fact: Change Healthcare is a subsidiary of UnitedHealth Group that processes certain claims for reimbursement related to the Exogen device

fact: March 7, 2024 is the date UnitedHealth Group issued a statement about the incident

fact: UnitedHealth Group expected to begin testing and reestablishing connectivity to the affected claims network on March 18, 2024

fact: An alternative claim processing intermediary was identified and claims submissions to some payers have resumed

reasoning: The paragraph describes a real cybersecurity incident at Change Healthcare (third-party vendor), including the nature of the breach, operational impact on the company's billing/collections processes, remediation steps taken, and investigation status—this is classic Incident Disclosure. Specificity is elevated to Level 4 by the March 7 and March 18, 2024 dates tied to UnitedHealth Group's public statements about the incident timeline and recovery plan, both of which are externally verifiable through UnitedHealth Group's own communications.


content_category: Incident Disclosure

fact: $2.7 million of loss (net with funds recovered, plus professional fees for independent forensic investigation and recovery efforts)

category_confidence: high

specificity_confidence: medium

reasoning: This paragraph describes an actual cybersecurity incident (a complex criminal scheme involving fraudulently-induced wire transfers in early Fiscal 2024), including what happened, how it was discovered, response actions taken, and financial impact — making it primarily an Incident Disclosure per Rule 4. Specificity is Level 4 due to the $2.7 million hard dollar amount representing the quantifiable financial loss from the incident, which is externally verifiable through the company's financial statements (Note 18).

provider: minimax

stage: benchmark


content_category: None/Other

category_confidence: low

specificity_confidence: low

reasoning: This paragraph is biographical career history for David Shear (President International of RBI) with no cybersecurity context mentioned — he has no cybersecurity title, responsibilities, or committee role. Despite appearing in Item 1C (Cybersecurity), it does not answer any of the six substantive cybersecurity questions. Career history of general business executives is generic boilerplate with no firm-specific cybersecurity facts.


content_category: Management Role

fact: CIO has primary responsibility for information security program

fact: CIO has 19 years of experience in technology risk management

fact: 11 years of CIO's experience is with the Company or its affiliates

fact: CIO holds SANS Global Information Security Leader certification

fact: CIO holds Certified Information Systems Auditor (CISA) certification

fact: Monthly scorecard updates

fact: Quarterly dashboard updates

specificity_confidence: high

reasoning: The paragraph primarily describes the CIO's role, qualifications, certifications, and organizational structure of the information security team, making this a Management Role disclosure. The specificity reaches Level 4 due to two quantified verifiable facts: the CIO's 19 years and 11 years of company-specific experience, plus named professional certifications (SANS GILS, CISA) that are independently verifiable through certification registries.


content_category: Risk Management Process

fact: National Institute of Standards and Technology Cybersecurity Framework

reasoning: The paragraph's central question is 'what does the cybersecurity program do?' — describing risk assessment, framework adoption (NIST CSF), vulnerability monitoring and patching, multi-layered defenses, and incident response planning. This maps to Risk Management Process. The NIST Cybersecurity Framework reference is a named cybersecurity standard that demonstrates domain expertise — an ERM professional would not naturally reference NIST CSF, making this Domain-Adapted level. No firm-specific titles, named programs, or quantified claims are present.


reasoning: This paragraph is a cross-reference directing readers to the Risk Factors section (Item 1A) for cybersecurity threat information. It contains no substantive cybersecurity disclosure—only a pointer to where such disclosure can be found—making it None/Other. Per Rule 6, there is no actual cybersecurity measure, process, or assessment described, and the 'may materially affect' language is speculation/disclaimer text, not an SI materiality assessment.


content_category: Strategy Integration

reasoning: This paragraph contains a negative assertion about material impact ('we are not aware of any risks from cybersecurity threats... that have materially affected or are reasonably likely to materially affect us') which matches the Rule 5 SI pattern for backward-looking assessments, combined with a cross-reference to Item 1A risk factors. It contains no domain-specific terminology, no firm-specific facts about the cybersecurity program, and no verifiable claims—it is standard negative-assertion boilerplate commonly found in 10-K cybersecurity sections.


reasoning: The paragraph describes third-party service providers assisting with cybersecurity risk management activities, which maps to RMP under Rule 3 (third parties hired to serve the company as a component of the internal program). For specificity, the language 'identify, assess, and manage material risks from cybersecurity threats' is generic ERM terminology that any risk management professional could write — it passes the ERM test (replace 'cybersecurity' with 'financial' and it still works). No domain-specific security terms, no named providers, no firm-specific details, and no verifiable claims are present.


category_confidence: medium

reasoning: The paragraph describes the Incident Response Team's structure and escalation procedures for cybersecurity events, which falls under risk management process activities. However, it contains no domain-specific terminology (ERM test: any enterprise risk management professional could write this about incident response), no firm-specific organizational details (no named committees, no VP-level cybersecurity titles), and no verifiable external claims—all roles and processes are described generically without distinguishing details.


reasoning: This paragraph is a cross-reference to Item 1A Risk Factors, providing no substantive disclosure about cybersecurity governance, management, processes, or controls. It merely states that cybersecurity risks exist and directs readers elsewhere for details, making it a None/Other category. It contains zero domain-specific terminology, firm-specific organizational claims, or externally verifiable facts, resulting in Generic Boilerplate specificity.


content_category: Board Governance

fact: Vice President, Finance and Controller

reasoning: This paragraph describes how cybersecurity information flows to the board-level audit committee (who reports, what they report on), which is the core question Board Governance answers. The specificity is elevated to Firm-Specific by the named management roles reporting to the audit committee—specifically the Senior Vice President and General Counsel and Vice President, Finance and Controller. No domain terminology passes the ERM test, and no externally verifiable claims are present.


content_category: Third-Party Risk

reasoning: The paragraph describes third-party service provider requirements (certification of security ability, breach reporting obligations) imposed on vendors, which is the central topic and fits TP under Rule 3. All language is generic boilerplate—'certify that it has the ability...to implement and maintain reasonable security measures' and 'promptly report any suspected breach'—that any company could use without demonstrating specific cybersecurity domain knowledge, firm-specific details, or verifiable claims. The vocabulary ('reasonable security measures,' 'safeguards,' 'policies and procedures') passes the ERM test as language any risk management professional could use; it does not show cybersecurity-specific expertise.


reasoning: The paragraph describes Audit Committee education processes and member expertise, which falls under Board Governance oversight of cybersecurity. However, the paragraph contains no specific facts—it describes generic processes (presentations, discussions) with generic participants (management, third-party consultants, auditors, legal counsel) and generic expertise claims that apply to virtually any public company's audit committee. An ERM professional could write this paragraph about any board committee.


fact: Chief Information Officer (CIO) responsible for information security program and reporting to Board/Audit Committee

fact: CIO has 25 years of experience in the information technology industry

fact: CIO reports to Chief Executive Officer

fact: Dedicated cybersecurity team within information systems department

fact: Multidisciplinary incident response team

reasoning: The paragraph opens with explicit 'Cybersecurity Risk Governance and Oversight' framing and traces the oversight chain from Board/Audit Committee through to the CIO and supporting teams, making Board Governance the primary content. Specificity is elevated to Level 4 by the quantifiable claim that the CIO has '25 years of experience in the information technology industry,' which is an externally verifiable fact about a named role — an external party could confirm this against a resume or LinkedIn profile.


reasoning: This paragraph primarily answers 'How does cybersecurity affect the business or finances?' through a negative materiality assertion (no material incidents have affected business outcomes), which classifies as Strategy Integration per Rule 5. However, the paragraph contains zero specific facts—no domain expertise terms, no firm-specific organizational details, and no externally verifiable claims—making it Generic Boilerplate for specificity. The date 'December 31, 2024' is a reporting period anchor, not a cybersecurity fact, and the negative assertion about not experiencing material incidents cannot be independently verified.


reasoning: The paragraph is primarily a cross-reference plus a generic materiality framework description with no distinguishing facts — no named roles, no specific practices, no verifiable claims, and no domain-specific language that would differentiate this company from any other public filer.


reasoning: The paragraph opens with a backward-looking and forward-looking materiality assessment ('have not materially affected' / 'are reasonably likely to materially affect'), which maps to Strategy Integration per Rule 5. The bulk of the paragraph consists of speculative 'could result in' language about potential costs and cross-references to Risk Factors. No firm-specific cybersecurity facts, named roles, or verifiable claims appear — just generic risk management language that any SEC filer could use, yielding Level 1 specificity.


reasoning: This is a negative assertion about material incidents (per Rule 5: 'Have not experienced any material cybersecurity incidents' maps to SI as a backward-looking assessment). No specific facts are present—the language is generic boilerplate that any public company could use, containing only stakeholder references ('customers, vendors, suppliers, service providers') and a cross-reference to Item 1A.


reasoning: The paragraph's central topic is vendor/supplier cybersecurity oversight—describing vendor due diligence, ongoing monitoring of third parties, and risk-based assessment frequency—which clearly maps to Third-Party Risk. However, all language consists of generic business and ERM terminology ('vendor due diligence,' 'risk-based approach,' 'industry-standard guidelines and tools') that any non-cybersecurity risk professional could write. No domain-specific security concepts, firm-specific organizational details, or externally verifiable claims are present, resulting in Level 1 Generic Boilerplate specificity.


reasoning: The paragraph describes engaging external service providers to assist the cybersecurity program (evaluating and enhancing policies), which qualifies as RMP under Rule 3 as third parties hired to serve the company. The paragraph contains no domain-specific cybersecurity terminology, no firm-specific organizational facts, and no verifiable claims—only generic language ('external service providers,' 'information security policies and procedures,' 'aligned with regulatory requirements') that any company could use.


