content_category: Board Governance

category_confidence: high

specificity_confidence: high

reasoning: This paragraph describes committee oversight responsibilities ('Review information security examination reports' and 'Monitor and discuss emerging industry information security risk issues') that form part of a governance structure, fitting the Board Governance category. However, the content consists entirely of generic oversight language ('regulatory agencies', 'emerging industry information security risk issues') that any regulated company could use — no specific security tools, named frameworks, organizational roles, or other distinguishing details are present, resulting in Generic Boilerplate specificity.

provider: minimax

stage: benchmark


content_category: None/Other

reasoning: This paragraph is purely a cross-reference directing readers to Item 1A for cybersecurity risk discussion. It contains no substantive cybersecurity content—no governance structure, no management roles, no program activities, no incident details, and no materiality assessment. Specificity is Generic Boilerplate because the paragraph offers no facts whatsoever about the company's cybersecurity posture.


category_confidence: medium

reasoning: This paragraph sets generic risk context about why Equifax faces cybersecurity threats (data-rich target), but does not substantively answer any of the six disclosure questions — it describes neither what the company does, how it's organized, what happened, nor business impact. Specificity is Level 1 because the paragraph contains no domain-specific cybersecurity terminology (any ERM professional could write this about financial, operational, or compliance risk), no firm-specific facts (no named roles, committees, programs), and no verifiable claims (no numbers, specific dates, certifications).


reasoning: This paragraph describes the board's oversight structure and reporting chain for cybersecurity — governance chain content where the primary question answered is 'how does the board oversee cybersecurity?' — making Board Governance the correct category. The paragraph contains no specific cybersecurity domain terminology (ERM test: 'risk management' and 'mitigation efforts' are generic risk management vocabulary), no named individuals, no named non-generic committees (Audit Committee exists at every company), and no verifiable/quantified claims.


reasoning: This paragraph is a cross-reference directing readers to Item 1A Risk Factors for additional information. It contains no substantive cybersecurity disclosure, domain expertise language, firm-specific details, or verifiable claims — only a pointer to another section.


reasoning: This paragraph is purely a cross-reference directing readers to the MD&A section for cybersecurity information—it does not itself answer any of the six substantive questions about board governance, management roles, risk processes, third-party risk, incidents, or strategy. No specific facts, domain terminology, or verifiable claims are present; it's standard incorporation-by-reference language.


reasoning: This paragraph is a standard legal negative assertion stating no known material incidents as of a reporting date — it answers no substantive cybersecurity question and constitutes boilerplate. Per Rule 5 specificity guidance, negative assertions about incident absence ('we have not experienced...') are not independently verifiable since an external party cannot confirm the absence of something, and there are no domain terms, firm-specific facts, or verifiable claims present.


reasoning: This paragraph is a disclaimer and cross-reference that provides no substantive cybersecurity disclosure—it merely states Exxon Mobil believes its program is 'appropriate' and redirects readers to Item 1A Risk Factors. No specific facts, practices, roles, or verifiable claims are present, making it purely boilerplate.


content_category: Strategy Integration

reasoning: The paragraph primarily makes a negative assessment that cybersecurity has not materially affected business strategy, results of operations, or financial condition (Rule 5: 'Have not experienced any material cybersecurity incidents' → SI). The cross-reference to Item 1A is not substantive cybersecurity content. The specificity is Generic Boilerplate because the only 'fact' is a negative self-assertion about incident absence — per Rule 5, this is not independently verifiable, and no domain terms, firm-specific facts, or verifiable claims are present.


reasoning: This paragraph is purely a cross-reference directing readers to Item 1A for cybersecurity risk discussion. It does not address any of the six substantive cybersecurity disclosure questions and contains no specific facts, domain terminology, firm-specific details, or verifiable claims.


content_category: Management Role

reasoning: The paragraph describes which management roles are primarily responsible for assessing and managing cybersecurity risks, directly answering 'How is management organized to handle cybersecurity?' This is Management Role (MR) — it identifies organizational responsibility rather than describing governance oversight by the board. The specificity is Firm-Specific because CISO (Chief Information Security Officer) is a VP-level cybersecurity leadership role that distinguishes this company's management structure from generic peer companies.


reasoning: This paragraph provides background context about the company's technology dependency and data assets but does not describe any actual cybersecurity governance, program, process, or assessment. It answers no substantive question about how cybersecurity is overseen, organized, or managed. The paragraph is purely contextual—explaining why technology matters to the business rather than what the company does about it. No specific facts, domain terminology, or verifiable claims are present.


content_category: Third-Party Risk

reasoning: The paragraph's central topic is third-party vendor risk management, describing the commencement of a vendor third-party risk management program to identify and manage cybersecurity risks from service providers. However, it uses exclusively aspirational and generic language ('proactively taking steps,' 'commencement,' 'should better enable') with no domain-specific terminology, named practices, or verifiable claims. The paragraph describes a program being started rather than one that exists, containing no facts that would distinguish this company's approach from any other public company planning similar initiatives.


reasoning: The paragraph's central topic is clearly third-party cybersecurity oversight — describing a program for vetting vendors, conducting monitoring, and ensuring compliance with security standards — making it Third-Party Risk. However, it contains no domain-specific terminology (no named frameworks, specific assessment types, or security tool categories), no firm-specific details (no named programs, roles, or committee titles), and no verifiable facts (no specific dates, dollar amounts, named assessors, or quantified metrics). The language uses only generic descriptors like 'vetting,' 'regular monitoring,' and 'security standards' that any company could apply without demonstrating cybersecurity expertise.


reasoning: This paragraph is contextual background explaining why ADP's data-handling business makes it an attractive target for cyber threats. It does not describe any actual cybersecurity governance, processes, or measures — it merely states that threats exist and could affect the company. Per Rule 6, since no substantive cybersecurity measure, process, or assessment is described, the category is None/Other. The paragraph contains no domain terminology (no security tools, frameworks, or specific practices), no firm-specific facts (no named roles or committees), and no verifiable claims (no numbers, dates, or named entities), making it Generic Boilerplate.


content_category: Incident Disclosure

fact: March 2021 cybersecurity incident causing systems outage

fact: $2.4 million one-time incremental costs for consultants, experts, and data recovery, net of insurance recoveries, for the year ended December 31, 2021

fact: Engaged leading forensic IT firms and legal counsel

fact: Delays and disruptions to brewery operations, production, and shipments

fact: Production and shipment shift from Q1 2021 to remainder of fiscal year 2021

reasoning: This paragraph describes an actual cybersecurity incident from March 2021, including what happened, when it occurred, who was engaged to respond, and specific quantified impacts ($2.4 million in costs). The hard dollar amount ($2.4 million) tied to a specific reporting period (year ended December 31, 2021) makes this Quantified-Verifiable, as an external party could independently verify this figure against their financial statements and insurance filings.


fact: June 13, 2023 (specific date of incident)

fact: IT security incident impacting systems and global facilities

fact: Normal global business operations resumed over nine days

fact: Lost revenue of approximately $80 million to $85 million

fact: Operating earnings impact of $35 million to $40 million

reasoning: The paragraph describes a real cybersecurity incident (June 13, 2023 IT security event) with specific timeline, response actions, and quantified financial impacts ($80-85M lost revenue, $35-40M operating earnings loss) — all externally verifiable claims. Per Rule 4, when the incident frame is dominant (what happened, when, scope, response), category is ID. The specific hard numbers for dates and dollar amounts elevate this to Level 4 specificity.


content_category: Risk Management Process

fact: 24/7 security operations center

fact: real-time situational awareness

fact: insider threat protection program

fact: cross-function information sharing

fact: crisis management preparedness activities

fact: security awareness program for employees at least annually

reasoning: The paragraph describes operational cybersecurity program activities including incident response plans, a 24/7 security operations center, insider threat protection, and employee security awareness training—clearly fitting the Risk Management Process category. Specificity is Domain-Adapted (Level 2) because the terminology used (24/7 SOC, real-time situational awareness, insider threat protection program, cross-function information sharing) demonstrates cybersecurity domain expertise that a non-security ERM professional would not naturally use; these are specific security infrastructure and operational concepts distinct from generic risk management language.


fact: Vice-President of Information Technology (VPIT)

fact: Director - Information Security (DIS)

reasoning: The paragraph describes the board's cybersecurity oversight structure—specifically the Audit Committee's reporting to the full Board and the information flow from named cybersecurity leadership (VPIT and DIS) through presentations—making it a Board Governance disclosure. Specificity is Firm-Specific because both the VPIT and Director-Information Security are named role titles with cybersecurity/IT qualifiers that would help distinguish this company's governance structure from peers.


reasoning: This paragraph is a negative assertion stating no known cybersecurity incidents have materially affected or are reasonably likely to materially affect the Company—a materiality/business impact assessment (Rule 5, SI). The paragraph contains no specific facts: 'As of the date of this Form 10-K' is a reporting context anchor, and 'we are not aware of any cybersecurity incidents' is a negative self-assertion that cannot be externally verified (Rule 5 explicitly states such negative assertions do not qualify as QV). The cross-reference to Item 1A is not a cybersecurity fact.


reasoning: The paragraph answers 'how has cybersecurity affected our business?' via a negative assertion ('no cybersecurity incidents have had a material adverse effect') and speculation about insurance coverage—standard SI framing under Rule 5. However, it contains zero specific facts: no hard numbers, named third parties, specific dates, or firm-specific details; the negative incident claim is self-reported and unverifiable, and 'certain kinds of security incidents' is vague speculation rather than an actual assessment.


reasoning: This paragraph primarily describes the Trust's legal/operational nature (grantor trust, no operations, no customers, no data) rather than addressing any substantive cybersecurity question. The fragmented second sentence attempts to describe cybersecurity measures but provides no details about what those measures are, how they work, or any framework/process involved. Per the specificity rules, a paragraph must contain specific facts to escape Level 1 — generic references to 'cybersecurity threats' without any domain-specific terminology, process detail, or firm-specific claims do not elevate specificity.


