The paragraph centers on the CISO's role, responsibilities, and meeting cadences with various leadership groups, making MR the best fit—the CISO is the grammatical subject and the organizing frame is their interactions, not the Board's oversight structure. Specificity is Firm-Specific due to the named CISO role and the named leadership teams (ELT, SLT); cadences like 'at least quarterly' and 'at least annually' are generic and tabletop exercises without a cybersecurity qualifier remain Level 1.

thinking:
Let me analyze this paragraph.

Category: The paragraph describes the CISO's role, meeting cadence with the Board/ELT/SLT, and activities like tabletop exercises. The primary question is about how management is organized - the CISO leads security efforts, meets with various groups. But it also describes oversight structure (BG) and activities (RMP).

The CISO is the grammatical subject. The content describes both the role's interactions with governance bodies and activities like tabletop exercises. The person-removal test: remove CISO, titles, reporting lines - what remains? Tabletop exercises, incident response processes, threat landscape management.

The core of this is really about how the CISO bridges operational security work with governance oversight - they're the connection point between the Board's need for assurance and the actual cybersecurity risk management happening below. The paragraph frames everything through the CISO's interactions and responsibilities, so it's fundamentally about their role in the management structure. The tabletop exercises reference doesn't have an explicit cybersecurity qualifier, so it stays at L1. The incident response processes are also L1 per the rules. That gives me firm-specific facts around the CISO role and the named teams—ELT and SLT—which puts this at Level 3.


reasoning: This paragraph is general business context about the company's reliance on technology systems and third-party applications to store data — it does not answer any of the six substantive cybersecurity questions (no program activities, no governance structure, no incident, no materiality assessment). No domain terminology, firm-specific facts, or verifiable claims are present.

thinking:
Classify this paragraph.

This describes the company's reliance on technology systems and third-party systems for operations and data storage. It's context-setting about the business environment, not answering any of the six substantive questions directly. No cybersecurity measures, processes, or assessments are described.

Category: None/Other - this is general business context about technology dependence, not a substantive cybersecurity disclosure.

Specificity: Generic Boilerplate - no domain terms, no firm-specific facts, no verifiable claims.


fact: CSO (Chief Security Officer) role referenced

fact: phishing tests

reasoning: The paragraph describes program activities—tools and processes for incident identification/containment/remediation, employee training, phishing tests, and consultant engagement. Person-removal test leaves substantial program description, so RMP over MR. CSO is a VP+-level security role elevating to Firm-Specific; phishing tests are domain-adapted but CSO sets the floor at Level 3. No verifiable quantities or named third parties.

thinking:
Let me analyze this paragraph.

Category: The paragraph describes what the security team does - implementing the program, detection/reporting/security/mitigation, developing tools and processes, incident response, employee training, phishing tests. The CSO is mentioned but as grammatical subject describing program activities. Person-removal test: remove CSO and team references, substantive program description remains (tools, processes, incident identification/containment/remediation, consultants, training, phishing tests). → RMP

Specificity:
- "CSO" (Chief Security Officer) → firm-specific named role (VP+ level)
- "phishing tests" → domain term (ERM test: specific to cybersecurity)

- Most other elements like detection/reporting functions, incident management processes, and employee training are generic industry practices
- "Lumen" as parent company → other_specific

The CSO role is firm-specific and phishing tests qualify as domain terminology, so this lands at Level 3. There are no verifiable facts like specific numbers, named certifications, or other firms mentioned.


fact: security operations center (SOC)

fact: Cybersecurity Incident Response Plan with categorized thresholds

fact: Chief Information Officer

fact: Crisis Response Team consisting of CEO, CFO, CHRO, CIO, and General Counsel

fact: Public Disclosure Committee

reasoning: Person-removal test: removing all roles/titles leaves a substantive program description — SOC monitoring, incident response plan with escalation thresholds, risk-based escalation process, and public disclosure analysis workflow — so this is RMP. Specificity is Firm-Specific due to the named CISO role, the specifically composed Crisis Response Team, the named Cybersecurity Incident Response Plan, and the Public Disclosure Committee.

thinking:
Let me analyze this paragraph.