reasoning: The paragraph describes the board's cybersecurity oversight structure—how the Audit Committee and Board receive periodic updates from the Chief Business Officer and an outside consultant, and how they are notified of significant threats between updates. This is a governance-chain description, clearly Board Governance. For specificity, the paragraph contains no domain-specific cybersecurity terminology (all terms like 'oversight,' 'updates,' and 'incidents' are generic ERM vocabulary), no firm-specific distinguishing facts (Audit Committee and periodic updates are universal), and no verifiable claims, making it Generic Boilerplate.


reasoning: The paragraph describes the Board's oversight structure for cybersecurity—including the full Board as primary overseer, management reporting cadences, and the Audit Committee's role in financial-risk reporting—which directly answers how the board oversees cybersecurity. No domain-specific cybersecurity terminology, firm-specific identifiers, or verifiable claims are present; the language ('operational risk management responsibilities,' 'mechanisms to effectively manage such risks') is generic governance boilerplate any company could use.


reasoning: This paragraph is a meta-statement describing the purpose of the section overview rather than disclosing any substantive cybersecurity information. It does not answer any of the six substantive questions (board governance, management role, risk management process, third-party risk, incident disclosure, or strategy integration). It contains no domain-specific terminology demonstrating cybersecurity expertise, no firm-specific facts distinguishing this company's program, and no externally verifiable claims — making it Level 1 generic boilerplate.


reasoning: The paragraph describes the board's oversight structure and delegation of cybersecurity risk oversight to the Audit Committee, with management reporting on a quarterly cadence—this is a textbook governance-chain description making Board Governance the correct category. However, none of the facts elevate specificity beyond Level 1: the Audit Committee is a generic board committee found at every public company; CTO and COO are generic role titles (not named individuals); and the stated years of experience ('over 10 years,' 'over 5 years') are soft lower bounds tied to unnamed role-holders, not independently verifiable named-person credentials. The paragraph uses only generic cybersecurity terminology that any ERM professional could employ, with no firm-specific organizational claims or externally verifiable claims.


fact: Information Security Steering Committee (ISSC) — named internal committee with specific acronym

fact: Cross-functional composition: Legal, Accounting, Internal Audit and Risk Management, Cybersecurity, and Facilities departments

fact: Services agreement with LMC

reasoning: The paragraph primarily describes the organizational structure of how management is set up to handle cybersecurity risks — the named ISSC committee and its cross-functional membership composition. While the committee's oversight scope (risk categories) is mentioned, the dominant content is about WHO is organized and how, which maps to Management Role under Rule 1 (management-level committee structure). Specificity is Firm-Specific because the named ISSC with its specific departmental composition (Legal, Accounting, Internal Audit and Risk Management, Cybersecurity, and Facilities) is a distinguishing organizational claim that would help narrow down which company wrote it. The services agreement reference with LMC is also company-specific context.


reasoning: The paragraph describes an actual cybersecurity incident (employee interaction with suspicious websites), its containment, and forensic investigation findings—this is the core of Incident Disclosure. However, the paragraph contains no specific facts: no hard numbers, no named third-party investigators, no specific dates, and no quantifiable thresholds. The incident characterization and outcome are self-reported assertions without externally verifiable anchors, resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes the Audit Committee's oversight responsibility for cybersecurity threats and the quarterly information flow from management to the board, which is the hallmark of Board Governance. However, it contains no firm-specific facts (the Audit Committee is a generic board committee present at all public companies), no named individuals, no specific dates, numbers, or externally verifiable claims — making it pure generic boilerplate with no specificity above Level 1.


reasoning: This paragraph is a cross-reference directing readers to Item 1A for cybersecurity risk information. It does not substantively answer any of the six core questions about board governance, management roles, risk management processes, third-party risk, incidents, or strategy integration. As a pure pointer to another section with no specific facts, domain expertise, or verifiable claims, it is correctly classified as None/Other at Generic Boilerplate.


reasoning: This paragraph is a forward-looking disclaimer about potential future cybersecurity incidents rather than a substantive disclosure answering any of the six core questions. The reference to processes being 'designed to help prevent, detect, respond to and mitigate' is a passing generic claim in service of the disclaimer—not a description of the cybersecurity program. The primary function is speculation about future risk and a cross-reference to Risk Factors, which maps to None/Other. No firm-specific facts, domain expertise terms (beyond generic risk language any business could use), or verifiable claims are present.


reasoning: This paragraph is a negative assertion about the absence of material cybersecurity incidents and immaterial expenses — per Rule 5's SI materiality rule, 'Have not experienced any material cybersecurity incidents' qualifies as a backward-looking assessment of business impact. It contains no specific facts: 'In the last three fiscal years' is a soft timeframe, 'have not experienced' is a negative self-assertion (externally unverifiable per the specificity guidance), and 'immaterial expenses' provides no hard number — qualifying it as Generic Boilerplate.


reasoning: The paragraph describes board-level oversight structure—specifically the Audit and Finance Committee's responsibility for cybersecurity oversight and the cadence of briefings (quarterly and annual). These are governance-chain elements about WHO oversees and HOW OFTEN, making Board Governance the primary category. The specificity is Generic Boilerplate because all identified facts (Audit and Finance Committee, CISO, CTO/CDO, quarterly/annual cadences) are standard, commonly-found governance language that appears across countless 10-K filings; no named individuals, specific dates, verifiable certifications, or distinguishing firm-specific details are present.


reasoning: The paragraph's primary purpose is describing the board-level oversight structure (Audit Committee receiving periodic reports on cybersecurity threats and processes), which maps to Board Governance. The second sentence is a standard negative materiality disclaimer appearing in virtually all 10-Ks. For specificity, the paragraph contains no firm-specific identifiers (the Audit Committee exists at every public company), no named cybersecurity leadership, no domain-specific security practices, and no verifiable facts—only generic governance language that would appear identically in any company's 10-K. The cybersecurity vocabulary used ('threats,' 'risk,' 'processes') is generic enterprise risk language any non-security professional could write, failing the ERM test for domain expertise.


reasoning: The paragraph primarily describes how third-party cybersecurity firms are engaged to support the company's security program (penetration testing, threat monitoring, risk assessments) — these are third parties hired to serve the company, which maps to RMP under Rule 3. The specificity is Level 1 because the paragraph contains only generic cybersecurity domain terms that any enterprise risk management professional could write, without demonstrating specialized cybersecurity expertise, firm-specific distinctions, or verifiable claims.


reasoning: The paragraph describes third-party oversight requirements—auditing the risk program, third-party experts assisting with design/implementation, and contractual certification requirements for service providers—which directly addresses how third-party cyber risks are managed, fitting the TP category. The paragraph contains only generic third-party oversight language with no named auditors, specific certification standards, quantitative metrics, dates, or other distinguishing details, resulting in Generic Boilerplate specificity.


fact: In October 2023, we experienced a cybersecurity incident

fact: certain information of our users was accessed and downloaded from individual 23andMe.com accounts without the account users' authorization

fact: reset customer passwords

fact: required two-step verification for new and existing customers

fact: enhanced our detection tools and capabilities

fact: implementation of new tools and processes

reasoning: This paragraph describes an actual cybersecurity incident in October 2023 involving unauthorized access to user accounts, making Incident Disclosure the appropriate category. Specificity is Level 4 due to the specific date tied to a real event (October 2023) and specific remediation actions taken (password reset, two-step verification requirement, enhanced detection tools) — all of which are externally verifiable claims about what occurred and what was done in response.


reasoning: The paragraph describes requirements imposed on franchisees and licensees regarding information security compliance and incident reporting, which falls under Third-Party Risk (Rule 3). However, it contains no firm-specific facts (no named programs, individuals, or organizational details), no domain-expertise terminology beyond generic 'information security,' and no verifiable external claims—making it Generic Boilerplate at Level 1.


reasoning: The paragraph describes third-party vendor oversight (security assessments before engagement, ongoing monitoring for compliance), which directly answers how third-party cyber risks are managed—fitting the TP category. However, the language is entirely boilerplate: 'processes designed to mitigate risks,' 'security assessments of key third-party providers,' and 'ongoing monitoring' are generic risk management terms that any company could use. No domain-specific terminology (SOC 2, NIST CSF, specific assessment tools), no firm-specific organizational facts (named committees, roles, or team compositions), and no externally verifiable claims appear. The specificity falls to Level 1 — Generic Boilerplate.


fact: ISO 27001 framework

fact: least-privilege principle

fact: phishing awareness exercises

fact: security-by-design principles

reasoning: This paragraph describes what the cybersecurity program does — framework adoption, access control principles, and employee training activities — making RMP the appropriate category. The specificity is Domain-Adapted because the paragraph demonstrates cybersecurity expertise through domain-specific terminology (least-privilege, security-by-design, ISO 27001, phishing exercises) that an ERM professional would not naturally use without cybersecurity domain knowledge. No firm-specific organizational claims or externally verifiable facts are present.


reasoning: This paragraph describes the board's cybersecurity oversight structure — delegation to the Audit Committee, reporting lines, and the types of roles (CIO, vCISO, internal staff, external experts) that brief the committee. Per Rule 1, governance-chain paragraphs describing oversight structure default to Board Governance. For specificity: the paragraph uses only generic governance terminology (Board, Audit Committee) and generic cybersecurity roles (CIO, vCISO, internal security staff, external experts) without any firm-specific identifiers, hard numbers, named individuals, or externally verifiable claims. No fact in this paragraph would distinguish Bloom Energy's cybersecurity governance from any other public company's disclosure.