reasoning: This paragraph is primarily a cross-reference to other Items (1A, 1B, 1C) with brief mention that senior management and the Emergency Incident Response Team periodically review and drill on 'the plan.' The disclosure is wholly generic—no specific cybersecurity practices, tools, or processes are described. There are no domain-specific terms (would apply equally to any emergency response program), no firm-specific organizational details, and no verifiable claims. The cross-reference framing and bare-bones description of a review/drill cadence (without specifics on frequency, scope, or participants) render this pure boilerplate.


reasoning: The paragraph describes how management stays informed about cybersecurity through various generic means (briefings, threat intelligence, alerts from security tools). This answers the MR question of how management is organized to handle cybersecurity information flow. All elements are generic boilerplate — 'internal security personnel,' 'external advisors,' 'security tools deployed in the IT environment' contain no identifiable names, specific tools, or quantifiable details that would distinguish this from any other public company's disclosure.


reasoning: The paragraph primarily makes a backward-looking negative assessment about whether cybersecurity risks have had a material adverse effect on the company (Rule 5), which is a business outcome question. The threat actor enumeration (criminal hackers, hacktivists, state-sponsored organizations, nation states, competitors) uses generic cybersecurity terminology any risk professional could write, and the generic process language ('monitor for, identify, investigate, respond to and remediate') contains no domain-specific tools, standards, or architectural concepts that would elevate specificity. The negative assertion about material incidents is a self-reported claim, not an externally verifiable fact.


fact: endpoint protection

fact: two-factor authentication (2FA)

fact: real-time threat monitoring

fact: migration of business-critical systems, including the Company's ERP system, to Tier-1 cloud service providers

reasoning: This paragraph describes the cybersecurity program's activities and practices (threat monitoring, endpoint protection, 2FA, cloud migration of ERP systems), which answers 'What does the cybersecurity program do?' — fitting Risk Management Process. The specificity is Domain-Adapted because the paragraph demonstrates cybersecurity expertise through specific technical terms (endpoint protection, 2FA, real-time threat monitoring, infrastructure simplification, Tier-1 cloud providers) that an ERM professional would not naturally use without cybersecurity domain knowledge. No firm-specific roles or verifiable claims are present.


fact: automated event-detection notifications or similar technologies

fact: security operations team

fact: incident response team investigates

fact: assesses the severity of the event and sensitivity of any compromised data

specificity_confidence: medium

reasoning: The paragraph describes the detection and analysis operational workflow within the cybersecurity program — how incidents are identified through monitoring technologies and what the response process involves (investigation, nature determination, severity assessment). This answers what the cybersecurity program does, making it RMP. The language demonstrates cybersecurity domain expertise beyond generic risk management — 'automated event-detection notifications,' 'security operations team,' and 'severity assessment' are terms a non-security ERM professional would not naturally use, passing the ERM test at Domain-Adapted level. No firm-specific identifiers (named roles, specific tool names, committee names) or externally verifiable facts are present.


fact: phishing tests

fact: detection, reporting, security and mitigation functions

fact: employee trainings on privacy, cybersecurity and information management policies

fact: company-wide awareness of cybersecurity risk through broad-based communications and educational initiatives

reasoning: The paragraph describes what the cybersecurity program does at the operational level — tools and processes for incident identification/containment/remediation, employee training, phishing tests, and awareness initiatives. After removing role-specific content (CSO, security team), the substantive activities remain, making this RMP. The paragraph uses cybersecurity domain terminology (phishing tests, detection/reporting/mitigation functions) that passes the ERM test — a generic ERM professional would not naturally use this language — earning Domain-Adapted specificity.


reasoning: The paragraph describes the components of the cybersecurity program (risk assessments, team responsibilities, external providers, training, incident response plan, third-party oversight), making Risk Management Process the appropriate category. For specificity, while cybersecurity terminology is present (security controls, incident response plan, cybersecurity standards), these are generic descriptors that any company could use — none demonstrate specialized domain expertise beyond what a general ERM professional would write. No named frameworks, specific tools, named roles, verifiable certifications, or other distinguishing facts are present, resulting in Generic Boilerplate.


fact: Enterprise Cybersecurity Management Review Group (Enterprise Cybersecurity MRG)

reasoning: The paragraph describes a management-level steering committee (Enterprise Cybersecurity MRG) — its structure, senior leader composition, regular meeting cadence with the CISO, and responsibilities for incident response. This directly answers 'How is management organized to handle cybersecurity?' The named committee with distinguishing internal terminology (Enterprise Cybersecurity MRG) and specific functions (oversight, strategic direction, incident response escalation) distinguishes this company from generic governance descriptions, supporting Level 3 Firm-Specific.


fact: "Written Information Security Program" (named internal program)

reasoning: The paragraph answers 'What does the cybersecurity program do?' by describing the program's approach, framework alignment, and six key operational areas, making it primarily a Risk Management Process disclosure. Specificity reaches Firm-Specific (Level 3) primarily due to the named internal program ('Written Information Security Program'), which is a firm-specific identifier distinguishing this company's cybersecurity documentation. Multiple Level 2 domain terms (defense-in-depth, NIST CSF, vulnerability scanning, penetration testing, MFA, threat management) are present, but the named program designation elevates the paragraph to Level 3 overall.


reasoning: The paragraph primarily asserts a backward-looking conclusion about no material cybersecurity incidents during the reporting period, which maps to SI per Rule 5 (negative assertion). The 'Governance' label appears to be a section header marker, and the cross-reference to Item 1A does not itself contain substantive disclosure. No domain expertise, firm-specific details, or verifiable claims are present.


reasoning: The paragraph is a negative self-assertion (no incidents have materially impaired the business) which under Rule 5 falls to N/O since negative incident assertions are explicitly excluded from SI and no substantive cybersecurity measure, process, or assessment is described. No domain terms, firm-specific facts, or verifiable claims are present, making this Level 1 generic boilerplate.


fact: phishing attempts, ransomware and other forms of malware, computer viruses, email attachments, extortion, and other scams

reasoning: The paragraph primarily answers whether cybersecurity has affected business outcomes through its negative assertion ('not aware of any material cybersecurity incidents') and forward-looking risk acknowledgment, which maps to Strategy Integration. Specificity is Domain-Adapted: the threat taxonomy (phishing, ransomware, malware, computer viruses, email attachments, extortion, scams) demonstrates cybersecurity domain expertise that a generic ERM professional would not use, even though the paragraph contains no firm-specific or externally verifiable facts.


fact: isolated computer workstations

fact: passwords, passphrases, and two-factor or independent authorizations

reasoning: The paragraph describes the Trust's cybersecurity measures—isolated workstations, password/passphrase requirements, and two-factor/independent authorizations—which are activities the program performs. Specificity is Domain-Adapted because phrases like 'isolated computer workstations' and 'two-factor or independent authorizations' demonstrate cybersecurity domain expertise (ERM professionals would not naturally use this security-specific vocabulary about non-cyber risks), even though the overall paragraph is thin and somewhat garbled. No firm-specific roles, named programs, or verifiable claims are present.


reasoning: The paragraph describes a third-party service provider cybersecurity risk assessment process, clearly placing it in the Third-Party Risk category — the onboarding risk assessment requirement and risk tolerance monitoring are classic TP content. However, the paragraph contains no specific domain terminology (no reference to SOC 2, pen testing, encryption standards), no named individuals or committees, no hard numbers, and no verifiable claims; it describes only that a 'documented process' exists and that 'designated personnel' perform assessments — generic organizational language that any company could use, failing both the ERM test (cybersecurity-swappable with financial risk) and the specificity thresholds.


reasoning: This paragraph states the importance of cybersecurity governance in general terms but does not describe any actual governance mechanisms, board oversight specifics, management structure, or program activities. It is a philosophical/importance statement about governance rather than substantive disclosure about how HE actually manages cybersecurity. Contains no firm-specific facts, domain terminology, or verifiable claims.


reasoning: The paragraph's central topic is third-party cybersecurity risk management, describing preliminary assessments, enhanced due diligence procedures, and security requirements imposed on vendors — all characteristic of TP category. However, the paragraph describes generic processes ('preliminary assessment,' 'enhanced due diligence procedures,' 'security risk assessments') without any domain-specific security terminology, named frameworks, specific tools, firm-specific roles, verifiable claims, or distinguishing details. The language would apply equally to any company's third-party risk management program, yielding Generic Boilerplate specificity.


reasoning: This paragraph is a general statement of commitment to protecting IT and data assets but does not describe any specific oversight structure (BG), organizational roles (MR), security processes or tools (RMP), vendor management (TP), actual incidents (ID), or business/financial impact (SI). It contains only generic protective language without describing how the company actually manages cybersecurity. No domain-specific security terminology, firm-specific facts, or verifiable claims are present.


fact: Vendor Management department

reasoning: The paragraph's primary focus is describing the Vendor Management department's role in vetting third-party cybersecurity risks, making Third-Party Risk the appropriate category. Specificity is Firm-Specific because the only qualifying fact is 'Vendor Management department' — a named internal function that is company-specific rather than universally applicable.


reasoning: The paragraph's dominant frame is about potential business/financial consequences of cybersecurity incidents ('could have a material adverse effect on our business, liquidity, financial condition'), making Strategy Integration the appropriate category. However, the paragraph contains no domain-specific expertise beyond generic terms, no firm-specific facts (no named roles, no specific tools/frameworks), and the negative assertion about not experiencing material incidents is a self-reported claim that cannot be independently verified. All content is standard boilerplate applicable to any public company.