Category: This describes how cybersecurity threats are identified, assessed, and monitored, plus the incident response escalation process. The SOC monitors threats, and when thresholds are met, escalation occurs through CISO to Crisis Response Team. While it mentions many named roles, the person-removal test: remove all person-specific content - there's still a substantial description of the security operations center, incident response plan with categorized thresholds, escalation review process, and public disclosure analysis. This is RMP.

Wait - actually, let me reconsider. The paragraph describes the SOC monitoring, incident response escalation, and the crisis response team composition.

The core of this is the program itself - the monitoring activities, escalation procedures, assessment processes, and disclosure protocols all remain even if I strip away the specific titles and names. So this is definitely RMP. Now I'm identifying the specific elements: the security operations center is a domain term, the Cybersecurity Incident Response Plan is a named program unique to this firm, the CISO and Crisis Response Team are named roles and committees with specific compositions, and the Public Disclosure Committee is another named committee.


fact: Enterprise Risk Management Committee ("ERM Committee")

fact: SOC1 reports reviewed for third-party service providers

reasoning: The paragraph primarily describes what the cybersecurity program does — assessing, identifying, and managing risks, with the ERM Committee's activities (overseeing, reviewing, reporting) and third-party oversight via SOC1 reviews. Per Rule 1, the management-level ERM Committee is described in terms of activities, pointing to RMP over BG. The named 'Enterprise Risk Management Committee' with its specific composition (executives appointed by the Board) is a firm-specific fact, and SOC1 is a domain term passing the ERM test, yielding Level 3.

thinking:
Let me analyze this paragraph.

Content category: This paragraph covers multiple topics - ERM integration, risk management processes, third-party oversight, and board governance. The primary question it answers is "What does the cybersecurity program do?" - it describes risk assessment, the ERM Committee's role in reviewing risks, reporting to Audit Committee, and third-party oversight. The governance chain (ERM Committee → Audit Committee) is present but serves to describe the process flow. The third-party mention is one component, not central. I'd say RMP is the best fit, though there's a BG element with the Audit Committee reporting.

I'm reconsidering the categorization here. The paragraph really centers on what the program does—assessing and managing risks—but the governance structure is more prominent than I initially thought. The ERM Committee is described as a management-level body that oversees and reports to the Audit Committee, which pushes this toward board governance territory. The question is whether the governance chain is just incidental to describing the program's activities or if it's the main point.

Looking at the specific details: the ERM Committee is named and firm-specific, executives are appointed by the Board, and there's a reporting cadence to the Audit Committee. These are structural elements. But the paragraph emphasizes what the committee does—oversees risks, reviews processes, provides reports—which aligns with RMP. The third-party SOC1 reviews are a concrete process detail that answers "what does the program do?" SOC1 is a domain-specific term that fits the ERM test. So this leans RMP because the focus is on the program's activities and processes, even though governance structure is woven in.


fact: 2017 material cybersecurity incident (criminal attack)

fact: Theft of personal information of U.S., Canadian and U.K. consumers

reasoning: The first sentence describes a real, specific cybersecurity incident (the well-known 2017 Equifax breach) with verifiable details — timing, nature, and geographic scope of affected consumers. The remainder is forward-looking speculative risk language ('could have a material adverse effect'), which per Rule 5 is not SI. The only substantive content is the incident reference, making ID the best fit despite the speculation dominating by volume. The 2017 breach date and consumer scope are externally verifiable facts, placing this at Level 4.

thinking:
Classify this paragraph.

It references the 2017 Equifax breach (a real incident) but most of the paragraph is forward-looking speculation about future compromises. Let me assess.

First sentence: references real 2017 incident - ID
Rest: hypothetical future compromises and their potential consequences - speculative/risk factor language

The first sentence is a brief reference to a real incident. The rest is forward-looking risk language. The dominant frame is speculative risk, not incident disclosure details.