reasoning: This paragraph describes the board oversight structure for cybersecurity—specifically that security team representatives brief the Audit Committee/Board quarterly on cybersecurity matters. This is a Board Governance paragraph about oversight structure and reporting cadence. The paragraph contains no firm-specific facts (Audit Committee and quarterly cadence are universal), no domain-expertise language that would distinguish this from generic ERM disclosures, and no verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: This paragraph's primary function is a negative materiality assessment—that cybersecurity threats have not materially affected and are not reasonably likely to materially affect the company—making it a Strategy Integration disclosure. However, it contains zero specific facts: no domain terminology (fails ERM test), no firm-specific roles or committees, no quantified claims, and no verifiable assertions. The paragraph is entirely boilerplate negative assurance language with a cross-reference to risk factors.


fact: defense in depth

fact: zero trust

fact: phishing email simulations

reasoning: The paragraph primarily describes what the cybersecurity program does—its methodologies, tools, and activities (enterprise risk management integration, defense in depth and zero trust controls, monitoring laws, phishing simulations, employee training). This directly answers 'what does the cybersecurity program do?' → RMP. Specificity is Domain-Adapted because the paragraph demonstrates cybersecurity domain expertise through terms like 'defense in depth,' 'zero trust,' and 'phishing email simulations' that an ERM professional would not naturally use without cybersecurity domain knowledge.


reasoning: The paragraph describes board oversight structure, update cadence (at least quarterly), and topics covered in cybersecurity briefings—all hallmarks of Board Governance content. However, specificity stays at Level 1 because 'quarterly' updates are a generic cadence applicable to any enterprise risk reporting, 'Audit Committee' and 'Board of Directors' are governance roles universal to all public companies, and terms like 'measures taken,' 'cybersecurity assessments,' and 'evolving risks' pass the ERM test (a non-security professional would naturally use this language for any risk domain). No domain-specific security practices, tools, or externally verifiable claims are present.


reasoning: This paragraph describes cybersecurity risk identification and assessment methodology, which maps to the RMP question ('What does the cybersecurity program do?'). Third-party assessments are mentioned as one component within the broader multi-faceted approach rather than as a central topic, so Rule 3 routes this to RMP rather than TP. For specificity, the paragraph uses only generic process language ('multi-faceted approach,' 'independent assessments') and component labels ('internal audit,' 'IT security') that any enterprise risk management professional could use — no domain-specific security terminology (no SIEM, SOC, EDR, NIST CSF, threat hunting, etc.), no firm-specific organizational claims (no named roles above VP level, no named committees), and no quantified or verifiable facts. This is standard boilerplate.


reasoning: The paragraph primarily assesses cybersecurity risk exposure and makes a backward-looking negative assertion about incident history, framed around potential business/financial impacts — fitting Strategy Integration. However, it contains no firm-specific operational details, named leadership, verifiable certifications, or quantified metrics; only generic threat categories and standard speculative risk language, making it Generic Boilerplate.


reasoning: This paragraph is a pure cross-reference directing readers to Item 1A for cybersecurity risk information. It contains no substantive disclosure about any of the six categories—it does not describe oversight, organization, processes, third-party risk, incidents, or business impact. As a cross-reference without any accompanying disclosure content, it is None/Other with no specific facts to evaluate.


fact: scanning internal network and infrastructure

fact: third-party vulnerability testing

fact: identify, escalate, investigate, resolve and recover from security incidents

reasoning: This paragraph describes what the cybersecurity program does—vulnerability scanning, third-party testing, and security tools for incident management—making it fundamentally about risk management processes. The specificity level is Domain-Adapted because the paragraph uses cybersecurity domain-specific terminology (network scanning, vulnerability testing, incident response phases) that an ERM professional would not naturally use when describing non-cyber risks. The cadences mentioned ('at least monthly,' 'at minimum annually') are soft specifications and the practices described are standard cybersecurity measures, not firm-specific or externally verifiable claims.


reasoning: This paragraph states the company's policy commitment regarding future incident disclosure—what they will report IF a material incident occurs. It does not describe an actual incident (ID requires a real event), nor does it describe substantive cybersecurity measures or governance structures. It is a forward-looking disclosure policy statement that qualifies as boilerplate under Rule 6. No specific facts are present; the paragraph contains only generic policy language applicable to any SEC registrant.


reasoning: This paragraph describes the board oversight structure—specifically how cybersecurity incident information flows to the Board and its Security & Technology Committee—making it a Board Governance disclosure. It contains no specific facts: no named individuals, no quantified thresholds, no verifiable claims about reporting cadence or committee composition; only generic descriptions of information-sharing processes that could appear in any company's 10-K.


reasoning: This paragraph states the cybersecurity program's aspirational goals (business continuity, protecting proprietary technology, safeguarding data) but does not describe any specific processes, activities, or measures that constitute the program — making it generic boilerplate with no informative content. No specific facts are present, and the language is so universal it could appear in virtually any company's filing.


reasoning: The paragraph describes a governance oversight chain (Task Force → Audit Committee) for cybersecurity, including briefing frequency and incident notification responsibilities — making Board Governance the primary content category. The paragraph lacks any cybersecurity domain terminology, specific security tools/practices, or firm-specific details (the 'Task Force' is generic naming, and the Audit Committee is a universal governance role), resulting in no facts that elevate specificity above Level 1.


reasoning: The paragraph centers on third-party vendor risk management, describing a Third-Party Risk Management Program, Vendor Management Policy, and audit process — all constituting vendor oversight as the central topic, which maps to Third-Party Risk. For specificity, the paragraph uses only generic ERM concepts (onboarding, periodic reviews, policy) and references the Interagency Guidance on Third-Party Relationships, a banking regulatory framework rather than a cybersecurity-specific standard. It contains no cybersecurity domain terminology (no SIEM, SOC, EDR, penetration testing, zero trust, NIST CSF, etc.), no firm-specific roles above VP level, and no verifiable quantified claims — therefore Generic Boilerplate.


fact: SOC 2 report evaluations for security, availability of data, processing integrity, confidentiality and privacy controls

reasoning: The paragraph's central topic is third-party vendor oversight (due diligence surveys, SOC 2 evaluations, centralized registry), which maps directly to Third-Party Risk per Rule 3. Specificity is Domain-Adapted because the reference to SOC 2's specific control categories (security, availability, processing integrity, confidentiality, privacy) demonstrates cybersecurity domain expertise that a general ERM professional would not naturally possess — the writer knows what evidence to request from vendors and which trust service criteria matter.


reasoning: The paragraph directly addresses third-party cybersecurity oversight by describing the company's engagement process for reviewing IT service providers' security measures. However, it contains no specific facts whatsoever—only generic language ('customarily includes, among other things') describing a vague review process with no domain-specific terminology, firm-specific identifiers, or verifiable claims.


reasoning: This paragraph is a general commitment statement about cybersecurity importance and organizational dedication — it describes no specific governance body, management role, risk management activity, third-party arrangement, incident, or business impact. The content_category is None/Other because it does not substantively answer any of the six core questions. The specificity is Generic Boilerplate because the paragraph contains zero domain-specific expertise terms (the ERM test easily passes — 'robust policies, procedures, and security measures' works identically for financial, operational, or cybersecurity risk), zero firm-specific facts, and zero externally verifiable claims.


fact: Director of Operations & Information Technology role with cybersecurity oversight responsibilities

fact: Approximately 20 years of experience in field

fact: Holds certifications in cybersecurity from accredited information technology certification providers

reasoning: The paragraph is primarily about a specific management role (Director of Operations & Information Technology) and the person's qualifications (20 years of experience, cybersecurity certifications), making it a Management Role disclosure. Specificity reaches Level 4 because 'approximately 20 years of experience' is a hard number that could be verified against a resume or LinkedIn profile, and certifications from accredited providers are independently verifiable through certification registries.


reasoning: The paragraph primarily describes the company's third-party risk management approach (security assessments before engagement, ongoing compliance reviews), making TP the most directly answered question. However, the paragraph contains only generic language ('stringent processes', 'thorough security assessments', 'ongoing review') with no domain-specific terminology, named frameworks, or firm-specific details, resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes a framework for identifying and mitigating cybersecurity threats, including threat detection, incident response, and risk mitigation procedures — answering 'what does the program do?' — which is the RMP question. However, all terms ('threat detection,' 'incident response,' 'risk mitigation') are generic ERM vocabulary any non-security professional could write; they fail the ERM test for domain expertise. No firm-specific facts (named roles, specific committees, team composition) or verifiable claims (hard numbers, named certifications, specific dates, named tools) are present. The paragraph is boilerplate language describing the existence of a framework without any specifics.


fact: Chief Information Security Officer (CISO)

fact: Chief Information Officer (CIO)

fact: CISO reports to CIO (reporting relationship)

reasoning: This paragraph describes the cybersecurity governance chain (Board → Audit Committee → Legal → CISO → CIO), making Board Governance the primary category. The specificity is Firm-Specific because both the CISO and CIO are named roles with an explicit reporting relationship — per the firm-specific rules, VP-or-above cybersecurity-adjacent titles (CISO, CIO) are firm-specific facts that distinguish this company's governance structure. The paragraph contains no externally verifiable claims, so it does not reach Level 4.