reasoning: This paragraph's primary purpose is to state an assessment about whether cybersecurity has or could affect business outcomes — a backward-looking negative assertion ('has not been materially affected') combined with forward-looking risk acknowledgment. Per Rule 5, this is a Strategy Integration assessment. The paragraph contains no specific cybersecurity facts: the 'to date' negative assertion is a self-reported claim about absence (not externally verifiable per specificity guidelines), and the rest are cross-references to Item 1A Risk Factors.


fact: Enterprise Cybersecurity team holds CISSP certification

fact: Enterprise Cybersecurity team holds GICSP certification

fact: Team uses Electricity Information Sharing and Analysis Center (E-ISAC) threat intelligence

fact: Team uses Cybersecurity and Infrastructure Security Agency (CISA) threat intelligence

fact: Team performs network monitoring

fact: Team performs vulnerability scanning

reasoning: The paragraph primarily describes what the cybersecurity program does—its threat intelligence sources (E-ISAC, CISA) and operational activities (network monitoring, vulnerability scanning)—placing it squarely in RMP rather than MR, which focuses on organizational structure and reporting lines. Specificity reaches Level 4 because the named certifications (CISSP, GICSP) are independently verifiable via (ISC)² and GIAC registries, and the specific threat intelligence organizations (E-ISAC, CISA) provide externally verifiable references beyond generic threat-sharing language.


reasoning: This paragraph answers the question 'Could cybersecurity affect the business?' through a backward-looking materiality assessment ('prior cybersecurity threats have not materially affected...') and forward-looking speculation ('we could be negatively impacted'), making it Strategy Integration per Rule 5. It contains no specific facts—no named leaders, no domain-specific tools or practices, no quantified claims, no verifiable external assertions. The language is purely generic boilerplate that any SEC filer could use.


fact: threat detection rates and response times (domain-specific metrics)

fact: External penetration tests (cybersecurity domain practice)

fact: process audits (security-relevant process review)

reasoning: The paragraph describes how the Audit Committee oversees cybersecurity risk management, with the Director of IT preparing dashboards and providing annual briefings to the committee — this is a governance-chain paragraph primarily answering how the board oversees cybersecurity (→ Board Governance). Specificity is Domain-Adapted because the writer demonstrates cybersecurity domain expertise through specific practices like threat detection rates, response time metrics, and external penetration tests — concepts a non-security ERM professional would not naturally reference.


fact: Enterprise & Technology Security (E&TS) organization

fact: Chief Information Security Officer (CISO)

fact: CISO manages the CSIRT

fact: CISO manages the Product Security Incident Response Team (PSIRT)

fact: Business Information Security Officers (BISO)

fact: E&TS addresses cybersecurity risks associated with third party suppliers

reasoning: The paragraph describes IBM's cybersecurity organizational structure and management hierarchy—E&TS organization, CISO role with specific teams (CSIRT, PSIRT), and BISO roles coordinating with the CISO—making it primarily about how management is organized to handle cybersecurity (Management Role). The presence of named internal organizations (E&TS, CSIRT, PSIRT), specific leadership roles (CISO, BISO), and explicit reporting relationships distinguishes this from generic program descriptions, yielding Firm-Specific specificity.


reasoning: This paragraph is primarily a forward-looking disclaimer with generic cybersecurity language. While it mentions implementing 'mechanisms, controls, technologies, and processes,' these are never specified. The SI element ('could result in us incurring significant costs') is purely hypothetical, not a stated conclusion about actual business impact. The negative assertion about no material incidents is a self-reported claim about absence, not an assessment of cybersecurity's effect on business. The vague mention that 'we have experienced the same in our own business' regarding threat increases lacks any quantifiable or specific detail. No domain expertise, firm-specific facts, or verifiable claims are present — the language is interchangeable with any generic 10-K cybersecurity risk factor disclosure.


reasoning: The paragraph's central topic is vendor cybersecurity oversight (risk and compliance assessments of third-party service providers), making Third-Party Risk the correct category. It lacks firm-specific facts (no named programs, committees, or roles) and verifiable claims (no named assessors, certifications, or specific metrics), but demonstrates cybersecurity domain knowledge about extending risk management to third parties.


fact: real-time security scoring of supplier technology services

fact: threat intelligence

fact: financial intelligence

fact: geopolitical risk intelligence

fact: continuous threat intelligence monitoring for third-party cybersecurity incidents

reasoning: The paragraph's central topic is vendor/supplier cybersecurity oversight—monitoring suppliers, assessing their risk posture, and negotiating cybersecurity contract provisions—which maps directly to the Third-Party Risk category. The specificity is Domain-Adapted because the paragraph demonstrates cybersecurity domain expertise beyond generic risk language: it references specific practices like 'real-time security scoring' of suppliers and named intelligence categories (threat, financial, geopolitical) that an ERM professional would not naturally use without cybersecurity context. No firm-specific facts (named committees, named leadership roles, specific headcount) or externally verifiable claims (named assessors, specific dates, certifications) are present.


fact: May 2022 ransomware attack

fact: Network disruption impacting certain systems

fact: Engaged third-party forensic experts

fact: Notified law enforcement

fact: Did not pay ransomware

fact: Added multi-factor authentication post-incident

reasoning: This paragraph is Incident Disclosure (ID) because it describes a real cybersecurity event—specifically a May 2022 ransomware attack—with specifics on nature, detection, response, and impact. Specificity is Level 4 (Quantified-Verifiable) primarily because the paragraph contains a specific date ('May 2022') and incident-specific details (network disruption, ransomware type, third-party forensic experts, law enforcement notification, no ransom paid) that an external party could independently verify through sources such as law enforcement records, threat intelligence reports, or other contemporaneous disclosures.


reasoning: The paragraph's primary function is a backward-looking materiality assessment—stating that past cybersecurity incidents did not materially affect strategy, financial condition, or results of operations—which directly answers 'how does cybersecurity affect business outcomes?' per Rule 5. The Board/Cybersecurity Committee language is present but brief and generic, while the 'framework of principles, policies and technology' is boilerplate without domain-specific detail. No firm-specific facts, verifiable claims, or domain-expert terminology are present.


reasoning: This paragraph answers the question 'Has/did cybersecurity affect business outcomes?' with a forward-looking assessment about whether threats are reasonably likely to materially affect strategy, operations, or financial condition—this is a Strategy Integration disclosure under Rule 5. The paragraph contains no specific facts: the negative assertion of no material incidents is a self-reported claim not independently verifiable, and the generic references to 'updating its information security plan' and 'making investments' contain no domain-specific terminology, firm-specific details, or quantifiable claims.


fact: CIO (leader of DTI organization)

fact: CISO (leader of CDT function)

fact: CDT team (internal cybersecurity monitoring/detection team)

fact: Incident Response team (includes CISO and senior CDT members)

reasoning: This paragraph describes the management-level cybersecurity organizational structure: the roles of CIO and CISO, the CDT team's responsibilities, and the Incident Response team's composition and function. It is about management organization (roles, responsibilities, reporting lines), not board-level oversight. The specificity is Firm-Specific because it identifies named leadership roles (CIO, CISO) and distinct internal teams (CDT function, Incident Response team) that would distinguish this company's cybersecurity governance structure from any other. No hard verifiable facts are present—no specific headcount, named individuals outside their titles, dates, certifications, or tools—so it does not reach Level 4.


reasoning: This paragraph makes a backward-looking negative assertion that cybersecurity incidents have not materially affected the company's business strategy, results of operations, or financial condition, which directly answers the Strategy Integration question per Rule 5. It contains no domain terminology, firm-specific facts, or verifiable claims — it is purely a standard boilerplate disclaimer that appears in virtually every SEC cybersecurity disclosure.


fact: Security and Technology Risk Leadership Committee (named internal committee)

fact: Privacy and Data Governance Committee (named internal committee)

fact: Data Security and Privacy Governance Committee (named internal committee)

fact: CISO chairs the Security and Technology Risk Leadership Committee

fact: Chief Privacy Officer chairs the Privacy and Data Governance Committee

fact: Committees composed of cross-functional representatives from approximately 20 departments

fact: Committees meet monthly or every other month

reasoning: The paragraph describes management-level committee structure (chairs, membership composition, reporting relationships) rather than board-level governance or specific cybersecurity activities, making Management Role the correct category per Rule 1. The specificity is elevated to Firm-Specific by multiple named internal committees (Security and Technology Risk Leadership Committee, Privacy and Data Governance Committee, Data Security and Privacy Governance Committee), named officer roles (CISO, Chief Privacy Officer), and the specific claim of cross-functional representation from approximately 20 departments — all of which would distinguish this company's cybersecurity governance structure from any other public company.


reasoning: The paragraph primarily consists of a cross-reference to Item 1A and a negative self-assertion ('have not experienced any material cybersecurity incidents') which Rule 5 explicitly maps to Strategy Integration as a backward-looking assessment. However, the negative assertion is not independently verifiable by an external party (you cannot confirm the absence of incidents), and 'three fiscal years' is a soft timeframe without specific dates — neither constitutes a qualifying fact above Level 1. The paragraph contains no domain expertise language, no firm-specific verifiable facts, and no quantified claims, making it Generic Boilerplate.


reasoning: The paragraph explicitly states assessments about cybersecurity's impact on business outcomes—past material effects on results of operations and financial condition, and forward-looking claims that risks are reasonably likely to materially affect business strategy—making it Strategy Integration per Rule 5. However, it contains no specific facts: the 'Previously Disclosed Cyber Incident' is merely referenced without description, and the materiality assertions are conclusory statements rather than verifiable claims about specific financial impacts, named individuals, or quantifiable details.