But wait - does the first sentence constitute ID? It mentions timing (2017), nature (criminal attack, theft of personal information), scope (U.S., Canadian, U.K.

The paragraph opens with a real incident but immediately shifts to speculative risk language about potential future breaches. The 2017 breach serves as historical context, while the bulk of the text uses "could have a material adverse effect" phrasing—which is speculation, not incident disclosure. The dominant purpose is forward-looking risk assessment, not describing what actually happened. frame is forward-looking speculation.

Given the mix: the real incident reference is brief (one sentence), while the speculative risk language dominates (two sentences). The paragraph's primary question is really about potential future impacts - but "could have a material adverse effect" is explicitly called out as NOT SI per Rule 5.

I think this falls into a gray area. The mention of 2017 is real ID content. The rest is generic risk factor boilerplate. Since the incident is mentioned but not the central focus, and the rest is speculation...

Actually, re-reading: "In 2017, we experienced a material cybersecurity incident following a criminal attack on our systems that involved the theft of personal information of U.S., Canadian and U.K. consumers." This IS describing a real event. Then it pivots to hypothetical future risk.

The first sentence is clearly incident disclosure - it describes what actually happened. Everything after that is just standard risk language that doesn't add substantive content. Even though speculation takes up more space, the only meaningful information here is that 2017 breach, which is externally verifiable with a specific date and scope covering U.S., Canadian, and U.K. consumers. That's Level 4 specificity - it's the famous Equifax incident that's well-documented and verifiable. So this is Incident Disclosure.


reasoning: The paragraph states a backward-looking materiality conclusion ('not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect...business strategy, results of operations, or financial condition'), which is a textbook SI assessment per Rule 5. Specificity is Level 1: the negative self-assertion about no material incidents is not externally verifiable, there are no domain terms, and the cross-reference to Item 1A adds no substantive content.

thinking:
Strategy Integration - materiality assessment statement plus cross-reference.

The first sentence is a backward-looking materiality assessment ("not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect"). Per Rule 5, this is SI.

The second sentence is a cross-reference to Item 1A, which would be N/O on its own, but the primary content is the materiality assessment.

Specificity: "have not materially affected... business strategy, results of operations, or financial condition" - this is a negative self-assertion about absence of material incidents. Per the rules, negative assertions are NOT externally verifiable.

There's no domain-specific language or firm-specific facts here—just standard materiality boilerplate with no verifiable claims. This is Level 1.


reasoning: The paragraph's substantive content is a backward-looking materiality assessment ('did not experience a material cybersecurity incident during the year ended December 31, 2024'), which per Rule 5 maps to Strategy Integration. The cross-reference to Item 1A and the trailing 'Governance' header are ancillary. No domain terms, firm-specific facts, or verifiable claims are present—the negative assertion is self-reported and the date is a reporting period marker, not a cybersecurity fact.

thinking:
Negative assertion about no material incidents + cross-reference + section header.

The "did not experience a material cybersecurity incident" is a backward-looking materiality assessment → SI per Rule 5.

But there's also a cross-reference and a section header "Governance." Let me weigh: the materiality conclusion is the substantive content, cross-reference is N/O, "Governance" is a header.

Per Rule 5: "Have not experienced any material cybersecurity incidents" → SI (negative assertion).

Specificity: The negative assertion is not externally verifiable.

The reporting period date "December 31, 2024" is just a timestamp—no domain-specific content or company facts here, so that's Level 1.


reasoning: The paragraph opens with a materiality assessment stating cybersecurity threats have not materially affected and are not reasonably likely to affect business strategy, results of operations, or financial condition — this is the SEC Item 106(b)(2) backward-and-forward-looking conclusion, triggering SI per Rule 5. No domain terms passing the ERM test, no firm-specific facts, and the negative materiality assertion is a self-reported claim not externally verifiable, so specificity remains Level 1.

thinking:
Let me analyze this paragraph.