reasoning: The paragraph describes executive management's oversight role and ultimate responsibility for cybersecurity strategy, which directly answers 'How does management oversee cybersecurity?' — fitting Board Governance. The language uses generic ERM terminology ('risk oversight,' 'cybersecurity strategy') that any business professional could write without cybersecurity domain expertise, contains no firm-specific facts (no named committees, officers, or programs), and is clearly boilerplate. The truncated ending ('during the year ended') suggests this is the start of a longer boilerplate sentence.


fact: Chief Information Officer (CIO) — named executive role specific to this company

fact: has led Century Communities IT efforts since 2016 — specific start date verifiable via employment records

fact: more than 20 years of experience as an IT leader in the homebuilding industry — specific quantity (lower bound) with specific industry context

fact: reports to our Corporate General Counsel — specific reporting line

reasoning: This paragraph is about the CIO as a role holder — their qualifications, experience, scope of responsibilities, and reporting line — making it Management Role per Rule 2. The paragraph contains multiple verifiable facts: 'since 2016' is a specific date claim checkable against employment records, and 'more than 20 years of experience' is a quantified lower bound about a named individual, both meeting the Level 4 threshold.


reasoning: This paragraph describes the board's oversight structure for cybersecurity — specifically the reporting chain from Board to Audit Committee to CIO/CDO and back. This is Board Governance as it answers 'how does the board oversee cybersecurity?' rather than describing management's organizational role or the cybersecurity program's activities. The specificity is Generic Boilerplate because all terms used — 'Audit Committee,' 'Board,' 'CIO/CDO,' 'risk assessments,' 'control maturity assessments' — are generic governance and ERM concepts that appear in virtually every public company's cybersecurity disclosure. There are no firm-specific facts (no named individuals, no unique committee structures), no domain expertise demonstrated (would read identically if 'cybersecurity' were replaced with 'financial'), and no externally verifiable claims.


fact: COO reports to CEO (organizational reporting line)

fact: COO has over 15 years of experience in cybersecurity (quantified verifiable career tenure)

reasoning: The paragraph's grammatical subject is the COO, but applying the person-removal test (Rule 2): removing title, reporting line, and experience leaves a substantive description of cybersecurity program activities (risk assessments, incident response, compliance oversight) — making this RMP. The 'over 15 years of experience' claim is a hard, lower-bound number that is independently verifiable via background checks, and the CEO→COO reporting relationship is externally verifiable via company org charts or public filings — qualifying as Level 4.


reasoning: The paragraph's primary purpose is making an ASSESSMENT about whether cybersecurity threats have affected or are reasonably likely to affect business strategy, results of operations, or financial condition—triggering the SI materiality rule. It is NOT Incident Disclosure because it makes a negative assertion about incidents rather than describing a real event (per Rule 4). For specificity: the reporting period ('year ended December 31, 2024') is not a cybersecurity fact, and 'we did not detect any cybersecurity incidents' is a self-reported negative assertion that cannot be externally verified—neither elevates specificity above Level 1. No domain terminology (ERM test passes—no technical security concepts), no firm-specific facts (no named roles above VP, no named committees, no distinguishing organizational claims), and no verifiable facts (the negative assertion about absence of incidents is not independently confirmable).


reasoning: The paragraph describes board-level cybersecurity oversight through the Audit Committee, which is the defining characteristic of Board Governance (BG). Per Rule 1, board-level committees default to BG. For specificity, the paragraph contains only generic governance language (Audit Committee, Board of Directors, risk management) that appears in virtually every public company's cybersecurity disclosure. No named individuals, no firm-specific organizational structures, no domain-specific security terminology, and no verifiable claims are present. The reference to 'third-party subject matter experts' does not elevate specificity as it describes generic board briefing practices without identifying specific firms or topics.


reasoning: The paragraph explicitly describes board oversight structure — Audit Committee reports to the full Board regarding cybersecurity activities — making this primarily a Board Governance paragraph. While management responsibilities follow, they are framed as activities the board oversees. Regarding specificity: there are no named individuals, no named internal programs or committees beyond the generic Audit Committee, no specific dates, quantities, certifications, or tools with product names. The paragraph contains only generic cybersecurity terminology (threat intelligence, security tools, cybersecurity risk methodology) that could appear in any company's SEC disclosure — it describes the existence of a cybersecurity function, not any verifiable firm-specific or domain-expertise detail.


fact: President and CEO reports directly to the Board of Directors on cybersecurity programs

fact: CEO has more than 20 years of experience in Business Finance and Audit management industry

fact: Topics reported to Board: strategy, application, infrastructure, information security, support, and execution

reasoning: The paragraph primarily describes the governance reporting chain (CEO → Board of Directors) and what cybersecurity topics flow to the board, making Board Governance the central question answered. The CEO's quantified experience ('more than 20 years') provides an externally verifiable credential establishing their qualifications to lead the cybersecurity program.


fact: CISO

fact: CIO

fact: Audit Committee

fact: Technology & Operations Committee

reasoning: This paragraph describes the cybersecurity oversight structure — how information flows from cross-functional teams (IT, legal, internal audit) up to board-level committees (Audit Committee, Technology & Operations Committee) on a quarterly cadence. Per Rule 1, board-level committees anchor this as Board Governance. Specificity is Firm-Specific because it names CISO and CIO (VP-level cybersecurity/security portfolio roles that pass the firm-specific test) and explicitly names the Technology & Operations Committee as a distinct board committee overseeing cybersecurity.


reasoning: The paragraph describes types of third-party providers engaged to support the company's cybersecurity program (assessors, pen testers, MSSPs), which maps to RMP under Rule 3. However, the paragraph contains only generic category labels ('professional services firms,' 'cybersecurity consultants') with no specific firm names, numbers, or verifiable claims. Domain terms like 'penetration testing firms' fail the ERM test since any company describing its security program would use this language. No firm-specific or externally verifiable facts are present, making this Level 1.


fact: Senior Director of Information Technology has over 20 years of cybersecurity experience

fact: Senior Director of Information Technology has 10 years in leadership positions

fact: Senior Director holds CISSP certification

fact: Senior Director holds CCSP certification

fact: Senior Director holds GSTRT certification

fact: Senior Director is a Veteran Volunteer Instructor for US Cyber Command (ARCYBER)

fact: Senior Director is a member of Information Systems Security Association (ISSA)

fact: Senior Director is a member of Forum of Incident Response and Security Teams (FIRST)

fact: Third-party vendors hold CISSP-ISSAP certification

fact: Third-party vendors hold CGEIT certification

fact: Third-party vendors hold CDPSE certification

fact: Third-party vendors hold Certified Ethical Hacker (CEH) certification

reasoning: The paragraph is primarily about WHO is responsible for cybersecurity risk management (CFO and Senior Director of IT) and their qualifications, credentials, and professional affiliations—this is Management Role. Specificity reaches Level 4 because the Senior Director's 'over 20 years' and '10 years in leadership' are quantifiable experience claims (verifiable through background check), and the named certifications (CISSP, CCSP, GSTRT, ISSA, FIRST, CEH, etc.) are independently verifiable through certification bodies and membership registries.


reasoning: The paragraph makes a backward-looking negative assertion about whether cybersecurity incidents materially affected business outcomes, which is a Strategy Integration assessment per Rule 5. The specificity is Generic Boilerplate because the entire statement consists of standard legal language ('materially affected or are reasonably likely to materially affect') and a reporting-period date with no domain-specific terminology, firm-specific details, or externally verifiable claims. The 'no incidents' assertion is a negative self-assertion that cannot be independently confirmed.


reasoning: The paragraph's primary content is a backward-looking negative assertion that cybersecurity incidents have not materially affected the company's operations, reputation, or financial performance, which qualifies as an SI assessment per Rule 5. The secondary language about 'investing in technologies and partnerships' is entirely generic and could apply to any company's risk management. No domain-specific terminology (ERM test fails), no firm-specific facts, and the negative incident assertion is not independently verifiable.


reasoning: This paragraph is a negative assertion disclaiming cybersecurity incidents rather than describing actual incident response, governance structure, or cybersecurity program activities, making it None/Other. The paragraph contains no specific facts—it merely states the absence of incidents with no details about the company's cybersecurity posture, measures, or business impact assessment that would elevate it to Strategy Integration.


reasoning: The paragraph primarily describes what the cybersecurity program does — investing in processes and technology, implementing multiple security measures, continuously assessing capabilities, and engaging with third-party partners — making Risk Management Process the most fitting category. The specificity is Generic Boilerplate because every claim is generic: 'significant investments in processes and technology,' 'multiple and varied processes,' 'continuously assessing,' 'engaging with cybersecurity communities' — none of these contain firm-specific identifiers, named leaders, specific tools or frameworks, or quantifiable facts. The governance-chain mention (Audit Committee, Board) appears only as a concluding sentence and contains no firm-specific details about actual oversight activities.


reasoning: The paragraph describes board oversight via quarterly reporting from the CTO on cybersecurity risks and incidents—a governance-chain description that primarily answers how the board oversees cybersecurity (BG). The vocabulary ('quarterly reports,' 'risk management processes,' 'senior management') uses generic ERM language any business professional could write; it does not demonstrate cybersecurity domain expertise. The 'CTO' role and 'quarterly' cadence are generic governance structures present at nearly every public company, and no verifiable claim (specific number, named individual, hard date, named certification, or named program) is present.


reasoning: The paragraph describes cybersecurity program activities (monitoring, security tools, incident response coordination) — fitting the RMP category. However, specificity is Level 1 because all language is generic boilerplate: 'security tools' without naming any tools (SIEM, EDR, etc.), 'monitor our environment' without specific practices (threat hunting, vulnerability scanning), and 'respond to possible security incidents' without describing the actual response process. The language passes the ERM test — any risk management professional could write this paragraph about any risk domain.