reasoning: The paragraph describes the general structure and function of AT&T's cybersecurity program — it encompasses policies, procedures, processes for assessing/managing cybersecurity risks, third-party vendor risk, and incident response. This directly answers 'What does the cybersecurity program do?' → RMP. The paragraph uses only generic cybersecurity language that any company could state (e.g., 'reasonably designed to protect information,' 'identify and respond to security incidents'). No domain-specific security terminology (no tools, frameworks, specific practices), no named leadership individuals, no verifiable claims, no firm-specific organizational details. Generic boilerplate.


fact: February 2023: specific month/year of cyberattack tied to a real event

fact: Temporary interruption of systems occurred

fact: Disclosure of certain confidential information occurred

fact: Litigation and governmental inquiries resulted from the incident

reasoning: The paragraph describes an actual cybersecurity incident (February 2023 cyberattack) with specific consequences: system interruption, confidential information disclosure, litigation, and governmental inquiries. This is clearly Incident Disclosure as it answers 'what happened' with respect to a real event. The February 2023 date is a specific verifiable anchor point for the incident, making this Quantified-Verifiable (Level 4) — unlike negative assertions about absence of incidents, this is a positive assertion about an event that occurred and can be confirmed.


reasoning: This paragraph is a high-level preamble acknowledging cybersecurity importance and asserting that policies exist, but it describes no specific oversight structure, management roles, program activities, or business assessments. The language is fully generic (swap 'cybersecurity' for any other risk domain and it still works), containing no domain-specific terminology, firm-specific facts, or verifiable claims—making it None/Other at Generic Boilerplate.


reasoning: The paragraph's central topic is third-party service provider oversight — describing vendor risk assessments, reassessment processes, and contractual security requirements — making Third-Party Risk the correct category. The specificity level is Generic Boilerplate because all content uses generic descriptors: 'supplier risk management program' (unnamed), 'risk-based approach' (non-specific), 'Cybersecurity team' (unnamed role), and 'formal risk assessments' (no named framework). No named programs, specific tool names, named committees, individual titles above VP level, or quantified metrics are present — just domain-appropriate terminology that any company with a third-party risk program could use.


fact: 2023 incident at a third-party vendor

fact: Vendor used software called MOVEit Transfer

fact: Zero-day vulnerability in the vendor's file sharing software

reasoning: Despite concluding with a materiality statement, the paragraph primarily describes actual cybersecurity incidents (unauthorized access, customer fraud, MOVEit Transfer vendor breach) with specific verifiable details, making it Incident Disclosure per Rule 4. The named software (MOVEit Transfer), specific year (2023), and named vulnerability type (zero-day) provide externally verifiable facts, elevating specificity to Level 4.


reasoning: This paragraph is primarily generic risk-disclosure boilerplate stating that cybersecurity risks exist and could materially affect the business—language that appears in virtually every 10-K. While it mentions that the company 'established a robust cybersecurity risk management program,' it does not substantively describe what the program actually does, how it operates, or what specific processes it includes. Per Rule 6 (N/O threshold), this lacks any actual cybersecurity measure, process, or assessment to warrant a substantive category.


reasoning: The paragraph primarily answers whether cybersecurity incidents have affected the company's business outcomes — both backward-looking ('have not been materially adversely affected') and forward-looking ('reasonably likely to materially affect') assessments, which map directly to Strategy Integration per Rule 5. No specific facts are present: the paragraph contains only self-reported negative assertions and forward-looking speculation with a cross-reference to Item 1A, making it Generic Boilerplate.


reasoning: While this paragraph contains a negative assertion about material incidents (which Rule 5 flags as SI-related), the dominant content is forward-looking commitment language ('committed to cultivating a culture of security, remaining vigilant and continually improving') rather than a substantive assessment of how cybersecurity affects business outcomes. The paragraph contains no specific facts, domain-specific terminology (fails ERM test), or verifiable claims.


fact: Chief Information Security Officer ("CISO")

reasoning: This paragraph describes the board's oversight structure for cybersecurity: the Risk Committee's role in overseeing the ERM program, the reporting chain from the CISO to the Risk Committee to the Board, and the frequency of board-level reporting (at least annually). These are all hallmarks of Board Governance content. The specificity reaches Level 3 because the mention of the CISO as a named leadership role (a VP-level title with a security qualifier) is a firm-specific fact that would help identify this company if the name were removed.


fact: Due diligence analysis includes review of vendors' cybersecurity practices

fact: Due diligence analysis includes review of vendors' data and privacy protection practices

fact: Due diligence analysis includes review of vendors' business continuity practices

fact: Annual due diligence follow-up reviews are performed for existing vendors

reasoning: The paragraph is clearly about third-party vendor risk management — describing due diligence processes conducted ON vendors (cybersecurity, data/privacy, business continuity review) and annual follow-up oversight. This fits Rule 3 (requirements imposed on vendors → TP). Specificity is Domain-Adapted because the paragraph demonstrates cybersecurity domain expertise by naming specific due diligence components (cybersecurity practices, data and privacy protection, business continuity) that a non-security ERM professional would not naturally reference — the ERM professional would say 'risk review' without these security-specific sub-categories. The presence of these domain-specific review categories elevates this beyond generic boilerplate risk language.


fact: Eversource's Cyber Security Group conducts formal vendor screening as part of Procurement

fact: Company bars sourcing from countries on DHS's Prohibited Nations list

fact: Periodic rescreening is performed on critical vendors

reasoning: The paragraph's central question is how third-party vendor cyber risks are managed, with vendor screening, risk ranking, rescreening, and country-based sourcing restrictions forming the dominant content. Specificity is Firm-Specific (Level 3) due to the named Cyber Security Group, explicit reference to DHS Prohibited Nations sourcing policy, and periodic rescreening of critical vendors — all firm-specific operational practices rather than generic industry boilerplate.


fact: defense in depth strategy

fact: data loss prevention technology

fact: advanced transport layer security encryption

fact: phishing, malware and social engineering testing

reasoning: The paragraph describes concrete cybersecurity program activities and tools (defense in depth, DLP, TLS encryption, security awareness training with specific threat types) — answering 'what does the cybersecurity program do?' This is RMP. The use of domain-specific terminology (defense in depth, data loss prevention, TLS, phishing/malware/social engineering testing) demonstrates cybersecurity expertise beyond generic ERM language, supporting Level 2. No firm-specific roles, named committees, or externally verifiable claims are present.


reasoning: The majority of the paragraph describes the cybersecurity risk management system broadly (safeguards, programs, policies, procedures for protection and incident response), making Risk Management Process the primary category. The final sentence is a negative SI assertion but is relatively brief compared to the RMP content. For specificity: despite referencing cybersecurity terminology like 'information assets' and 'supporting infrastructures,' all language is generic boilerplate that any financial institution could use—'proactive and defensive safeguards,' 'information assets,' 'supporting infrastructures,' 'technology-related attacks' fail the ERM test as they contain no domain-specific security concepts, tools, architectural terms, or named frameworks. The 'December 31, 2024' date is a reporting period anchor, not a cybersecurity-specific fact. This paragraph contains no facts at any level.


reasoning: This paragraph functions as introductory risk-framing language (explaining why cybersecurity matters to operations) rather than describing actual cybersecurity processes, governance, or assessments. It poses hypothetical consequences ('could disrupt', 'could result in', 'could damage') rather than describing what the company actually does. No substantive question from the six categories is answered. No domain-specific terminology, firm-specific claims, or externally verifiable facts are present—only generic risk speculation applicable to any financial services company.


fact: cyber assessments on potential vendors (vs. generic security reviews)

fact: contractual requirements for vendors to manage cybersecurity risks

fact: vendor notification obligations for cybersecurity incidents

reasoning: The paragraph centers on third-party vendor risk management—conducting cyber assessments on vendors with IT access, contractual cybersecurity requirements, and breach notification obligations. These are third-party oversight mechanisms imposed on vendors, making TP the correct category. The specificity is Domain-Adapted: the use of 'cyber assessments' and 'cybersecurity risks' in the vendor context demonstrates the writer understands specific vendor oversight practices distinct from generic enterprise risk management language, passing the ERM test even though no firm-unique or quantifiable facts are present.


fact: defense-in-depth and layered strategy

fact: endpoint detection and response

fact: network anomaly detection

fact: multi-factor authentication across most of our environment

fact: threat intelligence services

fact: phishing simulation exercises

reasoning: The paragraph describes what the cybersecurity program does—its tools (EDR, network anomaly detection, MFA), methodologies (defense-in-depth, layered strategy), and activities (threat intelligence, phishing simulations, employee training)—making RMP the primary category. The specificity is Domain-Adapted because the paragraph uses cybersecurity-specific terminology (EDR, network anomaly detection, defense-in-depth, threat intelligence, phishing simulations) that a non-security ERM professional would not naturally use, demonstrating genuine cybersecurity domain expertise rather than generic risk management language.


fact: February 22, 2024 — date of disclosed cybersecurity incident

reasoning: The paragraph discloses an actual cybersecurity incident (February 22, 2024) involving cybercrime threat actors and describes the ongoing investigation, making 'What happened?' the primary question answered — this fits the Incident Disclosure category. The date is a specific, externally verifiable fact tied to a real event, setting specificity at Level 4.


fact: April 2022 occurrence date

fact: cybersecurity incident disrupted a subset of hospital operations

fact: exfiltration of confidential company and patient information

reasoning: This paragraph describes an actual cybersecurity incident that occurred in April 2022 with specific details about timing, nature (operational disruption, data exfiltration), and business impact (remediation costs, lost revenues), making it an Incident Disclosure paragraph per Rule 4. The April 2022 date is an externally verifiable timestamp of a real event, elevating specificity to Level 4.


reasoning: The paragraph's primary function is a backward-looking materiality assessment — stating that no cybersecurity breaches materially affected the company's business strategy, results of operations, or financial condition in 2023 — which qualifies as Strategy Integration per Rule 5. The second sentence is a cross-reference (N/O). The core content is a negative self-assertion about absence of material incidents, which is not independently verifiable; without an externally confirmable fact, specificity is Level 1 (Generic Boilerplate).