The paragraph starts with a materiality assessment ("not aware of any cybersecurity threats that have materially affected or are reasonably likely to affect... business strategy, results of operations or financial condition") → SI per Rule 5.

Then generic language about threats increasing and updating plans.

Specificity: The materiality statement is a negative self-assertion - not verifiable. "information security plan" - generic. "information technology infrastructure" - generic. No domain terms that pass ERM test, no firm-specific facts beyond the company name, no verifiable claims.

This is Level 1 - Generic Boilerplate. The language about threats not materially affecting the business is the SEC 106(b)(2) standard, but there's nothing specific enough to elevate it beyond boilerplate.


fact: isolated computer workstations

reasoning: The paragraph primarily describes what the Trust's cybersecurity program does (protocols, personnel awareness, authentication measures), making it RMP. Third parties are mentioned but only to note they have their own protocols, not as the central topic. Specificity reaches Level 2 due to domain-specific terms: two-factor authorization (MFA) and isolated computer workstations (an air-gapping/segmentation concept), both passing the ERM test. The text appears garbled/truncated, reducing confidence.

thinking:
Let me analyze this paragraph.

Content: Describes cybersecurity protocols including passwords, passphrases, two-factor authorization, isolated computer workstations, personnel awareness, and mentions third parties (banks, service providers, vendors) having their own protocols.

Category: This is primarily about what the cybersecurity program does - RMP. Third parties are mentioned but not as the central topic; they're noted as having their own protocols. The main content is about the Trust's own security measures.

Specific facts:
- "two-factor or independent authorizations" - this is MFA, a domain term

- "isolated computer workstations" - network segmentation concept, domain term
- "passwords, passphrases" - basic but these are specific security controls

The paragraph text seems corrupted in places, but it does outline concrete security measures. The presence of MFA and network isolation terminology indicates domain-specific language rather than generic security talk.

Specificity: Level 2 (Domain-Adapted) due to two-factor authorization and isolated workstations being recognized domain concepts.


reasoning: This is a grantor trust with no active operations, no customers, and no data — a no-operations entity with no substantive cybersecurity program to disclose, fitting Rule 6's N/O guidance. The paragraph appears truncated and contains no domain terms, firm-specific facts, or verifiable claims, yielding Generic Boilerplate.

thinking:
This is a grantor trust with no operations, no customers, no data. The paragraph describes that cybersecurity threats are tailored to its specific circumstances. This is essentially a SPAC/no-operations entity.

The paragraph seems truncated ("The Trust's from cybersecurity threats" - missing word), but the meaning is clear: minimal operations, no data, risks tailored to circumstances.

This is describing the trust's situation - no active operations. It's essentially saying they have minimal cyber risk. This could be SI (materiality/impact assessment) or N/O (no real cybersecurity program).

Looking more carefully: "conducts no active operations, has no customers, and maintains no personal or credit data" - this is context about why cyber risk is minimal.

Since this is a grantor trust with no operations and no cybersecurity program in place, this falls under N/O classification, which means I should apply the generic boilerplate response.


fact: Information Security Team

fact: Designated information security personnel from each segment perform assessments with internal business sponsors

reasoning: The paragraph's central topic is the documented process for overseeing cybersecurity risk from third-party service providers, including onboarding assessments and risk tolerance decisions — squarely Third-Party Risk. Specificity reaches Firm-Specific due to the named 'Information Security Team' and the segment-based organizational structure for personnel conducting assessments, which distinguish this company's approach. The vocabulary itself (risk assessment, onboarding, risk tolerance) is generic ERM language that doesn't pass the domain-expertise test.

thinking:
Classify this paragraph.

Category: This is about how third-party cyber risks are managed - vendor onboarding process, risk assessments of third-party service providers. Central topic is third-party risk management → Third-Party Risk.