reasoning: The paragraph describes third-party vendor risk management practices (annual assessments, security requirements for vendors with sensitive data access), making Third-Party Risk the primary category. However, the description contains only generic, boilerplate language—'assessed for any applicable cybersecurity or service availability risks' and 'expected to meet certain information security requirements' provide no specific practices, tools, evidence requirements, or other details that would demonstrate cybersecurity domain expertise beyond what any business professional could write.


reasoning: This paragraph is a cross-reference directing readers to the Risk Factors section for cybersecurity threat disclosures. It contains no substantive cybersecurity content—no governance description, no program activities, no incidents, no business impact assessment—making it a redirect statement that belongs in None/Other.


reasoning: The paragraph directly addresses how the company manages third-party cybersecurity risks through due diligence and periodic reviews of vendors/suppliers. This fits the Third-Party Risk category as the central topic. However, the paragraph contains only generic language ('due diligence,' 'periodically reviewing,' 'necessary cybersecurity standards') that any ERM professional could write — no domain-specific expertise (e.g., SOC 2 attestations, encryption requirements), no named vendors or assessors, no specific practices or tools, and no verifiable claims — resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers 'Has cybersecurity affected our business?' through negative assertions about past incidents and forward-looking materiality disclaimers, making it Strategy Integration. It contains no specific facts, domain expertise, or verifiable claims — only generic disclaimers and cross-references to risk factors that appear in virtually any 10-K.


reasoning: The paragraph's primary function is the negative assessment that no prior cybersecurity incidents have materially affected the company (SI per Rule 5), with third-party certification requirements stated as supporting context. For specificity: the negative assertion ('do not believe that any prior...incidents have materially affected') is a self-reported claim about absence of events—it cannot be independently verified by an external party and therefore does not qualify as Level 4; no firm-specific facts (named vendors, specific programs) or domain expertise (no named frameworks or specific security practices) are present.


reasoning: This paragraph is a cross-reference directing readers to Item 1A Risk Factors. Per Rule 5's SI materiality guidance, cross-references like 'see Item 1A' are classified as N/O — the paragraph itself makes no substantive assessment or disclosure about cybersecurity governance, processes, or business impact; it merely points elsewhere. No specific facts are present.


reasoning: The paragraph describes the Board's cybersecurity oversight structure—specifically the delegation to the Audit Committee, the reporting chain from the CISO and security team, and briefing cadences—answering 'how does the board oversee cybersecurity?' Content Category is Board Governance (BG). Specificity is Level 3 because 'CISO' is a named cybersecurity leadership role (explicitly listed as firm-specific), distinguishing this company's governance structure. The reporting cadence ('at least annually') is too soft to constitute a Level 4 verifiable claim.


reasoning: The paragraph contains a negative assertion about past incidents (Rule 5 SI), but all substantive language is generic boilerplate with no domain terminology, firm-specific facts, or externally verifiable claims. The specificity level is determined by the paragraph's most specific content, which here is entirely boilerplate.


reasoning: The paragraph's central focus is the company's reliance on third-party ORIX USA for cybersecurity risk management (TP), with the closing sentence explicitly framing this as a third-party dependency. No specific cybersecurity practices, domain expertise, named roles, or verifiable claims are present; the description of both the management structure and the cybersecurity program is stated at the most generic level, yielding Level 1 specificity.


reasoning: The paragraph is a cross-reference to Item 1A Risk Factors and does not independently answer any of the six substantive cybersecurity disclosure questions. It contains no domain-specific terminology, firm-specific facts, or externally verifiable claims, making it pure boilerplate.


reasoning: This paragraph makes explicit backward-looking ('have not materially affected') and forward-looking ('reasonably likely to materially affect') assessments about cybersecurity's impact on business outcomes, which is the core question of Strategy Integration per Rule 5. The paragraph contains zero specific facts—no domain terms (the 'reasonably likely' language is legal boilerplate, not domain expertise), no firm-specific roles or programs, and no externally verifiable claims. The entire paragraph consists of materiality assertions and a cross-reference to risk factors, making it indistinguishable from generic cybersecurity risk language in any 10-K filing.


fact: Change Healthcare is a subsidiary of UnitedHealth Group

fact: A cybersecurity threat actor gained access to Change Healthcare's information technology systems

fact: The incident disrupted certain of the company's patient billing and collections processes

fact: The company identified an alternative claim processing intermediary

fact: The incident caused delays in a portion of claims submissions to some commercial payers, delaying cash remittances

fact: UnitedHealth Group is still investigating the incident as of the filing date

reasoning: This paragraph primarily describes an actual cybersecurity incident (the Change Healthcare breach) — its nature, scope, impact on the company's operations, remediation steps taken, and ongoing investigation — making it an Incident Disclosure. The specificity reaches Level 4 because the named third party (Change Healthcare as a subsidiary of UnitedHealth Group) is an externally verifiable claim, as is the fact that a threat actor gained access to Change Healthcare's systems, which describes a real, documented security incident that was publicly reported.


reasoning: The paragraph primarily describes what the information security program does—evaluation by experts and engagement with external communities—which maps to RMP. The mention of Audit Committee and Board is subordinate context about reporting flow, not the central governance topic. No firm-specific roles (CISO, VP Security), named committees with distinguishing identifiers, domain-specific security tools/architectures, specific practices, or verifiable claims are present. All content describes generic cybersecurity program elements that any company could state, resulting in Generic Boilerplate.


reasoning: The paragraph's primary content is a negative assertion ('have not experienced a cybersecurity incident that resulted in a material adverse impact') followed by forward-looking speculation and a cross-reference to risk factors. The mention of 'information security policies and procedures' is incidental to the disclaimer structure rather than a substantive program description. No domain-specific cybersecurity expertise is demonstrated (ERM test: any ERM professional could write this), no firm-specific facts (no named roles, no specific team/committee, no named program), and no externally verifiable claims (the negative assertion is self-reported, not independently confirmable). This is standard SEC boilerplate at the lowest specificity level.


reasoning: This paragraph is a cross-reference incorporating risk factor disclosures by reference from Item 1A — it does not itself contain any substantive cybersecurity disclosure content (no governance, management, process, incident, or materiality assessment). For specificity, there are no domain terms, firm-specific facts, or verifiable claims; the text is purely structural navigation language pointing to another section.


fact: Incident occurred between approximately August 5-8, 2025

fact: Forensic investigation is complete

fact: Threat actor gained unauthorized access to the Company's systems

fact: Data may have been acquired

reasoning: The paragraph primarily describes what happened in a real cybersecurity incident — the forensic investigation findings, specific date range (August 5-8, 2025), unauthorized access, and potential data acquisition. While the paragraph concludes with forward-looking materiality language, the dominant frame is incident description (what happened, when, and what was found), making Incident Disclosure the primary category. The specific date range of August 5-8, 2025 tied to an actual forensic investigation constitutes a hard, externally verifiable fact, elevating specificity to Level 4.


fact: Executive risk committee comprised of Chief Financial Officer, Chief Legal Officer, and Senior Vice President, Engineering Operations

fact: Cybersecurity team comprised of technically skilled professionals with computer science, cybersecurity assurance or other cybersecurity degrees

fact: Senior Vice President, Engineering Operations brings decades of technical experience and technical education in computer engineering

reasoning: The paragraph primarily describes management-level organizational structure—the executive risk committee composition, cybersecurity team qualifications, and specific leadership credentials—answering 'How is management organized to handle cybersecurity?' The named senior role (Senior Vice President, Engineering Operations) with specific qualifications and the defined committee composition (CFO, CLO, SVP) constitute firm-specific facts distinguishing this company's cybersecurity governance from any generic company.


fact: Head of Information Technology holds Certified Information Systems Security Professional (CISSP) certification

reasoning: This paragraph describes the Board's oversight structure (Risk and Governance Committee, quarterly updates), making Board Governance the primary category. The specificity reaches Level 4 because the paragraph explicitly states the Head of Information Technology holds CISSP certification — a credential verifiable through the (ISC)² certification registry — which is a hard, independently confirmable fact even though it's mentioned in a subordinate clause.


reasoning: This paragraph is a definitional clause establishing what 'systems' means for purposes of the filing—it answers no substantive question about the company's cybersecurity governance, processes, or posture. For specificity, the language consists entirely of generic IT terminology (electronic information resources, infrastructure, collection, processing) that any business professional could write; it does not demonstrate cybersecurity domain expertise per the ERM test.


reasoning: This paragraph is primarily a materiality assessment—stating both backward-looking ('have not materially affected') and forward-looking ('reasonably likely to materially affect') conclusions about cybersecurity's impact on the business, which maps directly to Strategy Integration per Rule 5. The paragraph contains no specific facts: no named individuals, committees, tools, certifications, dates, or quantified claims. The SEC definition reference and cross-reference to Risk Factors are generic framing elements, and the materiality assertions are negative self-reports without supporting detail. Specificity is Generic Boilerplate.


reasoning: This paragraph is primarily forward-looking risk speculation and generic disclaimers about potential cybersecurity incidents rather than a substantive disclosure about the company's actual cybersecurity program, governance, or strategy. While it contains a negative assertion about past incidents, the bulk of the content consists of standard 'could have a material adverse effect' language found in any risk section. Since no actual cybersecurity measures, processes, assessments, or governance details are described, this is None/Other. No specific facts appear anywhere in the paragraph—only generic references to 'cybersecurity program,' 'network security,' and 'information systems' that would appear in any company's 10-K.