fact: CISO has 30 years of information technology experience

fact: CISO has 17 years focused specifically on information security and risk management

reasoning: The paragraph describes the CISO's role and personal qualifications/career history, which maps to Management Role (leadership roles, qualifications, and career history). Both '30 years' and '17 years' are hard numbers—specific quantities that an external party could verify through background checks or public records, making this Quantified-Verifiable Level 4.


reasoning: This paragraph is a cross-reference directing readers to Item 7's Risk Management section. It contains no substantive cybersecurity disclosure—no measures, processes, assessments, or governance details are described. Per Rule 6, it is N/O. With no specific facts present, specificity is Generic Boilerplate.


reasoning: The paragraph describes contractual security requirements imposed on third-party suppliers and vendors (TP per Rule 3). However, all language is generic boilerplate—'appropriate security controls' is a vague standard any company could use and fails the ERM test (an ERM professional could write this verbatim). No domain terminology (no specific evidence standards like SOC 2, no specific tools, no named frameworks), no firm-specific facts, and no verifiable claims.


fact: Chief Information Officer (CIO) is a member of the Company's Executive Committee

fact: Chief Information Security Officer (CISO) is responsible for assessing and managing cybersecurity risks

reasoning: The paragraph is primarily about management organization — it identifies the CIO and CISO and describes their cybersecurity responsibilities. The specificity level is Firm-Specific because the CIO's membership on the Executive Committee is a firm-specific organizational detail that distinguishes JNJ's structure. However, this paragraph lacks externally verifiable claims (no certifications, dates, dollar amounts, or named third parties), so it does not reach Level 4.


fact: SOC 1 audit

reasoning: The paragraph is centrally about managing third-party service provider cybersecurity risks through SOC 1 audit requirements, alternative waiver measures, and review processes—this is textbook Third-Party Risk. The mention of SOC 1 (a specific audit standard for evaluating service organization controls) demonstrates cybersecurity domain expertise beyond generic ERM language, supporting Domain-Adapted specificity. There are no firm-specific roles, named vendors, or externally verifiable claims.


reasoning: The paragraph describes board-level oversight structure (Audit Committee reviewing CISO reports) — clearly Board Governance. However, it contains no specific facts that distinguish United's cybersecurity posture: 'Audit Committee' is a generic governance role at every public company, 'CISO' is a standard role title, and all substantive content ('reports regarding identification and management of cybersecurity risks,' 'third-party assessments,' 'key metrics') is generic oversight language any SEC registrant could use. No named assessors, no specific dates, no quantified metrics, no firm-unique identifiers.


reasoning: The paragraph describes the board's oversight role and the information flow from the CIO to various executives and the Audit Committee—fundamentally about board governance structure. For specificity: all named roles (Board of Directors, Audit Committee, CIO, General Counsel, CFO, CEO) are generic titles that exist at every public company; there are no specific cybersecurity practices, no named non-generic committees, no hard numbers, and no externally verifiable claims. The language about cybersecurity oversight could appear in virtually any public company's 10-K without modification.


reasoning: The paragraph's central topic is third-party cybersecurity risk management—specifically how the company evaluates and mitigates risks associated with third-party service providers through pre-engagement and periodic assessments. Per Rule 3, this fits TP because it describes requirements and processes imposed on vendors. However, no firm-specific identifiers (named programs, specific committee titles), domain expertise beyond generic ERM language, or externally verifiable claims are present; 'strategic risk management committees' and 'periodic risk assessments' are descriptive but not specific enough to elevate beyond Level 1.


fact: Vice President of Information Technology, Security and Business Intelligence (specific VP-level role with security qualifier)

fact: over 18 years of experience in information technology and information security

fact: Named prior employers: Biogen, AstraZeneca, Iron Mountain, Charles River Labs, Sunovion Pharmaceuticals, Agero, DentaQuest

fact: Master's degree in business administration from Boston University

fact: Master's degree in electrical and computer engineering from Utah State University

fact: Bachelor's degree in electronics engineering from Mumbai University

fact: IT team has over 10 years of experience managing cybersecurity risks

reasoning: This paragraph is about Management Role because it centers on the VP responsible for cybersecurity oversight, their reporting relationships with senior leadership (CEO, CFO, General Counsel), and their professional qualifications. Specificity reaches Level 4 because multiple verifiable claims exist: specific tenure figures ('over 18 years,' 'over 10 years' — both lower-bound verifiable quantities), named prior employers across multiple companies, and named degree-granting institutions (Boston University, Utah State University, Mumbai University) — all externally confirmable against resumes and public records.


fact: Director of Cybersecurity position

fact: Chief Information Officer (CIO) position

fact: CIO reports directly to CEO

fact: Both CIO and Director of Cybersecurity have over 20 years of cybersecurity oversight experience

fact: CIO previously served as CIO for a New York Stock Exchange listed manufacturing company

fact: Director of Cybersecurity has experience developing and implementing cybersecurity programs for multiple manufacturing firms

reasoning: This paragraph describes management positions responsible for cybersecurity, their reporting lines, and qualifications—core Management Role content. The "over 20 years of cybersecurity oversight experience" claim is a specific quantity with a verifiable lower bound, and the CIO's prior role at an NYSE-listed manufacturing company is externally verifiable, making this Level 4 even though the primary focus is describing role qualifications.


fact: CISO provides a cybersecurity dashboard reviewed at every regularly scheduled Board meeting

fact: Dashboard includes key performance indicators for cybersecurity process maturity, operational performance, and enterprise performance toward Transportation Security Administration (TSA) compliance

fact: CIO and/or CISO presents to the Board bi-annually regarding cybersecurity risks and strategies, including as part of the Board's annual long-term strategy session

fact: Audit Committee reviews implementation and effectiveness of cybersecurity risk management protocols and cybersecurity as part of Company's accounting and internal control policies

fact: CIO presents to the Audit Committee bi-annually, as well as periodically in conjunction with internal audits related to cybersecurity

fact: Management has protocols for escalating cybersecurity incidents meeting established reporting thresholds to the Board with ongoing updates until addressed

reasoning: This paragraph describes the Board's oversight structure for cybersecurity, including the CISO dashboard reporting to the Board at every meeting, bi-annual CIO/CISO presentations, Audit Committee review responsibilities, and incident escalation protocols — all governance-chain content that directly answers 'how does the board oversee cybersecurity?' The specificity level is Firm-Specific because the paragraph describes the company's unique governance structure with company-specific cadences (every Board meeting, bi-annual presentations, annual long-term strategy session) and the specific TSA compliance framework applicable to Williams Companies as a pipeline operator, which distinguishes this disclosure from generic board governance language.


reasoning: The paragraph's central topic is third-party vendor cybersecurity oversight, directly answering how the company manages vendor cyber risks (selection criteria, contract requirements, reviewing practices). The specificity is Generic Boilerplate because the paragraph contains no domain-specific security terminology, no named frameworks or standards, and no firm-specific details—only generic language that any company's vendor risk management section could contain.


reasoning: The paragraph contains the forward-looking materiality assessment language ('are reasonably likely to materially affect our business strategy, results of operations, or financial condition') which aligns with SI under Rule 5. However, the specificity is Generic Boilerplate because the paragraph uses only generic cybersecurity terminology (cybersecurity threats, cybersecurity incidents, cybersecurity risks) that any non-security professional could write, with no domain-specific security concepts, firm-specific details, or externally verifiable claims.


fact: administrative, physical, and technical safeguards (domain terminology — the standard information security safeguards taxonomy)

reasoning: The paragraph centralizes third-party vendor cybersecurity oversight through contractual requirements (data security addenda, mandatory incident reporting, cybersecurity insurance mandates) — squarely TP. Specificity is Domain-Adapted: while the content describes substantive cybersecurity oversight practices, the language and requirements are generic vendor management practices without any firm-specific distinguishing details.


fact: VF's CISO has over thirty years of experience as a cybersecurity professional, including experience as the CISO of two large retailers

fact: CISO reports to VF's CSBDO

fact: CSBDO has nearly twenty years of experience enabling digital transformation for global companies

fact: VF associates who have access to confidential information receive training at least annually

reasoning: The paragraph's primary function is describing the organizational structure of cybersecurity management — the CISO and CSBDO roles, their qualifications and experience, and the reporting relationship — which makes Management Role the dominant category. The CISO's "over thirty years of experience as a cybersecurity professional" and the CSBDO's "nearly twenty years of experience enabling digital transformation" are externally verifiable biographical claims that establish Level 4 specificity, along with the specific "at least annually" cadence for associate training.


fact: network and perimeter defense

fact: infrastructure security

fact: cloud security

fact: endpoint protection

fact: data protection

fact: identity management

fact: network segmentation

fact: periodic cybersecurity assessments

fact: integration of cybersecurity threat intelligence

reasoning: The paragraph describes what the cybersecurity program does — its tools, safeguards, and activities — making it a Risk Management Process disclosure. The paragraph passes the ERM test: terms like 'network segmentation,' 'endpoint protection,' 'threat intelligence,' and 'perimeter defense' are cybersecurity domain concepts that a general enterprise risk management professional would not naturally use. No firm-specific claims (no named roles, committees, or organizational structure) and no verifiable external claims are present, so specificity remains Domain-Adapted.


fact: Cybersecurity risks have not materially affected NIKE's business or results of operations to date

reasoning: Per Rule 5 (SI materiality rule), the statement 'cybersecurity risks have not materially affected our business or our results of operations' IS an assessment about whether cybersecurity has affected business outcomes, making this Strategy Integration. However, the specificity is Generic Boilerplate because the negative assertion about absence of material impact is a self-reported claim that cannot be independently verified (you cannot confirm the absence of something externally), and the remainder of the paragraph is pure speculation/disclaimer language ('there can be no assurance... will not face a cybersecurity incident in the future') that appears in virtually every 10-K.