Specific facts:
- "Information Security Team" - named team (firm-specific)
- "designated information security personnel from each segment" - firm-specific organizational detail
- The process describes cybersecurity risk assessments of third-party providers, but the vocabulary is fairly generic ERM language except for "cybersecurity risk assessment" and references to "systems, data and networks"

- "cybersecurity risk assessment" is standard ERM terminology with a domain swap, and "systems, data and networks" is somewhat domain-specific but still fairly generic
- "Information Security Team" is a named team with a security qualifier, making it firm-specific

Specificity: Firm-Specific (Level 3) due to the named "Information Security Team."


fact: 24/7 security operations center

fact: insider threat protection program

fact: operational technology

reasoning: The paragraph describes what the cybersecurity program does—incident response, SOC operations, insider threat protection, training—making it RMP. The '24/7 security operations center' is a firm-specific organizational claim per the rules, elevating to Level 3, alongside domain terms like insider threat program and operational technology.

thinking:
Let me analyze this paragraph.

Content: Describes security operations, incident response, SOC, insider threat program, training, awareness program. This is about what the cybersecurity program does → RMP.

Specific facts:
- "24/7 security operations center" - firm-specific (specific organizational claim)
- "incident response plans" - L1 (generic)
- "insider threat protection program" - domain term (insider threat is a specific security concept)
- "security operations center" - domain term (SOC)
- "real-time situational awareness across the cyber-threat environment" - domain-ish

- "operational technology" - domain term
- "cross-function information sharing" - generic
- "at least annually" - generic cadence

The 24/7 SOC is firm-specific per the rules. Insider threat protection program and operational technology are domain terms, while cross-functional information sharing and annual cadence are generic elements.


reasoning: The paragraph's central topic is managing cybersecurity risks from third-party service providers, including conducting assessments on vendors requesting access — this is oversight imposed ON vendors, making it TP per Rule 3. The language ('risk and compliance assessments,' 'third-party service providers,' 'information assets') is standard ERM vocabulary that any enterprise risk professional would use, with no domain-specific cybersecurity terms, firm-specific facts, or verifiable claims.

thinking:
Classify this paragraph.

Category: It's about third-party risk management. The central topic is how they manage risks from third-party service providers. → Third-Party Risk.

Wait - Rule 3: "Third parties hired to serve the company (assessors, pen testers) → RMP. Requirements imposed ON vendors → TP." This is about conducting assessments OF third-party service providers - requirements/oversight imposed on vendors. Central topic is third-party risk. → TP.

Specificity: "risk and compliance assessments" - this is generic ERM language. "third-party service providers that request access to our information assets" - "information assets" is somewhat domain-aware but an ERM professional could use this.

This reads like generic boilerplate with no specialized terminology, firm-specific details, or concrete claims that would distinguish it from standard enterprise risk management language.


fact: CISO (Chief Information Security Officer) reports to Audit Committee

fact: Gendered pronoun ('her') indicating a specific individual serving as CISO

fact: Reports cover notable threats impacting the aviation sector specifically

reasoning: The paragraph primarily answers how the board oversees cybersecurity, describing the Audit Committee's role in receiving reports from the CISO — classic Board Governance. The CISO title is firm-specific, and the gendered pronoun ('her') points to a specific individual, but no verifiable claims (names, certifications, dates) elevate it beyond Level 3.

thinking:
Classifying this paragraph from United Airlines' 10-K Item 1C.

Category: This describes how the Audit Committee oversees cybersecurity - board-level oversight, briefing content, reporting from CISO to the committee. This is Board Governance.

Specific facts:
- CISO (named role, firm-specific)
- "her" - gendered pronoun for CISO (suggests specific individual)
- Audit Committee oversight of cybersecurity (generic, every company has this)
- Third-party assessments mentioned but as part of what's reported to board
- Aviation sector mentioned (firm-specific context)

The CISO reference is firm-specific, while the aviation sector context adds other specificity, but there are no verifiable claims like names, dates, or certifications. This lands at Level 3.


fact: real-time security scoring of supplier technology services

fact: threat intelligence monitoring for third-party incidents

reasoning: The paragraph is centrally about how the company manages cybersecurity risk from suppliers—assessments, monitoring, contract provisions—making Third-Party Risk the clear category. Domain terms like 'real-time security scoring' and 'threat intelligence' pass the ERM test (non-security risk managers wouldn't naturally use these), elevating to Level 2, but no firm-specific facts push it higher.

thinking:
Classify this paragraph.