reasoning: The paragraph describes board-level oversight structure (independent board members conducting quarterly reviews) and incident notification procedures, which directly answers how the board oversees cybersecurity — making Board Governance the appropriate category. The paragraph contains only generic governance language: 'independent board members' (exists at every public company), 'quarterly review' (generic cadence), and 'significant cybersecurity incident' (standard concept). No cybersecurity domain expertise is demonstrated (fails the ERM test), no firm-specific roles or programs are named, and no verifiable facts (dates, numbers, named individuals) are present, resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes third-party vendor oversight through 'weekly calls' and 'monitoring compliance,' which directly answers how third-party cyber risks are managed. However, for specificity, the language fails the ERM test: 'monitor compliance,' 'addressed immediately,' and 'mitigating measures' are generic vendor management terms any ERM professional could use without cybersecurity domain knowledge. There are no cybersecurity-specific practices (SOC 2 reviews, encryption requirements, penetration testing), no named frameworks, and no verifiable claims — making this generic boilerplate.


fact: CTO has over a decade of industry experience

reasoning: The paragraph primarily describes organizational structure and management roles (CTO responsibility, team composition, reporting lines) rather than board oversight mechanics, making it Management Role. The only hard quantifiable fact is the CTO's 'over a decade of industry experience' — a specific number that could be independently verified, setting specificity at Level 4 despite otherwise generic language.


reasoning: This paragraph functions as a bridging statement between Item 1C and the Risk Factors section, containing only generic speculative risk language (cybersecurity 'risks' and 'could affect' statements) rather than describing any actual oversight program, governance structure, or management process. The question it answers is not about how cybersecurity is overseen or managed but rather 'what cybersecurity risks exist' — a risk factor framing that defers to Item 1A. No domain-specific program details, no firm-specific organizational facts, and no verifiable claims are present; the paragraph consists entirely of boilerplate risk categories and consequence language.


reasoning: The paragraph centrally addresses third-party cybersecurity oversight through due diligence processes and contractual notification requirements, making Third-Party Risk the appropriate category. However, the specificity level is Generic Boilerplate because the paragraph contains no domain-specific security terminology (e.g., no mention of SOC 2, penetration testing, or specific assessment criteria), no firm-specific organizational details (no named roles, committees, or team compositions), and no verifiable quantified claims — only generic descriptions of due diligence and contractual obligations that any company could state.


reasoning: The paragraph is primarily forward-looking disclaimer language ('cannot anticipate', 'cannot eliminate', 'no assurance', 'may not') with a cross-reference to Risk Factors. While it contains an embedded negative assertion about past incidents not being material, this is subordinated within the disclaimer framing and does not make the paragraph's primary purpose about business impact assessment. The paragraph answers no substantive question about how cybersecurity is governed, managed, or operationalized.


reasoning: The paragraph's primary function is to make the SEC-required negative assertion that cybersecurity risks have not materially affected business outcomes, which maps to Strategy Integration under Rule 5. The second sentence mentions actual breaches but lacks any specifics (no dates, scope, nature, or remediation details) and serves as incidental context rather than substantive incident disclosure. The paragraph contains only generic cybersecurity language with no domain-specific terminology (ERM test: swapping 'cybersecurity threats' for 'business risks' still works), no firm-specific details, and no externally verifiable claims.


reasoning: This paragraph describes the components and activities of the cybersecurity program (risk assessments, training, tools, incident response plan, monitoring), which maps to RMP. However, all language is generic boilerplate that would apply equally to any enterprise risk management program — there are no domain-specific security terms (SIEM, SOC, EDR, zero trust), no firm-specific identifiers (named committees, specific roles, organizational details), and no verifiable claims (hard numbers, specific dates, named third parties). The specificity level is Generic Boilerplate.


reasoning: This paragraph describes the board's oversight structure for cybersecurity — specifically that the Board delegates to the Audit Committee and the Audit Committee oversees management's implementation. This is a classic governance-chain paragraph (Board → Audit Committee → Management) that directly answers how the board oversees cybersecurity. It contains no firm-specific facts (both 'Board' and 'Audit Committee' exist at every public company), no domain expertise (the language would be identical in any ERM or governance context), and no verifiable claims — making it Level 1 boilerplate.


fact: Hosting services via Namecheap, GoDaddy, and Cloudflare

reasoning: The paragraph identifies and characterizes the company's cybersecurity risk posture (websites as the sole risk source) and describes how they mitigate it through vendor selection. This describes an element of their risk management approach (using reputable hosting providers). While third parties are mentioned, the paragraph frames them as the risk source rather than describing a formal vendor oversight program, making RMP the better fit. The specificity is Domain-Adapted because the named hosting providers (Namecheap, GoDaddy, Cloudflare) are domain-specific companies that pass the ERM test—terminology like 'hosting' and 'hosting-related services' demonstrates cybersecurity domain knowledge rather than generic risk management language.


reasoning: The paragraph primarily asserts the absence of material cybersecurity incidents and their non-impact on business outcomes, which is a backward-looking materiality assessment (SI per Rule 5). While threat types (scanning, phishing, vulnerabilities) are mentioned, they are generic observations with no specific process, tool, or program detail that would elevate this to RMP. The specificity is Generic Boilerplate because the filing-period anchors ('fiscal years ended April 30, 2025 and 2024') are not cybersecurity facts, and the negative assertion about no material incidents is self-reported and not independently verifiable.


reasoning: The paragraph describes board-level oversight of cybersecurity, including how the Audit Committee and full Board receive reports, briefings, and updates from management. This is the Board's oversight structure question. For specificity: while cybersecurity and IT controls are mentioned, the paragraph describes only generic oversight practices (receiving reports, briefings, updates) that any non-security board member could write about any enterprise risk topic. No cybersecurity domain terminology (SIEM, SOC, vulnerability management), no named security-specific committees, no VP-level cybersecurity titles, and no verifiable claims. All roles mentioned (Audit Committee, Board, CIO, CFO) exist at every public company. The highest specificity achievable from any individual element is Level 1, making this Generic Boilerplate.


reasoning: This paragraph is a forward-looking risk acknowledgment describing general cybersecurity threats (cyber-attacks, ransomware, malware) without describing any actual governance structure, management organization, specific program activities, or incident details. Per Rule 5, the negative assertion about no material incidents does not qualify as Strategy Integration. Per Rule 6, since no substantive cybersecurity measures or processes are described, this is None/Other. The specificity is Level 1 (Generic Boilerplate) — the paragraph contains only generic threat language ('maintain the security and integrity of our information technology systems') that any public company could write, with no domain-specific expertise, firm-specific details, or verifiable facts.


reasoning: The paragraph primarily addresses the company's cybersecurity capabilities and limitations (what they can/cannot do regarding IT security vulnerabilities), making it most aligned with Risk Management Process. However, the specificity is Generic Boilerplate because the paragraph contains no domain-specific terminology (all terms like 'IT security vulnerabilities' are generic ERM language any professional could write), no firm-specific facts, and no verifiable claims — only general assertions about resource limitations and a standard legal disclaimer with no concrete details.


reasoning: The paragraph describes the Board's oversight structure for cybersecurity risks at both the Board level and through its Audit Committee, which directly answers 'How does the board oversee cybersecurity?' — making this Board Governance. The language ('overseeing management's assessments of major risks') is generic enterprise risk oversight terminology that any non-security ERM professional could write; it contains no domain-specific security terminology, firm-specific facts (no named officers or specific committees), or externally verifiable claims.


reasoning: The paragraph primarily describes cybersecurity program activities (maturity assessments, IT risk assessments, third-party security assessments), making RMP the fitting category. However, specificity is Level 1 because all terminology ('periodic program maturity assessments,' 'ongoing information technology risk assessments,' 'third-party security risks assessments') is generic boilerplate that any public company could use — none demonstrates cybersecurity domain expertise (no specific tools, frameworks, or practices), identifies firm-specific roles or committees (Audit Committee is universal), or contains any quantified or verifiable claims.


fact: Director of Information Technology (DIT) is primarily responsible for assessment and management of material cybersecurity risks

fact: DIT has over 20 years of experience in information security, risk management, and compliance

reasoning: This paragraph describes the governance chain for cybersecurity oversight—Audit Committee at the board level delegates to CEO, who directs the DIT as primary responsible party, supported by senior management. This is BG per Rule 1 (governance-chain paragraph describing oversight structure). Specificity is Level 4 because the claim that the DIT has 'over 20 years of experience' is a hard lower-bound number that could be verified against a resume, making it independently verifiable.


reasoning: This paragraph directly answers 'Has cybersecurity affected business outcomes?' with a backward-looking negative assessment ('we have not experienced...material cybersecurity incidents'), which is the core question of Strategy Integration per Rule 5. It contains no specific facts—'To date' is a generic temporal anchor, and the negative assertion about incident absence is explicitly non-verifiable per Rule 5, making this standard SEC boilerplate language with no domain expertise, firm-specific detail, or verifiable claims.


reasoning: This paragraph is a forward-looking disclaimer with boilerplate closing language that does not provide substantive cybersecurity disclosure — it contains no description of governance, management structure, risk processes, or actual incidents. Per Rule 5, the 'could have a material adverse effect' language is pure speculation present in every 10-K, and the insurance mention is incidental framing within the disclaimer, not a substantive materiality assessment. The paragraph contains no domain terminology demonstrating expertise, no firm-specific facts, and no verifiable claims — only generic stakeholder-protection language and cross-references.