fact: At least once each quarter, the Audit Committee discusses cybersecurity risk management with the CIO

fact: At least annually, the CIO meets with the Board to discuss cybersecurity risk management

fact: Information Security and Compliance teams coordinate with the Board and Audit Committee

fact: CIO and Vice President of Information Security coordinate with IT Senior Leadership Team

fact: Topics covered in board reports include vulnerability assessments, third-party and independent reviews, threat environment, and technological trends

reasoning: This paragraph is about Board Governance because it describes how the Board and Audit Committee oversee cybersecurity: what information they receive, how often they are briefed (quarterly/annually), and what topics are covered. The specificity is Quantified-Verifiable because it contains hard cadence claims ('At least once each quarter' and 'at least annually') that are externally verifiable against meeting records or board calendars. Additionally, the mention of specific reporting topics (vulnerability assessments, third-party reviews) demonstrates domain expertise beyond generic oversight language.


fact: CISO role in cybersecurity leadership structure

fact: Chief Legal Officer role in cybersecurity leadership structure

fact: Chief Financial Officer role in cybersecurity leadership structure

fact: Core Cybersecurity Management Team (CCMT) as named internal committee

fact: Teradata's CIRP (Cyber Incident Response Plan) as named internal program

reasoning: The paragraph answers 'How is management organized to handle cybersecurity?' through describing the CCMT composition, its member roles (CISO, Chief Legal Officer, CFO), and their responsibilities for incident oversight and stakeholder communications — all firm-specific organizational structure details rather than program activities. The specificity level is driven by the named CCMT committee, named CIRP program, and the specific executive roles assigned to cybersecurity governance.


reasoning: This paragraph primarily answers 'How does cybersecurity affect the business?' through a backward-looking negative assessment ('have not materially affected Microchip, our business strategy, our results of operations or our financial condition') and a forward-looking materiality reference ('reasonably likely to materially affect us'), which both map to Strategy Integration per Rule 5. No specific facts are present — the date 'March 31, 2024' is a reporting anchor, not a cybersecurity fact, and the negative assertion 'we have not experienced any material cybersecurity incidents' is a self-reported claim about absence that cannot be independently verified per specificity rules.


reasoning: The paragraph focuses on third-party vendor oversight—describing that Tredegar holds providers responsible for security measures and periodically conducts assessments to verify adequate protections—which directly answers 'How are third-party cyber risks managed?' However, specificity is Level 1 because all language is generic boilerplate: 'periodically,' 'appropriately and proportionally tailored,' 'corresponding risks,' and 'security measure protocols' are vague terms that could appear in any company's disclosure. No specific evidence reviewed (SOC 2, pen tests), no named frameworks, no specific timelines, and no quantifiable facts are present. The paragraph describes the concept of vendor security oversight without any domain-specific detail or firm-specific facts.


reasoning: This paragraph answers the question of whether cybersecurity threats have materially affected or are reasonably likely to materially affect the company's business (backward-looking negative assertion and forward-looking assessment), which maps to Strategy Integration under Rule 5. The paragraph contains no domain expertise terms (no specific security tools, practices, or frameworks), no firm-specific cybersecurity roles or committees, and no verifiable external claims—it relies entirely on self-reported negative assertions and speculative conditional language about potential future impact. Company name identifiers alone do not elevate specificity.


fact: Senior Manager of Enterprise IT Security Risk and Compliance team

fact: Reports to Managing Director of Enterprise IT

fact: Over 30 years of IT experience

fact: Over 20 years specializing in cybersecurity

reasoning: The paragraph's primary focus is describing a management-level role (Senior Manager of Enterprise IT Security Risk and Compliance), their reporting line, their qualifications, and their responsibilities — all hallmarks of Management Role content. The specificity is elevated to Level 4 by two externally verifiable claims: 'over 30 years of IT experience' and 'over 20 years specializing in cybersecurity,' both of which set verifiable lower bounds that could be checked against a professional resume.


fact: Crisis Response Team consisting of CEO, CFO, Chief Human Resources Officer, CIO, and General Counsel

fact: Security Operations Center staffed with cybersecurity professionals reporting to CISO

fact: Cybersecurity Incident Response Plan with categorized thresholds for escalation

fact: Resources provided by external vendors in SOC operations

fact: Public Disclosure Committee as final disclosure body

reasoning: The paragraph is primarily about organizational structure—describing the SOC team, CISO role, Crisis Response Team membership, and reporting/escalation relationships between named roles. Per Rule 2, removing person-specific content (names, titles, committee membership, reporting lines) would collapse the paragraph to near-nothing, confirming MR classification. Specificity is elevated to Level 3 by the explicitly named Crisis Response Team with specific membership (CEO, CFO, CHRO, CIO, General Counsel), the SOC staffed with cybersecurity professionals, and the named Cybersecurity Incident Response Plan—these firm-specific organizational facts would help identify the company even without its name.


fact: Senior Director of Governance & Information Security (Senior Director, GIS) is the role providing information security updates to the CFO

reasoning: This paragraph describes the board's cybersecurity oversight structure and information flow chain (Board → Audit Committee → CFO → Senior Director, GIS), making it Board Governance per Rule 1. The Senior Director of Governance & Information Security title is firm-specific (Level 3), as it is a Director-level role with a security qualifier distinguishing it from generic organizational references.


reasoning: The paragraph primarily answers 'How does cybersecurity affect the business or finances?' through direct assertions about materiality — stating that cybersecurity has not materially affected results to date, has materially affected business strategy, and could materially affect future outcomes. This is SI per Rule 5 (assessments about business/financial impact). Specificity is Generic Boilerplate because every claim is a self-reported negative assertion or vague hedged language ('significant resources') — no domain terminology, no firm-specific facts, and no independently verifiable claims are present.


reasoning: The paragraph describes board oversight structure—specifically which committees (Corporate Risk Committee, Audit Committee) oversee cybersecurity and the reporting cadence from CIO/CISO to the board. This directly answers 'how does the board oversee cybersecurity?' → Board Governance. However, the paragraph contains no cybersecurity domain terminology, specific practices, tools, or architectural concepts; it describes only governance structure and reporting cadences that any company could use for any enterprise risk topic. The named committee (Corporate Risk Committee) and roles (CIO, CISO) are firm-specific governance elements, but the paragraph's substance demonstrates no cybersecurity expertise beyond the topic label.


reasoning: The paragraph primarily addresses the financial/materiality question — whether cybersecurity incidents have affected or are likely to affect the company's business position — which maps to Strategy Integration under Rule 5. The paragraph contains only generic boilerplate: vague references to 'preventative actions' and 'investing in cybersecurity' without any specific practices, tools, named roles, or verifiable claims. No domain-specific security terminology, firm-specific facts, or quantified statements appear.


reasoning: The paragraph primarily makes a backward-looking negative assessment that cybersecurity has not materially affected business outcomes (SI per Rule 5), with a cross-reference to risk factors. The specificity is Generic Boilerplate because the entire paragraph consists of standard SEC forward-looking language and a reporting-period anchor — no domain-specific cybersecurity practices, firm-specific organizational details, or externally verifiable claims are present.


fact: Chief Capability Officer (CCO)

fact: Chief Information Officer (CIO)

fact: Chief Information Security Officer (CISO)

reasoning: The paragraph describes board-level oversight of cybersecurity through the Audit Committee receiving quarterly reports and engaging directly with named C-suite officers (CCO, CIO, CISO) on cybersecurity topics. This describes the governance chain for cybersecurity oversight, making it Board Governance. The named officer titles (CCO, CIO, CISO) are firm-specific facts that distinguish this company's cybersecurity leadership structure from any other public company, setting specificity at Level 3. The paragraph does not contain externally verifiable claims (no certifications, headcounts, dates, or dollar amounts) to reach Level 4.


reasoning: This paragraph is a cross-reference directing readers to Item 1A Risk Factors for cybersecurity risk disclosures; it does not itself contain substantive cybersecurity content. Per Rule 6, paragraphs that primarily point elsewhere or lack any substantive cybersecurity measure/process/assessment default to None/Other. The specificity is Level 1 (Generic Boilerplate) as the paragraph contains no domain-specific expertise, firm-specific facts, or verifiable claims—only a quoted risk factor heading and a reference to where disclosures can be found.


reasoning: This paragraph is a risk factor disclaimer cross-reference, not substantive cybersecurity disclosure — it does not describe any actual cybersecurity governance, program, or incident. Per Rule 5 (SI materiality rule), the negative assertion 'we have not been subject to cyber attacks that have been material' is an SI-type assessment, but it is embedded in forward-looking boilerplate ('there can be no guarantee') that points to Item 1A rather than making an independent assessment. The dominant function is warning about future risk and redirecting the reader elsewhere. The specificity is Generic Boilerplate because the paragraph contains no specific facts, domain-adapated terms (the phrase 'evolving cybersecurity threats' is generic risk language any ERM professional could write), firm-specific identifiers, or verifiable claims — just company name, generic threat descriptions, and a cross-reference.


fact: February 21, 2024 - date Change Healthcare notified EHC of cybersecurity incident

fact: Change Healthcare is a subsidiary of UnitedHealth Group acting as intermediary for payment claims processing for all payors

fact: Both companies severed business service connections between their systems in response

fact: EHC conducted forensics on its systems based on shared information about the incident

fact: February 28, 2024 - assessment date with no compromise or unauthorized access identified

fact: Incident has not affected operations except claims submission

reasoning: The paragraph describes an actual cybersecurity incident (Change Healthcare on February 21, 2024) including timeline, response actions, and findings — fitting the incident disclosure frame. The multiple specific dates, named entities (Change Healthcare, UnitedHealth Group), and concrete actions (severing connections, conducting forensics) are externally verifiable claims, elevating specificity to Level 4.