Content: About supply chain/vendor cybersecurity oversight - risk assessments of suppliers, monitoring suppliers with security scoring services, threat intelligence, contract provisions. This is centrally about third-party risk management.

Category: Third-Party Risk (vendor oversight is the central topic)

Specific facts:
- "real-time security scoring" - domain term
- "threat intelligence" - domain term
- "geopolitical risk intelligence" - not really cyber-specific
- "continuous threat intelligence monitoring" - domain term

Specificity: Domain-Adapted (Level 2) - uses security scoring, threat intelligence which pass the ERM test.


fact: Cybersecurity Committee of the Board

reasoning: This overview paragraph touches ERM integration, board oversight, and a cross-reference, but the backward-looking materiality assessment ('past cybersecurity incidents did not have a material impact on the Company, including our strategy, financial condition or results of operations') is a clear SI conclusion per Rule 5. The named 'Cybersecurity Committee' is a non-generic board committee that elevates specificity to Level 3.

thinking:
Let me analyze this paragraph.

Content category: This paragraph touches multiple topics - ERM integration, board oversight via Cybersecurity Committee, a materiality assessment, and a cross-reference. The materiality statement "past cybersecurity incidents did not have a material impact on the Company, including our strategy, financial condition or results of operations" is a backward-looking SI assessment per Rule 5. But there's also board governance content. Let me assess what dominates.

The paragraph has: (1) ERM integration statement, (2) framework mention, (3) Board/Cybersecurity Committee oversight, (4) materiality assessment (SI), (5) cross-reference to Risk Factors.

The materiality assessment is a clear SI trigger per Rule 5, and the explicit conclusion about whether cybersecurity has affected business outcomes makes this a strong SI indicator. But the paragraph also contains substantial governance content, so I'm weighing whether the materiality statement or the board oversight is the primary focus. Given the prominence and specificity of the materiality conclusion, I'm leaning toward SI, though this is genuinely a mixed paragraph that touches on both governance and incident assessment.

Now looking at the specificity markers: the "Cybersecurity Committee" is a named, non-generic committee that's firm-specific, while the enterprise risk management program reference is generic. The claim about past incidents not having material impact is a negative self-assertion that isn't independently verifiable. The cross-reference to Item 1A is also a factor here.

Given the "Cybersecurity Committee" designation, this lands at Level 3 for specificity. Though I'm reconsidering whether Board Governance might be the primary category since the committee oversight is the most concrete element—but the materiality statement about past incidents seems to be what the paragraph is ultimately driving toward, so I'll stick with SI as the primary category.


reasoning: The paragraph states a backward-looking conclusion that cybersecurity has not materially impaired business strategy, operations, or financial standing, which is a materiality assessment under Rule 5 → Strategy Integration. No domain terms, firm-specific facts, or verifiable claims are present; the negative self-assertion about absence of material incidents is not externally verifiable.

thinking:
Classify this paragraph.

"To date, the Company has not encountered cybersecurity challenges, risks, or breaches that have materially impaired its business strategy, operations, or its financial standing."

This is a backward-looking materiality assessment → Strategy Integration per Rule 5.

Specificity: This is a negative self-assertion about absence of material incidents. Not externally verifiable. No domain terms, no firm-specific facts. Level 1.


reasoning: The paragraph contains a backward-looking materiality assessment ('we have not...experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations'), which is an SI trigger per Rule 5. The remainder is speculative risk language and generic descriptions of the threat landscape. No domain-specific terms pass the ERM test (language like 'processes,' 'internal systems,' 'threat protection measures' is generic), no firm-specific facts, and no verifiable claims — the negative materiality assertion is a self-reported claim about absence, not externally verifiable.

thinking:
Let me analyze this paragraph.