reasoning: This paragraph describes the general threat landscape Okta faces (hackers, nation-state actors, APTs, ransomware, etc.) but does not answer any of the six substantive questions — it neither describes what the company does (RMP), how it's governed (BG), who manages it (MR), how vendors are overseen (TP), what happened in an incident (ID), nor how cybersecurity affects business outcomes (SI). For specificity: while the paragraph contains domain terminology (malware, viruses, worms, ransomware, password spraying, phishing, denial-of-service, APT), these threat categories are standard cybersecurity vocabulary that any security-aware professional would know — they describe WHAT threats exist rather than demonstrating HOW the company operates its cybersecurity program. No firm-specific roles, named committees, organizational structure, or verifiable claims are present.


reasoning: The paragraph describes board-level cybersecurity oversight structure—specifically that the Audit Committee oversees cybersecurity risk and receives updates at each meeting. This is a governance-chain description answering how the board oversees cybersecurity, making Board Governance the appropriate category. For specificity, the paragraph contains only generic governance elements: Board of Directors, Audit Committee (standard committee at all public companies), and 'at each meeting' (generic cadence, not a specific date). No firm-specific roles (no named officers), no domain expertise terms beyond the topic itself, and no verifiable claims—every element is boilerplate that could appear in any 10-K.


fact: November 2023 - specific date of cybersecurity incident

fact: Disruption of portions of its information technology systems - specific scope of impact

fact: Engaged external cybersecurity experts - third-party involvement

fact: Coordinated with law enforcement - government involvement

fact: Incident has been contained and mitigation efforts are complete - resolution status

reasoning: The paragraph primarily describes an actual cybersecurity incident that occurred in November 2023, including what happened (IT system disruption), when it occurred, how the company responded (investigation, remediation, law enforcement coordination, notifications), and its current status (contained). The specific date 'November 2023' tied to a documented cybersecurity incident is a verifiable fact that anchors this as a real event rather than hypothetical language, elevating specificity to Level 4.


reasoning: This paragraph is primarily a cross-reference pointing readers to Item 1A for details on cybersecurity risks. While the opening clause asserts that cybersecurity challenges have materially impaired operations/financials, no actual incident details, process descriptions, or governance mechanisms are provided—the paragraph's sole function is to redirect. Cross-references fall under None/Other per Rule 6. No domain-specific terminology, firm-specific details, or externally verifiable claims are present.


reasoning: The paragraph's central topic is third-party cybersecurity risk management, describing the company's approach to overseeing vendors and service providers, which maps to the Third-Party Risk category. However, the paragraph contains only generic, aspirational language ('comprehensive, risk-based approach') with no domain-specific technical terms, firm-specific identifiers, or verifiable facts — it describes what the company does in principle but provides no concrete details about HOW third-party risk is actually managed, making it Level 1 Generic Boilerplate.


reasoning: This paragraph describes the governance chain for cybersecurity oversight: management reporting to the Audit Committee, the format of those reports (at Audit Committee meetings), and the Audit Committee's periodic strategy evaluation role. The reference to the 'Senior Director, Global Information Security' is mentioned only as part of the reporting chain to the board—not as a description of that role's responsibilities or qualifications. No specific cybersecurity practices, tools, methodologies, or firm-specific organizational details are present.


reasoning: The paragraph describes general IT/OT infrastructure and software composition without addressing cybersecurity governance, risk management processes, or any cybersecurity-specific activities — making it None/Other. No specific facts, domain expertise, or verifiable claims are present, placing it at Generic Boilerplate.


reasoning: The paragraph describes how the cybersecurity program is integrated into the enterprise risk management framework using 'common methodologies, reporting channels and governance processes' — all generic ERM terminology that any risk management professional would use regardless of cybersecurity expertise. No cybersecurity-specific domain terms (SIEM, SOC, vulnerability management, threat intelligence, etc.) are present, and no firm-specific facts (named roles, committees, programs) appear. The paragraph reads as standard boilerplate about ERM integration with no distinguishing details.


reasoning: The paragraph describes real cybersecurity events (threat actors creating malicious phishing sites targeting their online banking platform), including timing (beginning of the year), nature of the attack, and outcomes (no losses). Per Rule 4, describing what happened constitutes Incident Disclosure. For specificity: while the paragraph references actual phishing attacks, it contains no domain-specific technical terms (generic 'malicious look-alike phishing sites' is basic terminology), no named roles/teams, no frameworks, no specific tools, and no quantifiable or externally verifiable facts — all generic language any company could use. The paragraph conveys that something occurred but provides no informational depth beyond boilerplate.


fact: Company states it has had one cybersecurity incident in the last decade (firm-specific incident history claim)

reasoning: The paragraph primarily describes a specific cybersecurity incident (ransomware attack), its scope, response, and impact — fitting the Incident Disclosure category. While the content is largely generic ('quickly identified and isolated', 'did not have significant financial impact'), the firm's self-reported claim of exactly one cybersecurity incident over the last decade is a firm-specific fact that distinguishes its incident history from other companies. The negative assertion about incident count is firm-specific rather than externally verifiable (no third party can confirm the absence of unreported incidents).


reasoning: This paragraph is primarily a forward-looking risk acknowledgment and negative assertion about incident history, with a cross-reference to Risk Factors. It does not describe board governance, management organization, specific cybersecurity processes, third-party oversight, an actual incident, or a business strategy/materiality assessment. The only 'fact' is the negative assertion of no prior incidents, which is a self-reported claim about absence—not externally verifiable—and fails the specificity threshold. The entire paragraph consists of generic language any ERM professional could write, containing no domain-specific cybersecurity terminology, no firm-specific organizational facts, and no verifiable claims.


fact: MOVEit (named managed file transfer software)

fact: First National 1870 division (named division)

fact: Guardian Mortgage division (named division)

fact: May 31, 2023 (specific date)

reasoning: This paragraph describes an actual cybersecurity incident — the MOVEit zero-day vulnerability — including timing (May 31, 2023) and reference to a prior 8-K filing, making it Incident Disclosure. The specificity level is Firm-Specific because it identifies the named product (MOVEit) and specific company divisions (First National 1870 and Guardian Mortgage), which would help narrow down which company wrote this.


fact: Director of Information Technology holds CISSP certification

fact: More than 20 years of experience in financial services

fact: Degree from University of California, Santa Barbara

reasoning: The paragraph's primary purpose is describing the qualifications, credentials, and background of the individual leading cybersecurity efforts (Director of Information Technology), which fits Management Role. Specificity is Level 4 because the paragraph contains three externally verifiable facts: CISSP certification from ISC2 (verifiable via (ISC)² registry), 'more than 20 years' experience (a lower-bound that can be checked), and a named institution (UCSB) — any one of which is sufficient to elevate to Level 4.


reasoning: This paragraph describes a general commitment to protecting IT assets and data but does not detail any specific cybersecurity process, methodology, or activity. While the topic relates to cybersecurity risk management, the content is a high-level policy statement without any domain-specific practices, firm-specific organizational details, or verifiable claims. It contains only generic language that any company could use.


reasoning: The paragraph describes the Board's oversight structure for cybersecurity — briefing cadence, information flow, and Audit Committee support — which directly answers the question 'How does the board oversee cybersecurity?' (BG). No specific facts elevate the paragraph beyond generic boilerplate: 'at least annually' is a soft cadence, the named roles (CIO, CFO, General Counsel, SVP Internal Audit) are standard executive titles that exist at every public company, and 'security metrics,' 'business continuity,' and 'cyber threats' are generic domain terms without cybersecurity-specific depth. The ERM test is failed — none of the language demonstrates specialized cybersecurity expertise beyond what any ERM professional could write about any risk domain.


fact: third-party security scoring system

reasoning: The paragraph directly addresses third-party vendor risk management, describing oversight processes, security scoring systems, and continuous compliance monitoring. This satisfies Rule 3 (TP vs RMP) as the central topic is vendor oversight. For specificity, the paragraph uses domain terminology ('security scoring system', 'security posture') that passes the ERM test — an ERM professional would not naturally use these cybersecurity-specific evaluation terms, indicating domain expertise rather than generic risk management. No firm-specific identifiers or verifiable facts are present.


reasoning: The paragraph describes what the cybersecurity program does—assessing, identifying, and managing risks; maintaining an incident response plan; and using third-party assessors to evaluate the program. This is the operational activities question that RMP answers. All content consists of generic cybersecurity process descriptions that would read identically in virtually any company's 10-K; no domain-specific terminology (SIEM, SOC, EDR, penetration testing, zero trust, NIST CSF), no firm-specific details (named roles, specific team composition, named committees), and no externally verifiable claims (certifications, specific headcounts, named assessors). This paragraph provides zero basis to distinguish Beneficient's program from any other filer—it is pure boilerplate.


reasoning: The paragraph describes an aspirational goal ('actively working towards') rather than a substantive, implemented cybersecurity measure. Per Rule 6, because the company is 'actively working towards' implementation rather than describing what the program actually does, no substantive cybersecurity disclosure is present. The language is generic boilerplate applicable to any company without specific practices, tools, named roles, or concrete processes that would elevate it beyond N/O.


fact: breach notification requirements imposed on vendors

reasoning: The paragraph is centrally about third-party vendor cybersecurity oversight (performing assessments of vendors, requiring breach notification from vendors) → TP. It demonstrates cybersecurity domain expertise by referencing specific practices (risk assessments of third parties, breach notification requirements) that go beyond generic vendor management language — an ERM professional would not naturally use 'cybersecurity risk assessments of third-party vendors' without a cybersecurity qualifier. No firm-specific identifiers (named committees, named leaders, specific headcount) or hard verifiable facts are present.