reasoning: This paragraph describes the general cyber threat landscape (phishing, nation-state threats, targeting of banking institutions) rather than answering any of the six substantive disclosure questions—it does not describe board oversight, management organization, program activities, vendor management, an actual incident, or business impact. The content is background context explaining why cybersecurity matters. All language is generic threat landscape observation with no firm-specific facts, no cybersecurity domain terminology beyond the threat types themselves, and no verifiable claims—the statements apply equally to any financial services company.


fact: In 2021, we suffered a ransomware attack on our information technology systems

reasoning: The paragraph describes an actual cybersecurity incident — a 2021 ransomware attack — including its nature, scope, and impact, making Incident Disclosure the primary category per Rule 4. The specific year '2021' tied to the occurrence of the ransomware attack is a verifiable fact (unlike a year anchoring a negative assertion), elevating specificity to Level 4.


reasoning: The paragraph primarily describes what the Incident Response Team does (composition from major business areas, materiality determination process) — fitting RMP. However, all factual claims are generic boilerplate: 'major business areas' is vague, the materiality process described ('implemented processes') is not elaborated, and the negative assertion ('has not identified any cybersecurity threats that have materially affected...') is a self-reported claim about absence, not an externally verifiable fact. No domain-specific security terminology, no named standards, no specific roles above VP level, no hard numbers, and no named programs — hence Generic Boilerplate.


fact: security incident and event manager interface

fact: behavioral analytics

fact: live metrics and reports of attempted breaches

fact: logs of firewalls, authentication attempts, emails, anti-malware, attempted intrusions and applications

fact: external and internal penetration testing

fact: system security assessments

reasoning: The paragraph describes cybersecurity program activities, tools, and testing methodologies, making Risk Management Process the appropriate category. The paragraph demonstrates cybersecurity domain expertise through specific technical terms (SIEM, behavioral analytics, penetration testing, system security assessments) and detailed logging categories that an ERM professional would not naturally use in describing non-cyber risks—these concepts are specific to cybersecurity practice rather than generic risk management language.


fact: Chief Information Officer (CIO) has more than 30 years of experience in information technology

fact: CIO led governance, risk, and compliance technology programs and information security programs in financial services, banking, healthcare, and hospitality sectors

fact: Dedicated cybersecurity team designs and monitors cybersecurity control framework and implements cybersecurity control systems and solutions

fact: Team holds: Master's in Cybersecurity, CISSP, CISM, Microsoft Certified Cybersecurity Architect Expert, Graduate Certificates in Enterprise Cybersecurity and Data Science, Security+, CISA

reasoning: This paragraph is primarily about Management Role because its central content describes leadership qualifications (CIO's 30+ years of experience across multiple sectors), organizational structure (dedicated cybersecurity team), and team credentials—all questions about WHO is responsible and how they're organized, not what the program does. The specificity reaches Level 4 because the paragraph contains multiple externally verifiable claims: the CIO's 30+ years of experience is a specific quantified lower bound (checkable against resume/LinkedIn), and all seven certifications (CISSP, CISM, Microsoft Cybersecurity Architect Expert, Security+, CISA) are individually named credentials verifiable through their respective certification registries (ISC², ISACA, Microsoft, CompTIA).


fact: External service provider used to perform outside-in, hacker-perspective monitoring of supplier cybersecurity posture

fact: TPRM program with formal name and acronym

fact: Outside-in hacker perspective approach (domain terminology)

reasoning: The paragraph's central topic is third-party vendor risk management—describing how Unisys oversees cybersecurity risks from service providers through its TPRM program, due diligence reviews, and ongoing monitoring—making it Third-Party Risk. The specificity reaches Level 4 because the paragraph identifies that an external service provider performs outside-in hacker-perspective assessments of supplier cybersecurity posture, which is a verifiable claim about a named third-party relationship that could be independently confirmed. The TPRM program name and the outside-in monitoring terminology further demonstrate both firm-specific formalization and cybersecurity domain expertise.


reasoning: The paragraph describes what the information security program does (engaging external assessors, evaluating threats, performing forensic reviews) — activities that define RMP. Under specificity: while 'forensic reviews' and 'independent security assessments' are security-adjacent terms, they fail the ERM test because they describe generic activities any cybersecurity program might undertake rather than domain-specific technical concepts. No named tools, frameworks, standards, roles, or verifiable claims are present. The phrase 'may engage and retain' is also hedged. This is standard boilerplate describing a common cybersecurity practice.


fact: CISO

fact: technical degree in computer science from an accredited public university

fact: security engineers, detection specialists, and business cybersecurity experts

fact: reports to CEO and Audit Committee

reasoning: The paragraph is primarily about management's organizational structure for cybersecurity—the CISO's qualifications, team composition, and reporting lines—which maps to Management Role. The specificity level is Quantified-Verifiable because 'over 20 years of information technology and cybersecurity experience' is a hard number (lower-bound verifiable against a resume) that anchors the CISO's credentials.


fact: Over 20 years of related experience (combined experience threshold for CDIO and VP of Platforms, Infrastructure, and Cybersecurity)

reasoning: The paragraph primarily describes WHO manages the cybersecurity program (specific executive roles: CDIO and VP of Platforms, Infrastructure, and Cybersecurity) and their qualifications, making Management Role the primary category. The 'over 20 years' threshold is a verifiable lower bound - an external party could confirm whether these two executives each possess at least 20 years of relevant experience.


fact: SOC 2 (System and Organization Controls)

fact: ISO 27001 (Information and Security Certification)

reasoning: This paragraph directly addresses third-party cyber risk management through vendor onboarding, due diligence, and security requirements imposed on suppliers (SOC 2 and ISO 27001 report requirements). Specificity is Domain-Adapted because the paragraph demonstrates cybersecurity domain expertise—specifically referencing SOC 2 and ISO 27001 as evidence requirements for vendors—which an ERM professional would not naturally use without cybersecurity domain knowledge. No firm-specific identifiers (named programs, committees, or leadership) or verifiable claims are present.


fact: National Institute of Standards and Technology Cybersecurity Framework

fact: Center for Internet Security – Top 18 Critical Security Controls – Control Level Framework

fact: biannual employee information security assessments

fact: phishing tests conducted at least quarterly on a global basis

reasoning: The paragraph comprehensively describes the cybersecurity program's activities, features, and components—what the program does—making Risk Management Process the appropriate category. Specificity is Domain-Adapted because the paragraph references named security frameworks (NIST CSF, CIS Top 18) and specific practices (biannual assessments, quarterly phishing testing) that demonstrate cybersecurity domain expertise beyond generic risk language, but does not include firm-unique identifiers or externally verifiable claims.


reasoning: The paragraph describes board-level oversight structure (Audit Committee monitoring cybersecurity governance, Risk Committee coordination) — clearly answering 'how does the board oversee cybersecurity?' — but uses only generic governance language applicable to any public company. No named individuals, no specific programs, no cybersecurity-specific terminology (ERM test: 'internal audit coverage of cybersecurity governance' could be swapped for any risk domain), no quantified claims, and no firm-specific facts.


reasoning: The paragraph directly addresses third-party cybersecurity risk management through a dedicated ERM department, making Third-Party Risk the clear category. However, the paragraph describes only generic processes (establishing a department, evaluating risks with IT) without any domain-specific cybersecurity terminology, tools, frameworks, or verifiable claims that would elevate it beyond generic boilerplate.


reasoning: This paragraph is a cross-reference directing readers to Item 1A for cybersecurity risk disclosures. It contains no substantive cybersecurity content—it neither describes a cybersecurity practice, assesses business impact, nor discloses an incident. It is purely a navigational pointer within the filing, which maps directly to None/Other.


reasoning: This is a section-intro paragraph that frames what the disclosure will cover without actually providing substantive cybersecurity content. It contains no specific facts, domain expertise, or verifiable claims—only generic assertions about the importance of cybersecurity and an announcement that an overview will follow. No substantive question from the six categories is answered.


fact: independent testing of the target technology prior to closing the acquisition

reasoning: The paragraph centers on third-party security risk management—specifically acquisition-target due diligence—which maps directly to TP. It describes requirements imposed ON third parties (remediation requirements, contractual protections in purchase agreements), distinguishing it from RMP where the company's own program activities are central. For specificity, 'independent testing of the target technology prior to closing' demonstrates cybersecurity domain expertise (pen testing of acquired systems) that passes the ERM test—this is not language a generic ERM professional would use about financial or operational risks. No firm-specific identifiers (named committees, named individuals, VP+ titles) or externally verifiable claims (specific dates, named frameworks, specific certifications, headcount) are present.


fact: Director of IT Infrastructure and Security (firm-specific VP-level title with security qualifier)

fact: Director brings over 30 years of experience

fact: Director implemented and verified cybersecurity controls in a Defense Industrial Base environment

fact: Director holds GIAC Security Essentials, GIAC Certified Enterprise Defender, GIAC Certified Incident Handler Certification, GIAC Certified Windows Security Administrator, and GIAC Critical Controls Certification

fact: Director reports to Vice President of Information Technology

fact: VP of Information Technology has over 19 years of experience

fact: VP holds Certified Information Systems Security Professional (CISSP) certification

reasoning: The paragraph is primarily about organizational structure and personnel (who holds cybersecurity leadership roles, their reporting lines, qualifications, and credentials), which maps directly to Management Role. Specificity reaches Level 4 due to multiple externally verifiable quantified claims: the Director's 'over 30 years of experience' and five named GIAC certifications, and the VP's 'over 19 years of experience' and CISSP certification — all independently checkable against professional registries and LinkedIn profiles.