Content: Commitment to governance, statement about no material incidents, speculation about future risks, general threat landscape discussion, mention of detecting/investigating attacks.

Category: The key statement is "we have not...experienced a cybersecurity threat or incident that resulted in a material adverse impact" - this is a materiality assessment (SI per Rule 5). The rest is speculation/boilerplate about risks. The materiality assessment is a clear SI trigger.

Specificity: "Have not experienced any material cybersecurity incidents" → SI per Rule 5, but for specificity, this is a negative self-assertion which is NOT externally verifiable.

Looking at the language more closely, there are no domain-specific terms beyond generic cybersecurity vocabulary like "cyberattack" and "threat protection measures." The references to "unauthorized attempts and attacks against our network" are boilerplate without any firm-specific details, practices, tools, or standards. This falls squarely into Level 1 - generic boilerplate.


reasoning: The paragraph is centrally about managing cybersecurity risks from third-party service providers — vendor assessments, due diligence, onboarding controls, and contractual security requirements — making Third-Party Risk the clear category. The language throughout (due diligence, risk assessments, security requirements and controls) passes the ERM test as generic process descriptions any risk professional could write, with no domain-specific terminology, firm-specific facts, or verifiable claims.

thinking:
Third-party risk management is the central topic here.

Specificity: Let me scan for facts. The paragraph describes vendor oversight processes in detail but uses mostly generic language. "preliminary assessment," "enhanced due diligence procedures," "security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile" — these are process descriptions but fairly generic. No named tools, no specific frameworks, no named roles, no quantities.

ERM test: "due diligence," "risk assessments," "onboarding" — an ERM professional would use all of this language.

The rest of the language follows the same pattern—terms like "security requirements and controls" and references to "security incidents that have impacted our third-party service providers" are all standard risk management vocabulary without concrete specifics. This is Level 1.


fact: Head of Cyber Security role provides reports to Audit Committee

fact: Quarterly reporting cadence to Audit Committee on cyber risk trends, technology security risks, projects, strategy, and threat landscape

reasoning: The paragraph's primary frame is the governance chain: Board delegates to Audit Committee, Head of Cyber Security reports to Audit Committee, Audit Committee reports back to Board — answering 'how does the board oversee cybersecurity?' Program activities (evaluation, incident tracking, third-party assessments) are mentioned but within the oversight reporting context. The 'Head of Cyber Security' is a firm-specific named role with a security qualifier, elevating specificity to Level 3.

thinking:
Let me analyze this paragraph.

Content: Describes board delegation to Audit Committee, Head of Cyber Security reporting quarterly, Audit Committee reporting to full Board, program evaluation, third-party risk assessments.

Category: The paragraph starts with board delegation and oversight structure (BG), then moves into program activities (RMP). The primary question answered is "How does the board oversee cybersecurity?" — the governance chain from Board → Audit Committee → Head of Cyber Security → reports back. But there's also substantial RMP content (periodic evaluation, third-party risk assessments). The governance framing is dominant — it's describing the oversight structure. BG.

Actually, looking more carefully at the breakdown: the governance chain runs through the first few sentences and again when the Audit Committee reports back, while the program evaluation and incident tracking sit in the middle. It's definitely mixed content, but the overarching frame is how information flows up to the board for oversight purposes. BG.

On specificity, the Head of Cyber Security is the only truly firm-specific element here — that's a named role with security authority. Everything else is generic: quarterly reporting cadences, standard Audit Committee structures, typical third-party assessments, and routine incident logging. So really just Level 3 for that one role.


fact: Cyberattack occurred in February 2023

fact: Resulted in temporary interruption of systems

fact: Resulted in disclosure of certain confidential information

fact: Resulted in litigation and governmental inquiries

reasoning: The paragraph describes a real cyberattack (February 2023) with its consequences (system interruption, data disclosure, litigation, governmental inquiries), making it Incident Disclosure. The specific date 'February 2023' is an externally verifiable fact tied to a real event, elevating to Level 4.

thinking: Incident disclosure with cross-reference.