fact: Arizona Cyber Threat Response Alliance (ACTRA)

fact: The Internet and Television Association (NCTA)

reasoning: This paragraph describes the company's threat intelligence gathering activities as part of its cybersecurity program, which is a core RMP function. The specificity is elevated to Level 3 by the named external partnerships (ACTRA and NCTA), which are specific organizations Cable One participates in for threat intelligence—these named collaborations distinguish this company's specific threat intelligence sources from generic industry participation claims.


reasoning: This single sentence is a generic introductory statement about the threat landscape that appears in virtually every cybersecurity disclosure. It answers no substantive question—it does not describe board oversight, management roles, security processes, third-party risks, incidents, or business impact. For specificity, the phrase 'threat environment' fails the ERM test (substituting 'financial risk' yields an identical sentence any ERM professional could write) and contains no firm-specific facts or verifiable claims.


reasoning: The paragraph primarily addresses financial risk management through cybersecurity insurance, making Strategy Integration the appropriate category. The paragraph contains no specific facts—it describes the existence of a cybersecurity program and insurance in generic terms without any verifiable details, named roles, specific coverage amounts, named tools/frameworks, or other differentiating information.


fact: attest reports covering cyber-related controls at third parties (SOC 2 attestation framework terminology)

fact: complementary user entity controls (SOC 2/SSAE 18 audit terminology)

fact: open lines of communication for cyber incident notifications

fact: contractual safeguards in the event a cyber incident occurs

reasoning: The paragraph is primarily about third-party cybersecurity risk management — describing specific measures the company takes to oversee third parties who host or manage their systems. The central topic is vendor oversight (obtaining attest reports, implementing complementary controls, maintaining communication channels, contractual safeguards), which directly answers the TP question. For specificity, the paragraph uses specialized SOC 2/SSAE 18 audit terminology ('attest reports,' 'complementary user entity controls') that goes beyond generic risk management language and demonstrates cybersecurity domain expertise — an ERM professional would not naturally use this language. However, no firm-specific facts (named roles, specific programs) or externally verifiable claims (hard numbers, named assessors) are present.


fact: Kroll conducted a security maturity assessment in November 2022

fact: Assessment scope included policies, procedures, past security assessments, penetration tests, network architecture documentation, security roadmaps and plans

fact: Century Communities Information Security Team worked with Kroll to identify deficiencies and close gaps

fact: Implemented industry leading solutions, policies and practices to close findings

fact: Developed an Information Security Incident Response Policy peer reviewed by Kroll

fact: Retained Kroll to conduct tabletop exercises to evaluate incident response plan, most recently September 2023

reasoning: This paragraph describes cybersecurity program activities including a third-party maturity assessment, gap remediation, policy development, and tabletop exercises—core Risk Management Process content. Kroll is a third party hired to serve the company (Rule 3), making this RMP rather than Third-Party Risk. Specificity reaches Level 4 because the paragraph contains two externally verifiable facts: the named firm 'Kroll' and two specific dates ('November 2022' and 'September 2023') that could be independently confirmed.


reasoning: The paragraph's primary content describes the incident response plan—what it contains, how it's structured, and what it covers—which answers 'What does the cybersecurity program do?' (RMP). The statement about no material cybersecurity incidents is a negative assertion about business impact (SI per Rule 5), but it's a secondary element in the paragraph. The physical security incident is explicitly framed as 'an isolated physical security incident'—not cybersecurity—and therefore doesn't qualify as Incident Disclosure. For specificity: all content describes generic cybersecurity documentation practices (incident response plan, team, lifecycle, templates, timelines, communication methods) that any company could claim. No named programs, no named committees, no named individuals, no specific metrics, no externally verifiable claims. The physical security breach (firemen's access conduit) is about physical security, not cybersecurity domain expertise. This paragraph contains no facts that would survive the specificity filters.


reasoning: This paragraph describes board-level cybersecurity oversight in entirely generic terms—'members with substantial expertise,' 'regularly updated,' 'established reporting mechanisms'—without naming any specific individuals, committees, tools, or verifiable details. The language is indistinguishable from standard enterprise risk management boilerplate any company could file. There are no domain-specific cybersecurity terms (the ERM test fails), no firm-specific facts, and no externally verifiable claims.


reasoning: The paragraph describes the governance structure for cybersecurity oversight—specifically that the ISP is overseen by ITBC (a board committee) and ITSC—answering 'how does the board oversee cybersecurity?' This fits Board Governance. However, the named committees (ITBC, ITSC) are generic governance structures found at many companies, and the risk management language ('managing technology and cyber risks, ensuring compliance, fostering controlled risk environment') is standard boilerplate that any ERM professional could write. No domain-specific cybersecurity terminology, no firm-distinguishing facts, and no verifiable claims are present.


fact: Named individual: Brian Fellon

fact: Specific appointment date: September 2024 (appointed by Board of Directors)

fact: Specific quantity: 28 years of information technology experience

fact: Specific prior employer and timeframe: Puget Sound Energy, Bellevue, WA, 2016 to September 2024

reasoning: The paragraph describes the cybersecurity management organization with a named CISO (Brian Fellon), specific appointment date, quantified experience (28 years), and verifiable prior employment (Puget Sound Energy 2016-2024), all of which are externally verifiable facts. Category is MR because it focuses on roles, reporting lines, and leadership credentials rather than cybersecurity program activities.


reasoning: This paragraph describes general regulatory monitoring and compliance awareness rather than any substantive cybersecurity governance, program, or incident content. It does not answer how the board oversees, how management is organized, what the program does, how third parties are managed, or what happened in an incident. The specificity is Generic Boilerplate as the paragraph contains no specific facts, domain expertise demonstrations (only mentions regulatory requirements generically), or verifiable claims.


reasoning: This paragraph is a forward-looking disclaimer cross-referencing Item 1A Risk Factors. While it contains a negative assertion about incidents ('we have not experienced any material cybersecurity incidents'), the primary function is directing readers elsewhere rather than providing substantive cybersecurity disclosure. No cybersecurity domain expertise, firm-specific program details, or verifiable facts are present.


reasoning: The paragraph primarily answers whether cybersecurity has affected business outcomes (SI), containing the standard negative assertion about not experiencing material cybersecurity incidents. It contains no facts that elevate specificity: the year '2023' is a reporting period not a cybersecurity fact; the negative assertion ('we did not identify any...') is explicitly non-verifiable per guidelines; and no domain expertise, firm-specific identifiers, or verifiable claims are present.


fact: October 2023 (specific date of incident occurrence)

fact: Certain information of users accessed and downloaded from 23andMe.com accounts without authorization

fact: Remediation measures implemented: password reset, two-factor verification required, detection tools and capabilities, new tools and processes, Security Operations enhancements

reasoning: This paragraph describes a real cybersecurity incident in October 2023 where user information was unauthorizedly accessed, making it Incident Disclosure per Rule 4. Specificity is Level 4 due to the verifiable date 'October 2023' and the concrete, auditable remediation measures described (password resets, two-factor verification requirement, Security Operations enhancements).


reasoning: The paragraph states an assessment about whether cybersecurity risks have materially affected or are reasonably likely to materially affect business strategy, results of operations, or financial condition, which directly maps to the SI question per Rule 5. However, it contains no domain-specific terms (any ERM professional could write this), no firm-specific facts, and the negative assertion cannot be independently verified — qualifying it as Generic Boilerplate.


reasoning: The paragraph describes the scope and purpose of the company's information security processes (identifying, assessing, and managing risks to various systems and data), which maps to Risk Management Process. However, all content is generic boilerplate language—'identify, assess and manage' is the standard risk management cycle any ERM professional could use, and the listed assets (networks, hosted services, hardware/software, data) are standard scope items without any firm-specific details, named programs, specific tools, or verifiable claims that would elevate specificity.


reasoning: This paragraph describes general information technology investment strategy supporting business operations but does not address any cybersecurity-specific topic (no governance, management structure, security processes, vendor oversight, incident history, or materiality assessment). It is generic strategic boilerplate about IT investments that does not constitute substantive cybersecurity disclosure under Item 1C.


reasoning: The paragraph primarily answers 'What does the cybersecurity program do?' by describing risk assessment procedures, policy development, employee training, and third-party consultant engagement — all core RMP content. However, the paragraph contains only generic process descriptions with no cybersecurity-specific domain terminology (no tools, frameworks, named practices), no firm-specific facts (no named roles, committees, or specific programs), and no verifiable claims. The language ('assessed as part of our enterprise risk management,' 'procedures for identifying,' 'policies and procedures') could apply to any ERM function without cybersecurity expertise, failing the ERM test for Level 2.


fact: quarterly scorecard assessments

fact: information security infrastructure

fact: emerging threat landscape

reasoning: The paragraph describes how the Board oversees cybersecurity risk, including the frequency (quarterly), the source (CIO), and topics covered—this is classic Board Governance content. Specificity is Domain-Adapted because the paragraph uses cybersecurity-specific terminology (quarterly scorecard assessments, information security infrastructure, emerging threat landscape, capital investments in information security) that an ERM professional would not naturally use outside a cybersecurity context, rather than generic governance language that could apply to any risk domain.


reasoning: The paragraph's core statement is a backward-looking negative assertion ('not aware of any cybersecurity incidents or threats that have materially impacted us') about business outcomes, which maps to Strategy Integration per Rule 5. The paragraph contains no specific facts — no named roles, frameworks, tools, or verifiable claims — and the negative assertion about absence of incidents is not independently verifiable, resulting in Generic Boilerplate specificity.