fact: John Bresney, EVP & CIO, reports directly to CEO

fact: John Bresney has been employed for approximately 30 years

fact: John Bresney has bachelor's degree in information systems and business

fact: John Bresney has Master's Certificate in Project Management

fact: John Bresney has Columbia University CIO Program Certificate

fact: Robert McKenna, SVP of Enterprise Strategy and Execution, reports to CIO

fact: Robert McKenna has been employed for approximately 21 years

fact: Robert McKenna has over 27 years of technology and information security experience

fact: Robert McKenna has master's degree in business administration

fact: Robert McKenna is Certified Insurance Counselor

fact: Robert McKenna oversees cybersecurity incidents under Security Incident Response Plan (IRP)

fact: Christopher Cunniff, SVP and CRO, reports to CFO and interim to CEO

fact: Christopher Cunniff has been employed for approximately 6 years

fact: Christopher Cunniff has over 32 years of insurance industry experience

fact: Christopher Cunniff is Fellow of the Casualty Actuarial Society

fact: Christopher Cunniff is member of American Academy of Actuaries

fact: Christopher Cunniff chairs ERC and Emerging Risk Committee

reasoning: This paragraph is about Management Role — it describes how three named executives (EVP & CIO, SVP of Enterprise Strategy and Execution, SVP and CRO) are organized to handle cybersecurity, including their reporting lines, responsibilities, and qualifications. It is Level 4 (Quantified-Verifiable) because it contains multiple externally verifiable claims: named individuals with specific titles, specific tenure numbers (30 years, 21 years, 27 years, 6 years, 32 years of experience), specific credential claims (Fellow of Casualty Actuarial Society, Certified Insurance Counselor), named committee chairs (ERC, Emerging Risk Committee), and named plan (Security Incident Response Plan).


reasoning: The paragraph centers on vendor due diligence for third-party cyber risks (assessing vendor control environments, reviewing information security practices), making Third-Party Risk the appropriate category. The language describes generic processes without domain-specific technical detail (no mention of specific assessment evidence like SOC 2 or pen testing, no tools named), no firm-specific facts (no named roles, committees, or programs), and no verifiable claims, resulting in Generic Boilerplate.


reasoning: This paragraph directly answers whether cybersecurity has affected or will affect business outcomes (backward-looking 'have not materially affected' and forward-looking 'reasonably likely to materially affect'), making it Strategy Integration. It contains no specific facts — the language is standard SEC materiality disclaimer boilerplate with no firm-specific details, named individuals, quantified claims, or domain-expertise vocabulary that would elevate specificity beyond Level 1.


reasoning: The paragraph makes a backward-looking assessment about the absence of material cybersecurity incidents (explicitly listed as SI in Rule 5), combined with standard forward-looking materiality boilerplate. No specific facts are present — the negative incident assertion is not independently verifiable, and all other content is speculative.


fact: June 21, 2023 - date Umpqua Bank was informed of the incident

fact: MOVEit - named filesharing software involved in the vulnerability

fact: June 22, 2023 - date email notification sent to potentially affected customers

fact: August 2023 - date written notice sent via U.S. mail

fact: 429,252 Umpqua Bank customers whose information was involved in the Vendor Incident

reasoning: This paragraph describes an actual cybersecurity incident (the MOVEit vendor breach affecting Umpqua Bank customers) with specific dates (June 21, June 22, August 2023), a named vulnerability vector (MOVEit), and a precise customer count (429,252). The externally verifiable hard numbers and specific timeline establish Level 4 specificity.


reasoning: The paragraph is a forward-looking risk disclaimer about potential consequences of cybersecurity failures ('could disrupt,' 'could damage,' 'could have a material adverse impact'), not an actual assessment of how cybersecurity has affected or is likely to affect the business. Per Rule 5, speculative 'could have a material adverse effect' language does not qualify as Strategy Integration — this is boilerplate found in every 10-K. The paragraph contains no specific facts, verifiable claims, domain terminology demonstrating expertise, or firm-specific identifiers.


fact: third-party risk assessments

fact: monitor cybersecurity incidents involving third-party providers

reasoning: The paragraph is centrally about managing third-party cyber risk—overseeing vendor cybersecurity, requiring information from material third-party providers, and monitoring incidents involving those providers—making TP the primary category. The paragraph uses cybersecurity domain terminology ('third-party risk assessments,' 'cybersecurity incidents involving third-party providers') that distinguishes cybersecurity-specific vendor oversight from general operational risk management, earning Domain-Adapted specificity, but lacks firm-specific details or externally verifiable claims.


reasoning: The paragraph describes the board's cybersecurity oversight structure, including the Board's risk oversight role, the audit committee's review responsibilities for IT governance and data security, disclosure committee responsibilities for incident detection, and complaint reporting procedures. This answers 'How does the board oversee cybersecurity?' — the core Board Governance question. The paragraph contains no firm-specific or externally verifiable cybersecurity facts: the governance roles described (Board, Audit Committee, Disclosure Committee) are universal to public companies, and the governance language ('risk oversight,' 'briefings and assessments,' 'complaint reporting procedures') is generic ERM terminology any governance professional could apply. The Employee Self Service portal reference is IT-related, not cybersecurity governance.


reasoning: This paragraph is purely speculative risk language—'could prevent,' 'could cause,' 'could result in'—describing what a hypothetical cybersecurity attack COULD theoretically do, rather than describing any substantive cybersecurity measure, program, governance structure, or actual incident. It contains no specific facts, domain terminology, firm-specific details, or verifiable claims. Following Rule 6 and Rule 5's guidance that 'could have a material adverse effect' is speculation rather than Strategy Integration, this generic risk language qualifies as None/Other.


reasoning: The paragraph describes the CISO's oversight role and reporting structure to the Board, ELT, and SLT, including quarterly meetings and annual tabletop exercises—these describe the board's cybersecurity oversight chain. Regarding specificity: 'Chief Information Security Officer' is a generic role title without a named individual; 'Board of Directors,' 'ELT,' and 'SLT' are generic governance entities found at every public company; and 'quarterly' and 'at least annually' describe standard cadences. No firm-specific titles (named CISO), no named internal committees, no verifiable facts—only boilerplate oversight language.


reasoning: The paragraph describes the Risk Committee's oversight function—providing assurances to management and the Board that risks have been identified, evaluated, and controls implemented. This directly answers how the board oversees cybersecurity, making Board Governance the appropriate category. The specificity is Generic Boilerplate: all language ('provides assurances,' 'key risks,' 'mitigating controls') is standard board governance boilerplate that any public company could write; no cybersecurity domain expertise is demonstrated, no firm-specific facts appear, and no verifiable claims are made.


reasoning: The paragraph answers 'How does cybersecurity affect the business or finances?' through a negative assertion ('not aware of any material risks') and forward-looking conclusion ('reasonably likely to materially affect'). This is a stated assessment about business/financial impact per Rule 5 SI materiality. However, it contains zero substantive facts—no specific practices, named frameworks, individuals, numbers, or verifiable claims—making it purely generic boilerplate language that could appear in any 10-K filing.


reasoning: The paragraph describes a cybersecurity governance hierarchy (Board → Management committees → Information Security program) with emphasis on oversight structure, reporting lines, and board-level risk expertise — making Board Governance the primary category. All content consists of standard governance vocabulary (Operational Risk Committees, Enterprise Risk Management Committee, Board of Directors) and generic executive titles (CTO, CEO, Chief Risk Officer) that appear in virtually every public company's cybersecurity disclosure; no firm-specific named individuals, unique committee identifiers, quantified metrics, or externally verifiable claims are present.


fact: third party security risk assessment

fact: supplemental reviews as necessary commensurate with the risk associated with each third party

fact: full assessment when third party affected by incident impacts company

fact: additional controls commensurate to the risk

fact: cybersecurity team continuously monitors and addresses cybersecurity threats and incidents at third-party service providers

reasoning: The paragraph's central topic is third-party cybersecurity risk management, describing due diligence reviews, security risk assessments, supplemental reviews based on risk levels, and continuous monitoring of third-party service providers. This fits Third-Party Risk (TP) as the dominant category. For specificity: the paragraph uses cybersecurity-specific terminology including 'third party security risk assessment,' 'supplemental reviews,' and describes 'cybersecurity team' monitoring threats at third-party providers—language that demonstrates cybersecurity domain expertise beyond generic ERM terminology. The ERM test confirms this: an enterprise risk management professional would not naturally use 'cybersecurity threats and incidents at third-party service providers' as the object of monitoring. No firm-specific identifiers (named leaders, specific committees, quantified headcount) or externally verifiable claims (certifications, named third parties) appear.


reasoning: The paragraph describes a Chief Risk Officer role and its function within the ERM structure, which answers 'How is management organized to handle cybersecurity?' However, the description is entirely generic boilerplate: no named individual, no specific cybersecurity responsibilities cited, no domain-specific security terminology (the language about 'specialized expertise and oversight in the broader domain of risk management' passes the ERM test — any ERM professional would use this language), no firm-specific facts, and no verifiable claims. Every fact mentioned ('Chief Risk Officer,' 'ERM structure,' 'dedicated support') is generic to the point of being indistinguishable from any public company's disclosure.


fact: Adrian J. Holt, age 55

fact: Senior Vice President and Chief Human Resources Officer

fact: Joined Eastman in 2016

fact: Prior roles: Chief HR Officer at WireCo World Group, VP of Corporate HR at BASF North America

fact: Current position effective May 2023

reasoning: This paragraph describes a named executive's current role, career history, and appointment date, making Management Role the primary category. The specificity is Level 4 because the paragraph contains multiple externally verifiable facts: the executive's specific age (55), a named prior employer (WireCo World Group), a named prior employer (BASF North America), and a specific appointment date (May 2023).